Weapons in the Dark: Dark Net Demand and Supply Response to Mass-Casualty Events

Home , AK 5, HS2000, SAR 21, SIG SG 550

COPENHAGEN BUSINESS SCHOOL

MSc Advanced Economics and Finance

Master’s Thesis

Weapons in the Dark: Dark Net Demand and Supply Response to Mass-casualty Events.

Authors: Elena Ivanchenkova, Lavi Apfelbaum Supervisor: Chandler Lutz Date of submission: May 15th, 2017. Number of Pages: 100 Number of Characters: 164,460

May 2017

Illustration source: Scotti, 2013.

“Place your clothes and weapons where you can ﬁnd them in the dark.”

Robert A. Heinlein COPENHAGEN BUSINESS SCHOOL

Abstract

by Elena Ivanchenkova & Lavi Apfelbaum

In this paper, we examine the eﬀect of mass-casualty events on the supply and demand for arms on the Dark Net markets. We explain the environment based on the existing research literature on Bitcoin, encrypted browsers, smuggling and other mechanisms that keep it functioning. We overcome data quality issues related to missing observation using imputation tools. In this research, we use classical econometric methods to obtain evidence on the weapons trade response to the non-strict exogenous shocks. Our results provide some evidence on the short-term and midterm arms sales reaction to the terror attacks and mass shootings. We also ﬁnd a potential of recognising trends and patterns in weapon trade through the activity analysis in the Dark Net markets Acknowledgements

We hereby thank our thesis supervisor Chandler Lutz for the continuous support his guidance and engagement in the process of this research. We furthermore thank Gwern Branwen for his advice and being open in sharing the knowledge not only about the dataset but on the research ﬁeld in general. Finally, we thank our family and friends who supported us throughout the process and provided some valuable ideas which we implemented in the research. . .

iii Contents

Abstract ii

Acknowledgements iii

List of Figures vii

List of Tables ix

Abbreviationsx

1 Introduction1 1.1 Research question and contribution...... 2 1.2 Research methodology and scientiﬁc approach...... 3 1.3 Outline...... 3

2 Dark net markets set up4 2.1 History and development...... 4 2.1.1 Black markets history and development...... 4 2.1.2 DNMs history and development...... 6 2.1.3 Terminology...... 7 2.1.4 Challenges to law enforcement...... 8 2.2 Dark Net tools...... 9 2.2.1 The Onion Router...... 10 2.2.2 Bitcoin...... 15 2.2.3 Encryption...... 18 2.2.4 Escrow...... 21 2.2.5 Delivery mechanisms to end users...... 22

3 Literature review 24 3.1 Market mechanisms on the Dark Net...... 24 3.2 Properties of Bitcoin...... 27

iv Contents v

3.3 Terrorism...... 30 3.4 Weapon laws and illicit trade...... 32

4 Theory 34 4.1 Hypothesis...... 34 4.1.1 Main hypothesis...... 34 4.1.2 Secondary hypothesis...... 36 4.2 Model setup...... 36 4.2.1 Variables for hypothesis testing...... 36 4.2.2 Weapon price return...... 37 4.2.3 Dynamic causality effect...... 38 4.2.3.1 Difference in number of market listing per day...... 39 4.2.3.2 Difference in aggregated USD value of market listing per day 39 4.2.3.3 Average Bitcoin return per day adjusted for exchange rates effects...... 40 4.2.3.4 Number of new market listings per day...... 41 4.3 Assumptions...... 42

5 Data description 44 5.1 Data set composition...... 44 5.1.1 General considerations for the data...... 44 5.2 Dependent variable Y. Market listings...... 45 5.2.1 Data source...... 45 5.2.2 The crawler...... 46 5.2.3 Data preparation for the model...... 49 5.2.4 Market listings data quality considerations...... 51 5.3 Explanatory X variables...... 52 5.3.1 Exchange rates and precious metals data...... 52 5.3.2 Number of casualties from terror attacks and mass shootings.... 53

6 Methodology 55 6.1 Imputation and handling missing data...... 55 6.2 Models implementation...... 57 6.2.1 Weapon price return...... 57 6.2.2 Difference in number of market listing per day...... 58 6.2.3 Difference in aggregated USD value of market listing per day.... 59 6.2.3.1 Average Bitcoin return per day adjusted for exchange rates effects...... 61 6.2.3.2 Number of new market listings per day...... 62

7 Analysis 65 7.1 Weapon price return...... 65 7.1.1 Currencies signiﬁcance speciﬁcation...... 65 Contents vi

7.2 Number of market listings per day...... 69 7.3 Aggregated USD value of market listings per day...... 71 7.4 Average bitcoin return per day adjusted for exchange rates eﬀects..... 73 7.5 The number of new market listings...... 77

8 Discussion 83 8.1 Robustness of the assumptions...... 83 8.2 Limitations...... 85 8.3 Results discussion and possible implications...... 86 8.3.1 Weapon price return...... 86 8.3.2 Number of new market listings...... 87 8.4 Future possible research...... 87 8.4.1 Weapon price return...... 88 8.4.2 Dynamic causality eﬀect...... 88

9 Conclusion 89

A Appendix 91 A.1 Dark Net markets set up...... 91 A.2 Code for filtering the data by product names in python...... 94 A.3 Code for filtering the data by specific vendor names in python...... 98 A.4 Table of casualties...... 101 A.5 methodology...... 105 A.6 Analysis...... 106

Bibliography 111 List of Figures

2.1 How Tor works part 1. Source: TorAbout...... 12 2.2 How Tor works part 2. Source: TorAbout...... 13 2.3 How Tor works part 3. Source: TorAbout...... 14 2.4 Bank system. Source: He et al.(2016)...... 16 2.5 Blockchain distributed ledger. Source: He et al.(2016)...... 16 2.6 Blockhain in by the numbers. Source: Blockchain...... 17 2.7 An example of the PGP public key...... 20

3.1 Volatility of Bitcoin compared to major currencies and gold. Source: Yer- mack(2013)...... 28 3.2 Bitcoin price diﬀerence across exchanges. Source: Kroeger and Sarkar(2016) 29

5.1 DNM listing example. Source: Alphabay...... 47 5.2 DNM custom listing example. Source: Alphabay...... 50

6.1 Graphical explanation of the imputation process and its analysis...... 56 6.2 Distribution of imputed number of market listings dataset and original dataset 59 6.3 Distribution of imputed aggregated USD value of market listings dataset and original dataset...... 60 6.4 Distribution of imputed average Bitcoin return per day adjusted for exchange rates eﬀects...... 62 6.5 Distribution of imputed number of new market listings dataset and original dataset...... 63 6.6 Rounded down distribution of imputed number of new market listings dataset and original dataset...... 64

7.1 Cumulative sum of the residuals from the weapon price index model.... 75 7.2 ACF for cumulative sum of residuals...... 77 7.3 PACF of new market listings...... 80

A.1 Tor hidden service 1...... 91 A.2 Tor hidden service 2...... 92 A.3 Tor hidden service 3...... 92 A.4 Tor hidden service 4...... 93 A.5 Tor hidden service 5...... 93

vii List of Figures viii

A.6 Tor hidden service 6...... 94 A.7 PCA of residuals...... 105 A.8 Range of possible imputed values for an observed data point...... 106 A.9 ACF of new deals...... 110 List of Tables

5.1 DNMs that are present in the dataset...... 46

7.1 Output of the weapon price return model...... 66 7.2 Output of the weapon price return model (continued)...... 67 7.3 The difference in number of listings per day...... 70 7.4 Difference in standardised value of listings explained by ”number of casualties”...... 72 7.5 Residuals from the first model explained by ”number of casualties”.... 74 7.6 Augmented Dickey-Fuller test for unit root with a drift...... 76 7.7 Number of new listings explained by the ”number of casualties” (under Poisson model)...... 78 7.8 Number of new listings explained by the ”number of casualties”(80 lags).. 79

8.1 Positive and negative coeﬃcients of signiﬁcant currencies...... 86

A.1 DNMs that are present in the data set...... 105

ix Abbreviations

DN Dark Net DNM Dark Net Market PGP Pretty Good Privacy ECB European Central Bank GTD Global Terrorism Databse

x Chapter 1

Introduction

We live in a high-tech era where the internet is accessible through most of the smartphones, computers and other gadgets that people use on a daily basis. With this rapid technological development comes more and more advanced solutions that are tailored for various purposes. One of the examples is the Dark Net. Specific types of software were developed to bring black markets online. As a result, it is possible to purchase illicit products from every gadget in the world that has an internet connection. Another important feature of a modern society is media development. News appear within few minutes after a major event. Some of the events such as terror attacks and mass shootings spread fear among the population with media help. One can say that media plays an educational role, but it is not always a positive one. For example, the recent mass shooting in Munich on the 22nd of July 2016 shows a direct link to the Dark Net (Siebelt): ”The man who killed nine people at a shopping mall in Munich on Friday was a local 18- year-old obsessed with mass killings who had bought his reactivated 9mm Glock 17 pistol on the dark web.” This information gives a reader an idea of possibility to buy a gun through internet, the only thing you need is money, and few tools developed specifically for that purpose and that provide privacy to such buyers. It is difficult to assess the volume of the online illicit trade. The Economist (TheEconomist, 2016) provides an estimated sales volume of the illegal drugs - 27 million USD, prescrip- tion drugs - 4.6 million USD and non-drug - 0.8 million USD. This numbers reflect the period December 2013 July 2015 based on the data from Silk Road 2.0, Evolution and Agora cryptomarkets. Additionally, Christin(2013) states that on the Silk Road, one of

1 introduction 2 the most famous cryptomarket of all times, the number of sellers increased by 150% in only ten months. With this volume and pace of growth that of online illicit trade, it is logical to question the ability of law enforcement agencies to prevent these illegal online activities. Guns are also traded on cryptomarkets. In addition to the Munich attack mentioned above, Weimann(2016) indicates that terrorists in Paris attack that happened in Novem- ber 2015 are suspected of using weapons purchased in the Dark Net. Ii is important to note that, although the process of a sale on the DN seems very complicated at ﬁrst glance, it is a very structured business. The sellers have guidelines on how to smuggle illegal items through the customs and ensure successful delivery of their products. As we will see further in this paper, taking into account all additional tools and DN setup, one can conclude that the agents that operate on cryptomarkets are knowledgeable dealers.

1.1 Research question and contribution

In this paper, we will analyse whether terror attacks and mass shootings as exogenous shocks affect supply and demand of illegal weapons on the DNMs. More specifically, we will concentrate on the reaction of gun dealers on cryptomarkets and check if they adjust the number of offers or the price of the products that are already on the market. We will explore if there is an effect on the weapon price return of the existing listings or change in the supply volume of guns after an event. It is important to understand how does the activity on the DNMs react to such exogenous events. This research will provide some insights into the mechanisms of the DN and explain its user’s behaviour. Additionally, the answer to the research question could be a starting point for further research of the supply and demand behaviour on the DNMs in more details than we will do in this paper. The results can provide some significant implications for the law enforcement agencies. In case of the present reaction of the trading activity on the exogenous shocks, the understanding of such patterns could be beneficial for the police. This input could provide a more optimal allocation of financial as well as human resources within agencies. In other words, knowing when the trading peaks will take place after a terror attack, police will be able to concentrate their resources towards illicit internet deals with a greater efficiency. Dark Net market set up 3

Be aware that it is a repetition of the above section, we have to structure it better:

1.2 Research methodology and scientiﬁc approach

Our methodology and scientiﬁc approach follow Saunders and Lewis(2009) ”Research methods for business students”. We construct our paper according to the deductive research methodology. We introduce a research question and develop hypotheses that will help to answer the central question. Further, we will express these hypotheses in operational terms providing the measurement details of the variables. To test those we build several models. Our empirical part is based on the historical data. Based on the result, we will conclude on the outcome of the research.

1.3 Outline

The rest of the thesis is built as follows. Firstly, we provide an insight to the Dark Net setup, introducing tools and overall trade setup for the cryptomarkets and explain how the anonymity builds on. Secondly, we perform an overview the recent literature that covers the Dark Net, explore issues with some of the tools in the cryptomarkets, such as bitcoin and cover other related topics. Thirdly, based on the evidence from the literature, we derive hypothesis for the following research. Fourthly, we build econometrical models that help to test the hypothesis in order to answer the main research question. Fifthly, we introduce the dataset followed by methodology that contributes to overcoming quality ﬂaws and some distribution of the variables considerations. Sixthly, based on all the previous evidence and discussed factors we provide regressions outcome. Finally, we will discuss the results, mention limitations, propose the ideas for further research and summarise. Chapter 2

Dark net markets set up

In this chapter we start with the development and history of the black markets, giving few examples of an increase in the volume of illicit trade across time. After a historical brieﬁng, we describe the tools and overall setup of the Dark Web. It is an important aspect of this paper, as the concept of online black trading platforms is sophisticated and involves technical details that are crucial to understand.

2.1 History and development

2.1.1 Black markets history and development

The history of black markets goes far back in time. One of the most striking economic developments of the war and post-war periods has been the rise of black markets. The term ”black market” usually refers to those transactions which take place illegally at prices higher than a legal maximum or sometimes lower than a minimum (e.g., in the case of contraventions of a minimum wage law)(Boulding, 1947). Other reasons for a development of the black markets: prohibitions, such as a liquor ban in the US from 1920 until 1933. Miron and Zwiebel(1991) estimate, that the alcohol consumption fell sharply at the beginning of Prohibition, to approximately 30% of the pre-ban level, however, alcohol consumption increased to 60-70% of the pre-Prohibition level during the next several years. This fact proofs the development of the black market

4 Dark Net market set up 5 in the US during Prohibition. Other reasons for the growth of the black markets are rationing, queues and shortages. All of those phenomena lead to the underground trade blooming. The Soviet Union is a good example of a country where black markets were highly popular, but at the same time government considered it as non-typical phenomena which would be removed tomorrow or at least the day after tomorrow (Polterovich, 1993). Interestingly, even the term ”black market” was forbidden for scientific publications, and main empirical analyses of Soviet black markets were performed by western economists (Polterovich, 1993). Within black market category, there exist markets specifically tailored for the illegal drugs and guns trade. Historically, such markets operated based on physical interactions with some boundaries and rules. Usually, it is associated with some specific geographical re- gions, parts of the city and actual people (EMCDAA, 2016). The drug trade was associated with drug dealers that will meet face-to-face only after they have ensured safety of the buyer and trustworthiness of the person who connected the customer with the dealer (EM- CDAA, 2016). When new technology such as mobile phones had developed, the face-to-face encounters between seller and buyer of drugs and guns had decreased (EMCDAA, 2016). The communication between parties became easier and did not need physical encounter every single time. EMCDAA(2016) states that the deals moved to more accessible spaces within ver- ified and trusted contacts instead of being held only on the dealers apartment or in some other remote places. At the same time such technology as phone, recordings or number tracking became a significant threat to the anonymity for both parties of the transactions. Next step of the technological evolution that had a significant influence on the dark markets, was the global development of the internet. When the internet became available for a big part of the worlds population, the interaction between people became much easier. Illicit trade expanded into the online platforms that are defined as the Dark Net (DN). Trading platforms in the DN are called Dark Net Markets (DNMs) and sometimes referred to as cryptomarkets. Such platforms can be defined as an online forum where goods and services are exchanged between parties who use digital encryption to conceal their identi- ties (Martin, 2014). There are certain advantages for both buyers and sellers. Hence cryptomarkets should be considered as a significant drug market innovation (EMCDAA, 2016). Vendors that operate on DNMs now can sell to unknown customers. Thus, as a result DN shifted drug markets back to an ”open” market, as opposed to a ”closed” market. Moreover, it enabled Dark Net market set up 6 to do so on a global scale (EMCDAA, 2016).

2.1.2 DNMs history and development

One of the biggest and probably the most famous DNMs is Silk Road that has been operational since 2011 (Martin, 2014). It became very popular and captured worldwide media attention after being exposed in New York-based blog Gawker (Martin, 2014). A high number of articles and news appeared covering all the aspects of the DNM and getting even more attention from the publics and law enforcement agencies that already were struggling with maintaining drug prohibition (Martin, 2014). All this attention surrounding Silk Road, and the resultant public criticism by law enforcement and government authorities did not have a significant negative impact on the site. Moreover, Martin(2014) argues that the inability to close Silk Road down may have served only to encourage new and existing users, and therefore, stimulated further online illicit trade. The administrator, who in some source he is also blamed to be a founder, e.g. Thielman (2015), under pseudonym Dread Pirate Roberts stated in his first interview to Forbes (Greenberg, 2013a): ”At its core, Silk Road is a way to get around regulation from the state. If they say we can not buy and sell certain things, we’ll do it anyway and suffer no abuse from them. But the state tries to control nearly every aspect of our lives, not just drug use. Anywhere they do that, there is an opportunity to live your life as you see fit despite their efforts”. This interview took place before the closure of the Silk Road by FBI in October 2013. The administrator, 29-year-old Ross William Ulbricht has been charged with engaging in a money laundering and narcotics trafficking conspiracy as well as computer hacking (Greenberg, 2013b). In March 2013 the secret site listed 10,000 items for sale, 7,000 of which were drugs including cannabis, MDMA and heroin (Thielman, 2015). Prosecutors said Silk Road had generated nearly 213.9 million USD in sales and 13.2 million USD in commissions before police shut it down (Thielman, 2015). Within weeks of Silk Roads closure, Silk Road 2.0 was launched, even though many other platforms were competing for dominance on the DN, Silk Road 2.0 grew quick (EMCDAA, 2016). Some of the most famous exit scams where the market administrators seize the activity and disappear with all the bitcoins that were deposited in the accounts on the Dark Net market set up 7 platform, were in the following markets (EMCDAA, 2016):

• Sheep. This cryptomarket grew to a size comparable to that of Silk Road. 5,400 bitcoins from users account were stolen worth around 6 million USD at that time;

• Evolution in March 2015. With administrators reportedly having taken 12 million USD from buyers and sellers accounts.

There are upward trends in the trade volume (Martin, 2014). Christin(2013) shows in his analyses that the number of sellers listed on the Silk Road increased from 220 to over 550 from November 2011 to August 2012, in only ten months; and the average daily volume of sales in bitcoins rose from 5,000 to approximately 8,500 in only six months. When the evidence of such a signiﬁcant growth of the trade is in place, it might be possible that the market’s volume will increase even further (Martin, 2014).

2.1.3 Terminology

Some confusion could arise in the terminology. The Dark Net and the Deep Net do not mean the same. As BrightPlanet company, specialising in the research and analysis of the data from the Surface Net, Deep Net, and even places on the Dark Net (BrightPlanet), defines the difference (BrightPlanet, 2014): ”The key thing to keep in mind is the Dark Web is a small portion of the Deep Web. Some media is inaccurately defining both and we want to do our best to clear up the confusion.” To understand the actual difference we should start with the Surface Net. This part of the internet can be identified by search engines. There are three steps that browsers use. Take Google as an example (Google, 2017):

Step 1. Crawling Googlebot, the program (bot or spider) that performs the fetching of billions of webpages, discovers new and updated ones and adds those to the Google index. All the active links updated and broken links on each page are detected, and the program combines them the Google index.

Steep 2. Indexing The process of compiling a massive index of the word found and its location on the pages. Dark Net market set up 8

Step 3. Serving Returning the result that is the best match for the users query.

These steps help to organise all the contents that is located on active URLs and keep it structured, so whenever a user asks for some specific information, the best option will be suggested right away. All the content that could be indexed by a search engine is known as the Surface Web. The Deep Net includes all the information that could not be found in the search browser. Here are few examples of such data: Specific dates of a flight with a defined direction. Usually, a browser will direct a user to the website with booking option, but it does not have this option in its Index. Therefore, the user will have to use the search box provided by the website to get to the desired selection. The hotel booking information (availability, price, etc) is so-called Deep Net. Early estimates of the Deep Net size suggest that it is thousands of times larger than the Surface Net (Hardy and Norgaard, 2016). The Dark Net then is classified as a small portion of the Deep Net that has been intentionally hidden and is inaccessible through standard web browsers (BrightPlanet, 2014). This concealed content usually could be accessed with a particular browser. The most popular it The Onion Router (Tor). The set up of the DN is aimed to provide the best degree of anonymity to users, to secure the transaction and make it untraceable for anyone (EMCDAA, 2016) That is one of the reason for DN growth. The increased anonymity lowers the risk of detection by law enforcement in exchange for an increase in the risk of scam between buyer and seller, which was popular in early markets where the security designed mechanism was not as complex as DNMs these days (Hardy and Norgaard, 2016).

2.1.4 Challenges to law enforcement

State authorities have had little success in preventing the rapid increase in number of buyers and sellers on Silk Road in the period while it was operating for about two years (Christin, 2013). The growth of the DN suggests that law enforcement is failing to stop illicit products are distributed by traders through the cryptomarkets (Martin, 2014). Martin (2014) argues that while inspection of postal items is more likely to result in the detection of an illegal activity than online monitoring of the DNMs, this strategy has some problems. The rapid expansion of global trade increases the volume of goods travelling through the international post (Martin, 2014). Therefore, customs have to perform their checks only Dark Net market set up 9 for highly suspicious items. We will describe in the next section the techniques which sellers in the DNMs use to smuggle their products through customs to make it almost impossible to detect. Another challenge to police and other law enforcement agencies resource prioritisation. The agencies could try to allocate people to surveillance of the addresses and pick-up points but the costs and beneﬁts of this expensive approach are likely to be unbalanced (Martin, 2014). Trying to catch guns or drug dealers can be more valuable in case of success than just catching someone who purchased a pack of weed for his private use or to resell (Martin, 2014).

