{"id":"4f9729bb-d69c-4d88-9d01-83db3871c383","arxiv_id":"2411.16291","paper_version":1,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":6.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":0,"one_line_summary":"Trust-building mechanisms known from cybercrime forums appear rarely on Telegram, yet forum-linked Telegram channels form distinct roles such as marketplaces and announcements that support criminal trade.","lead":"This paper studies why people in the cybercrime underground switch between forums and Telegram groups, using a fictional participant called Dmitry. It finds that trust signals like escrow and reviews are rare on Telegram, and maps the roles that Telegram groups play in supporting forum-based crime.","discovery_kind":"new_application","skeptic_critique":{"model":"deepseek-v4-flash","headline":"The claim that Telegram is too immature for high-value trade rests on a forum-derived instrument whose exhaustiveness is unverified and whose prevalence counts are never reported; instrument transferability is the load-bearing risk.","rationale":"The reader's CONDITIONAL verdict is appropriate. The paper is explicitly a position paper with preliminary results and self-declared hypotheses; the iterative coding process and the third-batch validation support the descriptive role taxonomy. However, the central inference about Telegram's immaturity depends on a framework-transfer assumption that the reported data cannot verify. The authors do not provide per-mechanism prevalence counts, saturation diagnostics, or inter-coder agreement, so a reader cannot distinguish 'few signals in Telegram' from 'few signals in the instrument's field of view.' Section 3.2's own evidence of coherent Telegram roles supporting forum trade further weakens the unqualified low-value claim. I would not escalate to REJECT because the paper's caveats and independent batch validation keep the contribution within the scope of a preliminary position paper; the required fix is to measure Telegram-native trust signals and report prevalence statistics. Thus the reader's conditional verdict stands, though the concern is real and should be addressed in follow-up work.","tokens_in":3865,"tokens_out":4186,"duration_ms":40183,"concrete_test":"Re-code a stratified random sample of 100 channels from the 543 groups/channels (or the full 1.1M-message corpus) using an expanded Telegram-native trust codebook that adds forwarded forum vouches, pinned administrator endorsements, bot-mediated escrow, order-confirmation forwards, and linked forum reputation, while retaining the [3] features. If the expanded codebook finds these signals in a substantial fraction of channels currently coded as having no trust mechanisms, or if prevalence rates differ by more than 20 percentage points from the original coding, the 'few and rarely signaled' conclusion is an artifact of the instrument rather than a property of the Telegram ecosystem.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The central empirical claim in Section 3.1 is that only 'a small fraction' of the 28 forum trust mechanisms from Campobasso et al. [3] apply to Telegram, and that these signals are 'few and rarely signaled,' leading to the hypothesis that Telegram 'may at most support low-value crime activities.' This inference requires assuming that [3]'s forum feature set is an exhaustive lens for trust on Telegram. The paper itself shows the instrument had to be adapted: 'Telegram Bots' is a platform-native mechanism not present in the original forum set, and forum-specific features such as vendor vetting and segregation may have no direct analogue simply because Telegram channels are structured differently. If Telegram users signal trust through forwarded forum vouches, pinned administrator endorsements, bot-mediated escrow, linked forum identities, or channel age and engagement, the codebook would not capture them, and 'few and rarely signaled' would be an artifact of the instrument rather than a property of the ecosystem. This is not merely speculative: Section 3.2 finds that forum-linked Telegram channels commonly fill Marketplace and Proof-of-Credibility roles for Malware and Documents, suggesting that the low-value inference is scope-dependent. Moreover, the 'rarely signaled' claim is supported only by an undescribed 'preliminary exploration through keyword matching'; the paper reports no per-mechanism prevalence counts, rates, or confidence intervals. Together, these gaps make the headline inference undetermined by the reported evidence.","agreement_with_reader":"partial"},"referee_report":{"model":"deepseek-v4-flash","summary":"This position paper asks what market signals drive a hypothetical cybercriminal (\"Dmitry\") to join one underground community rather than another, focusing on migration from forums to Telegram. The authors first apply the 28-feature trust-mechanism framework of Campobasso et al. [3] to 543 Telegram groups/channels (about 1.1M messages) seeded