Assessing the Extent and Nature of Wildlife Trade on the Dark Web

Research Note Assessing the extent and nature of wildlife trade on the dark web

Joseph R. Harrison,∗ David L. Roberts,†‡ ¶ and Julio Hernandez-Castro∗‡ ∗School of Computing, University of Kent, Canterbury, Kent CT2 7NF, U.K. †Durrell Institute of Conservation and Ecology, School of Anthropology and Conservation, Marlowe Building, University of Kent, Canterbury, Kent CT2 7NR, U.K. ‡Interdisciplinary Centre for Cyber Security Research, University of Kent, Canterbury, Kent CT2 7NF, U.K.

Abstract: Use of the internet as a trade platform has resulted in a shift in the illegal wildlife trade. Increased scrutiny of illegal wildlife trade has led to concerns that online trade of wildlife will move onto the dark web. To provide a baseline of illegal wildlife trade on the dark web, we downloaded and archived 9852 items (individual posts) from the dark web, then searched these based on a list of 121 keywords associated with illegal online wildlife trade, including 30 keywords associated with illegally traded elephant ivory on the surface web. Results were compared with items known to be illegally traded on the dark web, specifically cannabis, cocaine, and heroin, to compare the extent of the trade. Of these 121 keywords, 4 resulted in hits, of which only one was potentially linked to illegal wildlife trade. This sole case was the sale and discussion of Echinopsis pachanoi (San Pedro cactus), which has hallucinogenic properties. This negligible level of activity related to the illegal trade of wildlife on the dark web relative to the open and increasing trade on the surface web may indicate a lack of successful enforcement against illegal wildlife trade on the surface web.

Keywords: CITES, darknet, deep web, enforcement, illegal wildlife trade, internet, police, Tor

Valoracion´ de la Extension´ y la Naturaleza del Mercado de Vida Silvestre en la Red Oscura Resumen: El uso del internet como plataforma de comercio ha resultado en un cambio en el mercado ilegal de vida silvestre. El escrutinio incrementado del mercado ilegal de vida silvestre ha resultado en preocupacion´ por que el mercado ilegal de vida silvestre llegue a la red oscura. Para proporcionar una l´ınea base del mercado ilegal de vida silvestre en la red oscura descargamos y archivamos 9,852 objetos (publicaciones individuales) de la red oscura y despu´es los buscamos con base en una lista de 121 palabras clave asociadas con el mercado ilegal de vida silvestre en l´ınea, incluyendo 30 palabras clave asociadas con el marfil de elefante comerciado ilegalmente en la superficie de la red. Los resultados se compararon con objetos conocidos por ser comerciados ilegalmente en la red oscura, en espec´ıfico el cannabis, la coca´ına y la hero´ına, para comparar la extension´ del mercado. De estas 121 palabras clave, cuatro resultaron en aciertos, de los cuales solo´ uno estuvo potencialmente conectado con el mercado ilegal de vida silvestre. Este caso unico´ fue la venta y discusion´ de Echinopsis pachanoi (cactus de San Pedro), que tiene propiedades alucinogenas.´ Este nivel insignificante de actividades relacionadas con el mercado ilegal de la vida silvestre en la red oscura en comparacion´ con el creciente mercado abierto en la superficie de la red puede indicar una falta de autoridad exitosa en contra del mercado ilegal de vida silvestre en la superficie de la red.

Palabras Clave: autoridad, CITES, ilegal, internet, mercado ilegal, polic´ıa, red oscura, red profunda, Tor

¶Address correspondence to D. L. Roberts, email [email protected] Paper submitted February 13, 2015; revised manuscript accepted February 18, 2016. 1 Conservation Biology, Volume 00, No. 0, 1–5 C 2016 Society for Conservation Biology DOI: 10.1111/cobi.12707 2 Wildlife Trade on the Dark Web