Other challenges to law enforcement are directly linked to the very sophisticated technical setup of the DNMs with layers of encryption and other tools providing anonymity for the users. In the next section, we give an introduction to the main tools that support the DN and allow illicit activity to function online.

2.2 Dark Net tools

In this section, we describe the sale process and speciﬁc tools that support it. DNM has the same baseline concepts as the Surface Net but has many additional features that provide anonymity and safety of the transactions that attracts users to the network. The primary tools and systems that DN is built on will be covered in the next section. We describe:

• The Onion Router (Tor) is a browser for the Dark Web;

• Bitcoin (BTC) is an electronic currency that is used by customers and accepted by seller for the product;

• Pretty Good Privacy (PGP) is an encryption of all the messages used for communication purposes between seller and buyer;

• Escrow is a system that provides insurance for the transaction between buyer and seller;

• Delivery of products to end users schemes. Dark Net market set up 10

2.2.1 The Onion Router

One of the main differences from the surface web as we have already mentioned above is a specific network that allows a user to access the Dark Net. The TOR Project 1 developed a software which enabled people to use the internet anonymously. If a user wants to get into the dark net, he has to download a particular browser such as Tor as a first step. We focus on Tor because it is the most popular product. It is a free software and an open network that helps a user to defend against traffic surveillance, which threatens personal freedom and privacy, confidential business activities and relationships, as well as state security (TorAbout). The main idea behind it is that the users IP would be hidden to provide online anonymity and privacy to the end user. Tor Browser is downloaded 100,000 times from the Tor website every day (TorProject, 2017). Those downloads could be new users or old users downloading it again (TorPro- ject, 2017). Tor is used not only by criminals who is involved in illicit activities but it is also adopted by the following groups (TorAbout):

• journalists to contact their secret sources of information;

• ill people; rape and abuse survivors who want to stay anonymous on forums;

• companies for some conﬁdential correspondence. The more people using Tor, the more secure it becomes, as it hides an individual among others in the network.

We provide more details on the traffic analysis. Internet data packets have two parts: a data payload and a header used for routeing. The first is what being sent, whether that is an email message, a web page, or an audio file. Traffic analyst can reveal a lot about a user by looking at the headers which disclose the timing, source and so on (TorAbout). But there are also more important kinds of traffic analysis. Offenders on the internet today are developing sophisticated tools which use statistical methods to spy on communication patterns of both individuals and organisations. Against those type of offenders encryption is ineffective because headers are still visible even though the traffic is hidden. (TorAbout).An excellent illustration of the TOR working process is a post service. The postal office can get the information on the frequency of one’s packages or letters, the

1http://www.theonionrouter.com/ Dark Net market set up 11 recipients and the destination address for those items, as well as measurements such as their size. This analogy gives an understanding of how easy it is to get the most frequent contacts of the individual on the internet on mobile phone, at home, in the office or on public Wi-Fi (EMCDAA, 2016). The mechanism of Tor helps to avoid the possible analysis of the individuals traffic by encrypting the communication and distributing the routes all over the world before reaching the specified destination (EMCDAA, 2016). Individuals activities are spread over many different locations on the internet, making it enormously difficult to source it back to the user(EMCDAA, 2016). Unlike normal information flow on the internet, where data is passed from point A to point B directly, using random data routes through several different points, Tor hides its user’s track. This method makes it impossible for the spectator to determine the origin and the end point of the data. (TorAbout). Here is an illustration from the TorAbout that shows how does Tor work. Alice wants to access to a webpage of Bob without disclosing it to anyone else, and afterwards, visiting Jane’s webpage. She opens Tor browser and first Alice’s Tor client is getting a list of Tor nodes from a directory server (EMCDAA, 2016). Dark Net market set up 12

Figure 2.1: How Tor works part 1. Source: TorAbout

As described in Figure 2.1, the browser contacts relay’s that are referred to as ”Tor Network directory authorities” where a list of all possible relays is being kept at any given point in time. These relays are computers that switch traﬃc in between machines (TorAbout). The browser selects the relays from a list of active ones and builds a series of routes from Alice’s computer to each relay (TorAbout). This is illustrated in Figure 2.2. Assuming Alice wants to proceed with visiting Jane’s website, Tor forms a new set of circuits to the new website. This process is described in Figure 2.3. The routes in Tor are usually active only for ten minutes, after which new paths are created using diﬀerent relays (TorAbout). Dark Net market set up 13

Figure 2.2: How Tor works part 2. Source: TorAbout Dark Net market set up 14

Figure 2.3: How Tor works part 3. Source: TorAbout

To illustrate how Tor browser is functioning we will expand a post example. Alice wants to send a package to Bob. She does not want anyone else to know what is inside and hide the fact that Bob received the package from her. Therefore, Alice prepares three packages: to Chris, to Daniel and to Evan. She packs the original package to Bob inside the package to Evan, then packs this one into Daniel’s and ﬁnally wraps it all in the package for Chris after this is completed, Alice sends it out with the post. Chris receives the mail, opens it and sends it further to Daniel, who then sends it to Evan. Finally, the package achieves the ﬁnal destination, i.e. Bob (EMCDAA, 2016). All participants of this chain are not necessarily located in the same countries. In case any of the individuals are being watched, or their correspondence is tracked, the postal system can provide information only about two points of the contact, not the whole chain, which makes this chain more safe for private messaging (EMCDAA, 2016). We should note that Tor cannot solve the anonymity problem, it focuses only on the transportation of data. Nevertheless, Tor provides ”Hidden Service Protocol” to hide user’s location, by changing IP addresses, to disguise the actions one takes in the network,and make it untraceable (TorProtocol). Tor suggest to use hidden services such as Dark Net market set up 15

”rendezvous points”. so users can connect to it (TorProtocol) anonymously and hide their actions among other movements in the Tor network (TorProtocol). The scheme is provided in Appendix A.1. Independently of Tor, there is a general-purpose search engine for hidden services at Ahmia 2. Its mission is to create a working search engine for indexing, searching and ”cataloguing content” in the Tor onion space (EMCDAA, 2016). Another important technology that played big role in the development of cryptomarkets is bitcoin. It deals with ﬁnancial transactions on the Dark Net. Users do not have to pay with their credit cards that linked to the identity of an individual. Bitcoin is used instead of providing a high degree of anonymity.

2.2.2 Bitcoin

As it was mentioned before, all the transactions on the DNM are paid in Bitcoin. The FBI sees the anonymous Bitcoin payment network as an alarming haven for money laundering and other criminal activities (ZETTER, 2012). ECB(2015) defines Bitcoin among other virtual currencies as follows: ”Although the term ”virtual currency” is commonly usedthe ECB does not regard virtual currencies, such as Bitcoin, as full forms of money as defined in economic literature. Virtual currency is also not money or currency from a legal perspective”. Nakamoto(2009) presented Bitcoin to the world in 2009. This pseudonymous hacker defined this virtual currency in his white paper in 2009 as follows: ”A purely peer-to-peer version of electronic cash would allow online payments to be sent directly from one party to another without going through a financial institution” (Nakamoto, 2009). Bitcoin is associated with inelastic money supply coded via mathematical formula and unsustainable volatility (Bouoiyour et al., 2015). This virtual currency amount is fully predictable and limited at 21 million units in 2140, meaning that the number of coins cannot continue to grow after this date (Bouoiyour et al., 2015). Currently, there are around 16 million Bitcoins in circulation 3. The main problem with digital items is that whenever a user sends or uploads an item, it can still stay on his computer as a copy. How can users trust each other and be sure that they received not a copy but an original of a digital coin? As we have mentioned before,

2https://ahmia.fi 3https://blockchain.info/charts/total-bitcoins, accessed 06/03/2017 Dark Net market set up 16 usually transactions are controlled by banks and can not be performed on a peer-to-peer level. Even though nowadays it is easy to transfer money between cards, the process is still controlled by the banks. Technology that allows Bitcoin to function is blockchain. The blockchain is a public summary which records all successful transactions made with Bitcoin (EMCDAA, 2016). It exists to make sure that no one can use the same Bitcoin for payment more than once. The diﬀerence is that blockchain mechanism is tracking all the movements of the currency and not only user’s accounts (EMCDAA, 2016). This mechanism enables to see which addresses, analogous to a bank account, hold what amount of Bitcoins. A ’block’ is a series of updates of the movements which are observed in between addresses and can be compared to a fresh page in the summary (EMCDAA, 2016).The reason behind its name is because each block refers to the previous block’s information. The comparison between payments through a bank and with using blockchain technology is illustrated on the Figures 2.4 and 2.5:

Figure 2.4: Bank system. Source: He et al.(2016) Figure 2.5: Blockchain distributed ledger. Source: He et al.(2016)

EMCDAA(2016) also notes that each ”page” of the ledger contains a complex mathematical problem which needs to be solved before the block can permanently join the blockchain. For each one of those equations, there are multiple solutions, but only one of them need to be revealed. Those equations intentionally become more complicated over time and require more computing power to solve. The computer that provides the solution ﬁrst will be granted additional Bitcoins as a reward for helping to maintain the block chain. This process is known as ”mining” (EMCDAA, 2016). An important fact is that this updating of the ledger is not controlled by a third party such as a bank, for example, a formal ﬁnancial institution or a government. Therefore, one can say that the Bitcoin network Dark Net market set up 17 regulates itself based on the supply and demand principles (EMCDAA, 2016).

Figure 2.6: Blockhain in by the numbers. Source: Blockchain

Once the technical features are explained, we introduce the process of purchasing of Bit- coin. Most of the Bitcoin users do not mine the coins themselves, but instead, purchase it using a fiat currency (EMCDAA, 2016). There are different types of software that are called wallets that allow users to buy, store and transfer their Bitcoins. There are several ways to acquire a virtual coin.The first option is associated with a high degree of anonymity: users buy virtual currency in person or through cash deposits to the vendor’s local bank branch. The purchase will be performed through a bitcoin trader on a site such as localbitcoins.com, providing the bank details (EMCDAA, 2016). Usually, no identification document is required to complete this transaction. After the purchased bitcoin is transferred to the wallet, the user will have a bitcoin that is untraceable to their identity, in case if users wallet does not reveal it. The second option of obtaining bitcoins is to buy it with a link to the real-world identity. In many of the popular website, a user have to provide passport, driver license, etc. The coins could be bought with a bank card, which is easy to trace back to the user (EMCDAA, 2016).

As it is not diﬃcult to trace the transactions back to the original time of purchase where the coin was made, many users prefer to unlink their identity from the coins (EMCDAA, 2016). The anonymity will prevent the theft of their Bitcoins and also will not disclose the purchases and other operations that the individual was performing. There are special tools on the web that can create this anonymity. One of the favourite websites that provides Dark Net market set up 18 such a service is Bitcoin Fog foggedddxlunnaaa.onion 4. The transaction’s destination is hidden among other users. Basically, the site behaves as a ”black box” that mixes between that enter, and then it distributes coins to the destination point (EMCDAA, 2016). To summarise, Bitcoin and related technology such as blockchain allow its users to perform transactions on the DN. One of the most important features is a possibility of anonymous transactions for the users of the cryptomarkets. That is the biggest advantage for the users involved in the illicit trade. Later, in the literature overview, we will cover the speciﬁc features of Bitcoins such as high volatility and inelastic money supply.

2.2.3 Encryption

The next tool which is necessary to conceal communication from a third party is encryption. Surfing the cryptomarkets one can notice that in many cases vendors ask to use PGP and provide a long ”key” consisting of different letters and characters. This is a way of encrypting a message to ensure that no one else could read the communication between vendor and the customer. One of the software for encrypting is PGP, that stands for ”Pretty Good Privacy” . It is the most popular message encryption program. Philip Zimmermann created this computer program in 1991. He explains the reason for creation of this program (Zimmermann, 1999): ”It’s personal. It’s private. And it’s no one’s business but yours. You may be planning a political campaign, discussing your taxes, or having a secret romance. Or you may be communicating with a political dissident in a repressive country. Whatever it is, you don’t want your private electronic mail (email) or confidential documents read by anyone else. There’s nothing wrong with asserting your privacy. Privacy is as apple-pie as the Consti- tution” When Zimmermann wrote PGP he distributed it as a shareware which became available to download worldwide, which was problematic in the eyes of the US government, since it violated the export laws (Zimmermann, 1995). Zimmerman has been under investigation for two years by a federal court due to this reason. Because of this publication of the shareware was stopped, No criminal charges were filed against him. After the investigation, he published a book with a source code through MIT Press. This made it possible to export the code outside the US, because there are no export limitations on books in

4Can only be accessed via TOR Dark Net market set up 19 the US. It was still possible for users to scan the book with text recognizer and build the PGP (Zimmermann, 1995). Later this software was acquired by different corporations; its current developer is Symantec. In the preface of his book Zimmermann(1995) is writing: ”Cryptography is a surprisingly political technology. In recent years, it has become more so, with the controversy surrounding the Government’s Clipper chip, the FBI wiretap leg- islation, export controls on cryptographic software, and the balance of power between a government and its people. Historically, cryptography has been used mainly by govern- ments for diplomatic and military traffic. But with the coming of the information age, ubiquitous personal computers, modems, and fax machines, this is changing. With an emerging global economy depending more and more on digital communication, ordinary people and companies need cryptography to protect their everyday communications. Law enforcement and intelligence agencies want access to all of our communications, to catch people who break the law, and detect threats to National Security. Civil libertarians want to keep the Government out of our private communications, to protect our privacy and maintain a healthy democracy.” From the book preface Zimmermann(1995) also notes that the US Government made a significant contribution for PGP being spread very actively due to all the information and media attention around his case. There are other similar encryption software: GnuPG, Off the Record (OTR) used for encryption of instant messengers, OpenPGP is the most widely used email encryption standard and was originally derived from the PGP software (OpenPGP), and others. According to the definition provided by the symantec PGP is a mechanism that allows the users to communicate privately uses the public key approach: messages are encrypted using the publicly available key, but the intended recipient can only unlock them via the private key that is kept secret by the end user. Every user has a pair of such keys, which are files saved on the computer, external portable drive or just USB. The public key is available to other users, on DNMs it looks like on the Figure 2.7: Dark Net market set up 20

Figure 2.7: An example of the PGP public key

This key is used by other users to encrypt the message that only the receiver will be able to read it as the private key decrypts the messages sent to the key owner. The private key is also used to sign the mails to ensure that it comes speciﬁcally from him. Such a key could be shared, but it is not a common practice (EMCDAA, 2016). It is important to remember, that the metadata is not encrypted by the PGP. Conse- quently, the date and time of the message are available for others (EMCDAA, 2016). It means that an administrator or someone else who is watching could see which customers are talking, even though they cannot see the contents of the dialogue (EMCDAA, 2016). Dark Net market set up 21

PGP is a crucial tool for the cryptomarkets users. It is a way to be sure that the personal information will not be available for anyone else except for the target person. For example, buyers use it to communicate their name and the delivery address for the packages. As a result, even if law enforcement will close down the market, seize their servers and control the data ﬂow, it will be still impossible to decrypt personal details of the users.

2.2.4 Escrow

With all the tools that provide anonymity, that we described above, a prevention of fraudulent behaviour becomes an issue. For example, what does stop the seller from receiving money and not shipping the product to the customer(?). On the other hand, agents in the market, do not disclose their identity if they are smart enough. Thus it could be tempting to receive a product without paying for it. As there are no authorities that regulate the market relations on cryptomarkets, hence the seller cannot file a lawsuit or complain to the regulator. To ensure that such behaviour will not take place within the cryptomerkets, a unique system is usually implemented into websites, called escrow. This system is also used on the surface net to secure the transaction in the markets such as Amazon, eBay and other similar trading platforms. ”An escrow is a financial arrangement where a third party holds and regulates payment of the funds required for two parties involved in a given transaction” (esc). It helps to secure a deal by keeping the payment in an escrow account; the amount is released when all of the terms of an agreement are met, hence reducing the risk of fraud. There are five usual steps for a transaction which is secured by an escrow service on the surface web (esc):

Step 1 Both parties of the transaction, Buyer and Seller agree to the terms of the deal.

Step 2 Buyer pays the escrow system by submitting required amount to the secure account using an approved payment method. Escrow veriﬁes the transaction and Seller receives a notiﬁcation that a transfer was made successfully and is now secured by escrow.

Step 3 Seller ships goods to Buyer and submits the tracking information to the escrow system. Escrow veriﬁes if Buyer received the merchandise. Dark Net market set up 22

Step 4 Buyer has a certain number of days to check the quality and other features of the merchandise and as a result to accept or reject it. The buyer accepts the goods.

Step 5 Escrow pays the Seller by releasing the funds from the secured account. In case if the Buyer does not accept the merchandise due to the reasons stated in the agreement, he can return the good and get the money back. It also works the other way around, if Buyer cannot pay the whole amount to the escrow account, then the Seller will be saved from shipping the product to the fraudulent Buyer.

The Dark Net markets sometimes also provide the escrow system to its users. Because the users in this marketplace cannot seek legal recourse for their illegal transactions, they must police themselves (Hardy and Norgaard, 2016). The difference is in the agreement between parties as the return is not possible. All the users are anonymous, and the Seller does not provide any information about the return address. Hence the good cannot be returned, and consequently, escrow works in a different way to secure the transaction. An escrow service cannot exist which simultaneously satisfies Buyer and Seller on the cryptomarkets. Christin(2013) says that some markets allow vendors with a good reputation to require their customers to ’finalise early’, meaning that there will be no escrow protection. Under those circumstances, merchants have earned users trust and therefore can skip additional security precautions. There is also the possible risk of an exit scam by the escrow agent themselves, meaning that while having the buyer money in safe they will ”take the money and run”. A more secure alternative is a multi-sig escrow, which is more technical to set up, requires additional checks and protects users against any risk of the escrow provider stealing users coins (Dean).

2.2.5 Delivery mechanisms to end users

There are discussion forums in the DN, such as Reddit 5 and many others, where a user can easily ﬁnd guidelines on how to avoid the customs and postal detection when sending illicit products. There is a detailed description of the packaging, the appearance of the envelope or a box and steps of how to wrap up the drugs to prevent any detection by authorities (Christin, 2013). Moreover, it is advised for buyers to avoid ordering from countries which will attract attention, such as Colombia. Instead the forums advice on

5A network of forums in the Surface network dedicating for a variety of topics, accessible via https: //www.reddit.com Literature review 23 buying from places which are more ”clean”, Denmark could be a good example here. In the case of drugs, its also advised buying in small undetectable amounts (Christin, 2013). One need to remember that weapon smuggling is harder. We analysed the forums on the DNM called ”The Armory”, that is created specifically for the arms trade. It is advised to sellers to conceal all parts of the gun separately and place it in packages with electronic or metal devices. There is also a map with locations in the world where shipping should not be a problem and countries where the shipping is not advised. In an interview of Matthews(2014) with an arms dealer, the seller describes this method as ”power tools” saying ”take the tool apart, mill out space for the firearm component and seal it back up. If done carefully, the item can even continue to operate.”. He gives an example that a good concealment technique is to use engines, computers and other similar products. The density and materials of both such products fit well (Matthews, 2014). Sellers clean the products from any leftovers of oil or gun powder firmly, to make the detection by dogs close to impossible (Matthews, 2014). To emphasise the professionalism of agents when it comes to delivering the products, we refer to the Russian article, which states that there is a whole business school to educate dedicated people to smuggle drugs and weapons (Abrosimova, 2017). Another method that is used by some vendors is a ”dead drop” that is described on the Reddit forums. This delivery method means that a person who is linked to the seller or, very rarely, the vendor itself drops the product somewhere first. Then the location is communicated to the buyer who in turn picks the item. A reason to use this service is the possibility not to disclose the address of the customer, which might be a link to identity. This, of course brings other issues, such as the possibility of an ambush or an arrest in the place of the drop, or losing the product and therefore value associated with it.

Based on the facts presented in this chapter, we can conclude that the entrance barriers to the DN are very high. Besides, we learn that the complexity level DN demands a high degree of computer sophistication from agents. Moreover, they have to be careful and precocious. This applies to both vendors and buyers. Additionally, the sellers need to know how to smuggle products and win the trust of the potential buyers, while customers need to know how to avoid law enforcement and not to become a victim of scams. Chapter 3

Literature review

The topic of online black markets is still relatively new in the research. The most discussed topics are related to the IT set up of cryptomarkets and estimation of the trading volume. Nevertheless, there are several interesting studies that we will introduce later in this paper. We have covered the technical setup of the Dark Net in the previous chapter. Firstly, we take a look at the market mechanisms which are allowing it to function. Secondly, we talk about Bitcoin specifications as currency. Thirdly, we define terrorism and provide some important considerations linked to the DN. And finally, we briefly explore if there is evidence that difference in regulations on the gun possession affects the illegal trade. All the relevant facts will be considered as the basis for our model and hypothesis that we build in the next chapter.

