8 An Evolving Threat The Deep Web Learning Objectives distribute 1. Explain the differences between the deep web and darknets.or 2. Understand how the darknets are accessed. 3. Discuss the hidden wiki and how it is useful to criminals. 4. Understand the anonymity offered by the deep web. 5. Discuss the legal issues associated withpost, use of the deep web and the darknets. The action aimed to stop the sale, distribution and promotion of illegal and harmful items, including weapons and drugs, which were being sold on online ‘dark’ marketplaces. Operation Onymous, coordinated by Europol’s Europeancopy, Cybercrime Centre (EC3), the FBI, the U.S. Immigration and Customs Enforcement (ICE), Homeland Security Investigations (HSI) and Eurojust, resulted in 17 arrests of vendors andnot administrators running these online marketplaces and more than 410 hidden services being taken down. In addition, bitcoins worth approximately USD 1 million, EUR 180,000 Do in cash, drugs, gold and silver were seized. —Europol, 20141 143 Copyright ©2018 by SAGE Publications, Inc. This work may not be reproduced or distributed in any form or by any means without express written permission of the publisher. 144 Cyberspace, Cybersecurity, and Cybercrime THINK ABOUT IT 8.1 Surface Web and Deep Web Google, Facebook, and any website you can What Would You Do? find via traditional search engines (Internet Explorer, Chrome, Firefox, etc.) are all located 1. The deep web offers users an anonym- on the surface web. It is likely that when you ity that the surface web cannot provide. use the Internet for research and/or social What would you do if you knew that purposes you are using the surface web. The your electronic footprints could not be surface web only accounts for about 4% of all traced? the Internet—the rest is found on the deep web, 2. Why would this be appealing to criminals? sometimes also referred to as the deep net. The deep web is not accessible through tradi- 3. What problems does anonymity create tional search engines. In order to access the for law enforcement and other criminal deep web, special considerations are needed, justice professionals? distribute including private URL addresses or, for some areas, darknets (specialized software). or The Surface Web Before discussing a seemingly unknownpost, aspect of the Internet, it is necessary to define what the majority of users consider to be the Internet: the surface web, or the public web. Like its name, the surface web contains any and all websites accessible via traditional search engines, such as Google. The surface web is accessible to anyone with Internet connection and is hosted by browsers such as Internet Explorer, Firefox, and Google Chrome. According to some sources, there are over 4 billion indexed web pages on the surface web; however, many search enginescopy, do not have the capacity to access all pages.2 On average, Google accesses 16% of the surface web, while other search engines are able to access even less.3 Criminals do operate on the surface web but are more vulnerable to being discovered than if they operate on the deep web. Examples of crime on the notsurface web include the stealing of personal information and data for financial gain. However, even more deceptive are surface websites that operate as legiti- mate businesses but are marketing counterfeit goods. As illustrated in Chart 8.1, millions of dollars in counterfeit goods are seized every year by the U.S. govern- Do ment. Much of this is sold online via websites that are constantly changing their Internet protocol (IP) addresses. Unknown to the buyer, the goods are coun- terfeit and are being sold illegally, taking advantage of the easy access online shopping provides. Copyright ©2018 by SAGE Publications, Inc. This work may not be reproduced or distributed in any form or by any means without express written permission of the publisher. Chapter 8 • An Evolving Threat: The Deep Web 145 CHART 8.1 ● Counterfeit Goods Seized by the United States: 2014 400 350 300 250 200 150 100 50 Total Value of Seized Goods 0 s s toys other footware CDs/DVDslabels/tags watches/jewelry handbags/wallets pharmaceuticals clothing/accessories computers/accessorie distribute consumer electronics/part Source: Based on data from Bain, M. (2015). Counterfeit watches and jewelryor are the new counterfeit handbags. Retrieved from http://qz.com/376249/counterfeit-watches-and-jewelry-are-the-new- counterfeit-handbags/. The Deep Web and Darknets FIGURE 8.1 ● Surface Web Versus the Although the surface web seems vast andpost, infinite, it is Deep Web only a small piece of the Internet compared to the deep web. The surface web is often compared to the tip of the iceberg (see Figure 8.1) of the Internet, as the deep web is 400 to 500 times bigger than the surface web.4 Moreover, there is an anonymity associated with parts of the deep web, specifically on the dark web. There is much confu- sion between the deepcopy, web