Introduction ketplace for selling illegal items, primarily drugs. Anony- mous networks have been the focus of recent attention Illegal wildlife trade is pervasive and of global concern from law enforcers. For example, Operation Onymous (Economic and Social Council of the United Nations aimed to close down drug markets, money laundering 2013). Such a trade is facilitated, in part, by the global services, and contraband sites (Europol 2014). Whether reach of the internet, over which billions of transactions such networks actually provide anonymity or security occur daily. There is interest in measuring the volume is the subject of speculation given that numerous law- of trade in wildlife occurring over the internet through enforcement operations have been successful (Boiten & business, auction websites (Hernandez-Castro & Roberts Hernandez-Castro 2014). With classic illegal trades (e.g., 2015), and social media (Yu & Jai 2015). The volume drugs and firearms) moving to the dark web (Christin of legal internet trade masks, either through launder- 2013), it is a reasonable assumption that those wishing to ing or sheer volume, a substantial level of illegal trade conduct illegal wildlife trade might also migrate to such (Hernandez-Castro & Roberts 2015). networks. Concerns over illegal wildlife trade have increased Illegal markets on the Tor network typically operate recently at all levels, internationally (e.g., London as hidden services. The protocol used enables the Conference on the Illegal Wildlife Trade 2014), location of servers and clients to remain anonymous nationally (e.g., UK government commitment on ivory to one another while allowing them to communicate [Nature Check 2013]), and locally (e.g., state bans confidentially. Due to the protocol design, there is no on ivory [Atkins 2015]). Online companies are being single network-wide database of all hidden services pressured to increase the rate at which they detect (Tor Project 2014b). As part of the hidden service proto- such trade (Sajeva et al. 2013), to make requirements col, websites are allocated a 16-character .onion domain for trade more explicit (e.g., Article 10 certificate address, much like a typical domain name. However, this [http://www.preloved.co.uk/animals/cites]), and even identifier is the public component of a service’s keypair, to ban certain trades (e.g., eBay’s ban on ivory [Brewer- and the information necessary to access a hidden service Hay 2008]). With increased focus on illegal trade on can only be updated using the corresponding private key the surface web, such trade could move to anonymous to prevent hijacking attempts (Tor Project 2014a). The networks such as the darknet (also known as the .onion address is a human readable representation of an “dark web”), as has occurred with drugs, firearms, and 80-bit number, which is base32-encoded. A sequential ap- pornography (Nuwer 2014). To date, however, few proach for searching all possible .onion addresses would have explicitly examined wildlife trade over anonymous require connection access attempts to 280 services. Even networks to determine whether such trade is taking at a rate of 10,000 attempts per second, it would take place. We conducted the first preliminary survey of 3.8 trillion years, making this simplistic approach illegal wildlife trade on the dark web. impossible.

Anonymous Networks Methods

Anonymous networks, such as those implementing lay- Although markets operating as hidden services are now ered encryption (onion routing) (e.g., Tor network partially indexed and could be considered no longer part [https://www.torproject.org]), are specifically designed of the deep web, their physical locations are still con- to offer users anonymity. These networks enable users cealed by the hidden service protocol and their domains to communicate and exchange money (e.g., cryptocur- are impossible to determine. Services such as Tor2Web rencies) anonymously. The main aims of such networks (Swartz et al. 2014) allow access to the Tor network via are to hide the location and identity of users and keep the surface web, rendering the dark web accessible. It the contents of communications confidential (Reed et al. is therefore possible to discover markets that are operat- 1998). Although the popular term deep web refers to ing as hidden services via existing indexing services and, parts of the web that are not indexed by, or accessible most commonly, through posts in social media sites as via, search engines, we focused on sites and services lo- users discuss the locations of dark-web markets or create cated on the dark web (i.e., those intentionally hidden contents and lists for other users. and inaccessible via the surface web). We constructed a list of markets from the /r/DarkNet- Because anonymous networks allow users to perform Markets subreddit (http://reddit.com/r/DarkNetMakets) (in theory) any activity without revealing their true iden- and from The Hidden Wiki (http://thehiddenwiki.org/), tity, illegal activities can easily take place. A prominent a de facto index of Tor domains. These represent 2 main example is the Silk Road (Gayathri 2011), known as a mar- indexes covering much of the darknet. In this paper, a

