In cybersecurity, a takedown (withdrawal procedure or simply withdrawal) refers to all actions taken to identify, report and obtain the removal, deletion or blocking of content deemed malicious, illegal or infringing and broadcast on the Internet.
This procedure aims to neutralise the threat that this content represents and to prevent its spread with users.
π Types of content concerned
Fraudulent websites (phishing and scams)
- Fake bank websites imitating the interfaces of legitimate banks to steal identifiers and financial information.
- Fake online sales sites offering products at very attractive prices, but never delivering orders or stealing bank details during payment.
- Login pages for fake online services (social networks, messaging systems, cloud services) to recover login details.
- Sites disseminating false information or conspiracy theories that could harm public health or social order (misinformation).
Malicious software (malware)
- Ransomware which encrypt data and demand a ransom to decrypt it.
- Spyware that spy on user activity and steal personal information.
- Virus and to which spread and damage systems.
- Trojan horses (Trojans) which masquerade as legitimate software to infiltrate systems and open backdoors.
- Botnets networks of infected computers controlled remotely to carry out attacks (DDoSspam, etc.).
Illegal content
- Child pornography : strictly prohibited and subject to priority takedowns.
- Hate speech and incitement to violence: content that is racist, anti-Semitic, homophobic, etc., or incites hatred and violence against groups or individuals.
- Terrorist content and apology for terrorism : terrorist propaganda, online recruitment, etc.
- Infringement of copyright (Counterfeiting) : illegal distribution of copyright-protected music, films, software, books, etc.
- Defamation and damage to reputation : publication of false information damaging to the reputation of a person or company.
- Sale of illegal products : counterfeit medicines, drugs, weapons, etc.
π―Objectives of a takedown
Protecting users
- Protection of personal data : prevent the theft and misuse of sensitive information (identity, bank details, health data, etc.).
- Financial protection : prevent financial fraud, loss of money due tophishing or online scams.
- Protection against material and immaterial damage: avoid damage to IT systems caused by malicious software, service interruptions, data loss, etc.
- Protection of public health : combat health misinformation, the sale of counterfeit medicines, etc.
Preserving your reputation
- Maintaining the confidence of customers and partners: acting quickly to remove defamatory content reassures stakeholders of the company's responsiveness and seriousness.
- Brand image protection : prevent negative or illegal content associated with the brand from damaging its public perception.
- Minimising negative media impact: reduce the visibility of harmful content and limit its viral spread.
Combating cybercrime
- Disrupting the activities of cybercriminals : removing the tools and infrastructure they use (phishing sites, botnet command and control servers, etc.).
- Dismantling criminal networks: takedown procedures can provide useful information for police and judicial investigations to identify and dismantle cybercriminal organisations.
- Deterring cybercrime: by showing that illegal online activities are not tolerated and are subject to repressive measures.
How does a takedown work?
How does a takedown work?
The takedown procedure varies depending on the country, legislation and type of content.
Notification and voluntary withdrawal
In many cases, a simple notification to the hosting provider (web host, social networking platform, etc.) or domain name registrar is sufficient to obtain voluntary removal of the content. This notification must generally be motivated and supported by evidence the illegal or malicious nature of the content. It can rely on general terms and conditions of use (GTCU) that prohibit certain types of content.
Withdrawal procedures based on legislation
In more complex cases, or when voluntary withdrawal is not obtained, more formal procedures may be initiated, based on different legislation:
- DMCA (Digital Millennium Copyright Act) in the United States: allows copyright holders to request the removal of infringing content. Similar procedures exist in other countries.
- Formal notices : in France and many other countries formal notices can be sent to web hosts and publishers on the basis of intellectual property law, image rights, privacy rights, the law on freedom of the press, the criminal code (for illegal content), etc.
- Court orders : in the most serious or contentious cases, it may be necessary to take legal action to obtain a settlement. order of withdrawal forcing the host or registrar to take action. This may be the case for child pornography, terrorist content or content that seriously undermines public order.
- Reporting to platforms : most online platforms (social networks, search engines, video-sharing platforms, etc.) have reporting mechanisms allowing users to report content they consider illegal or contrary to the terms of use. These reports are then examined by the platform, which may decide to remove or block the content.
π€ Actors involved in a takedown
- Victims : Individuals or organisations targeted by malicious or illegal content. Companies, public institutions, associations and even private individuals.
- Hosting providers : Companies that store websites and files on their servers: social networking platforms, video sharing platforms, application shops, IP address registries (in some cases).
- . domain name registrars organisations that manage domain names (e.g. .com, .fr). They can be asked to suspend or delete a domain name used for illegal activities.
- Judicial authorities : your description is precise. We can mention more specifically : police and gendarmerie specialising in cybercrime, parquets, examining magistrates, criminal courts and assize courts. La international cooperation between judicial authorities is essential for cross-border takedowns.
- Companies specialising in cyber security: law enforcement agencies and the courts, which can order the removal of illegal content . We can add : law firms specialising in digital law, online reputation management companies, security incident response centres (CERT).
- Regulatory and reporting bodies : In some countries, there are public bodies responsible for receiving reports of illegal online content and coordinating takedown procedures (for example, Point of Contact in France for illegal content on the internet).
- Search engines : although they are not directly involved in hosting, search engines can be asked to dereferencing web pages containing illegal content, making them less accessible to users.
- Web browsers and Internet Service Providers (ISPs) : In extreme cases, ISPs may have to block their subscribers' access to certain websites by court order. Web browsers can also incorporate filtering and warning mechanisms against malicious sites.
π Statistics in France and worldwide
