INNOVATION REPORT ANONYMOUS NETWORKS & DARKNET INTERPOL Innovation Centre 18 Napier Road Singapore 258510 INTERPOL Global Complex for Innovation INNOVATION REPORT: ANONYMOUS NETWORKS & DARKNET September 2018 EXECUTIVE SUMMARY The Internet has provided an enormous opportunity for the global economy and social prosperity, but presents some significant challenges for law enforcement. Network anonymisation and the Darknet are used for legitimate reasons by people wishing that their privacy is maintained, but the Darknet is also used to camouflage illicit activities. The challenge for police investigators is to work through the myriad of technology and encryption capabilities to uncover the intent and extent of criminal activities. This investigative analysis has seen significant disruptions in criminal activity on the Darknet, including the taking down of Silkroad and AlphaBay markets. Police have witnessed the resilience of criminal conduct and operations in this environment. Countering this resilience requires a concerted effort from global law enforcement to mitigate the risks of illegal vendor shops and marketplaces, the “crimes as a service’ economy, child abuse, extremist and radicalisation and other Darknet related crimes. To prepare law enforcement for the current threat and the future of cyber enabled crimes, it is recommended that Chiefs of Police consider: 1. Hiring and training technical experts on Internet, Deep web and Darknet capabilities; 2. Investing in tools such as web crawling, data mining and cryptocurrency analytical tools; and 3. Reporting and sharing cybercrime instances with other agencies to develop universal capabilities across law enforcement agencies. The INTERPOL Innovation Centre is fostering global efforts to facilitate the above goals by providing support, expertise and coordination. 2 1. INTRODUCTION Technology, in general, has created enormous opportunities in economic and social prosperity but has also triggered massive challenges for law enforcement as criminals can easily use them to conduct their illicit actions while evading attribution. Network anonymisation techniques are one such example. They enable users worldwide to communicate and exchange information securely. Allowing journalists, human rights advocates, political dissidents and law-abiding citizens that are concerned about their privacy to avoid censorship and freely communicate. However, despite the lawful use of these technologies they are perceived as a double-edged sword as they are also used extensively by criminals for their illegal endeavours. Creating a haven, called Darknet, for various illicit activities and groups away from the eyes of Law Enforcement Agencies (LEAs), in particular the trading of illicit goods and services (including drugs, firearms, credit card or account details, falsified documents, stolen goods, etc.), terrorism communications, crime-as-a-service, cybercrime software solutions, child exploitation material dissemination, money laundering, etc. Darknet is described as a camouflaged/encrypted communication network that sits on top of the normal internet (aka. A Network of networks). To access the Darknet, specialised anonymity software and browser configurations are needed. These allow users to communicate, exchange information and goods facilitating the ultimate goal of committing crimes in a digitally concealed medium, uncontrolled by central authorities, governments and regulators with minimal constraints and efforts to access. In the context of policing, we often encounter investigators focusing their efforts on the analysis of Darknet markets where illicit goods and services are traded. These investigations have had some significant outcomes for law enforcement thwarting criminal networks. Examples include the take- down of Silk Road 1.0, Silk Road 2.0, AlphaBay and the Hansa markets. Despite the numerous takedowns, an increasing number of Darknet markets and forums are appearing and facilitating more diverse types of illegal operations, such as Hackers for hire, Bio-terrorism guidelines, etc. Apart from the vast increase in the number of Darknet markets and forums as well as their illicit services and goods traded, the law enforcement community has also witnessed a significant increase in the sophistication and manner that criminals conduct their operations and cyber security activities in these environments. Presenting additional challenges and limitations for law enforcement to trace and track these activities within these Darknet markets and forums to real world criminal entities. 2. Analysis and Background Information INTERNET The Internet is the global infrastructure which interconnects various networks and electronic devices through the use of standardised communication protocols such as the Internet Protocol (IP) and computer languages such as HyperText Markup Language (HTML); it is a ‘network of networks’. Through the Internet, an individual can access and use a number of applications, amongst them: Communication Platforms – Online chat and instant messaging between users. This is enabled by software programs such as the Internet Relay Chat (IRC), MSN Messenger, WhatsApp, etc. 3 E-mail Platforms – electronic messages sent from one user to one or more recipients. Software such as Mozilla Thunderbird which facilitates creation, sending, receipt and viewing of these messages. Web Sites – Consisting of a set of related HTML documents and other scripting artefacts collected together under a single domain name (for example: www.interpol.int). 1 A site typically contains a mixture of text and multimedia content for a particular purpose (For example: a banking website which enables customers to access their account, discover services offered by the bank etc.). Online Gaming Platforms – Electronic games played over a local network of computers (LAN) or the Internet which enables two or more players to participate simultaneously from different locations. Social Media Sites and platforms – Applications that enable an individual to create and share content, or participate in social interactions, with other individuals. Cloud storages – Remote data storage facilities which allow its users to save their valuable data safely online. The data is then physically hosted inside server farms of large data storage providers throughout the world. An individual uses an electronic device such as a computer, smartphone or a tablet computer to access these applications. Historically, a computer-based user would access the above services via his/her Internet browser (Internet Explorer, Firefox, etc.) to connect to the provider's domain name (website, i.e., www.facebook.com). Nowadays, a typical end user would use an application on his smartphone to interact with these services. Some service providers don’t even offer a website based service anymore (i.e., there is no website to play a Candy Crush game). To do so, users load and save various software programs/applications to their electronic device which enables them to access specified services provided through these applications (for example: an e-mail client to access e-mails, a WhatsApp client to chat with other WhatsApp users). The electronic device connects to the Internet via an Internet service provider (ISP). Figure 1 How an individual accesses the Internet via an ISP An individual pays a subscription fee to the ISP to be able to use the ISP to access the Internet. The ISP provides the internet access via an electronic device known as a modem (aka a “box”) and a family of Digital Subscriber Line (DSL) technologies. Currently, ISPs typically deliver Internet access via standard telephone copper cables, Cable TV lines or optical fibre cabling. A dedicated modem for each of these types is required. 4 ANONYMOUS NETWORKS Being a network of networks, the Internet consists both of open, public and private networks. When an individual accesses an application on an open network, their identity is not typically concealed, and a third party can track their online activity. This means that the websites they visit, things they discuss via IRC, or the content they access can be identified and/or monitored. However, the possibility of being tracked is reduced or disguised for an individual who accesses an anonymous network. Although anonymous networks cannot provide an individual with complete obscurity, they give an individual more significant opportunities to hide their online activities. This is because information and content are anonymously shared and possibly encrypted, disguising an individual and their online activities, and making it harder for third parties (such as law enforcement agencies) to identify the individuals and monitor activities. Anonymous networks are often considered to be locations which are used to facilitate illicit online activity because there is less likelihood of detection and disruption than if the same activity was conducted on an open Internet network. Deep web Some companies scan the web to index contents making it readily searchable in a central location for internet users to find (i.e. Google, Bing, Yandex, DuckDuckGo, etc.). These “search engine” companies use spiders/crawlers/robots (dedicated pieces of software) to scout the web in search of data to index. These tools are limited in their scanning of data within anonymous networks, restricted access and private areas of the internet. Research studies estimate that standard search engines do not index approximately 96% of the data on the Internet. The contents of the