3.1 Market mechanisms on the Dark Net

Given the illicit nature of the markets, a high degree of anonymity around all the transactions and lack of regulations, it is reasonable to think that it is hard to establish a mechanism that will let cryptomarkets function. We will ﬁrst describe the mechanism of feedback on the websites. After that, we try to understand what type of business is the most common for cryptomarkets. Finally, we will outline the main law enforcement challenges that are a consequence of the unique market mechanisms on the dark net. Hardy and Norgaard(2016) in their paper ”Reputation in the Internet black market: an empirical and theoretical analysis of the Deep Web” conclude that the reputation acts as

24 Literature review 25 a sufficient self-enforcement mechanism to allow transactions on cryptomarkets without any government taxation and regulation. They base their findings on the cannabis listings data that was scraped from the Silk Road DNM for eleven months from November 2013 (Hardy and Norgaard, 2016). During our analysis of the cryptomarkets, we also noticed that ratings are critical for vendors, this prevents dishonesty on the platforms. Sellers try to get higher ratings by making offers for bundled sales; sometimes they can suggest promotional products for a cheaper price compared to the market. Those actions are intended to get some reviews to start building their reputation on the platform. The rating depends not only on the quality of the product but also on the ability of the vendor to deliver the illegal product to the end user. As we already know from the DNMs setup chapter, that is one of the difficult parts. The escrow system provides an option to return money to the buyer if the product was not delivered successfully. Both sellers and buyers will suffer losses from such an outcome: a vendor loses the product and hence the associated cost of it and other expenses for shipping are sunk, a buyer does not receive the product and could bear the escrow fees depending on the website rules. Resnick and Zeckhauser(2002) conclude that on the markets where players repeat transactions, but rarely with the same agent, the transmission of reputation can deter moral hazard and discourage entry by malicious user types. Their paper is based on the eBay reputation analysis, which is similar to the cryptomarkets reviews set up. Only the customer who bought the product can leave a comment and rate the vendor he dealt with. This prevents having a high number of fake reviews. Nevertheless, these measures are not exhaustive and therefore, do not completely prevent from fake reviews to appear on the websites. An author of the paper ”Lost on the Silk Road: Online drug distribution and the cryptomarket”, Martin(2014) describes an example of the vendor’s on the Silk Road reaction to the feedback received concerned an unexpected increase in orders reportedly failing to be delivered to recipients in Australia. As a result of new procedures, which were implemented in the Australian customs, made it more difficult to smuggle illegal products in the country (Martin, 2014). This issue was discussed in the forums. Seller chose different solutions for this problem. While number of vendors seized the sales to Australia entirely, others continued their business as usual. Interestingly, a part of vendors modified the terms and conditions and separated Australia from other countries and endorsed very unfavourable term such as no reshipping and only 30% refund, while for others the refund will consist of 50% and 100% reshipping possibility Literature review 26

(Martin, 2014). Martin(2014) illustrates that vendors react to the changes in an external environment, as well as take into account the demand and adjust their business to address both: the latest changes influencing the market, as well as the demand (Martin, 2014). Now we provide an overview of the academic discussion on the type of the business activity on the DNMs. The discussion is around whether cryptomarkets are built as a peer-to-peer sale network or as business-to-business interactions. The supporters of the first view are Christin(2013) and Martin(2014). The authors argue in their papers based on the data collected from the Silk Road that this cryptomarket could be defined as an eBay for drugs. In other words, the trade is between peers and the purchases are in small quantities for personal use. Aldridge and Décary-Hétu(2014) has a different view on the trade set up. The authors find in their paper that a substantial proportion of transactions on Silk Road are best characterised as ”business-to-business”, with sales at quantities and at prices that are typical of purchases made by drug dealers sourcing stock (Aldridge and Décary-Hétu, 2014). Therefore, it is not just peer-to-peer sales, but well-functioning businesses around cryptomarkets. Based on the fact that the volume of each transaction is not high as mentioned by Martin (2014), he argues that even if law enforcement agencies do manage to detect a consignment of prohibited drugs, there are still significant obstacles in obtaining a sufficient evidence for prosecution. All the precaution measures that are undertaken by the users making it more difficult for the police to get sufficient evidence (Martin, 2014). The author argues that one particularly complex strategic challenge facing law enforcement is that of resources allocation, aiming to yield maximum results. Benavie(2012) supports this view and suggests the allocation will be more towards either ’high-end’ policing, which targets the importers and distributors located at the middle echelons in the chain of supply, or lower-level (”retail”) enforcement which targets street dealers and end-users in known drug hot-spots. Even in case of a successful operation by police, the effect will not have a significant benefit. Literature review 27

3.2 Properties of Bitcoin

In the chapter DNMs setup, we have introduced the concept of Bitcoin and blockchain technology that allows the Bitcoin market to function. In this section, we provide a discussion in the recent academic literature on the main properties of Bitcoin. Based on this overview we conclude if any specific adjustments are required to the economic model that will be set in the next chapter. For the purpose of our research we need to understand whether there are any issues with the exchange rates and volatility of Bitcoin. Hence we will concentrate our attention on these two properties. Several recent literature sources discuss whether a Bitcoin is a currency and if so, why it is that volatile (Yermack, 2013), (Dwyer, 2015), (ECB, 2015). Authors discuss the possible inflation of the currency and the effect of the absence of authority that intervenes in the supply and demand of the electronic money. As those sources do not state directly that in the foreseeable future Bitcoin will seize to exist, our research, could use it as a reference currency. Dwyer(2015) explains how to use the technologies behind Bitcoin. The volatility of Bitcoin by far outperforms average monthly volatility of fiat currencies and gold (Dwyer, 2015). Nevertheless, the lowest monthly volatilities for Bitcoin are less than the highest monthly volatilities for gold and the foreign currencies (Dwyer, 2015). Yermack (2013) supports the view on the high volatility and illustrates the year-to-date volatility of the Bitcoin/dollar exchange rate. He does it for the period between January 1 and November 29, 2013, based on daily data. The Figure 3.1 shows the annualised volatilities of the exchange rates of the euro, Swiss franc, yen, British pound, as well as the London price of gold for comparison purposes. Literature review 28

Figure 3.1: Volatility of Bitcoin compared to major currencies and gold. Source: Yer- mack(2013)

The Figure 3.1 suggests that investing in Bitcoin even for short term period is risky, which is inconsistent with a currency acting as a measurement of value and therefore (Yermack, 2013). All the sources agree that the excessive volatility is more consistent with the behav- ior of a speculative investment than a currency (Yermack, 2013), (Dwyer, 2015), (ECB, 2015). Additionally, ECB(2015) defines the volatility as the most serious drawback for holders of Bitcoin as they have to cash these coins back into currency or purchase some products. The price of these goods is usually quoted in currencies, therefore users do not have a sufficient degree of certainty as to how many Bitcoin they should hold to be able afford the product (ECB, 2015). It is important to note that there is a risk that the business operation value could be affected by changes in exchanges rates (ECB, 2015). We will consider this fact while setting up the model for our research. As we have noted in the previous chapter, Bitcoin faces a structural economic problem related to the absolute limit of 21 million units that can ever be issued, with no expansion possible of the Bitcoin supply after the year 2140. If Bitcoin becomes extremely successful and substitutes other world currencies, it would result in a powerful deflationary force on Literature review 29 the economy due to the money supply does not increase to accommodate the economic growth (Yermack, 2013). This problem is a hot topic for discussion in academic literature, but out of the scope of our thesis. Moreover, ECB(2015) notes the lack of continuity and potential liquidity of the virtual currencies such as Bitcoin. In other words, there is a risk for holders that the activities will suddenly stop users with possess coins with no value. This statement is important for this paper, as we have to assume that this risk is not significant in the current state. Other issues discussed by the (ECB, 2015) are; lack of transparency; absence of legal status, i.e. users do not have legal protection and are exposed to the various risks that regulation usually mitigates; high IT and network dependency. These features are more general considerations of the virtual currencies and do not affect the assumptions needed for the purpose of our research. Another important for this paper feature, is the USD value of the Bitcoin. Exchange rates are not as straightforward fo virtual currencies as it is for other fiat currencies. Kroeger and Sarkar(2016) state that the virtual currency is supposed to be homogeneous, meaning that coins bought in different platforms suppose to be equal. Therefore, any price difference should be realised by the arbitrageurs (Kroeger and Sarkar, 2016). Consequently, the law of one price should be applicable to this asset. However, in the Figure 3.2 illustrates the difference between the price of the BTC in USD on the major exchange platforms: BTC-E, Bitfinex, and Bitstamp (Kroeger and Sarkar, 2016).

Figure 3.2: Bitcoin price diﬀerence across exchanges. Source: Kroeger and Sarkar (2016) Literature review 30

The relative price difference is positive on average, meaning that Bitcoin from BTC-E is underpriced. Kroeger and Sarkar(2016) state that the discount averages is about two percent. Authors argue that the discount might appear due to the counterparty risk, based on the fact that BTC-E is more anonymous and hidden (Kroeger and Sarkar, 2016). Such a feature may stop users from using the exchange as the probability of bankruptcy or fraud is higher (Kroeger and Sarkar, 2016). To answer our research question, we will need to use the USD values of the Bitcoin for some of the models, which we will discuss in the Theory chapter. The fact that exchange rates are different on some platforms and usually traded with an average discount on the BTC-E does not have a significant effect on our analysis. We will look into changes in the values of guns to catch dynamic causal effects. Therefore, the only thing that is important for us is the changes in USD value and not so much the Bitcoin price. Nevertheless, we have to remember that high volatility could affect the operations on the DNMs as the activity might be lower when Bitcoin is too cheap, and therefore, a customer will have to pay many coins for one USD.

3.3 Terrorism

The aim of this subsection is to provide an insight into some aspects of the terrorism and mass shootings that we use later in our research as an exogenous shock to the market activities. We would like to provide a deﬁnition of ”terrorism” which adopt in this paper. Moreover, we highlight the most important facts and features about terror and mass shootings. After this, we check if any signiﬁcant assumptions should be stated in the economic model. Borum(2007) starts his book Psychology of terrorism with the following citation of a famous psychologist and a professor of a Stanford University Phillip Zimbardo: Terrorism is about one thing: Psychology. It is psychology of fear. Phillip Zimbardo, personal communication, April 2004 Phillip Zimbardo in his interview asks the following questions Ross:

”How do we go about understanding the motivations of anybody in different situations? What is the role the media plays in promoting terrorism? For me, terrorism is all about Literature review 31 the psychology of a small group instilling fear in a larger group, fear of random, unpredictable attacks, where when it works, you undercut the confidence of citizens that their government can protect them. That was the thing about the anthrax scare we hadand by the way, we still haven’t found that guyand that was 9/11. The argument is that terrorism is really about the psychology of fear induction in a population through these random, unpredictable attacks.” Both of the terms terror and terrorism have a long history behind them. The English word terrorism comes from a the regime de ta terreur that prevailed in end of 18th century in France (Borum, 2007). The definition had been changed many times throughout history. ”Terror” was also used to describe ”the actions of states against their own people, such as ”the Nazi terror” but in middle 20th century it started to be used to describe ”the violence by small groups of dissidents or revolutionaries to intimidate or influence the state” (Jackson, 2005). Back in 1977 terrorism was already a problem. Johnson(1977) defines different types of terror and emphasise the importance of separating it to ethnic, nationalistic, ideological and pathological types. He also notes that publicity through news media should be viewed as an indulgent cause for terrorism and could also lead to a viral or imitation effect (John- son, 1977). We will take this fact into account in further chapters. The author summaries causes of the terror development in the ”three T’s”:

• New targets. The development of the society provides more easy targets for terrorist attack: aeroplanes, airports and other crowded places;

• New technology. This includes both: weapons and means of catching public attention through media channels;

• New toleration for terrorism. This support of terrorist organizations by nations. This also includes the failure of law enforcement agencies to enforce countermeasures (Johnson, 1977).

We can conclude that all the ”T’s” still important nowadays, 40 years later from the paper published by Johnson(1977). We want to highlight, that in this paper we analyse a new technology which expands the crime environment into the internet as we already stated in the DNM setup chapter. This technology makes it easier to access illicit goods, such as Theory 32 guns, bombs and other types of weapons. Morin(2016) states that ”terrorism is a violent communicative act and, unlike other forms of violence; its target is not its immediate victims, but a larger audience. Its main goal is not to harm or punish the immediate victims but to send an intimidating message to a target population, state, or organisation”. Media gives terrorism a wide coverage which is desired by the terrorists in some cases. This creates a ”prisoner dilemma”, meaning that everyone will be better oﬀ without the extreme coverage. Nevertheless, because of a harsh competition between media channels over ratings the equilibrium is that all of them widely broadcast terror attacks. As a result of this high degree of competition, the world lives ”online”. People will ﬁnd out about a new terror attack almost immediately. Although some people do not read news, still everyone around talks about the latest updates on the events such as terror attacks. Even though it is unrealistic to expect the media not to broadcast the acts of terror, Featherstone et al.(2010) argues that using the ”media spectacle” terror spreads ”beyond the immediate vicinity” of the attacks. It enters into people’s houses and distorts the security feeling (Featherstone et al., 2010). Morin(2016) notes that the fear of Islamic terror spread through western countries after the 9/11 attack in the US is an illustration of the consequences of such a broad coverage in media. On the subject of new technology adaptation by terrorists, there is a clear evidence that those groups are migrating into the dark web (Weimann, 2016). As stated in Weimann (2016), there are indications that terrorists are not only communicating through the DN but actually trade there. One example, which is brought in the article, is the believe that weapons for the Paris attack in November 2015, were bought in a DNM.

3.4 Weapon laws and illicit trade

One of the general questions that appears when discussing guns on the black markets relates to te gun laws and regulations in the countries. Is it difficult to buy a gun legally and why do people by it in the DN? Gun laws can vary a lot between countries, and in the US even between states. The difference in gun laws is affecting the number of weapons in a given population, as can be seen in (GunPolicy) data, and it is also mentioned in (Peters, 2009). Furthermore, Peters (2009) draw a direct link between the size of the legal market for weapons and the effect it has on the illegal possession of weapons. Consequently, the possible conclusion is that Theory 33 countries with less restrict gun laws might have a larger illicit arms market. Peters(2009) begins with a statement which is worth emphasizing:”A thousand people die each day from gunshot wounds, and three times as many are left with severe injuries. If the death, injury and disability resulting from small arms were categorised as a disease, it would qualify as an epidemic”. We believe these figures reflect the importance to understand the illicit market for weapons. The size of small arms illegal market is estimated to be around one billion dollars a year (RELATIONS, 2013). The DNMs share of this huge market is marginal. Jacobson and Daurora(2014) brings as an example the Mexican case, where law enforcement agencies caught over 306,000 fire arms between 1994-2010. Vargas and GONZáLEZ(2015) has done a further research specifically on the illegal Mexican small arms trade. He claims that due to the differences in gun laws between the US and Mexico, where the latter are stricter, a high number of weapons flows illegally from the US to Mexico(Vargas and GONZáLEZ, 2015). Chapter 4

Theory

In this chapter, we will present a theoretical frame to answer the research question of the thesis. We start with the formulation of hypothesis. Next, we set up an economic model, explaining which variables are relevant and provide reasoning behind it. We conclude this chapter with general assumptions for the model.

4.1 Hypothesis

This part will be divided into a main and secondary hypotheses. While our main hypothesis deals with the eﬀect of terror attacks on the DNMs weapon supply and demand, our secondary hypothesis questions the actual signiﬁcance of globalisation of the weapon market in the DN.

4.1.1 Main hypothesis

As stated in our research question, we need to know whether there is an effect of terror attacks on the supply and demand changes in the DNMs. Therefore, our hypothesis is as follows: H0: Supply and demand on the dark net markets is not effected by the number of casualties in terror attacks. H1: Number of casualties in mass shooting do effect the dark net markets supply and demand.

34 Theory 35

When defining the hypothesis, we assume that terror events are non-strictly exogenous shocks on the illicit weapon market. We will elaborate more on this assumption later in this chapter. We expect the effect to be significant due to the following reasons:

A. Fear of random violence. This phenomenon might increase the demand for guns as a matter of security. It is important to remember that DNMs are platforms which specialise on illicit activities, mainly drugs dealing but also weapons, stolen credit cards and bank accounts(EMCDAA, 2016). Therefore, this point has a weakness. It is doubtful that ordinary people will look for solutions concerning their security issues the DNMs.

B. Implementation of more strict regulations after terror attacks. In case of terror acts, authorities are more likely to increase the security measures. Consequently, such actions make it harder to deliver guns across borders or even transport within one country, as well as cracking down on illegal arms dealers.

C. Imitation of violent acts. As we have mentioned in the Literature overview, mass shooting and terror attacks tend to get a high media coverage. This leads to a significant number of people receiving detailed information from the news about the act of terror. Past studies have shown that in some cultural environments observing a glorified violent act can push certain individuals to produce a similar act (Victoroff, 2005). Hence, we assume that those people might access the DNMs and push the demand curve up.

D. Criminal arms race. Some of the mass shooting come from gangs violence. As deﬁned earlier, the DNMs are mainly outlaw markets. Decker and Van Winkle(1996) state in the ﬁeld research that gangs tend to slide into arms races. Therefore, a highly media covered event of mass shooting by gang members can push arms race, which might increase the demand for weapons.

To summarise, multiple reasons are indicating the likelihood to witness an effect of terror attacks on the supply and demand for weapons. It is also possible that some of the Theory 36 effects described above can net-off each other. For example, if demand goes up because of imitators activity, but at the same time supply goes down due more strict regulations amplification, we would not be able to notice either of the effects.

4.1.2 Secondary hypothesis

We would like to test if the DN weapon market is a global one. In other words, we want to test if parties react to currency fluctuations, which could be considered as additional costs for the trading parties. Moreover, we want to ensure that the market contain real deals and not only fake listings, i.e. the supply will react to external factors. H0: The DNMs for weapons is not a vibrant global market. H1: The DNMs for weapons is a vibrant and global market, which represent real deals. There is a common belief that a most of the offers and deals regarding weapons in the market are either scams or ”honey-pots” (fake vendors run by law enforcements)(Vitaris, 2016). In contrast to this statement, there is a concrete evidence for terrorists using weapons that were bought in the DNM. We have described Paris Bataclan and Munich attacks in Introduction. By showing that the market profitability is affected by different exchange rates, we can infer that this is a real market where buyers and sellers are reacting to the change in implied transaction costs, i.e. the necessity to interchange fiat currency and Bitcoin. We start testing the secondary hypothesis to ensure that the DN weapon market consists of active users that react to external factors. After that we concentrate on the main hypothesis.

4.2 Model setup

4.2.1 Variables for hypothesis testing

In this section, we first define variables and theoretical framework that we use in order to test the stated hypotheses. The dataset that should provide a good estimate of the analysed relations is the information on the deals in the DN. We would like to assess whether opened offers react to external factors. In case of using this approach, we would Theory 37 expect to see the change in the price of the product, new items will appear or old will disappear on the market in connection with an event. Therefore, the dataset will consist of non-identical items. To ensure that we can construct a model we use the wholesale price index approach to modifying the prices of different products into the price index. In order to test our main hypothesis, we use dynamic causality effect models as a theoretical background. We will construct several models, considering various aspects of the data. To quantify the events of terror that will be an explanatory variable, we use a number of casualties in such attacks. We provide more details on the data source and technical considerations in the Data and Methodology chapters.

4.2.2 Weapon price return

As we have stated above, in this paper we look at multiple non-homogeneous products that are for sale in the DNMs. To unify the market listings, we use the wholesale price index (WPI) as a tool. We construct returns in the following form:

∀Itemi ∈ data (4.1)

Pt+1 Return(Itemi)t+1 = , (4.2) Pt where Pt is the price at time t. then for every existing date in our dataset we aggregate the returns and average them:

Pt+1 ∈j X P Return = t (4.3) datej NumOfDeals

In our example, the WPI is constructed out of all the different types of weapons and ammunition measured through changes in the prices on a daily level. We will refer to this variable as weapon price return. Next step is to define what does affect the activity on the DNMs. We have already stated in the secondary hypothesis section, that the changes in fiat exchange rates are linked to additional transaction costs for the sellers and buyers. This is because the users eventually will have to exchange the Bitcoin in fiat currencies. We used an OLS regression: the weapon price return on the left-hand side, being the dependent variable; while on the right-hand side we have different exchange rates and precious metal commodities prices. The latter ones we use as control variables for speculative Theory 38 nature of the Bitcoin.

Returns ∼ β0 +β1Exchange1 +....+βiExchangei +β21Metal1 +...+β23Metal3 + (4.4)

Where is the error term. As stated earlier there are few reasons we are interested in this regression. Firstly, a significant effect of the different exchange rates over the return will indicate that this is a viable global market, and not just a local phenomenon or an inactive market. Secondly, we would like to take the residuals from this regression and use them as a dependent variable which we regress over ”the number of casualties in terror attacks” as an independent variable. Another motivation to use this approach comes from the fact that Bitcoin is a very volatile currency, consequently, by removing exchange rates effect, we can control for some of this volatility when we come to estimate our model. We will provide more insight into this approach in the next section.

