The ClearScore Darkpaper THE DANGER OF THE DARK WEB 2020 Shining a light on the data being sold on the dark web and how we can protect ourselves. SHORT ON TIME? HERE ARE THE KEY OUTTAKES Key Findings MOST UK RESIDENTS HAVE A DECENT UNDERSTANDING OF THE DARK WEB. 2 PASSWORD HABITS NEED SIGNIFICANT IMPROVEMENT. 3 ONLINE FRAUD REMAINS A HUGE PROBLEM IN THE UK. 4 Overview ClearScore’s Darkpaper: The danger of the dark web 2020 examines For enhanced protection, ClearScore also offers Protect Realtime - UK citizens’ understanding of the dark web and online fraud alongside a subscription service for just £2.99 a month which monitors the dark the latest industry insight on these themes. It will also take a look at web daily for up to three email addresses. ClearScore will scan for how COVID-19 has affected online fraud and people’s perceptions of names, phone numbers, postcodes and other data that has been it, before concluding with actionable guidance on how individuals can compromised in addition to passwords. protect themselves from this growing threat. ClearScore Protect, dark web monitoring, for free, forever. The purpose of this Darkpaper is to highlight the problem that online Activate ClearScore Protect here. fraud poses to the UK’s population and help guide them to a better understanding of online security with the launch of ClearScore Pro- tect. ClearScore Protect is a free dark web monitoring service provided to all ClearScore users, for free. Every three months, ClearScore privately and securely runs a scan of the dark web, monitoring for any stolen passwords associated with your ClearScore-registered email address. You’ll be alerted by email if any of your data is found so that you can take action and secure your accounts against fraudsters. You’ll also get personalised security tips to help protect your identity. 5 What you’ll find in this Darkpaper 7 Foreword: statements from Justin Basini, CEO and co-founder of ClearScore; Troy Hunt, founder of Have I been pwned 8—12 Section One: What’s so dark about the dark web? 13—16 Section Two: Fraud on the dark web 17—20 Section Three: A note on COVID-19 21—29 Section Four: How can we protect ourselves? 30-31 Conclusion, Methodology & About ClearScore 32-33 Endnotes 6 Forewords “We launched ClearScore in 2015 to help people achieve greater financial well-being by providing credit scores and reports for free, forever. We now serve 9 million people in the UK. A big part of financial well-being is understanding how and where your data is being used, and so we designed ClearScore Protect 18 months ago to help consumers take control of their online presence. I myself have fallen victim to identity theft and have had first-hand experience of how it can an impact a person's financial and mental well-being. On behalf of the team at ClearScore, I hope that ClearScore Protect and the guidance in this Darkpaper will help you steer clear from becoming a victim of online fraud.” — JUSTIN BASINI, CEO & CO-FOUNDER CLEARSCORE “There’s a fundamental lack of cyber security awareness amongst consumers and it’s leading to a great deal of personal distress, both emotional and financial. ClearScore Protect is a great consumer resource, especially given it provides tailored sup- port from a human by way of Protect Realtime. This can make a huge difference to those who’ve just lost money to cybercriminals. Online fraud has been plaguing consumers for years, I hope the launch of Protect helps drive consumer awareness around online safety.” — TROY HUNT, WEB SECURITY EXPERT & CREATOR OF ‘HAVE I BEEN PWNED?’ 7 SECTION 1: What’s so SO...WHAT ACTUALLY IS IT? • The dark web refers to all websites that are only accessible through a dark about TOR network. • TOR stands for “The Onion Router”, so- called because it sends encrypted traffic the dark web? through layers of relays around the world so as to hide the website, the searcher and EXAMINING PEOPLE’S CONCEPTIONS & their location.2 MISCONCEPTIONS ABOUT THE DARK WEB • In a nutshell, everything on the dark web is there because it wants to be anonymous. WHAT IS THE “DARK WEB”? • To access the dark web, you have to down- load the TOR browser and you can then The Cambridge Dictionary defines the dark web as: surf it either by knowing the web address you want to visit or using a search engine Dark web like DuckDuckGo.3 noun (also dark net) “parts of the internet that are encrypted (= use a secret code), and that cannot be found using ordinary search engines, and that are sometimes used for Dark fact: You may have heard the term “deep web” as criminal activity.” 