from public repositories and snowballing. They report that only a small fraction of forum mechanisms appear on Telegram and that these are \"rarely signaled,\" leading to the hypothesis that Telegram may at most support low-value crime. In a second study, they sample 500 forum threads that advertise products linking to Telegram, identify six roles (private communication, automated services, announcements, proof of credibility, marketplace, community building), and find that Telegram channels often serve as marketplaces and proof-of-credibility venues for malware and documents. The paper concludes by proposing analogies from migration economics to frame future research on Dmitry's choices.","tokens_in":4099,"tokens_out":3109,"duration_ms":30601,"significance":"If the empirical claims were fully supported, this would be a valuable step toward comparing trust environments across underground platforms and could inform threat intelligence. The paper is explicitly preliminary and is appropriately cautious in its wording, and it contributes a concrete role taxonomy for Telegram channels plus a transparent description of the coding process. However, the significance is currently limited by the absence of quantitative validation: no inter-coder agreement, no per-mechanism prevalence counts, and no formal treatment of instrument transferability. The role analysis in Section 3.2 is the strongest contribution, as it is grounded in a fresh sample of forum-linked channels and suggests a coherent ecosystem that partly contradicts the low-value hypothesis. The paper is worth publishing after substantial empirical strengthening.","major_comments":[{"comment":"The central claim that trust mechanisms on Telegram are \"few\" and \"rarely signaled\" is not supported by any reported counts, rates, or confidence intervals. The paper states only that a \"preliminary exploration of the data through keyword matching\" shows this, with no table or figure reporting the number of channels exhibiting each mechanism, the frequency of signals, or the distribution across batches. The authors should report per-mechanism prevalence (e.g., number and percentage of channels coded for each taxonomy entry) and, ideally, inter-coder agreement (e.g., Cohen's kappa) for the coding process described in Section 3.1. Without these numbers, the \"small fraction\" and \"rarely signaled\" assertions are not verifiable, and the subsequent low-value hypothesis rests on an unquantified impression.","section":"Section 3.1"},{"comment":"The instrument transferability from forums to Telegram is a load-bearing assumption that is not validated. The taxonomy in Table 1 is derived from the 28 forum mechanisms of [3], and the paper itself notes that the instrument had to be adapted (e.g., adding \"Telegram Bots\" and dropping forum-specific features like vendor vetting and segregation). If Telegram communities signal trust through mechanisms not in the forum-derived codebook—such as forum-linked reputation, forwarded vouches, pinned administrator endorsements, bot-mediated escrow, or channel age and engagement—the finding of \"few\" signals would be an artifact of the instrument rather than a property of the ecosystem. To address this, the authors should either conduct an instrument-free pilot coding of Telegram channels to discover platform-native trust mechanisms, or at minimum discuss known Telegram-specific signaling practices and test whether they are captured by the taxonomy.","section":"Section 3.1"},{"comment":"There is an unresolved tension between the hypothesis that Telegram \"may at most support low-value crime activities\" and the findings of the second study, where Marketplace and Proof-of-Credibility roles are \"particularly common\" for Documents, Carding, and Malware. If forum-linked Telegram channels serve as marketplaces and credibility proofs for exactly the categories associated with high-impact crime, the low-value inference from Section 3.1 appears scope-dependent or possibly contradicted. The paper should reconcile these findings, for example by testing whether the channels with forum links exhibit the same sparsity of trust mechanisms as the broader sample, or by qualifying the low-value claim to exclude forum-linked Telegram spaces. As written, the two sections support different conclusions about Telegram's role in serious crime.","section":"Sections 3.1 and 3.2"},{"comment":"The role analysis lacks the same quantitative transparency as the rest of the paper. The text says the authors \"identify six roles\" from 500 threads, but neither the number of threads coded per role nor the frequencies underlying Figure 1 are reported. Claims such as \"the Marketplace role is particularly common for Documents, Carding, and Malware\" and \"Proof of credibility is prevalent in Documents and Malware\" cannot be evaluated without prevalence counts or at least the raw numbers on which the figure is based. I recommend adding a table with