4.2.3 Dynamic causality eﬀect

To test our main hypothesis we set up a model that is based on the dynamic casual effect theory described in Stock and Watson(2003). Following the example from Stock and Watson(2003), authors analyse what effect does the ”number of freeze days” in Florida has on the price of orange juice concentrate with lags of 1 to T months. The freeze days are exogenous shocks to the price of orange juice concentrate. The number of freeze days that happen in month ”t” will have an effect on the price in the following months: ”t” ”t+1”... ”t+n”.. In our case ”number of casualties” in terror attacks and mass shootings is functioning as the freeze days from the example. The analogue for the dependent variable, orange concentrate price, will be four different variables. We build separate models for each of the following: ”the number of market listings per day”, ”aggregated USD value of market listings per day”, ”average Bitcoin return per day adjusted for exchange rates effects” and ”the number of new market listings”. We apply a particular methodology for every model due to unique assumptions and nature of the dependent variable. To summarise, we use a unified approach to testing the main hypothesis from different perspectives. We look at several dependent variables and run a regression on the ”number of casualties from terror attacks” on specific days with lags of Theory 39

”t+n” as follows:

Yt ∼ β0 + β1(Xt) + β2(Xt−1)... + βn(Xt−n) + t (4.5) while E(t) = 0 is an error term We now will specify each sub-model, elaborate on the properties and explain the reasoning of each regression.

4.2.3.1 Diﬀerence in number of market listing per day

In this regression, we assume that if the number of casualties in terror attacks has an eﬀect on the supply and demand of the illegal weapons market, it should show up in the number of listings which exist in the market for a given day. In other words, we expect the supply will be aﬀected by the exogenous shock. The following regression is introduced:

(NumListingt − NumListingt−1) ∼ β0 + β1(Xt) + β2(Xt−1)... + βn(Xt−n) + t (4.6)

The main weakness of this approach is that possibly even if there exist an effect of our dependent variable, we will not be able to observe this due to an offsetting effect of the demand and supply. If sellers put more offers in the market and buyers, buy more at the same day reacting to the same shock, the number of offers we observe in the market will stay the same and we will not be able to observe the underlying change in the supply and demand. This leads us to the following sub-model.

4.2.3.2 Diﬀerence in aggregated USD value of market listing per day

By introduction of this model, we try to overcome the main issue of the previous one. Due to the possibility of the offsetting effect on the number of listings which are active on the market every day, we choose to analyse the change in aggregated USD value of these offers. Although offsetting issue could still be present, we might observe a change in prices of offered products on the market. In other words, the aggregated USD value of money in the market will adjust upwards or downwards reacting to the shock. The regression will Theory 40 be as follows:

(V alueOfListingt−V alueOfListingt−1) ∼ β0+β1(Xt)+β2(Xt−1)...+βn(Xt−n)+t (4.7)

Even though the offsetting problem seems not that important for this model, it still has some considerations that should be taken into account when interpreting the result of this regression. We have to consider the fact that the DN weapon market offers dissimilar products. The following example illustrates this issue in details. Assume two offers are active in the market, more specific, two assault rifles, which is an expensive product. Next day, reacting to the shock sellers adjust prices of these rifles upwards and therefore increasing the aggregated USD value of the market listings. One of the weapons is sold, and a new listing opens. This time it is only weapon ammunition, that is much cheaper than the rifle listing. Consequently, the USD sum for the next day is lower, despite the increase in the price of the existing product. Based on this example we conclude that such instances of non-identical items dynamic can distort the actual effect of the seller’s reaction to the external shocks. Nevertheless, this model illustrates the dynamic of the online weapon market, but we would like to analyse if there is an effect on the price or volume of the specific products. Ii is important to note, that even two exact same guns can be offered as products of different price category. This is possible due to the difference in history and quality of the item. In some cases the gun is described as ”clean”, meaning that it was never used and there are no criminal records related to this weapon. This automatically allows the seller to put price up. As a result of such detalisation, it is almost impossible to group the products in comparable categories for the analysis. To overcome this issue, we will use the approach of the WPI that was described in our first model.

4.2.3.3 Average Bitcoin return per day adjusted for exchange rates eﬀects

In the first section of this chapter, we introduced weapon price return model (WPR), that was based on the using WPI, to test activity in the market. We can use this model to overcome the issue in the model where we look at the aggregated USD value of the market listings. WPI is a tool that solves the problem of non-identical items in the data sample and constructs the price index out prices of diverse products. In order to have Theory 41 a clean Bitcoin effect without other exchange rates effects, we take the residuals from the WPR model. Next, we average the residuals per day and regress them on the terror attacks events measured by a number of causalities. The sub-model regression is as follows:

(Residualst) ∼ β0 + β1(Xt) + β2(Xt−1)... + βn(Xt−n) + t (4.8)

This model is robust. However, it will detect only a change in the price. This could be an issue in case if there was an increase in the volume of listings but no change in the price we will not observe it with this regression. Therefore, we introduce our last sub-model.

4.2.3.4 Number of new market listings per day

The purpose of this model is to measure the changes mainly in supply caused by the terror attacks. There are few advantages in this model. Firstly, we will not have the problem of offsetting results as only new opened offers are taken into account. Secondly, even if prices do not change but more vendors appear on the market, or more products are in supply, we will observe it. Another advantage of this approach is the fact that not only the supply side is analysed, but also the demand. Due to the nature of our data and culture in the DNMs, many of the listings appear to be ”custom listings” that are created as a direct respond to a specific demand. We will explain this fact in more details in the data description chapter. This sub-model has a more complex structure than preceding ones, due to the nature of the dependent variable. This is a non-negative variable, unlike the models with where the differences in the listings, aggregated values and returns could be negative. Moreover, this is a pace variable that measures the pace of new deals coming into the market. Therefore, we assume it to have a Poisson distribution and run a Poisson GLM regression. The Poisson distribution has the following form:

YNewListingsP erDay ∼ P oisson(λ) (4.9) λk p(k listings in a day) = e−λ (4.10) k! We use the deﬁnition provided by Choirat et al.(2017a), which is the Poisson regression built in the Zelig package in R, to construct the model that will serve the needs of our research. We deﬁne Xit as the number of casualties in terror attacks per day and Xit−n Theory 42 its n lag. Therefore, the regression will be as follows:

β0+β1(xi )+...+βnxi λi = e t t−n (4.11)

We look at what should be the expected value of our dependent variables given certain shocks. The drawbacks of this model are the assumption of a more complex distribution structure, together with a bias in the number of new openings due to an entry of new markets into the data collection. Even though given the data type this seems reasonable to assume.

4.3 Assumptions

We describe all the assumptions that we use for the models. We discuss the reasons behind the assumptions and show that they can exist together. Most of the assumption are ﬂexible and are validated by parts of our method and model set up. We will describe what happens in case if some of the assumptions are released in the Discussion chapter.

Assumption 1. DNMs do exist and the trade is real. This assumption is the base one for our research. To ensure that we can release this assumption we use the weapon price return (WPR) model where we analyse the signiﬁcance of the market and its interdependencies with ﬁat currency basket.

Assumption 2. The data is a representative sample We need to assume that the data of market listings that we use for the research is a good representation of the market activity. Given the fact that DNMs are difficult to access due to various layers of encryption as discussed in the Chapter 2, it is difficult to collect the data without any errors. The dataset contains around 26 thousand market listings that were collected across two years for the 27 markets that were active in different time. We can consider the dataset being a good representation of the all online DNM for weapons trade and therefore this assumption is not a crucial one for the research.

Assumption 3. Variables distribution For the most of our dependent variables, we assume normality. In Methodology Data description 43

chapter, we provide the reasoning behind each speciﬁc distribution and the basis for normality of the variables.

Assumption 4. The media coverage of the terror attacks is exhaustive In order to assume that there is a reaction of the market activity, in case of a terror attack, we need to assume that the knowledge about the event will reach to the participants in the market and other people who can potentially increase the demand. As discussed in the Literature review chapter, in order to justify this assumption, we take only events which happened in the western world. In this region that includes the USA and western Europe, free media and high coverage of violent events is widely spread. We avoid terror attacks in places such as the Middle East, third world countries and Russia, where such occasions are more common and usually not well covered in the media.

Assumption 5. Non-strict exogeneity of independent variable The non-strict exogeneity means that the number of casualties in terror attacks in the past and today is not correlated with the error term. meaning:

E(ut|Xt,Xt−1...Xt − n) = 0 (4.12)

where ut is the error term This assumption is essential, releasing it will mean that a terror attack today or in the past is somehow correlated with the supply of weapons we see in the market and not through the act itself. We will further discuss why this might be violated and why it is unlikely. On the other hand, we can not assume a strict exogeneity, As we mentioned in the Introduction, some of the terrorists have used weapons bought in the DNMs. Therefore, mass shooting in the future might be dependent on other variables that eﬀect gun supply in the past.

E(uT |Xt+n,Xt1 ,Xt,Xt−1...Xt − n) 6= 0 (4.13)

But this fact does not limit this research as we study only the past casualty effects.(Stock and Watson, 2003) Chapter 5

Data description

Once we have models in place to test the hypotheses, we can start with the data description. We begin with the general data considerations and then go to more detailed level for both the dependent and the explanatory variables. Each regression has a different explanatory variable. We define specific features of each of them. As the explanatory variable is the same for all of the dynamic causal effect models, we do not separate the description for each model. Firstly, we introduce the sources of the relevant datasets. Secondly, we describe the methods of data collection. Thirdly, we follow the process of data preparation and finally, discuss the quality considerations.

5.1 Data set composition

5.1.1 General considerations for the data

The models defined in the previous chapter require several datasets. The first set is the data for the dependent variable, that represents supply of the weapons on cryptomarkets. It should contain market listings with the details such as the price, unique ID, product name, detailed description, shipping details and the country of origin. The second set of data is required for the explanatory variable in the dynamic causal effect models. It acts as an exogenous shock to DN weapon market activities. In our research, it is represented by the number of casualties per day from terror attacks and mass shootings. According to our Assumption 4 that we set in the Theory chapter, we include the events

44 Data description 45 that are well covered by the media. Therefore we include terror attacks only from the United States of America and western Europe. The third dataset that serves as an explanatory variable in the WPR model, is the basket of exchange rates of Bitcoin to most traded ﬁat currencies. We provide detailed description for all of these three dataset compositions below.

5.2 Dependent variable Y. Market listings.

5.2.1 Data source

The dataset for the dependent variable for the dynamic casualty effect model contains market listings for the major cryptomarkets. This set is public and available on the website of an independent researcher Gwern Branwen https://www.gwern.net/index, who is also a writer. He is known for his research in is the DNMs & Bitcoin, blinded self-experiments & Quantified Self analyses, dual n-back & spaced repetition, and modafinil (Gwern Branwen, 2015). Branwen describes himself as follows: I am a freelance writer & researcher. I have worked for or published in Wired, MIRI3 (formerly SIAI), CFAR, A Global Village, Cool Tools, Quantimodo, New World Encyclo- pedia, Bitcoin Weekly, Mobify, Bellroy, Dominic Frisby, and private clients; everything on gwern.net should be considered my own viewpoint or writing unless otherwise specified by a representative or publication. (Gwern Branwen, 2015). For the purpose of the research, we used the data from the Grams (subreddit) archives. These archives contain all market listing that were active on cryptomarkets in the period between 09/06/2014 and 17/04/2016. The market listings were scraped from the Dark Net and stored in CSV format, organised by cryptomarket name that are grouped by days in the archive(Gwern Branwen, 2015). The dataset stores as near-daily CSV files for the different active markets. In addition to the above exported market listings, Grams archives contain other datasets:

• Aldridge and D´ecary-H´etu(2014) crawler results for the Silk Road sales in 2013;

• Christin(2013) dataset scraped from Silk Road 2 platform. Data description 46

The dataset covers 27 platforms, which were functioning during the diﬀerent period of times that are presented in the Table 5.1. Some of those market listings are spread across several years, such as Agora and Alphabay for instance, others were closed down during the period of the data collection. Cryopthomarkets that are covered in the dataset:

Market List Archive1 Archive2 Dates:09/06/2014 - Dates:14/07/2015 - index 12/07/2015 17/04/2016 1 Abraxas Abraxas 2 Agora Agora 3 AlphaBay AlphaBay 4 Middle Earth Middle Earth 5 Oxygen Oxygen 6 Silkkitie Silkkitie 7 1776 Dream Market 8 ADM Hansa 9 Alpaca Nucleus 10 BlackBank Oasis 11 Bungee54 RealDeal 12 Cloud9 Tochka 13 Evolution Valhalla 14 Haven 15 NK 16 Outlaw 17 Pandora 18 Silk Road 2 19 TOM 20 TPM

Table 5.1: DNMs that are present in the dataset

5.2.2 The crawler

One of the main questions regarding the market listings data is the completeness. There is no certain way to provide full completeness of the dataset. Nevertheless, several measures were undertaken by the Branwen in order to cover the most of the active cryptomarkets. Data description 47

To check if there are new markets opened, Gwern Branwen browsed the forums such Red- dit or The Hub. This allowed him to acquire knowledge on the emerging markets, added a scraper for the new market. Figure 5.1 below is a screenshot of one of the cryptomarkets that are part of the dataset. Alphabay is a big market that contains not only drugs, but also guns, and other illicit products. The data structure that is used as an input for the model is described based on this example.

Figure 5.1: DNM listing example. Source: Alphabay

The following information was fetched by the crawler:

1 Vendor name. As we have mentioned in the literature overview, the cryptomarkets seem to be a marketplace for gun dealers, not just a random trader who wants to sell one item. First of all, to deserve an acceptable rating on the market, it will take time and effort. The rating system is a market mechanism that provides a perception of a product quality and provides an understanding whether the vendor could be fraudulent. It will be very difficult for a one-sale vendor to finalise a deal without any trading history. One should note, that on different platforms it is possible to see the history of sales by the vendor, the total number of sold item since the date of the vendor registration. During analysis of the platforms, we have identified some vendors stating unlimited supply or sometimes described as weapon stores. Data description 48

2 Product name. The name of the product that is usually short and precise. Vendors state name, size and any other relevant important information.

3 Bitcoin price per item. On the most of the trading platforms, vendors have to set a price for the product in USD or in rare cases in other currencies. Then the cryptomarket converts the stated value in Bitcoin following the algorithm that is applicable for the speciﬁc website. It is diﬃcult to check what are the algorithms for Bitcoin equivalent calculation on each of the 27 DNMs, especially due to some of the markets had been closed down. We have Bitcoin value in our dataset for each market listing.

4 USD price. As we have mentioned above, the vendors usually state the price in USD that s automatically converted to Bitcoin. As we do not have USD price of the products in our data, we calculate it using the exchange rate per day. The exchange rate was taken from the Coindesk.com website.

5 Description part. In this section, vendors state all the details that are necessary to know for a customer in order to make a decision. In some websites, there are administrators, who look after the descriptions to be informative, trustworthy and sometimes should be according to some templates. They also check that the description is understandable and does not contain too much slang. Usually, vendors disclose such information as if the weapon has a serial number, includes bullets or not, was used before or is it a brand new gun.

6 Features. Under features, vendors deﬁne the shipping details. In some markets, Alphabay is one of the examples, worldwide shipping could be stated, but in the details mentioned if they cannot ship it to some speciﬁc country or region. Many listings state Worldwide in the dataset, that doesnt add value for our research.

The date of the listing will be the when the crawler copied the data from the market. Basically, the crawler was active every day, collecting all the information described above from active markets that were identified by Branwen. Every listing has a unique hash that serves an identification for the listing. In case if the offered product was in the market Data description 49 for a week, we will see seven line items for the same hash, that will represent information related to that product. After the listing is closed, the hash will not appear again in the dataset. The data includes all types of products that were offered on cryptomarkets for that time of the search. This gives us many irrelevant for our research data points. Hence we have to clean the dataset that will be the best input to test our hypothesis that we have set in the Theory chapter. We will perform the manipulations with the data in next section.

5.2.3 Data preparation for the model

The archives contain around 20 million data points for all the illicit deals that were scraped from the cryptomarkets for approximately two years. Our first step is to extract the relevant listings for our research. We need only gun market listings and all the relevant information. To extract only the necessary items we used Python programming language. The script is presented in Appendix A.2. We have created a key words list and filtered only the items that contained these words in the product name. For example, these words were used as the filtering instrument: pistol,Beretta, Baretta, colt, smith, wesson, vz.50, wildey, zastava, remington, kel-tec, ruger, walther, Kalashnikov, AK-74, AK-47, Nesterov. The full list could be found in the code in Appendix. The Second step was to dispose of false positive results of the search, that were selected due to the word match but do not relate to weapons. We performed a manual filtering in excel. We looked through the results and based on the description, the product name, deleted not relevant observations.It is important to note that most of the DNMs there is a fee for opening a new listing, therefore vendors keep the listing opened when they go to vacation, or do not have product in stock but at the same time adjust the price to very high number, say 1,000 Bitcoin. This is a signal to the users and will distor our data. Therefore we excluded such items. While analysing the remainder data points, we have identified a number of vendors as gun dealers. Such a conclusion was made based on several factors: number of different listing on the markets per vendor, profile description on the cryptomarkets. The vendors which were mainly selling weapons had more deals under their profiles in active markets, such as Alphabay, than we were observing in our dataset. Moreover, we have identified that some of the listings did not include the specific names of the weapons but instead stating Data description 50 custom listing in the product name. We have checked several examples of such listing for the gun dealer type of vendors and ensured that those are weapon related offers. Vendors attach the pictures to show that the product is available and in good shape. One of such examples is displayed on Figure 5.2:

Figure 5.2: DNM custom listing example. Source: Alphabay

Taking into account that the weapon name is not mentioned in the product name, our initial search did not catch such offers. In order to eliminate such gaps in our data, we have created a new key word that contain vendor names which were defined as major weapon dealers. The code is presented in Appendix A.3. After receiving the results of the python script, we repeated the procedure for elimination of false positives in the additional dataset. Additionally, we ensured that there are no duplicate listings when we unite both search results into one dataset. We also kept in mind that some of the duplicates appeared due to the fact that several data sources were compiled in the archives. We ensured that we cleaned such observations from our listings sample. The third step, after the relevant data is ready, was to translate Bitcoin prices into USD values. As we have mentioned in the previous section, different markets can apply different Data description 51 algorithms for currency translation. We chose a unified approach and used daily exchange rates from Coindesk.comto convert the Bitcoin into the USD equivalent. The price of USD can be adjusted by the vendor. Hence the volatility in the price is not only due to exchange rates but also due to other factors. During the analysis of the USD prices, we have found some enormous changes in price for the same ID number. Some of these changes were around 1,000 USD, while the initial price was 2,000 USD. The reason behind is that vendor can keep the listing opened but change the offered product, therefore the hash in the dataset will be the same. We eliminated such instances from our observations by assigning new individual hash for every product with such a problem. Therefore, the changes that remained were due to adjustments from the vendor side or because of currency fluctuations. As we have defined in the Theory, the model contains different Y variables. We provide more guidance in the Methodology chapter on overcoming some of the quality issues in the dataset. In most of the models, we use whole dataset arranged in time series by means of grouping observations by the date. That applies for both dynamic causality models where we test the number of market listing per day and their aggregated USD value. It is important to note, that the new listings contain a lot of zero values, as the offers do not appear very often. It might be because of an additional associated with the opening of a new listing. This variable is a time series count variable that measures a pace of new offers coming into the market. We will provide more details on that in the next chapter. The last two Y variables are interconnected. Weapon price return model uses the dataset not in the form of the time series and the reasoning will be provided in the Methodology. While the last model uses the adjusted to exchange rates and precious metals exchange rates, transformed to the time series as a dependent variable. We will provide further details and explain the reasoning in the next chapter.

5.2.4 Market listings data quality considerations

The data that we receive after all the filters and corrections, still has some flaws. It is important to remember that spider scripts are usually subject to errors. It is difficult to build an error-free script that will fit all the markets with a different setup, layouts and other details on the webpages. This issue is even more crucial due to cryptomarkets containing many specific technical features, which provide anonymity to users and prevent tracking of IP addresses. Gwern Branwen states on his website: No matter how much work one puts Data description 52 into it, one will never get an exact snapshot of a market at a particular instant: listings will go up or down as one crawls, vendors will be banned and their entire profile & listings & all feedback vanish instantly, Tor connection errors will cause a nontrivial % of page requests to fail, the site itself will go down (Agora especially), and Internet connections are imperfect.(Gwern Branwen, 2015) There are several other obstacles involving the crawler: the user login could expire, ban by site administrators, market closures. We have to remember that the data is not available for every day. There are some gaps, due to internet breaks or some other errors that took time for a researcher to find. For example, the period from 09/01/2015 to 21/02/2015 is not covered due to a technical issue that was eventually resolved. These data flaws are random. Based on this fact we will apply an imputation approach of the random values that will be described in details in the Methodology chapter.