1 well as dark web and assumed they are the same thing, but they’re not. The dark web is actually a small, encrypted This matches relatively well with the UK population’s general under- (locked up) part of the much larger deep web, which is the standing of the dark web. They may not know how to access it neces- 95% of the internet not indexed by web search engines like Google. Content on the deep web includes academic sarily, but popular culture (alongside stock images of people in hoodies journals, company intranets and even your in front of computers) means 83% of Brits have heard of the dark web email account.4 and most (69%) see it as “a hotbed of all sorts of criminal activity”. 8 WHO RUNS THE DARK WEB? More than half of people in the UK think the dark web is run by criminals (52%), but a quarter of the general populace aren’t sure. 25% 52% 5% 8% 3% 7% 52% Criminals 7% A distributed network of volunteers 3% The government 8% All of the above 5% No-one 25% I don’t know 9 WHAT IS THE DARK WEB USED FOR? When we asked our respondents what the dark web is used for, we gave them seven options to pick from (alongside “I don’t know” and “Other”) all of which are in fact correct. Drug dealing 46% Illegal pornography 35% 46% Selling/buying people’s data 44% Weapons dealing 35% Hiring hitmen 15% Whistleblowing 6% Getting discounted 4% Netflix subscriptions I don’t know 18% Other 2% 10 SO...WHAT IS REALLY ON THE DARK WEB? A study from 2015 by Gareth Owen and Nick Savage (both from the University of Portsmouth) on behalf of the Global Commission on Internet Governance collected data on the dark web for six months to analyse the type and popularity of its content. The study shows that while crime (especially drugs) is a big part of the dark web, there is also less insidious content like bitcoin, and its anonymity can be used for good, for example for whistleblowing and activism.5 Dark fact: No one actually runs or owns the dark web. It is known as a decentralised internet which means everyone owns and controls their own data. The invention of the dark web is typically thought to have taken place in the early 2000s, most notably with the release of TOR by the US government, who built it to help their own operatives remain untraceable.6 11 Key takeaways 1. The dark web is part of the deep web which can’t be accessed using normal search engines like Google. It uses TOR (The Onion Router) in order to keep visitors and websites anonymous. 2. Despite 52% of Brits believing the dark web is run by criminals, it’s actually run and owned by no-one. 3. The dark web is predominantly used for criminal activity like fraud but is also used for good, like whistleblowing and activism. If you want to learn more about the dark web, check out this blog on the ClearScore website. 12 SECTION 2: HOW BADLY IS THE UK AFFECTED BY Fraud on ONLINE FRAUD? Our data found that one third (33%) of the the dark web UK population admitted to being victims of online fraud. WHAT ARE DARK WEB CRIMINALS DOING WITH MY DATA? Victims were more likely to be men (53% of whom were affected), aged between 25 and 34 (26% of whom were affected) and live in the South East (15% of whom were affected). As we saw in the last section, the third most common kind of content Interestingly, wealth has nothing to do with it; on the dark web is fraud related. But how does this affect people there’s only one percentage point difference in the UK? in the proportion of those typically defined as the middle and working classes who have HOW MUCH DO UK RESIDENTS CARE ABOUT FRAUD? fallen victim to online fraud. A separate piece of market research conducted on behalf of Clear- In terms of how much money is stolen from Score in March 2020 found that Brits’ biggest financial concern is individuals in these cases, 31% of those sur- saving money, with 23% of the population placing this as their number veyed who had fallen victim to online fraud one money worry. However, the second and third biggest stresses are lost between £101 and £500, 5% lost £1,001 identity theft and fraud (for example, their credit card information to £2,000 and 3% lost over £2,000. Losing any being used against them). amount of money to online fraud is incredibly stressful, not only because of the financial im- pact but also because of the time and effort it can take to try to reclaim money.