Author: Adriel Hampton

Guest post by Naomi Muller

In a public Linkedin post shared on September 8th, former Patreon security team member Emily Metcafe wrote, “So for better or worse, I and the rest of the Patreon Security Team are no longer with the company.” This news came as a shock to staff and creators who utilize the platform alike and quickly spread to Twitter. 

Patreon is a popular platform for artists and content creators. Creators utilize the features of the site differently: some use it specifically as a hub for their community; other creators use it as a place for sharing exclusive content with patrons, similar to a subscription service; while others, like podcasters, streamers, and Youtube personalities, share their work elsewhere and only work with the platform as a way to easily accept tips and monthly pledges from fans.

One of the main functions of the Patreon website is payment processing so the type of data that is at risk is not simply customer preference information. Directory information and other contact data is widely available from government databases (such as voter files) and from data aggregators and list-building services. Financial data, however, is much more sensitive and breaches are more likely to result in the kind of fraud that has you looking at long-term credit monitoring, freezes and other inconvenience.

Whoa @Patreon laid off their ENTIRE security team.

Wouldn’t trust my data there. Also there’s some amazing talent to scoop up.

— Whitney Merrill (@wbm312) September 8, 2022

And speaking of competition, other than the new subscriber features on popular social media platforms, such as Super Followers on Twitter, there are not many clear alternatives to Patreon at the moment–at least not with the same level of consumer brand recognition.

Patreon acknowledged the removal of its security staff, saying it would use third-party services instead. This may not assuage the concerns of creators who expressed feeling blindsided by this move. As more social media platforms introduce paid subscriber features, this was not something anyone associated with the popular platform, including Patreon’s own employees, saw coming. 

Guest post by Naomi Muller

Since its creation in 2013, Kiwi Farms has provided a forum for people who find cyberstalking, doxxing private information, and targeted harassment of the most vulnerable entertaining. The site’s founder Joshua Moon, nicknamed “Null” on the platform, was formerly an administrator for 8chan–an unmoderated alternative to 4chan.

In 2017, Moon changed his company’s name to “1776 Solutions, LLC” from “Final Solutions, LLC”–a direct reference to the holocaust. From the beginning, Kiwi Farms was an online space dedicated to mocking marginalized people and destroying their lives.

Users of the hate forum engaged in long-term harassment campaigns specifically to direct online abuse and offline violence to marginalized people especially transgender people, neurodivergent folks, and sex workers but most Kiwi Farms targets were LGBTQ+, including children. Targets families would also be relentlessly tormented–some even after their targeted loved ones died by suicide with encouragement from Kiwi Farms users.

There are at least three known trans targets who have died by suicide over the years and many who lived in fear with their most personal details posted on the site to be openly mocked and ridiculed. This wasn’t something the site’s hosting service Cloudflare seemed concerned with until recently, despite the pleas of targets who have had their lives threatened and derailed. At least, not concerned enough to address it. Kiwi Farms users openly bragged in the forum that they don’t respect laws and Moon ignored any legal correspondences from victims’ lawyers regarding the encouragement and admission of hate crimes on the site.

Popular trans Twitch streamer Clara Sorrenti, who also goes by Keffals, was “swatted” on August 5th after she was impersonated in an email which contained threats of performing a mass shooting. Swatting was a common way that Kiwi Farms users would torment their targets–using law enforcement to harass and in some cases, kill their victims as officers believe there may be credibility to false threats sent under the victims’ name. She was arrested by London police and had her devices confiscated by police in her home in Ontario.

Once proven innocent, Keffals, who frequently raises funds for trans youth initiatives, crowdfunded support and fled to Northern Ireland.  And then she chose to fight back—using her platform on Twitter to speak openly about her experience as a target and posted regular updates after talking to the press. She began to use to the tag #dropkiwifarms and call for her followers to pressure Cloudflare to stop doing business with the hate site

And it worked.

With the support of her community, Keffals gathered enough donations to leave her home country and stay safe while continuing to push for Cloudflare to stop hosting the forum.

Cloudflare lost nearly $3 billion in market capital since #dropkiwifarms started to trend and on September 3rd, dropped them citing “an imminent threat to life”. The Kiwi Farms domain redirected to this notice on the Cloudflare’s website. Responsible service providers online, take note. 

Following Cloudflare, login security provider hCaptcha also dropped support for the site. Then the Russian hosting company DDoS-Guard that Moon tried to host from instead of Cloudflare followed suit. Though Kiwi Farms has popped back up sporadically with other Russian and Chinese hosts, these also go down almost immediately. And this was to be expected. There will probably always be splinter groups in private Discords and on Telegram but the main hub for organizing the mass harassment and death threats is not easily accessibly anymore and functionally gone—taking with it thousands of abusive threads with identifying information of victims.

Keffals released her final statement on September 5th. “The campaign is over. We won.” 

As of September 7th, Kiwi Farms no longer comes up in a Google search. The results are Wikipedia and articles covering the story. In a public statement, creator Joshua Moon said, “I do not see a situation where the Kiwi Farms is simply allowed to operate. It will either become a fractured shell of itself, like 8chan, or jump between hosts and domain names like Daily Stormer.”

A month ago, Clara Sorrenti was swatted and dealing with death threats like many of Kiwi Farms trans targets and their families over the years. Now, users can’t even access old versions of Kiwi Farms through the Internet Archives’ Wayback Machine.