per-role, per-forum-section counts (or percentages) and reporting inter-coder agreement for this second coding pass as well.","section":"Section 3.2 and Figure 1"}],"minor_comments":[{"comment":"The term \"migratory\" appears in the title and later as \"migration,\" but the paper does not clearly define what counts as migration (e.g., joining a new community vs. abandoning an old one); a brief operational definition in the introduction would help.","section":"Abstract and Introduction"},{"comment":"Typographical issues: \"Crytocurrency\" should be \"Cryptocurrency\" in Table 1, and \"hypothetise\" should be \"hypothesize\" in the last paragraph of Section 3.1.","section":"Section 3.1"},{"comment":"The text \"the forums CryptBB, Cracked, CrackingPro, Nulled, 2crd, and Xss\" is missing a space after \"the forums.\" Also, Figure 1 is not referenced in the text with a sentence; consider adding an explicit callout.","section":"Section 3.2"},{"comment":"In the sentence \"whereas trust building mechanisms do seem to affect Dmitry's decision to join a form rather than another,\" \"form\" should be \"forum.\"","section":"Section 4"}],"recommendation":"major_revision","confidential_remarks":"The paper is honestly positioned as a position paper with preliminary results, which is commendable, but the empirical backbone is not yet at the level the conclusions require. The absence of any numerical prevalence data is the single biggest gap; this can be fixed within the scope of a revision. I would also gently note that the framework from [3] is the authors' own prior work, and the paper would benefit from an explicit acknowledgment of the risk of framework self-confirmation and from an external validation step. The paper's fit with a security venue is good, and the role taxonomy is a useful contribution that could stand alone after some strengthening."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"The genuinely new thing here is the mapping. The authors took Campobasso's forum trust framework to Telegram, manually coded 543 channels (about 1.1M messages), and produced a Telegram-specific taxonomy that adapts the original 28 mechanisms into nine observable ones, including platform-native 'Telegram Bots'. The second empirical piece, a role taxonomy for 500 forum threads that link to Telegram, stands independent of the forum framework and is the most useful contribution. Six roles (Private Communication, Automated Services, Announcements, Proof of Credibility, Marketplace, Community Building) and their distribution across forum sections give a concrete, plausible picture of how Telegram supports forum-based trade. The observation that Marketplace and Proof-of-Credibility roles dominate for Malware and Documents, while Automated Services carry server and traffic trading, is specific and believable.\n\nThe soft spot is the load-bearing inference in Section 3.1. The claim that 'a small fraction' of forum mechanisms apply and that trust signals are 'few and rarely signaled' is not actually measured. There are no per-mechanism counts, rates, or confidence intervals, and the 'rarely signaled' finding rests on an undescribed keyword matching pass. More importantly, the instrument is the forum codebook from [3]. If Telegram users signal trust through forwarded forum vouches, pinned admin endorsements, bot-mediated escrow, or channel age, the codebook would not capture them, and the sparse-signal conclusion could be an artifact. The paper itself shows the codebook had to be adapted—Telegram Bots is a new mechanism—which cuts both ways. Section 3.2 then finds that forum-linked Telegram channels commonly perform marketplace and proof-of-credibility roles for malware and documents, which sits awkwardly with the hypothesis that Telegram 'may at most support low-value crime activities'. The authors are transparent that these are preliminary results, which is to their credit, but the headline claim is underdetermined by the reported evidence.\n\nWho benefits? A reader working on cybercrime ecosystems or threat intelligence will find the role taxonomy and the 'not all Telegram places are the same' point worth citing now, even before the trust-mechanism claim is firmed up. The migration framing is speculative but sensible. This deserves a serious referee: it is important enough and has enough empirical novelty to merit peer review, though revision should require coding procedures, inter-coder agreement, prevalence counts, and a more careful treatment of what the adapted framework can and cannot see.","headline":"A clearly framed position paper with a genuinely new role taxonomy for forum-linked Telegram channels, but its headline claim that Telegram lacks trust signals is under-measured and may be an artifact of the forum-derived instrument.","tokens_in":4653,"tokens_out":1807,"would_cite":true,"duration_ms":17902,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"The paper argues that trust-building mechanisms observed in underground