Conservation Biology Volume 00, No. 0, 2016 Harrison et al. 3 site is what runs on a domain, although a site could run and counterfeiting. Specifically, bone resulted in 126 on multiple domains much in the same way eBay.com hits, linked in one case to one item referring to bone-dry could be considered equivalent to eBay.co.uk. A market cannabis and in another to bone-marrow donation. The is representative of a site in that it may run, for example, keyword faux had 16 hits associated with the sale of faux specialist e-commerce software or a message board. Oakley sunglasses, and one user reporting having enough We scraped these markets for HTML-only content with of the faux stigma . . . surrounding drugs. The keyword Scrapy (http://scrapy.org/), which allows users to build ivory had 13 hits and was associated with one instance scrapers tailored to a specific target. Scrapy catalogs a of Ivory Wave (the drug desoxypipradrol [2-DPMP]). The page, finds all links on it that point to the same domain, only keyword that resulted in hits potentially related to and then repeats the process for any link it has not yet illegal wildlife trade was cactus, which generated 565 encountered. We configured Scrapy to connect via the hits, although these were in fact the same page available Polipo HTTP proxy because Scrapy cannot communicate via different URLs (hence not treated as duplicates by the via SOCKS, the internet protocol used by the TOR client. crawler). This page contained a discussion of powdered The scrapped data were stored and cataloged in Elastic- San Pedro cactus (Echinopsis pachanoi) and its sale. The Search (https://www.elastic.co/). This involved saving keywords cannabis had 2018 hits, heroin 588 hits, and the text of the page with all HTML tags stripped and cocaine 450 hits. indexing them along with metadata (e.g., URL and access time). The indexing process in ElasticSearch involves sav- ingthecontentpassedtoit,butitalsoindexestermsin Discussion the page so that they can be easily searched for later. We used keywords associated with illegal online We found little evidence of illegal wildlife trade over the wildlife trade on the surface web to search the archived dark web, the single exception being San Pedro cactus. markets. The search terms covered 49 taxa (e.g., bear, This species is listed on the International Union for Con- gorilla,andpython) and 89 products (e.g., fur, skin,and servation of Nature Red List as least concern (Ostalaza taxidermy)asidentifiedbytheInternationalFundfor et al. 2013). It is widely distributed, its populations appear Animal Welfare (IFAW 2014) and further included cactus stable, and there is no evidence of negative effects from and orchid. In a focus on elephant ivory, we searched trade. It is used as an ornamental horticultural species for 30 keywords used in this context on the surface web and for rituals (Ostalaza et al. 2013). It is this latter use, (e.g., faux ivory and ox bone) (IFAW 2014). In a compari- as a hallucinogen, which has rendered it illegal. In some son of illegal wildlife trade on the dark web and drugs, we countries, it is legal to grow it for horticultural purposes also searched for heroin, cocaine,andcannabis.Aswell but illegal to grow it for use as a hallucinogen (e.g., Mc- as counterfeit items, firearms, and pornography, drugs Candless 2006). Even so, all species of cacti are listed in are commonly found for sale on the darknet and therefore Appendix II or above of the Convention on International make an appropriate illegal trade with which to compare Trade in Endangered Species (CITES 2015); therefore, the illegal wildlife trade. any transboundary trade requires a permit. The timing of Operation Onymous (5–6 November Although the search terms we used, specifically those 2014), an international law-enforcement operation target- associated with illegal trade in elephant ivory, are a rea- ing darknet markets and other hidden services (Europol sonable starting point, they raise an interesting method- 2014), coincided with our study. As a result, a number of ological question. Why would criminals use the same markets were removed and could not be searched. keywords on the dark web as on the surface web? There is insufficient evidence that they use code words in the dark web to disguise their trade (e.g., eBay [Brewer- Results Hay 2008]). By its very nature, the dark web is difficult to police, and the use of code words may be unnecessary We sampled 14 markets, of which 9 required user reg- because criminals can potentially trade securely without istration. Of these, 7 used CAPTCHAs (completely auto- the necessity for the use of detection-avoidance tactics. mated public turing test to tell computers and humans Similar search-related problems also arise on the sur- apart), leaving 5 markets to survey. The initial crawl of face web, where words can have radically different mean- these markets took 2 h and 34 min and yielded 9852 items ings due to polysemy and context. For example, a search (average 1.06/s). The success rate for received responses for ivory results in the material, including elephant ivory, was 98.7%. and items that are ivory in color (e.g., ivory wedding Four of the 121 wildlife-trade keywords resulted in hits dress and lace) (Hernandez-Castro & Roberts 2015). On from the 9852 items. Three of these keywords, bone, the dark web, ivory could potentially be used to openly faux,andivory, all code names associated with elephant sell products made of ivory, without the need to use ivory, resulted in hits but did not relate to items associated code words (e.g., ox bone and faux ivory). However, all with illegal wildlife trade; rather, they related to drugs hits for ivory in subsequent searches were associated

