The Dark Side of the Web: ISIL’S One-Stop Shop? by Beatrice Berton

30 2015 Uncredi t ed/AP/S I PA

The dark side of the web: ISIL’s one-stop shop? by Beatrice Berton

In addition to its territorial expansion, the Islamic as it is inaccessible to most but navigable for the State of Iraq and the Levant (ISIL) has also em- initiated few – and it is completely anonymous. barked on a new campaign in the realm of cyber warfare. While Western law enforcement agen- The most popular means of accessing and navigat- cies are already tackling ISIL’s propaganda, training the Dark Web is to use a Tor browser. Conceived ing programmes and recruitment drives on the by the US Navy as a means of protecting sensitive mainstream web, the US Cyber Command has ex- communications, the Tor browser allows users to pressed its concerns over the growing penetration hide their IP address and activity through a world- of terrorist organisations into the so-called Dark wide network of computers and different layers Web, the hidden underbelly of the online world’s of encryption (like the layers of an onion), which Deep Web. guarantee their anonymity. Hidden services and marketplaces are listed on index pages such as the The web we know and use every day, made up of Hidden Wiki and are accessible only through Tor. websites accessible through conventional search Silk Road, a notorious online marketplace which engines such as Google, is referred to as the Surface sells drugs and weapons, was shut down by the Web. Few web users are aware that there is a Deep FBI in 2013, but a variety of black markets such Web, a larger (about 500 times) section of the as Agora, Evolution and AlphaBay soon filled the web consisting of websites, networks and online void and welcomed many of the buyers and sellers content which are not indexed by search engines. previously associated with Silk Road. While much of this unindexed material is harm- less, a smaller portion is intentionally hidden. It is The other side of Bitcoin within this unregulated environment that a variety of criminal organisations openly trade drugs, fire- ISIL’s adept use of social media makes the head- arms, child pornography and other illicit materi- lines, but the appeal of the Dark Web lies first and als. foremost in the anonymity of its services. Sadaqa (private donations) constitute one of ISIL’s main An ideal ecosystem sources of revenue, and its supporters around the world have allegedly used digital currencies such ISIL’s activities on the Surface Web are now being as Bitcoin to transfer money quickly to accounts monitored closely, and the decision by a number of held by ISIL militants while minimising the risk governments to take down or filter extremist con- of detection. Cryptocurrency, the digital equiva- tent has forced the jihadists to look for new online lent of cash, is often used for payments related to safe havens. The Dark Web is a perfect alternative illegal trade, extortion or money laundering as it

European Union Institute for Security Studies June 2015 1 particularly hard to trace. Dark Web marketplac- of US Cyber Command, recently stated that ISIL’s es such as Wall Street, Clone CC Crew or Atlantic activities on the Dark Web boost its capacity to Carding might also be used as a source of addition- sustain itself financially, as well as improve its op- al funding because they specialise in selling stolen erational effectiveness on the ground. Their recent credit card details, hacked PayPal credentials and military successes are likely to put more pressure even stolen Uber accounts. on governments to grant law enforcement agencies access to encrypted communications by de- Weapons, tutorials and forums signing ‘backdoors’ in encryption software. Such proposals will, in turn, fuel already heated debates While the EU boasts some of the toughest firearms about citizens’ privacy and civil liberties. regulations in the world, procuring guns within its borders is still possible, partly thanks to the Dark While law enforcement agencies have referred to Web. EuroGuns is an online marketplace which the Dark Web as a ‘gaping hole’ and admitted that deals in all kinds of weapons and sends them via they often lack the tools and resources needed regular mail. AK-47s – the type of assault rifle used to protect citizens, online anonymity is widely by the Kouachi brothers in the Charlie Hebdo at- regarded as a right. Moreover, privacy advocates tacks – are sold for $550 each on EuroArms, one argue that encryption is an essential tool for dis- of the largest online black markets for purchasing sidents and activists living in countries ruled by weapons. In the spirit of Anwar al-Awlaki’s brand oppressive regimes. While striking a balance be- of ‘self-help’ terrorism, several texts such as the tween protecting civil liberties and maintaining Terrorist’s Handbook and the Explosives Guide can security is not an easy task, the key challenge for also be purchased on AlphaBay. governments is to prioritise tailored responses and strategies instead of plumping for widespread, As a result of strengthened border controls and indiscriminate monitoring strategies. legal constraints placed on individuals linked to ISIL, travelling to Syria and Iraq has become in- …by onymising the anonymous creasingly difficult for jihadist sympathisers. The Dark Web allows users to bypass some of these The transnational nature of cyber jihadism means restrictions: Fake Documents Service, for instance, that any response requires a global approach. A offers clients ‘original high-quality fake passports, case in point is the joint operation conducted by driver’s licenses, ID cards, stamps and other prod- Europol, the FBI and the Department of Homeland ucts’ for use in the UK, US, Australia and Belgium, Security in 2014, Operation Onymous, which led to among other countries. the closure of over 400 black market websites and the arrest of 17 vendors and administrators. It has Jihadist forums and chatrooms on the Surface Web not yet been revealed whether law enforcement were widely used by al-Qaeda in the mid-2000s. agencies have found a way of penetrating Tor’s de- After raids by security services led to the arrest fences, but new efforts are underway to map out of several jihadist supporters, many extremist fo- the hidden services available on the Dark Web. rums moved to the Dark Web, where private vir- tual spaces are encrypted and membership needs The US Defense Advanced Research Projects to be verified by administrators. Links and path- Agency (DARPA) has developed new technology ways to these closed-access spaces are then usu- capable of finding content and analysing patterns ally made available on the social media accounts of activity on the Dark Web. The Memex search en- of extremist groups. Occasionally, different terror- gine, originally designed to counter human traffick- ist groups compete for control of these forums: ing rings, will be instrumental in identifying ISIL’s Shumukh al-Islam, for example, is a forum which cyber activities and limiting their access to online oscillates between ISIL and al-Qaeda supporters. resources. With ISIL actively looking for hackers ISIL militants also profit from secure and private and computer scientists to bolster its ranks, law communication on the Dark Web: email services enforcement authorities need to continue invest- such as Sigaint and TorBox allow users to send and ing in the training of cybersecurity experts and the receive messages without revealing their location strengthening of forensic capacities. But most of or identity. all, they need to make better use of the existing frameworks for international cooperation. Stopping the flow of resources… Beatrice Berton is a Junior Analyst at the EUISS. ISIL’s ability to generate funding online has allowed it to evolve from a regular terrorist group to a pro- to-state organisation. Michael S. Rogers, the head

European Union Institute for Security Studies June 2015 2