Source Takedown vs Link Removal

Piracy usually has two layers. At the bottom is the source: a file on a cyberlocker, a video on an embed host, a stream on an origin server, an account on a platform. Above it are the links: aggregator listings, forum posts, social media posts, Telegram messages and search results that send people to the source. A source takedown removes the bottom layer. Link removal removes pieces of the top one.

Following a link back to the file

Most enforcement starts at a link, because that is what a user finds first. A typical hypothetical chain: a social post links to an aggregator page, the aggregator page embeds a player, and the player loads video from a third-party host. Removing the social post is link removal. Removing the aggregator page is also link removal, from the point of view of the video. Getting the host to disable the video is the source takedown.

An analyst's first job is to follow that chain to the end and record each step. A notice sent to the wrong layer still has some effect, but it rarely has the effect the rights holder expects.

What a source takedown achieves

When the source goes, every link pointing to it breaks at once, including links nobody has found yet. A single cyberlocker file can sit behind a large number of forum posts and aggregator listings, and they all turn into dead links together. That is why source action is usually more durable and more efficient per notice.

It has two limits. First, the host has to cooperate. Mainstream file hosts and platforms generally process valid notices, but some hosts are set up in jurisdictions or business models that ignore them. Second, removal does not stop the uploader. A file taken down in the morning can be uploaded again in the afternoon, and the aggregator will update its link.

When link removal is the only lever

If the source will not act, the links are where the reach is. Search engines, social platforms, app stores and messaging services usually have their own notice processes and their own obligations, and they control how many people ever reach the uncooperative host. Removing those links does not delete the file, but it cuts the traffic.

Link removal also makes sense where the link surface is itself the main distribution point. A Telegram channel that posts direct download links to a large subscriber base, or a social account that shares new episodes on release day, is worth acting on regardless of what happens at the host.

Reading the result

Results need to be read carefully. A removed link is a link that no longer exists on that surface. A dead link is one that still exists but points to a source that has gone. Reports that count only removed links can look impressive while the sources stay up. Reports that count only source takedowns can miss the reach that link surfaces carry. A useful report shows both, along with whether the same source has returned.

Sequencing the two

In practice the two are run together. The analyst traces the link to the source and sends the source notice first where the host is responsive. In parallel, high-reach links on social platforms, messaging channels and search are removed, because they are driving traffic now and a source decision may take time. Where the host is known not to respond, effort shifts towards the link surfaces and towards escalation routes beyond the host.

DigiGuardians acts on the source as well as the link, and tracks re-uploads and mirror domains as they appear. The enforcement beyond detection article covers that approach, and the glossary entries on link aggregators and file lockers describe the two layers in more detail.