forums are mostly absent from Telegram criminal channels, so Telegram is probably limited to low-value crime while still acting as a support layer for forum markets.","keywords":["cybercrime underground","trust signaling","Telegram","underground forums","criminal marketplaces","migration decisions","threat intelligence"],"falsifier":"An audit of forum-linked Telegram channels coded for all 28 mechanisms that finds the same density of trust signals as forums, or a documented sale of a novel malware family negotiated entirely on a Telegram channel exhibiting none of the eight taxonomy mechanisms, would refute the paper's central claim.","tokens_in":3642,"feed_emoji":"💬","tokens_out":5267,"duration_ms":47821,"temperature":0.7,"pith_summary":"This position paper asks what drives a cybercriminal, called Dmitry, to choose one underground community over another. It applies a 28-mechanism trust-signaling framework originally developed for criminal forums to about 1.1 million messages from 543 Telegram groups and channels, and finds only a small fraction of those mechanisms appear and are rarely signaled. The authors interpret this as evidence that Telegram's criminal ecosystem is less mature and probably unsuitable for trading highly technological and innovative criminal products, hypothesizing that Telegram may at most support low-value crime such as trading stolen data. A second study of Telegram spaces linked from forum advertisements reveals a coherent support ecosystem of automated services, announcements, proof of credibility, marketplaces, and private communication. The overarching thesis is that studying these market and trust signals could explain, and eventually help act upon, Dmitry's choice of community.","feed_headline":"Telegram crime lacks the trust signals that make forums work","feed_subtitle":"A 543-channel study finds Telegram mostly supports low-value crime while serving as a support layer for forum markets.","key_machinery":"The argument is carried by two hand-built taxonomies derived through iterative card-sorting of Telegram posts. The trust taxonomy maps the 28 forum trust mechanisms from [3] onto eight Telegram-visible categories: escrow services, Telegram bots, digital wallets, cryptocurrency, moderation rules, user verification or vouching, scam reports, and reviews or feedback. The role taxonomy classifies forum-linked Telegram spaces into six roles: private communication, automated services, announcements, proof of credibility, marketplace, and community building. These taxonomies are the instruments that let the authors measure how institutionalized trust is on Telegram and how Telegram complements rather than replaces forums.","core_discovery":"The paper's central claim is that the trust institutions that make criminal forums work are largely missing on Telegram. Applying the 28-mechanism forum framework to 543 Telegram groups and channels, the authors find that only a small fraction of those mechanisms apply, and even those are rarely signaled. They conclude that Telegram is a much less mature environment that may hinder its use for trading highly technological and innovative criminal products, and they hypothesize that Telegram may at most support low-value crime activities. In parallel, they find that Telegram spaces advertised in forum posts form a coherent support ecosystem around traditional forum markets, with roles such as automated payments, announcements, proof of credibility, marketplaces, and private communication. The overarching thesis is that Dmitry's choice of community can be explained through these market and trust signals, and therefore potentially acted upon.","pith_inferences":["The two studies sit in tension: if trust is inherited from forums when buyers follow an advertised Telegram link, then the 'few signals' finding for snowball-discovered channels may underestimate Telegram's maturity for users who arrive pre-vouched; a direct test would compare trust-signal rates between forum-linked and snowball-discovered channels.","The 28-mechanism lens may be the wrong instrument for Telegram; native signals such as channel view counts, forwarded review provenance, pinned admin vouches, and bot-mediated escrow could perform the same economic function without looking like forum mechanisms, which would make 'few signals' an artifact of the comparison rather than a property of the platform.","If the support-ecosystem finding generalizes, threat intelligence should map Telegram as the logistics layer of underground markets, focusing on payments, customer support, and restock updates whose disruption would raise transaction costs even if forums remain.","The migration-economics analogy yields testable extensions: channels that add escrow bots and scam reports should attract higher-value listings, and removing a forum's trust signals should push vendors toward Telegram rather than toward another forum."],"forward_implications":["If Telegram cannot generate strong trust