and the dark web. These terms are often used interchangeably, but these two areas are not the same. The dark web is just a small portion of the deep web. Both are inaccessible from the surface web, and many general Internet users are unaware of their existence. Thenot deep web consists of all data behind firewalls. Surface websites use “crawlers” to browse the web in a systematic and automated manner. Deep websites cannot be found via these crawlers. Deep websites can include Dopasscode protected websites, websites that are not search- able, sites that are not linked to other programs (in which the URL must be typed in), medical databases, business Intranets, and darknets (dark web).5 © iStockphoto.com/traffic_analyzer Copyright ©2018 by SAGE Publications, Inc. This work may not be reproduced or distributed in any form or by any means without express written permission of the publisher. 146 Cyberspace, Cybersecurity, and Cybercrime FIGURE 8.2 ● Deep Versus Darknets (Dark Web) Deep Web Darknets distribute Darknets (also referred to as dark web) make up a small part of the massive deep web (see Figure 8.2), and this is where the majority of criminal activities on the deep web occur. There are two main forms of darknets:or peer-to-peer networks (used for file sharing) and large anonymous networks.6 We concentrate on the large anonymous networks in this chapter. Due to the anonymity provided, many criminals may feel more comfortable operating in the darknet market than on the surface web or even in the physical world. One reason for this is the lack of law enforcement presence on the deep web. It is extremely difficult to track the digital footprints of criminals on the deep web (see Chapter 9 and thepost, discussion of guardianship for more). Another reason for the high prevalence of criminal activity on the deep web is the ease of accessibility. Accessibility Accessing darknets is relatively easy, although it cannot be done via surface web searchcopy, engines (i.e., Google). There are multiple portals for the darknet, including Freenet, I2P, and The Onion Router. To access the darknet, one must first download one of these platforms. Freenet describes itself as “a peer-to- peer platform for censorship-resistant communication and publishing. Browse websites, post on forums, and publish files within Freenet with strong privacy notprotections.” 7 The Invisible Internet Project (I2P) advertises that “The I2P network provides strong privacy protections for communication over the Internet. Many activities that would risk your privacy on the public Internet can be conducted anony- Do mously inside I2P” and that it is “an anonymous overlay network—a network within a network. It is intended to protect communication from dragnet surveil- lance and monitoring by third parties such as ISPs.”8 Although both of these provide sufficient access to darknets, the most popular portal for access is The Onion Router. Copyright ©2018 by SAGE Publications, Inc. This work may not be reproduced or distributed in any form or by any means without express written permission of the publisher. Chapter 8 • An Evolving Threat: The Deep Web 147 The Onion Router The Onion Router (aka ToR) was originally developed by the U.S. Naval Research Laboratory as a method of anonymous communication. It can be down- loaded for free, and the website asserts: Tor is free software and an open network that helps you defend against traf- fic analysis, a form of network surveillance that threatens personal freedom and privacy, confidential business activities and relationships, and state security.9 In regard to security, ToR protects you by bouncing your communications around a distributed net- work of relays run by volunteers all around the world: it prevents somebody watching your Internet connection from learning what sites you visit, and it prevents the sites you visit from learning your physical location.10 distribute The number of ToR users around the world is increasing (see Chart 8.2), as many find benefit to the anonymity provided by the server. Once hidden within the lay- ers of ToR, individuals can browse the darknets while their privacyor is protected. Sites on the ToR network end in .onion, but if you were to type the web address into Google, the website would not be found. According to the ToR website, people use this platform for multiple noncriminal reasons, as outlined in Table 8.1. TABLE 8.1 ● Benefits of ToR Use post, Who Is Using ToR? Why? (Activity) People Without Malicious Surf the net in privacy, protect themselves and their Intent families Businesses Research competitions, keep strategies secret, internal copy,accountability Activists Report abuses and violations from dangerous locations; whistleblowing Media Protect sources, resources, and report from areas where not it is dangerous Military/Law Enforcement Protect communications, investigations, and intelligence DoSource: Based on information from torproject.org.