1. Darknet Investigations Pieter Hartel

2. Visit Alphabay Cyber-crime Science 2

3. Sample listing Cyber-crime Science 3

4. Darknet markets Social architecture - people »Keeping “honest” people honest (escrow) »Reputation building (reviews) »Dispute resolution (banning) Business architecture - processes »Specialization (80% Drugs) Financial architecture – processes »Pseudonymous payment system (Bitcoins) Technical architecture - technology »Web servers (Market, Forum, Wallet) »Anonymisation network (Tor) Cyber-crime Science 4

5. Technical architecture Cyber-crime Science 5

6. acTOR game “Write your phone number and the name of another person on the post-it and put it into the small envelope. Write the name of yet another person on the small envelope and put it into the medium envelope. Write again a different name on the medium envelope and put it into the large envelope. Write yet again a different name on the large envelope and give it to the person whose name is on it. If you receive an envelope, take the contents out and give it to the person whose name is on it. If you receive a post-it, can you find out whose phone number you have got? Cyber-crime Science 6

7. What do we know? You know who gave you the post-it The person who gave you the post-it knows the phone number too. You know who gave you an envelope and you also know whom you gave it to. And that should be all! (unless you cheated…) Cyber-crime Science 7

8. Visit site with Tor browser Cyber-crime Science 8 click

9. Two asymmetric circuits Cyber-crime Science 9 Rendez- vous point Client Hidden Server

10. Financial architecture Cyber-crime Science 10

11. Bitcoin Bitcoin is: »A virtual currency »A payment system Technical architecture »Clients send transactions to P2P nodes »Nodes verify transactions and prevent double spending »Block chain records transactions Business architecture »Clever incentives for “miners” »Cost structure transactions different from banks Cyber-crime Science 11

12. “Anonymous” payment Method:Trust provided by:Coverage: Cashgovernmentlocal Hawalanetwork of hawaladars who have done business for generations regional Bitcoinincentivized people using the same technology global Cyber-crime Science 12

13. Hawa- ladar Hawa- ladar Babar Hawa- ladar Aisha Hawala Cyber-crime Science 13

14. ATM Babar ATM Aisha Bitcoin Bitcoin network Cyber-crime Science 14

15. Bitcoin ATM Cyber-crime Science 15

16. Bitcoin market Market cap over 5 B$ 200 K transactions per day Exchange rate Jan 2009-Jan 2016 Cyber-crime Science 16 18 Nov 2013 900 $/BTC

17. Business architecture Cyber-crime Science 17 [Soska2015] Kyle Soska and Nicolas Christin. Measuring the longitudinal evolution of the online anonymous marketplace ecosystem. In 24th USENIX Security Symposium, pages 33-48, Washington, D.C., Aug 2015. USENIX Association. https://www.usenix.org/conference/usenixsecurity15/technical-sessions/presentation/soska https://www.usenix.org/conference/usenixsecurity15/technical-sessions/presentation/soska

18. A darknet market is an online market – increases choice an illegal goods market – increases demand an anonymous market – reallocates risk part of an ecosystem – increases competition Stealthy connection to the physical worldf Cyber-crime Science 18

19. Innovation Technologically sophisticated Fuelled by an alternative financial system Transformative, creating a new type of “responsible” dealer What is the effect on public health? Cyber-crime Science 19

20. Markets [Soska2015] Cyber-crime Science 20

21. Global drugs trade Street value of drugs seized in EU many billion $ per year Darknet markets turn over a few billion $ per year [Soska2015] Darknet markets trade still insignificant but growing… Cyber-crime Science 21 [EMCDDA2015] EMCDDA. European Drug Report 2015 - Trends and Developments. European Monitoring Centre for Drugs and Drug Addiction, 2015. Topic-Drugs. http://dx.doi.org/10.2810/084165 http://dx.doi.org/10.2810/084165

22. Social architecture Cyber-crime Science 22 [VanHout2014] Marie Claire Van Hout and Tim Bingham. Responsible vendors, intelligent consumers: Silk Road, the online revolution in drug trading. Int. J. of Drug Policy, 25(2):183- 189, Mar 2014. http://dx.doi.org/10.1016/j.drugpo.2013.10.009http://dx.doi.org/10.1016/j.drugpo.2013.10.009

23. Opportunity theory applies 3 out of 5 principles: »Low effort – everything via the Internet »Low risk – anonymisation technology »High rewards – high volume & value Dark markets offer several controls: »Escrow, Referral, Vendor bond, Finalise early, Personal messaging But who controls the admin? Cyber-crime Science 23

24. Offenders are victims too Vendor scams: »finalize early without delivering »ship low quality products Buyer scams: »deny delivery & reclaim payment »damage vendor reputation Admin scams: »delay payout and exit with the balance Cyber-crime Science 24

25. Investigative methods Web crawls [Soska2015] Data bases [Spitters2015] Interviews [VanHout2014] Screening shipments [Horne2015] Analysis of criminal cases [Lavorgna2014] Test purchases of drugs [Davies2010] Analysis of server data [McCoy2012] Cyber-crime Science 25

26. Cases SR I: 2011-Nov 2013, Ross Ulbricht SR II: Dec 2013-Oct 2014, Blake Benthall Evolution: Kimble & Verto – Feb 2015 Cyber-crime Science 26

27. Conclusions Seizing a market is not effective Some alternatives »Offenders make mistakes and scam each other »Online must meet offline »Trust erosion »Taxing Bitcoins New trends »Single vendor market places Cyber-crime Science 27