5.3 Explanatory X variables

5.3.1 Exchange rates and precious metals data

In order to run one of our models, specifically the weapon price return model, we needed the Bitcoin exchange rate to other fiat currencies. There is no good historical data for that, but we can get the data for USD/Bitcoin exchange rates for the required period. We used Werner(2007) service to extract the exchange rate to USD of different currencies and values of the three precious metals. We convert the extracted data to Bitcoin using the USD/Bitcoin exchange rate that wee get from Coindesk(CoinDesk, 2016). Considerations in choosing currencies We took the top ten most traded currencies as defined in (Werner, 2007) and three precious metals: gold, silver and platinum. As we mentioned in Theory, we added metals in order to control for Bitcoin speculative nature. Additionally, we then included some currencies which we believed can give us more information about the market. We defined three currencies that could add value to the model. We have selected three top South American currencies: Brazilian real,Peruvian sol and Venezuelan bolivar. The reason for that is high crime rate in South America which involves illegal use of weapons. Furthermore, we added few European currencies which might be a source for smuggling weapons into the EU and also important to understand the trading activity in the continent: Russian rouble, Serbian dinar and Swedish Krona. We also added the South African rand, due to Data description 53 the large number of illegal small arms weapons held in the country as stated in the paper of Snodgrass(2015). We should note, that using fiat exchange rates are traded during only business days. While Bitcoin is changing everyday, and the trade in the DNM is continuous. To overcome this problem, for the non-business days we used the exchange rate of the last business day before the weekend or holiday.

5.3.2 Number of casualties from terror attacks and mass shootings

For all dynamic causality models we want to analyse the reaction of the DNM activity to the non-strict exogenous shocks. As we define in Theory, the terror attack and mass shootings could be considered as such shocks. To quantify the event and to measure the importance (amplitude) of the event we take a number of dead and injured people from these attacks. As we have mentioned in the Literature overview and later in Assumption 4 in Theory acts of terror in the western media are well covered, especially if the attack took place in the western world. Based on this we build out dataset of casualties for western Europe and United Stated of America. The data is presented in Appendix A.4. Data source for US region We used http://www.shootingtracker.com/ as a source for the US number of casualties. ShootingTracker defines mass shooting according to the method used by FBI as four or more murders that occur during the same incident, with no distinctive period between the murders. These events typically involved a single location, where the killer murdered a number of victims in an ongoing incident(Morton and Hilts, 2008). The observations are numerical and reflect all shootings which reach the threshold of 4 people, excluding the shooterShootingTracker. The number of dead and injured people is presented separately in the data source. We summarise the casualties and use it as the main explanatory variable in the next chapters. Data source for western Europe To get the number of casualties for the region of western Europe we use Global Terrorism Database (GTD) (GTD). GTB uses the similar definition of the terrorism to one used in the US database: a terrorist attack as the threatened or actual use of illegal force and violence by a nonstate actor to attain a political, economic, religious, or social goal through fear, coercion, or intimidation (GTD, 2012). The criteria for inclusion in the database for an event should be satisfied at the same time (GTD, 2012): Methodology 54

Criteria 1 The incident must be intentional the result of a conscious calculation on the part of a perpetrator.

Criteria 2 The incident must entail some level of violence or immediate threat of violence including property violence, as well as violence against people.

Criteria 3 The perpetrators of the incidents must be subnational actors. The database does not include acts of state terrorism.

We generated a report for the western Europe number of casualties in terror attacks and selected the relevant for our research period. GTD does not include data for 2016. Therefore, we used another source that is covers mass shootings events for 2016 with detalisation on the number of deaths and injured people during an event. In this source the methodology that is used for the US data source is applied: Our tally will follow the example of the Gun Violence Archive, labelling any shooting in which four or more people are killed or injured, excluding the perpetrator(s), a mass shooting (VICE, 2016). While skimming through events, we chose only relevant once based on geography. The only period that is left uncovered in 2016 was 4.5 months, we needed to include the events up to 17/04/2016 as this date is the last one for the market listings. Overall, there were not that many western European countries that got into the dataset. Only six countries had terror attacks in the period covered by our research:

As a result of combining all three datasets, we compiled the base of casualties for the period from 09/06/2014 to 17/04/2016. Now we go to Methodology where we will provide solutions for the data quality, set up regressions and deﬁne approaches in order to test the research questions. Chapter 6

Methodology

In this chapter, we ﬁrst handle the missing observations in the dataset and then outline speciﬁc considerations for the models such as regression type, data transformation that was applied and other methods used.

6.1 Imputation and handling missing data

As we have stated in the Data quality considerations section in the previous chapter, the crawler the data has many missing data points due to errors in the crawler work. The continuity of data is important for a proper estimation of the dynamic causal eﬀect models, which we use to test the main hypothesis and the details are described in the Theory chapter. To overcome the problem with the absent data, we use Amelia package in R (Honaker et al., 2011). As we have assumed the random nature of the missing values, we can apply the imputation process. Furthermore, Amelia package assumes normality of the variables that will be imputed. This assumption seems reasonable and can be applied to some of the variable we use in the research, as will be illustrated in the graphs later in this section. Pleasse also refer to Appendix A.5 for an example of other ﬁgures which are produced through Amelia package to validate the imputation correctness of the data. In some individual cases, we had to perform the data transformation to use Amelia package. We provide more detailed description of variables transformation below.

55 Methodology 56

A good illustration of the imputation process is presented by Honaker et al.(2011):

Figure 6.1: Graphical explanation of the imputation process and its analysis

As illustrated on the Figure 6.1, the first step is to insert the incomplete data and start the bootstrapping process. As a result, the bootstrapped datasets are then going through an EM algorithm1. The output is then used by Amelia package to impute the data. The figure also illustrates the steps of the analysis. To perform this analysis, we use the Zelig package (Choirat et al., 2017b). It takes each imputed dataset and runs the model that is defined beforehand. Then Zelig combines the different results into a final dataset(Imai et al., 2008). Please refer to the Appendix A.5 for an example of the code used to run the different Zelig regressions. The following equations are used to extract the desired estimated variable, which in our case are the coefficients and corresponding standard deviation. This will follow the defini- tions and description in Honaker et al.(2011) that we provide also in the Analysis chapter:

1Expected maximum likelihood - the program estimates unique mean and variance of the distribution from which the bootstrapped data came from. Methodology 57

First, let us deﬁne m as the number of imputation and q as the estimated variable in question.

m 1 X q¯ = q (6.1) m j j=1 Thereforeq ¯ is our desired estimator from combining those imputed datasets. The variance of q is estimated from both within and between the imputed datasets and is represented by the following equations:

2 SE(qj) = V ar(qj) (6.2)

m X num(qj − q¯)) S2 = (6.3) q (m − 1) j=1 The ﬁrst term is the ”within” variance and the second is the ”between”, together with 1 an added error term (which is decreasing in the number of imputations) results in the m following: m 1 X 1 SE(q)2 = SE(q )2 + S2(1 + ) (6.4) m j q m j=1 Once we got all the datasets without missing values, we can now move to implementation of the models that we use in this research. We will specify the methods used over the following section

6.2 Models implementation

6.2.1 Weapon price return

We introduced the WPR model in the Theory chapter. Unlike the other models, we did not use imputation technique. We took the log of spot return of a speciﬁc deal as Y variable, then regressed it over the log of spot exchange rate 2. The reason to take both variables in log, is that both of them are deﬁned as rate. The dependent variable is the rate of return and the explanatory one is an exchange rate.

2As returns can be negative and therefore log will produce undeﬁned values, we use log plus one transformation to avoid this issue Methodology 58

Therefore, the log transformation will give the percentage diﬀerence(Wooldridge, 2009). We the ran a simple OLS regression using the ”lm” function in R.3 In order to comply for a case of heteroscedasticity, we run the regression using HAC standard errors.

6.2.2 Diﬀerence in number of market listing per day

We start with an imputation of the missing data for the dependent variable for this model. As stated in Honaker et al.(2011), five imputations is a sufficient number of datasets that provides good quality results. According to this guidance, we prepared five imputed datasets from the original data. The imputation in this case was done in a non-standard way. In order to get a more accurate result, we used a Bayesian 4 approach for the imputation. This unique method gives us robustness due to the imputed data will not drift too far off the real values. We used information from adjacent data points to limit the range of mean and variance for the missing observations. The more data cells were missing in a sequence, the more we increased the gap between the min-mean and max-mean. We used the same approach for variance The imputed values seem to have a reasonable distribution for the future analysis:

3This is a function that runs a simple linear OLS regression where βˆ = (XT X)−1XT y. 4Using Bayesian approach one assumes a random variable prior distribution, which in our case is normal deﬁned by Amelia package. After some evidence was revealed one estimates a posterior probability. Methodology 59

Figure 6.2: Distribution of imputed number of market listings dataset and original dataset

As illustrated on the Figure 6.2, the distribution ﬁts well on the tails and grows larger around the mode. The reason behind is that we have many missing observations that are surrounded by the similar values. Therefore imputation mechanism produces many data points that fall into the same numeric range. After the imputation of the data, we rounded the numbers of the imputed cells, in order to align it with the discrete nature of the variable5. Finally, we run an OLS regression on the ﬁnal dataset, using the Zelig package (Imai et al., 2008) and (Choirat et al., 2017b).

6.2.3 Diﬀerence in aggregated USD value of market listing per day

For this model, the ﬁrst thing we needed to do is to aggregate the daily value of deals for every given day. Secondly, the dataset contains only prices in Bitcoin, but users’ reference price is usually USD as we discussed in the Data chapter, we calculate the USD value in order to account for ﬂuctuations in the exchange rate. Thirdly, we perform imputation

5The rounding was done using excel, if the imputed data was ≤ 0.5 we rounded down, otherwise up Methodology 60 process for the aggregated USD value market listings data. In this case, we used the Amelia package initial assumptions (Honaker et al., 2011). The results of the imputation are presented on the Figure 6.3:

Figure 6.3: Distribution of imputed aggregated USD value of market listings dataset and original dataset

As the dataset created by Amelia package fits the original data, and additionally we increased the number of imputed datasets from five to 206, we do not need to use the Bayesian approach in this case. Fourthly, we performed an additional transformation. Since aggregated USD value of market listings is a positive continuous variable, the gamma distribution could be a better fit for the variable. To measure this, we use the Akaike information criterion (AIC) of a gamma model and a normal model. The normal model scored lower AIC in all 20 imputed datasets, which implies a better fit for the data. Fifthly, as the variable contains only positive data points, we standardise it in order to

6Since variance robustness for imputed data is not as intuitive as one might think, we decided to increase the number of imputed datasets in order to get robust errors. Methodology 61 move the mean back to the zero 7 As the last step, we use the Zelig package(Choirat et al., 2017b) to run the OLS regression which was described in the Theory chapter.

6.2.3.1 Average Bitcoin return per day adjusted for exchange rates eﬀects

For this model, we need to remember that the residuals from the WPR regression come in the form of the unbalanced panel data and not as a time series. This is due to we look at the returns from different listings across the same day and not an average return per day.8 Our next step is to collect the residuals by date, and average based on the number of the residuals per day. As a result, we get a time series with missing observations. Similar to the method we used in previous models, we fill the missing data with the help of the Amelia package. We plot the resulting distribution to illustrate the fit of the imputed data to the original one:

X − µ 7We took observation X in terms of value and got the ﬂowing transformation: X˜ = mean σSE 8This approach had few reasons: 1 It saves us from the need to impute random returns; 2 It increases our dataset and we do not lose information due to averaging the return on the daily basis; 3 Fiat currencies exchange rates do not change during weekends. However, the trade and consequently returns in the DNM do exist and hence, we would not be able to see any diﬀerence in Exchange rates during the weekends, and it could distort our results. Methodology 62

Figure 6.4: Distribution of imputed average Bitcoin return per day adjusted for exchange rates eﬀects

After ﬁnalising imputation, we follow the approach described in the Theory chapter and run OLS regression again using the Zelig package for imputed data(Imai et al., 2008).

6.2.3.2 Number of new market listings per day

Finally, we describe methods that we used for the model where the dependent variable is the number of new market listings. As this variable has a more complicated nature that was discussed in the Theory chapter, it demands some adjustments for prior the implementation. We need to perform imputation again to get a continuous variable, due to we still have missing observations in the dataset. As we stated many times, Amelia package that is used for the imputation is based on the normality of the data assumption (Honaker et al., 2011). The normalisation of the dataset will not help in this case, as this time the mode is close to zero due to the number of new deals is usually low, or for many days is zero. To Methodology 63 overcome this issue, we use a square root transformation which ﬁt the data well 9. Honaker et al.(2011) deﬁnes in the paper: ” count data is often heavily skewed and has nonlinear relationships with other variables. One common transformation to tailor the linear model to count data is to take the square roots of the counts. This is a transformation that can be set as an option in Amelia”. When imputing using the square root transformation, we get the following distributions:

Figure 6.5: Distribution of imputed number of new market listings dataset and original dataset

Now as it can be seen in the Figure 6.5 the outcome is not perfectly accurate. When applying the square root transformation we get a continues variable, unlike our original data which is natural numbers, This seems to shift the mode and therefore the density to the right. Consequently, in all imputation datasets we round down the numbers to the closest inte- ger10. By doing it, we shift the density of imputed numbers closer to our observed data

9Being an event count of the new deals coming in 10(We need to round it anyway since our variable is of a discrete none negative form, and instead of rounding up and down we round only down) Analysis 64 density as can be seen in Figure3.6

Figure 6.6: Rounded down distribution of imputed number of new market listings dataset and original dataset

After this adjustment of the imputed data, it ﬁts best, and we can use the resulted dataset as an input variable for the Posisson regression that we described in details in Theory. Chapter 7

Analysis

In the analysis, we show the results from the different models that we execute. We then explain the main outcome and discuss most significant findings. We also note some limitations, leaving those for a discussion in more details in the next chapter.

7.1 Weapon price return

The results of our regression of the weapon price return over 17 currencies and precious metals are presented in Table 7.1 and continue in Table 7.2:

From the tables, it is evident that the model R2 is very low, which means very little variance between the returns. Due to the high number of observations and degrees of freedom, we can still spot significant coefficients, although we do not capture much of the variance. This model is not predictive, which is satisfactory for us, as we do not expect the return being explained by the exchange rates fluctuations entirely. This means that the that even though exchange rates are significant, they are not the main factor driving the sales on the weapon market. For the regression code, please refer to Appendix A.6.

7.1.1 Currencies signiﬁcance speciﬁcation

When looking at the currencies and metals which are significant, we first note that both silver and gold are significant. We used the metals as control variables, due to the high 65 Analysis 66

Table 7.1: Output of the weapon price return model

Dependent variable: rate.of.change USD 1.630∗∗ (0.811)

Gold 0.624∗∗∗ (0.208)

Silver −0.107∗∗∗ (0.034)

Platinum 0.168 (0.138)

Canadian Dollar 0.329∗∗∗ (0.090)

Euro −0.018 (0.183)

Japanese Yen −0.067 (0.051)

Great British Pound 0.160∗ (0.084)

Swiss Franc 0.109∗ (0.058)

Australian Dollar −0.331∗∗∗ (0.074)

Hong Kong Dollar −2.093∗∗ (0.839)

New Zealand Dollar 0.074 (0.051)

Observations 25,753 R2 0.007 Adjusted R2 0.006 Residual Std. Error 0.101 (df = 25731) F Statistic 8.235∗∗∗ (df = 21; 25731) Note: ∗p<0.1; ∗∗p<0.05; ∗∗∗p<0.01 Analysis 67

Table 7.2: Output of the weapon price return model (continued)

Dependent variable: rate.of.change Korean Won 0.220∗∗∗ (0.068)

Mexican Peso 0.205∗∗∗ (0.065)

Brazilian Real −0.275∗∗∗ (0.038)

Peruvian Sol −0.139∗ (0.079)

Russian Ruble −0.004 (0.021)

Serbian Dinar 0.035 (0.170)

South African Rand 0.116∗∗ (0.047)

Swedish Krona −0.062 (0.097)

Venezuelan Bolivar −0.018∗ (0.011)

Constant 3.618∗ (1.907)

Observations 25,753 R2 0.007 Adjusted R2 0.006 Residual Std. Error 0.101 (df = 25731) F Statistic 8.235∗∗∗ (df = 21; 25731) Note: ∗p<0.1; ∗∗p<0.05; ∗∗∗p<0.01 Analysis 68 speculative nature of both expensive metals and bitcoin as we stated in Chapter 3. As these variables came significant, it indicates that speculation has an effect on the returns in the DNM for weapons. As we stated in Theory in the secondary hypothesis, we would like to see if the DNM is a global and viable market. We agreed to use the different exchange rates as a proxy for the market viability. In table 7.1 many currencies appeared to be significant, some more than others.We expected currencies such as USD, UK pound and euro to be significant. Surprisingly, euro does not appear as a significant variable. It is hard to conclude what are the reasons for the significance. Nevertheless, we provide some possible explanations for this results:

South American Currencies We can see the South American currencies are consistently significant: Mexican peso, Brazilian real, Peruvian sol and Venezuelan bolivar. This means that the exchange rates in South American currencies seem to effect the return of weapon in the DNM. Moreover, it is interesting to note that all of the currencies coefficients are negative except for the Mexican peso .

South African rand - We choose to add it to the regression of currencies because of a specific reason. The collapse of the apartheid regime created an inflation of illegal small arms, which is very influential in the country today (Snodgrass, 2015). Being a rather modern country with a large number of illegal small arms, we assumed that it is likely that some of the weapons in the market might originate from there. As can be seen, it did come significant, which strengthen our assumption.

Other European currencies The regression results present that euro is insigniﬁcant, as well as the Serbian dinar. There could be few reasons for that. First of all, we could think that European trade is conducted mostly inside the Eurozone, meaning that exchanging costs and translation costs are minimal. Second of all, Swiss frank is signiﬁcant. There might be a possibility that both the sellers and buyers on the DNM around Europe have accounts in Swiss frank. As we mentioned earlier in the Theory chapter, the traders on the DNMs are usually non-normative people. Hence, it is plausible to assume that criminal organisations, and also terror groups will be more Analysis 69

active in the illicit markets.There is evidence that suggests that speciﬁcally, those kind of groups together with arms dealers hold accounts in Swiss banks (Ryle et al., 2015). The regression result on the Swiss frank signiﬁcance to the return of illegal arm listings, while euro, rouble and Serbian dinar are not, might support this theory.

Overall, it might be a different reason for the significance of the specific currencies that show up in the results. All those currencies might be related to the ”money laundering” activities. Meaning that the currencies which are easier to ”launder” are the ones we find significant. To conclude, the regression results with several currencies to be significant. We also tried to choose the currencies in our regression by their importance for international trade as well as by other specific reasons as described above. An indication can clearly be seen in this regression for the DNMs for weapons being a global active market.

7.2 Number of market listings per day

After ensuring that the market is viable, we start with the dynamic causality models. First in our list of regressions is the one where the dependent variable is the number of market listings per day. In the Table 7.3 we present the output of this regression: Analysis 70

Coeﬃcient(Standard Errors) (Intercept) 0.076575 (0.414730) Number of Casualties[1:678] −0.000158 (0.037436) lag(Number of Casualties, 1)[1:678] 0.001325 (0.030567) lag(Number of Casualties, 2)[1:678] −0.006784 (0.027426) lag(Number of Casualties, 3)[1:678] 0.002926 (0.023757) lag(Number of Casualties, 4)[1:678] −0.014961 (0.022958) lag(Number of Casualties, 5)[1:678] −0.000805 (0.022074) lag(Number of Casualties, 6)[1:678] 0.002975 (0.020601) lag(Number of Casualties, 7)[1:678] 0.006328 (0.021166) lag(Number of Casualties, 8)[1:678] −0.006979 (0.021467) lag(Number of Casualties, 9)[1:678] 0.002143 (0.021435) lag(Number of Casualties, 10)[1:678] −0.001843 (0.021930) R2 0.01 (single Imputation based) Adj. R2 -0.01 (single Imputation based) Num. obs. 668 (single Imputation based) RMSE 9.88 (single Imputation based)

∗∗∗p < 0.001, ∗∗p < 0.01, ∗p < 0.05

Table 7.3: The diﬀerence in number of listings per day

Looking at the regression results in Table 7.3, we can clearly see that none of the lags is Analysis 71 significant. As we assumed in the Theory, it is very likely that an increase in demand and supply might come together. Therefore the volume we observed might not significantly change, due to the netting-off effect of opened and closed listing resulted in a higher activity. Nevertheless, running the model was essential. This is because if a clear effect would be captured, we could infer about stronger demand or supply reaction to the exogenous shock.

7.3 Aggregated USD value of market listings per day

The next OLS regression that we run with Zelig package generates the following results: Analysis 72

Coeﬃcient(Standard Error) (Intercept) 1.09e−04 (6.20e−03) Number of Casualties 2.42e−05 (3.29e−04) lag(Number of Casualties, 1) −1.82e−05 (3.21e−04) lag(Number of Casualties, 2) 3.87e−06 (3.10e−04) lag(Number of Casualties, 3) 1.05e−04 (5.72e−04) lag(Number of Casualties, 4) −1.17e−04 (6.20e−04) lag(Number of Casualties, 5) −4.33e−06 (3.10e−04) lag(Number of Casualties, 6) 3.18e−05 (3.42e−04) lag(Number of Casualties, 7) 5.78e−06 (3.11e−04) lag(Number of Casualties, 8) −7.30e−05 (4.56e−04) lag(Number of Casualties, 9) 9.39e−05 (5.30e−04) lag(Number of Casualties, 10) −2.16e−05 (3.25e−04) R2 0.01(single Imputation based) Adj. R2 -0.00(single Imputation based) Num. obs. 668 RMSE 0.65(single Imputation based)

∗∗∗p < 0.001, ∗∗p < 0.01, ∗p < 0.05

Table 7.4: Diﬀerence in standardised value of listings explained by ”number of casualties”

These results again do not generate any significant lags as stated in the Table 7.4. This Analysis 73 could support our concern which we described in Theory. The main problem with this approach is the fact that products offered on the DNMs can change significantly from day to day. It leads to change in the total USD value of the opened listings while not accounting for the type of the products offered, that can have different price level. This fact makes it problematic to account for changes in prices on the DNMs even though the numbers of total listings remains at the same level.

