Author Guidelines for 8

Proceedings of the 53rd Hawaii International Conference on System Sciences | 2020 Knowledge Sharing Network in a Community of Illicit Practice: A Cybermarket Subreddit Case K. Hazel Kwon Weiwen Yu Steve Kilar Arizona State University Arizona State University Arizona State University [email protected] [email protected] [email protected] Chun Shao Kailey Broussard Thomas Lutes Arizona State University Arizona State University Arizona State University [email protected] [email protected] [email protected] Abstract online communities of lawful practices. Often neglected is the fact that online knowledge sharing Often neglected in the literature about communities communities exist, and thrive, for illicit collectives of practice is the fact that online knowledge-sharing whose activities are stigmatized or outlawed [10]. communities thrive among illicit collectives whose Illicit knowledge sharing communities are mostly activities are stigmatized or outlawed. This paper hosted in a hidden side of the digital world: the dark focuses on a knowledge-sharing community of users web, a collection of websites and web services that are who engage in illegal practices by examining the ways accessible only through an anonymizing browser (e.g., in which the community’s network structure changes Tor) or special routing software (e.g., I2P). Not all when a high-stakes, uncertain event—the July 2017 activities in the dark web are harmful. In fact, some shutdown of the dark web market Alphabay—occurs. dark web activity helps expand civil liberties, This study compares the discussion network structures challenging an institutionalized, governmental, or in the subreddit r/AlphaBay during pre-shutdown days otherwise rigid notion of “legitimacy” [11]. The dark (the “routine” period) and shutdown days (the web often serves as the most secure channel for free “market defect” period) and offers a content analysis speech, offering space for journalists, whistleblowers, of the knowledge and resources shared by users during and political dissidents who challenge repressive these periods. Several differences were observed: (a) regimes [12, 13]. the network structure changed such that the network Nonetheless, much dark web activity is dedicated size grew while becoming more centralized; (b) new to transactions involving illegal products (e.g., drugs crisis-specific players emerged; (c) types of knowledge and weapons), cybercrimes (e.g., malware and cyber- shared during the market defect period was frauds), and the circulation of harmful content (e.g., qualitatively different from the routine period. child pornography). The ecology of communities of illicit practices is complicated by the fact that some dark web-related content is visible in the surface web (e.g., subreddits, news aggregator sites). However, 1. Introduction information exchanges that occur within communities of illicit practices almost always use anonymization Knowledge sharing communities are technologies to conceal identities, regardless of commonplace in digital spaces. Decades of literature whether the community operates only in the darknet or has explored motivations for and effectiveness of is visible in both the dark and surface web. knowledge collaboration online in various contexts This paper focuses on knowledge sharing such as business [1, 2], distributed software communities of dark web users who engage in illegal development [3—5] and e-learning [6—8]. economic practices. Specifically, we define a cyber- Studies on virtual knowledge sharing have largely underground market community as a self-organized centered around the notion of “communities of community of practice and examine the ways in which practice,” an informal group of people who share the community’s knowledge sharing network structure knowledge, resources, and meaning, and collectively changes when a high-stakes, uncertain event occurs. learn how to solve problems or do the work better [9]. Illegal markets have been one of the most troubling Most studies of knowledge collaboration examine cybersecurity issues concerned with dark web URI: https://hdl.handle.net/10125/64076 978-0-9981331-3-3 Page 2731 (CC BY-NC-ND 4.0) activities, and thus worth the empirical attention. The markets, other commodities such as weapons, illegal empirical case of interest is the subreddit community services, hacked data, and malware are also sold. r/AlphaBay, which was dedicated to discussing a If marketplaces are one pillar of the cyber- cryptomarket called AlphaBay. AlphaBay, which underground economy, the other pillar is discussion became the biggest cyber-underground market, forums [19]. Given the instability of market platforms, operated from December 2014 until July 2017, when it the sustainability of the cyber-underground economy was compromised and permanently shut down by law depends on timely information sharing among market enforcement [14]. This study compares the discussion members to help assess vendor and platform credibility network structures in r/AlphaBay during pre-shutdown and security updates. Beyond the whole market being days (the “routine” period) and shutdown days (the compromised, even a single individual’s identity “market defect” period). This study also offers a breach can increase the collective risk. Therefore, content analysis of the types of knowledge and community members tend to be proactive with respect resources that were shared by users during these to sharing knowledge about identity concealment periods and how members’ communicative activities strategies, called OPSEC [20—22]. Vendors and users differed during the two periods. often maintain the same screen name across different marketplaces and forums as a trust-building 2. Illicit Cybermarket Communities in the mechanism [19]. Participation in discussion forums helps contributors advertise products, demonstrate Dark Web expertise, and gain visibility as reliable informants. A positive reputation established in discussion forums The existence of cryptomarkets in hidden parts of can function as social capital [23] that may translate the web has become widely known to the public since into higher economic returns. the seizure of the infamous cyber-underground marketplace SilkRoad by the Federal Bureau of 3. Illicit Cybermarket Communities as Investigation in October 2013. Research has found that illicit drugs comprise the most common products Self-Organized Communities of Practice exchanged in cryptomarkets, followed by stolen data [15, 16]. AlphaBay was no exception: A vast portion of Considering the role online forums play in the illicit online discussions about the AlphaBay market alluded cybermarket ecology, an examination of the network to illegal drugs. structures in these forums may help explain how Virtual information sharing to assist drug cybermarket users engage in knowledge sharing to transactions is arguably older than the Internet. pursue their collective interests. Accordingly, we Stanford University and MIT students struck a deal propose to conceptualize illicit cybermarket forums as regarding a marijuana sale in the early 1970s through self-organized communities of practice. the ARPANET, the Internet’s predecessor [17]. In the The characteristics of illicit market forums fit 1980s and 1990s, a forum known as alt.drugs existed incredibly well the definition of communities of in Usenet for drug-related discussions [17]. Early cyber practice. Communities of practice are defined as drug markets such as AdamFlowers were based on “groups of people informally bound together by shared encrypted email accounts and relied on monetary expertise and passion for a joint enterprise” [24, p. transactions via Western Union, Paypal, Pecunix, I- 139]. Communities of practice have become an integral Golder and cash [18]. part of organizational systems that require some level Illicit market transactions in the early days were of collective knowledge management, including sometimes traceable, making it was easier for law business, government, education, and social sectors enforcement to detect the involved actors [18]. The rise [25]. Online networks help create decentralized of anonymizing technologies such as Tor, Virtual communities of practice that are larger scope and size. Private Network (VPN), and cryptocurrency enhanced The ways in which hidden cyber-collectives exploit the security of transactions, contributing to the digital platforms are commensurate with essential expansion of the illicit digital economy. As of April features of communities of practices [24, 25]. 2019, 11 retail markets and seven vendor shops were listed as English-based marketplaces on 3.1. Purposiveness deepdotweb.com, one of the main news sites for dark web market users. Although the status of those A community of practice “is defined by a shared marketplaces may fluctuate (e.g., being offline, online, domain of interest” [25, p.1]. The illicit market actors or temporarily unavailable), they are active markets. share a clearly defined agenda: to engage in economic While drugs are the most common products in these activities that are stigmatized or outlawed by legitimate Page 2732 institutions. Due to the nature of illegitimacy, members A community of practice is not a formal also share another problem: OPSEC. Specifically, the organization. Unlike project group assignments or interests in OPSEC have evolved at two levels. At the organizational divisions, members voluntarily choose “system level,” market platforms are vulnerable to the to be a part of the community [24]. Individual

Load more