Conservation Biology Volume 00, No. 0, 2016 4 Wildlife Trade on the Dark Web with pseudonyms, drugs (e.g., ivory is related to This apparent lack of enforcement suggests that there is 2-DPMP), and pornography (as well as tiger and lion) little need for the community to cross the technological (J. R. Harrison, D. L. Roberts, & J. Hernandez-Castro, per- threshold and move onto the dark web because increased sonal observation). anonymity does not appear to be required. However, an Beyond the scope of our study are darknet markets alternative explanation is probably needed for species that require registration or login for access. These are that could be considered the most serious forms of illegal difficult to access through a webcrawler because cookies wildlife trade (e.g., rhinoceros horns). Effective trading must be managed by the crawler to remain logged in; a networks are already established for distribution, at least user account must be created; and CAPTCHAs must be for the raw products. As a result, advertising over the circumvented to gain access. Of 14 markets surveyed, 9 internet is probably not required. required registration prior to viewing listings, 7 of which The U.K. Parliamentary Office of Science and Technol- used CAPTCHAs as part of the registration or login. Some ogy recently stated that there is “widespread agreement markets also required referrals; that is, the registration that banning online anonymity systems altogether is not system is closed and requires the use of a special re- seen as an acceptable policy option in the UK” (Rawl- ferral link obtained from an existing user. It is unknown inson 2015). This implies that anonymity technologies whether the purpose of closed registrations is to promote (e.g., Tor Project) and their use will probably remain exclusivity or as a means of preventing access by others legal in the United Kingdom and many other countries (e.g., law enforcement). What is offered on deep-web for the foreseeable future. This opens the door to semi- marketplaces was beyond the scope of this study, and anonymous illegal wildlife trade. However, we found lit- how these markets differ from those on the dark web is tle evidence of this and thus provide a baseline for future unclear. As such, our study only refers to the dark web. research. The lack of trade in illegal wildlife over the dark web Conservationists we have talked to suggest that illegal raises logical question as to why this is the case? Per- wildlife trade is taking place on the darknet. However, haps the keywords we used in the search were inap- their contention is based on placement of false wanted propriate. Given the level of anonymity such networks advertisements for certain items. Given that users of provide, there is no reason to expect code words would the darknet include members of organized crime, it is be used to disguise the sale of illegal wildlife, as on the unsurprising that such advertisements received offers surface web. Drugs such as heroin and cocaine were to supply goods. Such ploys are of questionable ethics openly on sale. Maybe we did not search sites on the and run the risk of encouraging trade as well as catching dark web where wildlife trade takes place. Although other conservationists. such sites could theoretically exist, there is no evidence that this is the case. We used the 2 main indexes of the Acknowledgments darknet. However, given the nature of the darknet, it is impossible to determine if our sampling strategy was We thank T. McCrea-Steele, of the International Fund for representative. Perhaps, the illegal wildlife trade commu- Animal Welfare, for sharing the keywords used in their nity lacked sufficient knowledge of the dark web and studies of illegal online wildlife trade on the surface web. how it is accessed. Access to an anonymous network, Parts of this work were possible thanks to the generous as with any technology, has a learning curve, and such support of a research grant from Chester Zoo. use within trade networks can only be as advanced as the individuals in the community. This therefore raises the question, what would be required for a community Literature Cited to move onto the darknet? The majority of the trade on the darknet is of classic illegal items (e.g., drugs, arms, Atkins T. 2015. Animal parts and products: importation or sale of ivory and rhinoceros horn. Assembly Bill No. 96, Chapter and pornographic images) (Sui et al. 2015), which are 475. Available from https://leginfo.legislature.ca.gov/faces/billText highly scrutinized by law enforcement. The dark web Client.xhtml?bill_id = 201520160AB96 (accessed November 2015). provides anonymity buyers and sellers require to prevent Boiten E, Hernandez-Castro JC. 2014. Can you really be identified detection. Illegal wildlife trade is unlikely to be under onTororisthatjustwhatthecopswantyoutobelieve? the same level of pressure. Thus, we hypothesize that The Conversation UK, 21st November 2015. Available from https://theconversation.com/canyou-really-be-identified-on-tor- the most likely reasons for our not finding illegal trade in or-is-that-just-what-the-cops-want-you-to-believe-29430 (accessed wildlife on the dark web are a lack of law enforcement March 2015). related to illegal wildlife trade over the surface web, and Brewer-Hay R. 2008. eBay to institute global ban on ivory well-established and effective trading networks for the sales. Available from https://www.ebayinc.com/stories/news/ebay- distribution of illegal wildlife products. Currently, crim- to-institute-global-ban-on-ivory-sales/ (accessed November 2015). Christin N. 2013. Traveling the silk road: a measurement analysis of inals appear to be able to sell their illegal wildlife rel- a large anonymous online marketplace. Proceedings of the 22nd atively openly without apparent interference from law International Conference on World Wide Web, 213–224. Available enforcement (e.g., Hernandez-Castro & Roberts 2015). from http://arxiv.org/abs/1207.7139 (accessed November 2015).