7.4 Average bitcoin return per day adjusted for exchange rates eﬀects

In this model, we regressed the residuals from the weapon price return model. We expected to find a significant change which would mean the price adjusts as a reaction to the shock. We have found no evidence that prices in the market are changing due to terror attacks and mass shootings. Let us assume that the effect of terror attacks on the supply and demand of weapons in the DNMs does exist. One of the possible reasons for the insignificance of the changes in return of the regression results, in this case, is that if the demand goes up but the supply curve is highly elastic1. Additionally, we should also note, that the weapon deals in the DNMs that we use for our research, is a relatively small part of the weapon market as a whole. Therefore, as a result of two facts combined, it is possible that on those levels of supply and demand, the supply curve is very elastic. Therefore, we can not yet conclude that terror attacks have no effect on the demand and supply curves. The output of this regression is presented in the Table 7.5:

1A full elasticity means that for a given price supply will be inﬁnite Analysis 74

Coeﬃcient(Standard Error) (Intercept) −1.50e−04 (1.91e−03) Number.of.deaths −2.40e−05 (7.82e−05) lag(Number of Casualties, 1) −2.72e−05 (8.46e−05) lag(Number of Casualties, 2) −7.68e−06 (8.67e−05) lag(Number of Casualties, 3) 5.51e−06 (8.27e−05) lag(Number of Casualties, 4) 1.12e−07 (9.70e−05) lag(Number of Casualties, 5) −3.16e−05 (7.32e−05) lag(Number of Casualties, 6) 2.99e−05 (7.45e−05) lag(Number of Casualties, 7) 3.63e−05 (7.37e−05) lag(Number of Casualties, 8) 4.78e−05 (9.41e−05) lag(Number of Casualties, 9) 1.16e−05 (9.30e−05) lag(Number of Casualties, 10) 1.93e−05 (9.35e−05) R2 0.01 (single Imputation based) Adj. R2 -0.01 (single Imputation based) Num. obs. 669 RMSE 0.03 (single Imputation based)

∗∗∗p < 0.001, ∗∗p < 0.01, ∗p < 0.05

Table 7.5: Residuals from the ﬁrst model explained by ”number of casualties”

In addition to this model we also check the stationarity of the dependent variable. The Analysis 75

Y variable in this case is the residuals from the weapon return index that is transformed to the time series as described in the Methodology. We do it with the analysis of the cumulative sum of the Y variable which is the reconstructed to time series residuals from the ﬁrst model.2 The result is illustrated in the Figure 7.1.

Figure 7.1: Cumulative sum of the residuals from the weapon price index model

Looking at the Figure 7.1, it seems that the residuals are growing until April 2014 where they stabilise excluding a big shock at the end to 2015. For the code, please refer to Appendix A.6. As stated in Methodology, our next step is to test for the presence of the unit root in these residuals. To perform this, we run Augmented Dickey-Fuller test, the code for which is presented in Appendix A.6. The results of this test are illustrated in the table below:

2In this case we took the residuals from the model without an intercept so we would be able to clearly see the drift. Analysis 76

Table 7.6: Augmented Dickey-Fuller test for unit root with a drift

Estimate Std. Error t value Pr(>|t|) (Intercept) 0.0080 0.0029 2.71 0.0068 ∗∗ z.lag.1 -0.0179 0.0068 -2.62 0.0089 ∗∗ z.diff.lag1 -0.0249 0.0389 -0.64 0.5227 z.diff.lag2 0.0197 0.0388 0.51 0.6110 z.diff.lag3 0.0024 0.0387 0.06 0.9513 z.diff.lag4 -0.0024 0.0387 -0.06 0.9498 z.diff.lag5 -0.1666 0.0386 -4.32 0.0000 ∗∗∗ z.diff.lag6 -0.0320 0.0385 -0.83 0.4059 z.diff.lag7 0.0010 0.0385 0.03 0.9800 z.diff.lag8 0.0078 0.0385 0.20 0.8389 z.diff.lag9 -0.0816 0.0385 -2.12 0.0345 ∗ z.diff.lag10 -0.0442 0.0386 -1.15 0.2526 Signif. codes: 0 *** 0.001 ** 0.01 * 0.05 . Statistical Measures

RSE:0.0258851 DF:656 R2:0.04877472

2 adj R :0.03282429 F(11,656): 3.057895 pval:0.0005209723

Critical Values

tau23=-2.6234 Phi1 4=3.7031

The critical value for tau2 in table 7.6 is smaller then -2.575 but bigger then -2.866, therefore, we can reject the existence of unit root confidence of a P − value < 0.1. The Phi1 assumption does not seem to be significant so we can reject the presence of a drift and the non-existence of the unit root. Moreover, we find the fifth lag to be significant. We can also clearly see it in the ACF plot in Figure 7.2.

3tau2 is the Dickey-Fuller test critical value, under the assumption that there exist unit root(none stationary) 4Phi1 is the Dickey-Fuller test critical value, under the assumption that there exist unit root and there is a drift 5the 5 percent conﬁdence critical value 6the 10 percent conﬁdence critical value Analysis 77

Figure 7.2: ACF for cumulative sum of residuals

The fact that the ﬁfth lag is signiﬁcant will be discussed in the analysis of the next model.

7.5 The number of new market listings

As described in the Methodology and Theory we examine the count of new listing ﬂowing into the market using the Poisson distribution for the Y variable. The result from the Poisson regression are presented in the Table 7.7. Analysis 78

New listings Poisson model (Intercept) 0.645845 *** (0.088512) Number of Casualties −0.001036 (0.006098) lag(Number of Casualties, 1) −0.002472 (0.003850) lag(Number of Casualties, 2) −0.002141 (0.003864) lag(Number of Casualties, 3) −0.003479 (0.004154) lag(Number of Casualties, 4) −0.001261 (0.004932) lag(Number of Casualties, 5) 0.002974 ** (0.001000) lag(Number of Casualties, 6) −0.015888 @ (0.009263) lag(Number of Casualties, 7) 0.000494 (0.001598) lag(Number of Casualties, 8) −0.003465 (0.004843) lag(Number of Casualties, 9) 0.000648 (0.002586) lag(Number of Casualties, 10) −0.008073 (0.010554) AIC 3726.22(single Imputation based) BIC 3780.29 (single Imputation based) Log Likelihood -1851.11 (single Imputation based) Deviance 2780.41 (single Imputation based) Num. obs. 669

∗∗∗p < 0.001, ∗∗p < 0.01, ∗p < 0.05,@p < 0.1

Table 7.7: Number of new listings explained by the ”number of casualties” (under Poisson model) Analysis 79

The output is from 10-lag regression. We can see the fifth and sixth lags are significant. We decided to run the same model up to 80 lags to check how this change significance level of the lags. Moreover, we run the fifth and sixth lag separately from others. The reasoning behind doing that is to understand better if the significant lags we observed are just due to multiple lags statistical error7. Addressing the fit of the model- Although the deviance seems to reject the Poisson model, based on a Chi − Squre657. Due to the low mean of our count variable, this could not be used as a reliable test (Bartlett, 2014). Moreover, we checked the deviance of a Poisson model which runs only on an intercept for the imputed datasets and comparing to the ten lag model. This ten lags model outperforms the only intercept model for each of the imputed datasets 8, meaning that the deviance is smaller.Therefore, based on Coxe et al.(2009) we can infer that our model has some explanatory power. Running the 80 lags regression we find more lags to be significant, but we do not see a reason to go beyond three weeks from the event. Moreover, we do not find any other two adjacent lags to be significant, as in the case of the fifth and the sixth lags. We present only significant lags which we find to be relevant in Table 7.8:

New listings Poisson model lags of interest(from 80 lags) lag(Number of Casualties, 5) 3.27e−03 ** (1.12e−03) lag(Number of Casualties, 6) −2.00e−02 @ (1.09e−02) lag(Number of Casualties, 18) 4.70e − 03 *** (8.43e − 04) Num. obs. 598

∗∗∗p < 0.001, ∗∗p < 0.01, ∗p < 0.05,@p < 0.1

Table 7.8: Number of new listings explained by the ”number of casualties”(80 lags)

It is evident that both the fifth and sixth lags keep a high significance level in the 80 lags regression. We can also see that the 18th lag is still very significant, we could not ignore that and had to understand where does this result comes from.To suppress reasons

7Meaning that if we run 100 lags statistically, we should find five lags which will be significant in a 5% confidence level. 8As described in the Methodology, for this model we have 20 imputed data sets Analysis 80 of serial correlation we ran the 18th lag as a lone regressor over the independent variable, it still came significant, with Pvalue < 0.001. Some representative regression codes are presented in Appendix A.6.

We decided to proceed by running the ACF and PACF of the dependent variable.

PACF is shown in the Figure 7.3.

Figure 7.3: PACF of new market listings

ACF figure is presented in Appendix A.6. As one can see in 7.3 the 19th lag of the dependent variable is strongly significant for the autocorrelation function. Therefore, we decided to run the regression together with the lags of our dependent variable.Even though, the PACF does not seem to support an AR process to be present at all in our data. We wanted to eliminate the option that the highly significant effect we observe for the 18th lag of the independent variable is affected by the nature of our dependent variable data. Therefore, we ran a regression of the following form:

Yt = α1Yt−1 + ... + α19Yt−20 + β1Xt + ... + β20Xt−20 (7.1) Analysis 81

This approach of running the regression with the dependent lag variable will help to clarify the nature of the observed significance from the independent variable 18th lag coefficient. After running this regression 7.1 we find that the P-value of the independent variable’s

18th lag is: Pvalue ≤ 0.001. We, therefore, infer that this is a clear effect of the terror attack and very unlikely to be a statistical error. Nevertheless, the results we are presenting are taken from the original regression output without adding Y lags. The use of the original regression is supported by Achen(2000) findings regarding using dependent variable lags in a non-present AR process. When we look at the coefficient of the independent variable’s 18th lag it is positive and equal to 0.0052219. Such a significant effect of the 18th lag means that the effect appears two and a half weeks after the shock, with a positive coefficient which might imply one of the following:

Supply side Every terror attack is followed by a more strict control of the law enforcement agencies over different kinds of illicit activities. For example, this implies more checks in the customs, which are an important delivery channel for international sales on the DNMs. Additionally, the attention comes not only to more armed police in the area but also higher monitoring of the DN. Therefore, all these factors together might affect vendors behaviour by ”lowering their profile” for a while. After two and a half weeks the activity resumes, resulting in more new offers on the DNMs.

Demand side As we discussed in the Data description, many of the listings are a custom that satisﬁes a particular customer request and therefore might represent the demand side. The buyers that wish to react to the observed event such as crime gangs, terrorist imitators or other users, might lay low for a while before acting. It might be because of the of the fear from law enforcement cracking down on the market or since conducting a plan for a violent act takes time.

Next, we analyse other lags of interest, the fifth and the sixth lags of the independent variable. We ran both lags independently to check for significance. The results are consistent: both lags stay significant under a five and ten percent significance levels accordingly.

9This result is based on the dependent variable regressed over the independent variable with 20 lags Discussion 82

In the previous model that was testing the average return of market listings, we have found evidence of the autocorrelation in the Y variable with the fifth lag. One can speculate that a possible reason might be that the time to process new information in the DNMs for weapons is around five days. Moreover, as can be seen in table 7.7 the coefficients are of opposite signs, the fifth is positive, and the sixth is negative. We should remember that a large number of the listings are custom offers as we have noted in the Data chapter. This type of listings originates from a particular demand of users. It seems that custom offers show up after an encrypted discussion of specific terms of the sale between a seller and a buyer. Based on these reasons, there are two possible reasons, again from the supply and demand sides:

Supply side Sellers are aware of a possible increase in the law enforcement attention following the terror attack. Therefore, vendors decide to push forward deals which are already in the process. Consequently, we observe an increase in the number of new listings at the ﬁfth day but a decrease in the sixth day.

Demand side Buyers are pushing their future demand forward, communicating to the sellers they want to make the deal as soon as possible. This could happen either due to fear of being arrested before they can execute their planned act of violence or due to received inspiration to imitate an act of terror?victoroff2005mind). The last phenomenon was discussed in Theory. Another possible reason for this ”push of the demand” effect could be after the criminal mass shooting, a fast escalating arms race between gangs Decker and Van Winkle(1996) could create the observed effect. This might mean that sellers will put a unique listing for those buyers on the market earlier, responding to the increased demand.

May it be any of the reasons we presented or any different reasons that affect the demand and supply of weapons on the DNMs after terror attacks and mass casualties, it is hard to state with certainty what are those reason. To summarise, we find evidence that the market responds to these events over two cycles: short term; an immediate reaction after five days, and midterm effect; after 18 days, both are measured by Poisson regression. Chapter 8

Discussion

In this chapter, we cover several subjects. Firstly, we will talk about the assumptions that we did not touch along in the paper. We will discuss their robustness and limitations. Secondly, we will express some thoughts regarding the results of the research. Lastly, we will talk about further research possibilities, based on our results.

8.1 Robustness of the assumptions

Assumption 1. DNMs do exist and the trade is real As discussed in Theory we need to assume that DNMs are real. We showed through the paper that this assumption is supported by a lot of evidence. The guns used in the Munich attack (Siebelt) and the Paris attack Weimann(2016) were purchased in the DN. Moreover, a gun dealer who appears in our dataset as ”WeaponsGuy” and got arrested COX (2015). We believe this provides a strong and concrete evidence for the reality of these markets. Moreover, the results from the ﬁrst regression that was modelled to test our secondary hypothesis, provided us another proof. It showed that the DNM for weapons is an international market, since the returns are aﬀected by exchange rates. Overall, this assumption seems to be robust and well validated.

Assumption 3.Variables distribution Some of our ﬁndings are relaying on the Poisson distribution, as we described in The- ory and in Analysis. However, this model is not perfect, since a Poisson distribution assumes equal variance and mean. As described in Theory, one of the drawbacks

83 Discussion 84

using this distribution, in our case, is the fact that there are certain times where we observe a jump in the variable. Those jumps are related usually to an entry of a new market into the data. In our case we observe an overspreading1 of the data, in this case other models such as the negative binomial might be more ﬁtting. Nevertheless, we believe that sticking to the Poisson model will be more appropriate due to the following reasoning; the reason for our increased variance is due to data collection limitation and not a problem of the modeling. Furthermore, entry of a new market into the data collection process should be random and therefore, not correlated with our observed terror events. Hence we believe that the Poisson model should be good enough. Even though, a better data collection method in the future might clarify the result.

Assumption 4. The media coverage of the terror attacks is exhaustive As we have shown along our research, agents who operate in the DNMs need to be very well informed. The DNMs is a complex environment. Therefore, even if we we release this assumption, and assume that media does not provide enough coverage to terror events. As agents will try to stay informed, we would still expect them to follow news which are aﬀecting their decision making. For example we expect gangsters to search for information about shootings done by other gangs. this also applies sympathisers of terrorists, who we expect to follow the terror groups they admire. Hence, even if we release this assumptions we will probably ﬁnd a reaction in the market to the shocks that we examine in this paper.

Assumption 5. Non-strict exogeneity of independent variable One possible problem in this assumption could be that the supply of weapons for the DNMs and terrorist group comes from one source at the same time. For instance, when war broke in Ukraine, it might be assumed that it became easier to buy a gun and smuggle it from Ukraine. If the access to guns became easier and both DNMs and terrorists use this source to stock their supplies. Hence it is likely we would observe a rise in listings for weapons in the DNMs as well as an increase in victims of terror, while both are connected to the Ukraine war. Therefore, we get a correlation between our X variable and our error term. Nevertheless, due to the fact that we analyse a short period of time, usually 20 days lag, this should not aﬀect our results. This is due to it usually would take more than

1Larger variance then expected under the model Discussion 85

a couple of days and even weeks from the date where there is an increase in weapons accessibility to prepare a well planned terror attack with those purchased guns.

Assumptions 2 was discussed in details in Theory chapter.

8.2 Limitations

In this research we encountered few limitations that are mainly related to the data quality. As we discussed in the Data description chapter, the market listings of the were partially missing in the data set. As the errors in the script that collected the listings were random, we applied the imputing technique to reproduce the missed data points. This method provided us with full time series data that we used to test our hypothesis. We understand that this approach gives only a random reproduction of absent data point, but it is still the best option. Another limitation that relates to the data quality is that the market listings are not the best proxies for supply and demand on the DNM. The data will get new listings whenever the new market is added to the crawler. This might be not fully accurate. In case the market was opened before being added to the crawler, the offers were put on the platform before the first crawler access. As a result, the script will give new deals when the data inflow from the new accessed cryptomarket appeared which could distort the real timing of those new deals in our analysis. Next issue is linked to the whole concept of defining market listings as a proxy for the supply and demand of weapons on the DNM. A better estimation of the demand would be actual closed deals. This data is available on many websites. In order to get such data, we would have to create a new crawler and to collect it all from a scratch. This would not be possible to perform for a relatively short period of time for this research. In addition to the above limitation, we would like to add that some of the aspects are not fully researched, as the markets are well encrypted and anonymous. We do not have knowledge on the actual supply mechanisms for the vendors in the DNM, therefore multi- collinearity problems could be present in the data as well as endogineity problem as was discussed above in this chapter. Discussion 86

8.3 Results discussion and possible implications

We will keep focus here on the two models in which we find significant evidence regarding the DNMs weapons market. We talk in Theory and Analysis about the possible reasons for not observing any significance within the other models.

8.3.1 Weapon price return

As seen in Analysis, more than few currencies exchange rates come out as significant. We have also brought studies showing that Mexico is a net importer of weapons and in particular from the US (Vargas and GONZáLEZ, 2015) but also in general having a large number of illegal weaponsRELATIONS(2013). Moreover, it can be seen in GunPolicy that the US is the number one country in civilians weapons per capita. Hence, we would expect also a bigger illicit market for weapons in the US. We also mentioned that Swiss franc is used by arms dealers and criminals(Ryle et al., 2015), lastly we would remind about South Africa having a huge problem regarding illegal weapons (Snodgrass, 2015). This connection leads us to believe that there should be a positive coefficient in currencies of countries with a big illegal market for weapons. while the negatively correlated ones might be the currencies which are used to maybe laundering money as this possibility was mentioned in Analysis chapter. This is a speculation that requires more research around it. Table 8.1 summarises the the currencies fiat currencies which were found significant:

Coeﬃcient sign of signiﬁcant currencies Positive Negative 1 USD Australian dollar 2 Canadian dollar Hong Kong dollar 3 Great British pound Brazilian real 4 Swiss franc Venezuelan bolivar 5 Korean won Peruvian sol 6 Mexican peso 7 South African rand

Table 8.1: Positive and negative coeﬃcients of signiﬁcant currencies Discussion 87

We ﬁnd the outcome of this regression to be of importance as it might serve as a signal about the countries that are highly involved in the illicit gun trade. Some of the currencies are not obviously important for trade but could be important for the arms dealers: Swiss frank (Ryle et al., 2015), South African rand (Snodgrass, 2015) and the Mexican peso (Vargas and GONZ´aLEZ, 2015).

8.3.2 Number of new market listings

In the Analysis chapter we showed our finding regarding the fifth, sixth lag and the 18th lag of a terror event on the DNMs activity. We would like to discuss the importance of this finding. As stated in introduction we believe that understanding the illicit weapons market, is crucial for the prevention of violent acts. A regular concept claims that those event could be decreased by limiting the right to carry guns. Therefore, if we assume that most illegal weapons were at some point legal (Peters, 2009), then restricting laws might harm the supply in a specific country. But the more the international black market in the DN is developing the less effective we believe such policies will be effective. It is enough to see the recent events in Europe, where gun laws are very restrictive (GunPolicy), to realise the reality is unfolding in front of our eyes. Another important point that follows from our observation of an increase of new listings in 18 days after attack, might be a good signal to the law enforcement. Police might perceive this as a signal for concentrating their forces on the DN monitoring three weeks after the attack, which might bring better results and save lives. Furthermore, there is evidence that in recent years terrorist groups are moving to the DNMs (Weimann, 2016). Our research could be used as a cornerstone in understanding trends and behaviour of weapon consumption by those terror groups. Terrorist are adapt- ing to new technologies (Johnson, 1977) and law enforcement must move faster and with high budget allocation efficiency if we want to be able to stop the future ”Paris attacks”.