signals, high-impact or innovative criminal products such as new malware and specialized service infrastructures are unlikely to migrate there, leaving forums as the locus of threat innovation.","Telegram's emerging role is complementary: it handles automated payments, customer support, announcements, and credibility displays for products advertised on forums, so disruption efforts aimed only at Telegram may not eliminate the underlying market.","Dmitry's movement is not random: communities with institutionalized trust mechanisms attract successful criminals, so platform choice itself acts as a market signal.","Because some Telegram roles co-occur, such as announcements with marketplaces and automation with private communication, the ecosystem is developing a division of labor that can support traditional crime even if it cannot bootstrap trust from scratch.","A full model of Dmitry's migration is probably out of reach, but push-pull and prospect-theory analogies from migration economics provide a way to think about which types of users end up in which types of communities."],"supporting_citations":[{"why":"Supplies the 28-mechanism trust-building framework and its distribution across underground forums, which the Telegram comparison is built on.","marker":"[3]"},{"why":"Acts as one of the seed repositories for Telegram groups and channels attributed to data leaks and cybercrime.","marker":"[9]"},{"why":"Acts as the other seed repository of Telegram threat actors used to bootstrap the channel collection.","marker":"[7]"},{"why":"Provides the method for discovering additional cybercrime-related groups and channels from the seed repositories.","marker":"[6]"},{"why":"Provides the 'market for lemons' economic rationale for why trust mechanisms matter in markets with quality uncertainty.","marker":"[1]"},{"why":"Establishes the dishonesty and uncertainty problems in the underground economy that the trust signals are meant to address.","marker":"[8]"}],"fun_headline_variants":["Telegram crime lacks forum-style trust signals, study finds","Why cybercriminals migrate: Trust signals shape forum vs. Telegram choice","Telegram is a support layer, not a replacement, for criminal forums","Trust signals missing on Telegram push cybercrime to forums"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The entire comparison rests on assuming that the 28 trust mechanisms defined for forums are the correct and complete lens for Telegram; if Telegram builds trust through platform-specific or forum-carried signals, the finding of few signals would be an artifact of the instrument rather than a property of the ecosystem.","fun_headline_variants_meta":{"raw":{"variants":["Telegram crime lacks forum-style trust signals, study finds","Why cybercriminals migrate: Trust signals shape forum vs. Telegram choice","Telegram is a support layer, not a replacement, for criminal forums","Trust signals missing on Telegram push cybercrime to forums"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000532,"raw_usage":{"total_tokens":2547,"prompt_tokens":917,"completion_tokens":1630,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":533,"completion_tokens_details":{"reasoning_tokens":1557}},"tokens_in":533,"tokens_out":1630,"duration_ms":11541,"temperature":1.0,"reasoning_tokens":1557,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-12T13:16:28.795463+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"An audit of forum-linked Telegram channels coded for all 28 mechanisms that finds the same density of trust signals as forums, or a documented sale of a novel malware family negotiated entirely on a Telegram channel exhibiting none of the eight taxonomy mechanisms, would refute the paper's central claim.","supporting_citations":[{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Supplies the 28-mechanism trust-building framework and its distribution across underground forums, which the Telegram comparison is built on."},{"cited_title":"https://github.com/SystemsLab-Sapienza/TGDataset (2023)","cited_arxiv_id":null,"evidence_quote":"Acts as one of the seed repositories for Telegram groups and channels attributed to data leaks and cybercrime."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Acts as the other seed repository of Telegram threat actors used to bootstrap the channel collection."},{"cited_title":"Master's thesis, TU Eindhoven (2024)","cited_arxiv_id":null,"evidence_quote":"Provides the method for discovering additional cybercrime-related groups and channels from the seed repositories."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Provides the 'market for lemons' economic rationale for why trust mechanisms matter in markets with quality uncertainty."},{"cited_title":"In: Economics of Information Security and Privacy, pp","cited_arxiv_id":null,"evidence_quote":"Establishes the dishonesty and uncertainty problems in the underground economy that the trust signals are meant to address."}],"review_version":1}