Conservation Biology Volume 00, No. 0, 2016 Harrison et al. 5

Convention on International Trade in Endangered Species (CITES). Nuwer R. 2014. The black market trade for endangered animals flour- 2015. Appendices I, II and III. CITES Secretariat, Geneva. ishes on the web. Newsweek, 30 October. Available from http:// Available from https://www.cites.org/sites/default/files/eng/app/ www.newsweek.com/2014/11/07/extinctcom-280884.html 2015/E-Appendices-2015-02-05.pdf (accessed November 2015). (accessed November 2015). Economic and Social Council of the United Nations. 2013. Crime Ostalaza C, C´aceres F, Roque J. 2013. Echinopsis pachanoi.InThe prevention and criminal justice responses to illicit trafficking in IUCN red list of threatened species 2013. Available from http:// protected species of wild fauna and flora. Resolution 2013/40. dx.doi.org/10.2305/IUCN.UK.2013-1.RLTS.T152445A637592.en UN, New York. Available from http://www.unodc.org/documents/ (accessed November 2015). commissions/CCPCJ/Crime_Resolutions/2010-2019/2013/ECO Rawlinson K. 2015. Banning Tor unwise and infeasible, MPs told. SOC/Resolution_2013-40.pdf (accessed April 2015). BBC News, 10 March 2015. Available from http://www.bbc. Europol. 2014. Global action against dark markets on Tor network. co.uk/news/technology-31816410 (accessed March 2015). Europol, The Hague. Available from https://www.europol. Reed MG, Syverson PF, Goldschlag DM. 1998. Anonymous connections europa.eu/content/global-action-against-dark-markets-tor-network and onion routing. IEEE Journal on Selected Areas in Communica- (accessed November 2015). tions 16:482–494. Gayathri A. 2011. From marijuana to LSD, now illegal drugs delivered Sajeva M, Augugliaro C, Smith MJ, Oddo E. 2013. Regulating internet on your doorstep. International Business Times, 11 June. Avail- trade in CITES species. Conservation Biology 27:429–430. able from http://www.ibtimes.com/marijuana-lsd-now-illegal-drugs- Sui D, Caverlee J, Rudesill DS. 2015. The deep web and the darknet: delivered-your-doorstep-290021 (accessed March 2015). a look inside the internet’s massive black box. STIP 03, August. Hernandez-Castro J, Roberts DL. 2015. Automatic detection of poten- Woodrow Wilson International Center for Scholars, Washington, tially illegal online sales of elephant ivory via data mining. PeerJ District of Columbia. Available from https://www.wilso- Computer Science 1: e10. ncenter.org/sites/default/files/stip_dark_web.pdf (assessed January International Fund for Animal Welfare (IFAW). 2014. Preventing illegal 2016). trade in restricted wildlife and improving the effectiveness of eBay’s Swartz A, Griffith V, HERMES. 2014. Tor2Web. Available from ivory ban. IFAW, London. https://tor2web.org/ (accessed March 2015). London Conference on the Illegal Wildlife Trade. 2014. Declaration. Available from https://www.gov.uk/government/uploads/system/ Tor Project. 2014a. Configuring hidden services for Tor. Available uploads/attachment_data/file/281289/london-wildlife-conference- from https://www.torproject.org/docs/torhidden-service.html.en declaration-140213.pdf (accessed April 2015). (accessed March 2015). McCandless D. 2006. Exotic, legal highs become big business as Tor Project. 2014b. Hidden service protocol. Available from ‘headshops’ boom. The Guardian, 9 January 2006. Available from https://www.torproject.org/docs/idden-services.html.en (accessed http://www.theguardian.com/society/2006/jan/09/drugsandal November 2015). cohol.drugs (accessed November 2015). Yu X, Jai W. 2015. Moving targets: tracking online sales of illegal Nature Check. 2013. An analysis of the Government’s natural environ- wildlife products in China. Traffic briefing February. Available from ment commitments. November 2013. Wildlife and Countryside Link, http://static1.1.sqspcdn.com/static/f/157301/26245505/1432122 London. Available from http://www.wcl.org.uk/docs/Link_Nature_ 394320/China-monitoring-report.pdf?token = Q8AuzEmc9lBrlrq Check_Report_November_2013.pdf (accessed November 2015). SNkYIn6E%2FseI%3D (accessed November 2015).

Conservation Biology Volume 00, No. 0, 2016 本文献由“学霸图书馆-文献云下载”收集自网络，仅供学习交流使用。

学霸图书馆（www.xuebalib.com）是一个“整合众多图书馆数据库资源，

提供一站式文献检索和下载服务”的24 小时在线不限IP 图书馆。图书馆致力于便利、促进学习与科研，提供最强文献下载服务。

图书馆导航：

图书馆首页文献云下载图书馆入口外文数据库大全疑难文献辅助工具