8.4 Future possible research

We will give diﬀerent possible directions for future research based on the result achieved in our models. Conclusion 88

8.4.1 Weapon price return

As we discussed earlier in this chapter, and mentioned in the Analysis, we find evidence for the market returns to be effected by specific currencies. We believe that a further research in this direction can unfold the international network of ”net buyers” and ”net sellers”. This kind of research could help to trace the smuggling routes of arms dealing and help in prevention of crimes. Another direction of such a research could be in recognising patterns found outside of the DN in arms trading. For example, Mexico being a big importer of illegal guns from the US (Vargas and GONZáLEZ, 2015), or the accounts in Switzerland used by arms dealers (Ryle et al., 2015). Finally, a small and interesting project could be undertaken. We could look into the Jan- uary effect of the returns and analyse if this property of the stock markets is also applicable to weapon trade on the DN.

8.4.2 Dynamic causality eﬀect

There are many possible researches that relates to ours that could be done in the DNMs. It is possible to analyse the dataset we used for this research in several other ways. Firstly, looking into the weapons we could include other events into the analysis. For example, the war in Ukraine effect over supply and demand in the weapon market could be a beneficial research addition. The following research related to our results could check whether future terror attacks and mass shootings are affected by the changes in the activity in the DNM for weapons. A research like that could provide an understanding of a full cycle of weapons trade and violence. It is also possible to use the same methodology to answer research questions related to drug products instead of weapons. For example, it could be interesting to test whether there exists a seasonal change in the drug trade activity depending on the number of festivals in Europe and the US as a shock to demand. Lastly, as we have mentioned in the Limitations section, it would be a good idea to construct a new crawler, which will provide another type of data of actual purchases on the biggest markets. Although we could have some similar quality problems that are linked to most of the crawlers and the fact that the DNM has a highly complicated setup. Chapter 9

Conclusion

When it comes to research in a relatively new field as the DN, in which information is limited, where the cornerstones of the environment are privacy and secrecy. One needs to be prepared for difficulties along the way. Nevertheless, we believe that our paper showed, that as a society we can not neglect this research because of the obstacles embedded. The drug dealers, the terrorists and the thieves are moving forward with technology and so must research. This is because only through the understanding of process the society can better utilise the technology and harvest the benefits. As stated by Zimmermann(1995) who created the PGP, in the world of growing surveillance there is an increasing need for privacy. Tor, PGP and Deep Net are important tools nowadays. However, these tools are available for everyone, hence with the high level of privacy, criminal activities start blooming. Preventive measures should be undertaken to stop the development of crime on the internet. We have found some evidence that it is possible to use the limited data in hand to find patterns of the supply and demand for weapons in the DN. In the interview of an arms dealer from 2014 Matthews(2014) he describes the growing percentage of his business moving to the DNMs. Together with the immigration of terrorist into the internet (Weimann, 2016), this might point out that the coefficient between a mass shooting and the DNM for weapons. Therefore, the need for additional research will only become stronger.

Moreover, an unregulated environment like the DNMs, could provide a laboratory to test for hypothesis about regulations, agency problems, entry cost and many more exciting

89 Appendix 90

ﬁelds in economics. We believe that this research could be a gateway for ways and possibilities to conduct meaningful studies in the rough but fascinating and valuable environment of the DNM. Appendix A

Appendix

A.1 Dark Net markets set up

We will bring here 6 photos which give a good explanation for how the hidden services of Tor are working.

Figure A.1: Tor hidden service 1

91 Appendix 92

Figure A.2: Tor hidden service 2

Figure A.3: Tor hidden service 3 Appendix 93

Figure A.4: Tor hidden service 4

Figure A.5: Tor hidden service 5 Appendix 94

Figure A.6: Tor hidden service 6

A.2 Code for ﬁltering the data by product names in python

Due to a diﬀerence between the archive formating we needed to modify the code a bit.

First Archive import csv import glob import os import pandas as ps import numpy as np os.chdir(’C:/thesis/rchives/grams1’) direc=’C:/thesis/rchives/grams1/’ checkWords = [’pistol’,’Beretta’,’Baretta’,’colt’,’smith’, ’wesson’,’vz.50’,’wildey’,’zastava’,’remington’, ’kel-tec’, ’ruger’, ’walther’,’cz.’,’armatix’,’caracal’,’heckler’,’horhe’,’glock’, ’taurus’,’ viper ’,’danuvia’,’kahr’,’makarych’,’brugger’,’pp-200’,’kimber’, Appendix 95

’barak’,’Z’,’guncrafter’,’arsenal’,’ hs2000 ’,’steyr’,’tanfogolio’, ’vektor’,’walther’,’bersa’,’mp-444’,’p-96’,’arcus’,’grand power’, ’mitchell’,’ FN ’,’firestar’,’mp-443’,’browning’,’hi-point’, ’ultrastar’,’jericho’,’claridge’,’ uzi ’,’minebea’, ’bren ten’,’astra ’,’llama’,’jennings’,’semmerling’,’desert eagle’, ’p-83’,’hardballer’,’benelli’,’pamas’,’m15’,’mac-11’,’intratec’, ’rifle’,’AEK-971’,’ADS amphibious rifle’,’AG-043’,’Kalashnikov’, ’AK-74’,’AK-47’,’AK-101’,’AK-102’,’AK-103’,’AK-104’,’AK-105’, ’AK-107’,’AK-108’,’AK-12’,’AK-63’,’AK-5’,’AMD-65’,’AMD-69’, ’AN-94’,’AO-27’,’AO-31’,’AO-35’,’AO-38’,’AO-62’,’ArmaLite’, ’ASM-DT’,’Barrett’,’Bullpup Multirole’, ’Bullpup Multirole’,’Close Quarters Battle Receiver’,’CZ-805’, ’Daewoo K2’,’SC-2005’,’Dlugov’,’EM-2’,’FAMAS’, ’FARA 83’,’FN CAL’,’FN F2000’,’FN FNC’,’FN SCAR’,’FX-05 Xiuhcoatl’, ’Galil’,’Howa Type 89’,’IMBEL MD2’ ,’IMBEL IA2’,’INSAS ’,’Kbkg wz’,’Beryl ’,’ L85 ’,’LR-300’,’ M16 ’, ’MSBS Radon’, ’Multi Caliber ’,’ Nesterov ’,’OTs-12’,’Pindad’,’ Mitralier ’, ’QBZ-95’,’ QBZ-97’ , ’QBZ-03’, ’Remington ’, ’Armament XCR’,’Daewoo K11’,’Sa vz.’,’SAR-80’,’SAR-21’,’SIG MCX’,’SIG SG 516’, ’SIG SG 530’,’SIG SG 540’,’SIG SG 550’, ’SOCIMI AR-831’,’SR-3 Vikhr’,’SR-47’,’ SS09 ’,’ Sterling SAR-87 ’, ’Steyr AUG’,’ Stoner 63 ’, ’TKB-517’, ’TKB-072’, ’Truvelo Raptor’, ’Valmet M76’, ’Valmet M82’, ’Vektor CR-21’,’Vektor R4’, ’VHS-2’,’Wieger StG-940’, ’XT-97’]

checkNames = [’name’] a= os.listdir() finaldata =ps.DataFrame() for i in a: path= direc+i combined = ps.DataFrame() for filename in glob.glob(os.path.join(path ,’*.csv’)): data=ps.read_csv(filename,delim_whitespace = False,delimiter=’,’ ,error_bad_lines=False) Appendix 96 idx_hash=[[checkWord.upper() in str(rowTup[1][checkName]).upper() for checkWord in checkWords for checkName in checkNames] for rowTup in data.iterrows()] tempdata=data[idx_hash] marketname = [filename for x in range(len(tempdata))] date = [i for x in range(len(tempdata))] datemark =ps.DataFrame({’date’:date, ’market’:marketname}) tempdata=tempdata.set_index(np.arange(len(tempdata))) combined = ps.concat([datemark,tempdata],axis =1) finaldata = finaldata.append(combined,ignore_index=True)

finaldata.to_csv()

second Archive import csv import glob import os import pandas as ps import numpy as np os.chdir(’C:\thesis\rchives\grams2’) direc=’C:\thesis\archives\grams2\\’ checkWords = [’pistol’,’Beretta’,’Baretta’,’colt’,’smith ’,’wesson’,’vz.50’, ’wildey’,’zastava’,’remington’, ’kel-tec’, ’ruger’,’walther’,’cz.’,’armatix’, ’caracal’,’heckler’,’horhe’,’glock’,’taurus’,’ viper ’,’danuvia’,’kahr’, ’makarych’,’brugger’,’pp-200’,’kimber’,’barak’,’Z’,’guncrafter’, ’arsenal’,’ hs2000 ’,’steyr’,’tanfogolio’,’vektor’,’walther’,’bersa’,’mp-444’,’p-96’, ’arcus’,’grand power’,’mitchell’,’ FN ’,’firestar’,’mp-443’,’browning’,’hi-point’, ’ultrastar’,’jericho’,’claridge’,’ uzi ’,’minebea’, ’bren ten’,’astra’,’llama’,’jennings’, ’semmerling’,’desert eagle’,’p-83’,’hardballer’,’benelli’, ’pamas’,’m15’,’mac-11’,’intratec’, Appendix 97

’rifle’,’AEK-971’,’ADS amphibious rifle’,’AG-043’,’Kalashnikov’,’AK-74’,’AK-47’, ’AK-101’,’AK-102’,’AK-103’,’AK-104’,’AK-105’,’AK-107’, ’AK-108’,’AK-12’,’AK-63’,’AK-5’,’AMD-65’,’AMD-69’, ’AN-94’,’AO-27’,’AO-31’,’AO-35’,’AO-38’,’AO-62’, ’ArmaLite’,’ASM-DT’,’Barrett’,’Bullpup Multirole’, ’Bullpup Multirole’,’Close Quarters Battle Receiver’,’CZ-805’, ’Daewoo K2’,’SC-2005’,’Dlugov’,’EM-2’,’FAMAS’, ’FARA 83’,’FN CAL’,’FN F2000’,’FN FNC’,’FN SCAR’,’FX-05 Xiuhcoatl’,’Galil’, ’Howa Type 89’,’IMBEL MD2’,’IMBEL IA2’,’Tavor’,’INSAS ’, ’Kbkg wz’,’Beryl ’,’ L85 ’,’LR-300’,’ M16 ’,’MSBS Radon’, ’Multi Caliber ’, ’ Nesterov ’,’OTs-12’,’Pindad’,’ Mitralier ’, ’QBZ-95’,’ QBZ-97’ , ’QBZ-03’, ’Remington ’,’Armament XCR’,’Daewoo K11’,’Sa vz.’,’SAR-80’, ’SAR-21’,’SIG MCX’,’SIG SG 516’,’SIG SG 530’,’SIG SG 540’,’SIG SG 550’, ’SOCIMI AR-831’,’SR-3 Vikhr’,’SR-47’,’ SS09 ’,’ Sterling SAR-87 ’,’Steyr AUG’, ’ Stoner 63 ’, ’TKB-517’, ’TKB-072’, ’Truvelo Raptor’, ’Valmet M76’, ’Valmet M82’, ’Vektor CR-21’, ’Vektor R4’,’VHS-2’,’Wieger StG-940’, ’XT-97’]

checkNames = [’"name"’] a= os.listdir() finaldata =ps.DataFrame() for i in a: path= direc+i combined = ps.DataFrame() for filename in glob.glob(os.path.join(path ,’*.csv’)): data=ps.read_csv(filename,delim_whitespace = False,delimiter =’,’ ,quoting=csv.QUOTE_NONE ,error_bad_lines=False) idx_hash=[[checkWord.upper() in str(rowTup[1][checkName]).upper() for checkWord in checkWords for checkName in checkNames] for rowTup in data.iterrows()] tempdata=data[idx_hash] marketname = [filename for x in range(len(tempdata))] date = [i for x in range(len(tempdata))] datemark =ps.DataFrame({’date’:date, ’market’:marketname}) Appendix 98 tempdata=tempdata.set_index(np.arange(len(tempdata))) combined = ps.concat([datemark,tempdata],axis =1) finaldata = finaldata.append(combined,ignore_index=True)

finaldata.to_csv()

A.3 Code for ﬁltering the data by speciﬁc vendor names in python

After identifying the vendors proﬁles of interest to us we ran the following 2 codes: First Archive

import csv import glob import os import pandas as ps import numpy as np os.chdir(’C:/thesis/rchives/grams1’) direc=’C:/thesis/rchives/grams1/’ checkWords = [’Alexandrea’,’alexandria’,’AlphaBayArmory’, ’ammodealer’,’ArmsnAmmo ’,’asap’,’chaoticneutral’ ,’exVendor’,’DocUnskillful’, ’FreeCity’, ’GeGunz’,’Gerald’,’Goblinking.’,’GunGrave’, ’Guns_Ammo’,’Gunshopeurope’,’gunseller9’,’GunSmith666’,’I-MetzgerDD-I’, ’ IrishConnection ’,’Kramer_cosmo’,’KUSH_CONNECTION’, ’RiflesandPistols’,’projeccao’,’nibbler’,’navyseal3’, ’MasterOfDarkness’,’Lenin_Cat’,’LeCorbeau’,’s987l’,’ Shopkeeper ’, ’TheArmory’,’thechaoticneutral’,’trinity101’,’ulfberht’,’Vintorez’,’weaponsguy’] Appendix 99 checkNames = [’vendor_name’] a= os.listdir() finaldata =ps.DataFrame() for i in a: path= direc+i combined = ps.DataFrame() for filename in glob.glob(os.path.join(path ,’*.csv’)): data=ps.read_csv(filename,delim_whitespace = False,delimiter =’,’, error_bad_lines=False) idx_hash=[[checkWord.upper() in str(rowTup[1][checkName]).upper() for checkWord in checkWords for checkName in checkNames] for rowTup in data.iterrows()] tempdata=data[idx_hash] marketname = [filename for x in range(len(tempdata))] date = [i for x in range(len(tempdata))] datemark =ps.DataFrame({’date’:date, ’market’:marketname}) tempdata=tempdata.set_index(np.arange(len(tempdata))) combined = ps.concat([datemark,tempdata],axis =1) finaldata = finaldata.append(combined,ignore_index=True)

finaldata.to_csv() finaldata.to_csv(’grams2gunspistols22’)

Second Archive:

import csv import glob import os import pandas as ps import numpy as np os.chdir(’C:/thesis/rchives/grams2’) Appendix 100 direc=’C:/thesis/rchives/grams2/’ checkWords = [’Alexandrea’,’alexandria’,’AlphaBayArmory’,’ammodealer’,’ArmsnAmmo ’, ’asap’,’chaoticneutral’,’exVendor’,’DocUnskillful’, ’FreeCity’,’GeGunz’, ’Gerald’,’Goblinking.’,’GunGrave’,’Guns_Ammo’, ’Gunshopeurope’,’gunseller9’,’GunSmith666’,’I-MetzgerDD-I’,’ IrishConnection ’, ’Kramer_cosmo’,’KUSH_CONNECTION’,’RiflesandPistols’,’projeccao’,’nibbler’, ’navyseal3 ’,’MasterOfDarkness’,’Lenin_Cat’,’LeCorbeau’, ’s987l’,’ Shopkeeper’,’TheArmory’,’thechaoticneutral’, ’trinity101’,’ulfberht’,’Vintorez’,’weaponsguy’]

checkNames = [’"vendor_name"’] a= os.listdir() finaldata =ps.DataFrame() for i in a: path= direc+i combined = ps.DataFrame() for filename in glob.glob(os.path.join(path ,’*.csv’)): data=ps.read_csv(filename,delim_whitespace = False,delimiter =’, ’,quoting=csv.QUOTE_NONE ,error_bad_lines=False) idx_hash=[[checkWord.upper() in str(rowTup[1][checkName]).upper() for checkWord in checkWords for checkName in checkNames] for rowTup in data.iterrows()] tempdata=data[idx_hash] marketname = [filename for x in range(len(tempdata))] date = [i for x in range(len(tempdata))] datemark =ps.DataFrame({’date’:date, ’market’:marketname}) tempdata=tempdata.set_index(np.arange(len(tempdata))) combined = ps.concat([datemark,tempdata],axis =1) finaldata = finaldata.append(combined,ignore_index=True)

finaldata.to_csv() Appendix 101

A.4 Table of casualties

We are presenting here a table with the cities and date of mass shooting events which

DATE CITY Total number Casualties 04-06-2014 Moncton 5 09-06-2014 Paterson 6 24-06-2014 Miami 9 28-06-2014 Antioch 7 29-06-2014 New Orleans 10 29-06-2014 Los Angeles 6 05-07-2014 Indianapolis 7 05-07-2014 Norfolk 7 05-07-2014 Houston 6 09-07-2014 Spring 7 21-07-2014 Irvington 6 25-07-2014 Chicago 7 26-07-2014 Sylvester 8 02-08-2014 New Bedford 7 02-08-2014 Pittsburgh 6 03-08-2014 Humble 7 09-08-2014 Minneapolis 9 10-08-2014 New Orleans 7 10-08-2014 Moreno Valley 7 10-08-2014 Washington 6 10-08-2014 Wrightsville 6 12-08-2014 Bartow County 5 16-08-2014 Salt Lake City 6 24-08-2014 San Fernando 7 03-09-2014 Los Angeles 6 11-09-2014 Detroit 8 14-09-2014 Anchorage 6 18-09-2014 Bell 8 28-09-2014 Miami 15 Appendix 102

29-09-2014 Walterboro 8 05-10-2014 Detroit 6 22-10-2014 Ottawa 5 21-11-2014 Pittsburgh 6 26-11-2014 San Francisco 6 15-12-2014 Montgomery County 5 21-12-2014 Dijon 11 21-12-2014 Calumet City 9 22-12-2014 Miami 9 04-01-2015 Roanoke 6 07-01-2015 Paris 24 09-01-2015 Paris 8 11-01-2015 Hope Mills 7 19-01-2015 San Antonio 7 23-01-2015 Boston 6 24-01-2015 Omaha 8 01-02-2015 Syracuse 6 05-02-2015 Beachwood (Warrensville Heights) 6 07-02-2015 Douglasville 7 08-02-2015 Friendship 6 26-02-2015 Tyrone 9 01-03-2015 Detroit 6 04-03-2015 San Bernardino 7 17-03-2015 Stockton 7 18-03-2015 Mesa 6 20-03-2015 Lancaster 6 22-03-2015 Albuquerque 7 27-03-2015 Panama City Beach 7 25-04-2015 Gates 7 27-04-2015 Brooklyn 6 03-05-2015 Dayton 7 03-05-2015 Houston 6 16-05-2015 Rockford 6 Appendix 103

17-05-2015 Waco 27 24-05-2015 Flint 7 11-06-2015 Bridgeport 9 17-06-2015 Charleston 9 20-06-2015 Detroit 12 20-06-2015 Philadelphia 11 22-06-2015 Philadelphia 7 28-06-2015 Venice 6 28-06-2015 Harrington 6 05-07-2015 Fort Wayne 9 05-07-2015 Shreveport 8 15-07-2015 Cleveland 7 16-07-2015 Chattanooga 8 16-07-2015 Lee 6 19-07-2015 Louisville 6 20-07-2015 Bronx 6 22-07-2015 Saint Louis 6 23-07-2015 Lafayette 12 24-07-2015 Erie 6 02-08-2015 Brooklyn 9 02-08-2015 Baltimore 7 08-08-2015 Blytheville 12 08-08-2015 Houston 8 16-08-2015 Fort Worth 6 19-08-2015 Rochester 7 21-08-2015 Durham 8 21-08-2015 Cincinnati 7 23-08-2015 Modesto 8 04-09-2015 Heppenheim 5 07-09-2015 Gary 6 07-09-2015 Rottenburg 5 12-09-2015 Minneapolis 6 13-09-2015 Ocala 6 Appendix 104

20-09-2015 Chicago 6 20-09-2015 Tulsa 6 27-09-2015 Greenville 10 01-10-2015 Roseburg 19 10-10-2015 Memphis 6 19-10-2015 Calumet City 6 22-10-2015 Trollhattan 5 04-11-2015 Merced 5 13-11-2015 Paris 259 15-11-2015 Tennessee Colony 5 22-11-2015 New Orleans 17 27-11-2015 Colorado Springs 12 29-11-2015 Acapulco 8 02-12-2015 San Bernardino 70 14-01-2016 Marseilles 6 30-01-2016 Glendale 8 04-02-2016 Loures 5 06-02-2016 Tampa 8 07-02-2016 Orlando 12 07-02-2016 Rochester 8 07-02-2016 Pass Christian 6 20-02-2016 Kalamazoo 8 20-02-2016 Iuka 5 24-02-2016 Nice 4 25-02-2016 Hesston 18 25-02-2016 Vahrenheide 6 06-03-2016 Compton 9 06-03-2016 Chelsea 7 09-03-2016 Pittsburgh (Wilkinsburg) 8 12-03-2016 Fort Mc Coy (Fort McCoy) 6 15-03-2016 Brussels 4 22-03-2016 Brussels 372 25-03-2016 London 5 Appendix 105

29-03-2016 Lisbon 5 16-04-2016 Orlando 6 17-04-2016 Edinburg 7

Table A.1: DNMs that are present in the data set

A.5 methodology

During the imputation process we made some graphs of the pca convergence of the imputed data and imputation prediction of imputed data in order to varify the process those are two examples.

Figure A.7: PCA of residuals Appendix 106

Figure A.8: Range of possible imputed values for an observed data point

A.6 Analysis

The code for the wholesale price model library(tseries) library(urca)

ExChange=read.csv("loglogbitcoin20coins.csv",header= TRUE, sep = ",",na.strings= NA) fit =lm(ExChange$rate.of.change~ ExChange$USD+ExChange$X.USD.BIT..XAU.USD+ ExChange$X.USD.BIT..XAG.USD+ExChange$X.USD.BIT..XPT.USD+ ExChange$X.USD.BIT..CAD.USD +ExChange$X.USD.BIT..EUR.USD+ExChange$X.USD.BIT..JPY.USD +ExChange$X.USD.BIT..GBP.USD+ExChange$X.USD.BIT..CHF.USD +ExChange$X.USD.BIT..AUD.USD +ExChange$X.USD.BIT..HKD.USD+ExChange$X.USD.BIT..NZD.USD +ExChange$X.USD.BIT..KRW.USD+ExChange$X.USD.BIT..MXN.USD +ExChange$X.USD.BIT..BRL.USD+ExChange$X.USD.BIT..PEN.USD +ExChange$X.USD.BIT..RUB.USD+ExChange$X.USD.BIT..RSD.USD+ ExChange$X.USD.BIT..ZAR.USD+ExChange$X.USD.BIT..SEK.USD +ExChange$X.USD.BIT..VEF.USD,robust= "VcovHAC") Appendix 107 summary(fit)

The code for the cumulative sum and dickey-fuler test

AvereagedNresidnoInt= (deathsResid1$avereged.resid+ deathsResid2$avereged.resid+deathsResid3$avereged.resid+ deathsResid4$avereged.resid+deathsResid5$avereged.resid+ deathsResid6$avereged.resid+deathsResid7$avereged.resid+ deathsResid8$avereged.resid+deathsResid9$avereged.resid+ deathsResid10$avereged.resid+deathsResid11$avereged.resid+ deathsResid12$avereged.resid+deathsResid13$avereged.resid+ deathsResid14$avereged.resid+deathsResid15$avereged.resid+ deathsResid16$avereged.resid+deathsResid17$avereged.resid+ deathsResid18$avereged.resid+deathsResid19$avereged.resid+ deathsResid20$avereged.resid)/20 cumresid= cumsum(AvereagedNresidnoInt) cumeresidDate=data.frame(date =deathsResid1$date,cumresid=cumresid ) cumeresidDate$date=as.Date(cumeresidDate$date, origin="1899-12-30") plot(y=cumeresidDate$cumresid,x=cumeresidDate$date, main = "cumulative residuals",type="n") lines( y= cumeresidDate$cumresid, x=cumeresidDate$date,type="l", col = "blue") plot(y=cumeresidDate$cumresid,x=cumeresidDate$date, main = "cumulative residuals",type="n", xaxt = "n") axis.Date(1, at=seq(min(cumeresidDate$date), max(cumeresidDate$date), by="5 mon"), format="%m-%Y") lines( y= cumeresidDate$cumresid, x=cumeresidDate$date,type="l", col = "blue") summary(ur.df(cumeresidDate$cumresid,type = "drift",lags =1)) DFresult=summary(ur.df(cumeresidDate$cumresid,type = "drift",lags =10))

We will also bring some example of how Zelig regression code looks like for our imputed new deals per day data. This is the 10 lag regression: Appendix 108

zelig(formula = number.of.new.deals~Number.of.deaths+ lag(Number.of.deaths,1)+lag(Number.of.deaths,2)+ lag(Number.of.deaths,3) +lag(Number.of.deaths,4)+lag(Number.of.deaths,5)+ lag(Number.of.deaths,6)+lag(Number.of.deaths,7)+ lag(Number.of.deaths,8)+lag(Number.of.deaths,9)+ lag(Number.of.deaths,10) , data=mi(deathsNewdDeal1,deathsNewdDeal2,deathsNewdDeal3, deathsNewdDeal4,deathsNewdDeal5,deathsNewdDeal6,deathsNewdDeal7, deathsNewdDeal8 ,deathsNewdDeal9,deathsNewdDeal10,deathsNewdDeal11, deathsNewdDeal12,deathsNewdDeal13,deathsNewdDeal14,deathsNewdDeal15, deathsNewdDeal16,deathsNewdDeal17,deathsNewdDeal18,deathsNewdDeal19, deathsNewdDeal20) ,model = "poisson",cite = TRUE)

The 80lag regression

zelig(formula = number.of.new.deals~Number.of.deaths +lag(Number.of.deaths,1)+lag(Number.of.deaths,2) +lag(Number.of.deaths,3) +lag(Number.of.deaths,4)+lag(Number.of.deaths,5)+ lag(Number.of.deaths,6)+lag(Number.of.deaths,7)+ lag(Number.of.deaths,8)+lag(Number.of.deaths,9)+ lag(Number.of.deaths,10)+lag(Number.of.deaths,11)+ lag(Number.of.deaths,12)+lag(Number.of.deaths,13)+ lag(Number.of.deaths,14)+lag(Number.of.deaths,15)+ lag(Number.of.deaths,16)+lag(Number.of.deaths,17)+ lag(Number.of.deaths,18)+lag(Number.of.deaths,19)+ lag(Number.of.deaths,20)+ lag(Number.of.deaths,21)+lag(Number.of.deaths,22) +lag(Number.of.deaths,23) +lag(Number.of.deaths,24)+lag(Number.of.deaths,25) +lag(Number.of.deaths,26)+lag(Number.of.deaths,27) +lag(Number.of.deaths,28)+lag(Number.of.deaths,29) +lag(Number.of.deaths,30)+lag(Number.of.deaths,31) +lag(Number.of.deaths,32)+lag(Number.of.deaths,33)+ lag(Number.of.deaths,34)+lag(Number.of.deaths,35) Appendix 109

+lag(Number.of.deaths,36)+lag(Number.of.deaths,37)+lag(Number.of.deaths,38) +lag(Number.of.deaths,39)+lag(Number.of.deaths,40)+lag(Number.of.deaths,41) +lag(Number.of.deaths,42)+lag(Number.of.deaths,43)+lag(Number.of.deaths,44) +lag(Number.of.deaths,45)+lag(Number.of.deaths,46)+lag(Number.of.deaths,47)+ lag(Number.of.deaths,48)+lag(Number.of.deaths,49)+lag(Number.of.deaths,50)+ lag(Number.of.deaths,51)+lag(Number.of.deaths,52)+lag(Number.of.deaths,53)+ lag(Number.of.deaths,54)+lag(Number.of.deaths,55)+lag(Number.of.deaths,56)+ lag(Number.of.deaths,57)+lag(Number.of.deaths,58)+lag(Number.of.deaths,59)+ lag(Number.of.deaths,60)+lag(Number.of.deaths,61)+lag(Number.of.deaths,62) +lag(Number.of.deaths,63)+lag(Number.of.deaths,64)+lag(Number.of.deaths,65) +lag(Number.of.deaths,66)+lag(Number.of.deaths,67)+lag(Number.of.deaths,68) +lag(Number.of.deaths,69)+lag(Number.of.deaths,70)+lag(Number.of.deaths,71) +lag(Number.of.deaths,72)+lag(Number.of.deaths,73)+lag(Number.of.deaths,74) +lag(Number.of.deaths,75)+lag(Number.of.deaths,76)+lag(Number.of.deaths,77) +lag(Number.of.deaths,78)+lag(Number.of.deaths,79)+lag(Number.of.deaths,80), data=mi(deathsNewdDeal1,deathsNewdDeal2,deathsNewdDeal3, deathsNewdDeal4,deathsNewdDeal5,deathsNewdDeal6,deathsNewdDeal7, deathsNewdDeal8 ,deathsNewdDeal9,deathsNewdDeal10,deathsNewdDeal11, deathsNewdDeal12,deathsNewdDeal13,deathsNewdDeal14,deathsNewdDeal15, deathsNewdDeal16,deathsNewdDeal17,deathsNewdDeal18,deathsNewdDeal19, deathsNewdDeal20) ,model = "poisson",cite = TRUE)

and lastly the combined 20 lag regression both on the independent and dependent variables elig(formula = number.of.new.deals~ Number.of.deaths + lag(number.of.new.deals,1)+lag(number.of.new.deals,2)+lag(number.of.new.deals,3)+ lag(number.of.new.deals,4)+lag(number.of.new.deals,5)+lag(number.of.new.deals,6) +lag(number.of.new.deals,7)+lag(number.of.new.deals,8)+lag(number.of.new.deals,9) +lag(number.of.new.deals,10)+lag(number.of.new.deals,11)+lag(number.of.new.deals,12) +lag(number.of.new.deals,13)+lag(number.of.new.deals,14)+lag(number.of.new.deals,15) +lag(number.of.new.deals,16)+lag(number.of.new.deals,17)+lag(number.of.new.deals,18) +lag(number.of.new.deals,19)+lag(number.of.new.deals,20)+lag(Number.of.deaths,1) +lag(Number.of.deaths,2)+lag(Number.of.deaths,3)+lag(Number.of.deaths,4)+ lag(Number.of.deaths,5)+lag(Number.of.deaths,6)+lag(Number.of.deaths,7) Appendix 110

+lag(Number.of.deaths,8)+lag(Number.of.deaths,9)+lag(Number.of.deaths,10) +lag(Number.of.deaths,11)+lag(Number.of.deaths,12)+lag(Number.of.deaths,13)+ lag(Number.of.deaths,14)+lag(Number.of.deaths,15)+lag(Number.of.deaths,16) +lag(Number.of.deaths,17)+lag(Number.of.deaths,18)+lag(Number.of.deaths,19) +lag(Number.of.deaths,20), data=mi(deathsNewdDeal1,deathsNewdDeal2,deathsNewdDeal3,deathsNewdDeal4, deathsNewdDeal5,deathsNewdDeal6,deathsNewdDeal7,deathsNewdDeal8, deathsNewdDeal9,deathsNewdDeal10,deathsNewdDeal11, deathsNewdDeal12,deathsNewdDeal13,deathsNewdDeal14,deathsNewdDeal15, deathsNewdDeal16,deathsNewdDeal17,deathsNewdDeal18,deathsNewdDeal19, deathsNewdDeal20) ,model = "poisson",cite = TRUE)

This is the ACF for the ”number of new deals” variable:

Figure A.9: ACF of new deals Bibliography

What is escrow? how does escrow work? https://www.escrow.com/what-is-escrow.

Nina Abrosimova. : [how does russian dark net look like]. https://openrussia.org/media/708458/, 2017.

Christopher H Achen. Why lagged dependent variables can suppress the explanatory power of other independent variables. Ann Arbor, 1001(2000):48106–1248, 2000.

Judith Aldridge and David D´ecary-H´etu.Not an’ebay for drugs’: the cryptomarket’silk road’as a paradigm shifting criminal innovation. 2014.

Jonathan Bartlett. Deviance goodness of ﬁt test for poisson regression. http://thestatsgeek.com/2014/04/26/ deviance-goodness-of-fit-test-for-poisson-regression/, 2014.

Arthur Benavie. Drugs: America’s holy war. Routledge, 2012.

Blockchain. Blockchain. https://www.blockchain.com/about/.

Randy Borum. Psychology of terrorism. Technical report, DTIC Document, 2007.

Kenneth E Boulding. A note on the theory of the black market. Canadian Journal of Economics and Political Science/Revue canadienne de economiques et science politique, 13(01):115–118, 1947.

Jamal Bouoiyour, Refk Selmi, et al. What does bitcoin look like? Annals of Economics and Finance, 16(2):449–492, 2015.

BrightPlanet. Bright planet. https://brightplanet.com/about-us/.

111 Bibliography 112

BrightPlanet. Clearing up conclusion. https: //brightplanet.com/2014/03/clearing-confusion-deep-web-vs-dark-web/, 2014.

Christine Choirat, James Honaker, Kosuke Imai, Gary King, and Olivia Lau. Zelig: Everyone’s Statistical Software, 2017a. URL http://zeligproject.org/. Version 5.0-17.

Christine Choirat, James Honaker, Kosuke Imai, Gary King, and Olivia Lau. Zelig: Everyone’s Statistical Software, 2017b. URL http://zeligproject.org/. Version 5.1-1.

Nicolas Christin. Traveling the silk road: A measurement analysis of a large anonymous online marketplace. In Proceedings of the 22nd international conference on World Wide Web, pages 213–224. ACM, 2013.

CoinDesk. Bitcoin usd historical exchange rate data. http://www.coindesk.com/, 2016.

JOSEPH COX. Dark web guns bust: Over a dozen arrested in undercover operation. https://motherboard.vice.com/en_us/article/ dark-web-guns-bust-over-a-dozen-arrested-in-undercover-operation, 2015.

Stefany Coxe, Stephen G West, and Leona S Aiken. The analysis of count data: A gentle introduction to poisson regression and its alternatives. Journal of personality assessment, 91(2):121–136, 2009.

Dean. Dark markets: How to buy things from the deep webs black markets.

Scott H Decker and Barrik Van Winkle. Life in the gang: Family, friends, and violence. Cambridge University Press, 1996.

Gerald P Dwyer. The economics of bitcoin and similar private digital currencies. Journal of Financial Stability, 17:81–91, 2015.

ECB. Virtual currency scheme - a further analysis, 2015.

EMCDAA. The internet and drug markets. Publications Oﬃce of the European Union, Lisbon, 2016.

Mark Featherstone, Siobhan Holohan, and Elizabeth Poole. Discourses of the war on terror: Constructions of the islamic other after 7/7. International Journal of Media & Cultural Politics, 6(2):169–186, 2010. Bibliography 113

Google. How google search works. https://support.google.com/webmasters/answer/70897?hl=en, 2017.

Andy Greenberg. An interview with a digital drug lord: The silk road’s dread pirate roberts? https://www.forbes.com/sites/andygreenberg/2013/08/14/ an-interview-with-a-digital-drug-lord-the-silk-roads-dread-pirate-roberts-qa/ #10f341795732, 2013a.

Andy Greenberg. End of the silk road: Fbi says it’s busted the web’s biggest anonymous drug black market. https://www.forbes.com/sites/andygreenberg/2013/10/02/ end-of-the-silk-road-fbi-busts-the-webs-biggest-anonymous-drug-black-market/ #2ae7a9a95b4f, 2013b.

GTD. Global terrorism database. http://www.start.umd.edu/gtd.

Codebook GTD. Codebook: Inclusion criteria and variables, 2012.

GunPolicy. Armed violence prevention, gun control laws and the small arms trade. https://www.gunpolicy.org.

David Dcary-Htu Rasmus Munksgaard Andersen StExo El Presidente Anonymous Daryl Lau Sohhlz Delyan Kratunov Vince Cakic Van Buskirk Whom Gwern Branwen, Nicolas Christin. Dark net market archives, 2011-2015. https://www.gwern.net/DNM%20archives, July 2015. URL https://www.gwern.net/DNM%20archives.

Robert Augustus Hardy and Julia R Norgaard. Reputation in the internet black market: an empirical and theoretical analysis of the deep web. Journal of Institutional Economics, 12(03):515–539, 2016.

Dong He, Karl Friedrich Habermeier, Ross B Leckow, Vikram Haksar, Yasmin Almeida, Mikari Kashima, Nadim Kyriakos-Saad, Hiroko Oura, Tahsin Saadi Sedik, Natalia Stetsenko, et al. Virtual currencies and beyond: Initial considerations. Technical report, International Monetary Fund, 2016.

James Honaker, Gary King, Matthew Blackwell, et al. Amelia ii: A program for missing data. Journal of statistical software, 45(7):1–47, 2011.

Kosuke Imai, Gary King, and Olivia Lau. Toward a common framework for statistical analysis and development. Journal of Computational Graphics and Statistics, 17(4): 892–913, 2008. URL http://j.mp/msE15c. Bibliography 114

Richard Jackson. Writing the war on terrorism: Language, politics and counter-terrorism. Manchester University Press, 2005.

Mark R Jacobson and Max Daurora. Signiﬁcant trends in illicit traﬃcking: A macro view of the problem and potential means to address it. Atlantic Future, 2014.

Chlamers Johnson. Terror. Society, 15(1):48–52, 1977.

Alexander Kroeger and Asani Sarkar. Why bitcoin exchanges aren’t as straightforward as they seem. https://www.weforum.org/agenda/2016/04/ why-bitcoin-exchanges-arent-as-straightforward-as-they-seem, 2016.

James Martin. Lost on the silk road: Online drug distribution and the cryptomarket. Criminology & Criminal Justice, 14(3):351–367, 2014.

Sam Matthews. Q and a with a deep web arms dealer. http://www.vocativ.com/tech/bitcoin/q-deep-web-arms-dealer/, 2014.

Jeﬀrey A Miron and Jeﬀrey Zwiebel. Alcohol consumption during prohibition. Technical report, National Bureau of Economic Research, 1991.

Aysel Morin. Framing terror: The strategies newspapers use to frame an act as terror or crime. Journalism & Mass Communication Quarterly, 93(4):986–1005, 2016.

Robert J Morton and Mark A Hilts. Serial murder: Multi-disciplinary perspectives for investigators. US Department of Justice, Federal Bureau of Investigation, 2008.

Satoshi Nakamoto. Bitcoin: A peer-to-peer electronic cash system. 2009.

OpenPGP. Open pgp. http://openpgp.org/.

Rebecca Peters. Small arms: No single solution. https://unchronicle.un.org/article/small-arms-no-single-solution, 2009.

Victor Polterovich. Rationing, queues, and black markets. Econometrica: Journal of the Econometric Society, pages 1–28, 1993.

COUNCIL ON FOREIGN RELATIONS. The global regime for transnational crime. http://www.cfr.org/transnational-crime/global-regime-transnationalcrime/ p28656, 2013. Bibliography 115

Paul Resnick and Richard Zeckhauser. Trust among strangers in internet transactions: Empirical analysis of ebay’s reputation system. In The Economics of the Internet and E-commerce, pages 127–157. Emerald Group Publishing Limited, 2002.

Greg Ross. An interview with philip zimbardo. http://www.americanscientist.org/bookshelf/pub/philip-zimbardo.

Gerard Ryle, Will Fitzgibbon, Mar Cabra, Rigoberto Carvajal, Marina Walker Guevara, Martha M Hamilton, and Tom Stites. Banking giant hsbc sheltered murky cash linked to dictators and arms dealers. International Consortium of Investigative Journalists website, February, 8, 2015.

M Lewis Saunders and Philip Lewis. P. & thornhill, a.(2009). Research methods for business students, 4, 2009.

ShootingTracker. Gun violence archive. http://www.shootingtracker.com.

Frank Siebelt.

Lyn Snodgrass. Illegal guns fuel violent crime, wreak deadly havoc in south africa. http://theconversation.com/ illegal-guns-fuel-violent-crime-wreak-deadly-havoc-in-south-africa-49006, 2015.

James H Stock and Mark W Watson. Introduction to econometrics, volume 104, chapter 15. Addison Wesley Boston, 2003. symantec.

TheEconomist. Buying drugs online. shedding light on the dark web. http://www.economist.com/news/international/ 21702176-drug-trade-moving-street-online-cryptomarkets-forced-compete, 2016.

Sam Thielman. Silk road operator ross ulbricht sentenced to life in prison. https://www.theguardian.com/technology/2015/may/29/ silk-road-ross-ulbricht-sentenced, 2015.

TorAbout. Theonionrouter.com. http://www.theonionrouter.com/about/overview.html.en. Bibliography 116

TorProject. Tor browser in numbers. https://blog.torproject.org/blog/tor-browser-numbers, 2017.

TorProtocol. Tor: Hidden service protocol. http://www.theonionrouter.com/docs/hidden-services.html.en.

Eugenio Weigend Vargas and Silvia VILLARREAL GONZ´aLEZ.Regulatory challenges for preventing ﬁrearms smuggling into mexico. Mexican law review, 7(2):63–81, 2015.

VICE. Introducing the vice 2016 mass shooting tracker. https://www.vice.com/en_us/ article/introducing-the-vice-2016-mass-shooting-tracker, 2016.

Jeff Victoroff. The mind of the terrorist: A review and critique of psychological approaches. Journal of Conflict resolution, 49(1):3–42, 2005.

Benjamin Vitaris. Do people really buy weapons from dark web markets? https://www.deepdotweb.com/2016/01/12/ do-people-really-buy-weapons-from-dark-web-markets/, 2016.

Gabriel Weimann. Terrorist migration to the dark web. Perspectives on Terrorism, 10 (3), 2016.

Antweiler Werner. Paciﬁc exchange rate service. the university of british columbia sauder school of business. http://fx.sauder.ubc.ca/, 2007.

Jeﬀrey M Wooldridge. Introductory econometrics: A modern approach. SOTH-WESTERN CENGAGE Learning, 2009.

David Yermack. Is bitcoin a real currency? an economic appraisal. Technical report, National Bureau of Economic Research, 2013.

KIM ZETTER. Fbi fears bitcoins popularity with criminalst. https://www.wired.com/2012/05/fbi-fears-bitcoin/, 2012.

Philip Zimmermann. PGP source code and internals. MIT Press, 1995.

Philip R. Zimmermann. Why i wrote pgp. https://www.philzimmermann.com/EN/essays/WhyIWrotePGP.html, 1999.