THE

CHANNELS

EN

Six Ways Law Enforcement Monitors the

Dark Web
Written by JASON KOEBLER (/AUTHOR/JASONKOEBLER)

February 17, 2015 // 03:16 PM EST

Law enforcement and governments are increasingly trying to crack the anonymizing network Tor and
the dark web crime rings that operate there. Now, a research group is suggesting that dark web
monitoring should become a primary goal of internet governance bodies.
The Internet Corporation for Assigned Names and Numbers' contract with the United Nationsis set to
expire this year (http://motherboard.vice.com/read/the-us-is-losing-its-grip-on-the-names-andnumbers-of-the-internet), which means it's a good time for internet governance types to try to make
changes to how it operates. Some believe ICANN should become less US-centric. Others believeICANN
needs to focus more on understanding the dark web
(https://www.ourinternet.org/#publications/impact-dark-web-internet-governance-cyber-security).
Michael Cherto, former secretary of the Department of Homeland Security and now a security
advisor and lawyer, and Tobby Simon, of the Bangalore-based Synergia Foundation think tank, just
released a paper with the Global Commission on Internet Governance
(https://www.ourinternet.org/#publications/impact-dark-web-internet-governance-cybersecurity)suggesting that researchers need "new ways to spot upcoming malicious [dark net] services
to deal with new phenomena as quickly as possible."
Cherto actually compares ghting crime on the dark web to Alexander the Great's doomed invasion
of Persepolis in 331 BC. The "Battle of the Persian Gate
(http://en.wikipedia.org/wiki/Battle_of_the_Persian_Gate)," in which Alexanders army was ambushed
by unknown forces, should "remind us of the importance of reconnaissance, and the need to better
understand what is beneath the surface."
It's a dramatic comparison, but not all that surprising coming from the former head of what has
largely become a law enforcement agency. Cherto does acknowledge some of the above-board uses
of the dark web, notably for whistleblowers and oppressed peoples, but he also details every method
we know of to scan the dark web.
Mapping the hidden services directory
This is most likely what theJustice Department meant earlier this month
(http://motherboard.vice.com/read/tor-and-encryption-have-created-a-zone-of-lawlessness-justicedepartment-says?utm_source=mbtwitter)when it said it has "made some advances in [its] ability to
penetrate the Tor network." Tor operates on a series of distributed "nodes," which are run by

volunteers all around the world. Tor trac routes between these nodes, anonymizing data. But if you
own and operate enough nodes you can glean enough information to learn quite a lot about the dark
Like 621K

Share

Follow

138Kfollowers

web and about who uses it. A recent report from the Tor Project

YouTube

710K

Motherboard

NEWSLETTER(HTTPS://CONFIRMSUBSCRIPTION.COM/H/I/62B347AD88B7A90A)

(https://research.torproject.org/techreports/extrapolating-hidserv-stats-2015-01-31.pdf) suggests that

30,000 hidden service websites make up less than 1 percent (http://www.dailydot.com/politics/tordark-net-study-size/) of all trac routed through the network.
Customer data monitoring
The NSA and other intelligence agencies could "benet from analyzing customer web data to look for
connections to non-standard domains," Cherto wrote. In other words, he's suggesting that if security
agencies can tell people are going somewhere on the dark web, they can make inferences from it.
"This can be done without intruding on users' privacy as only the destinations of the web requests
need to be monitored and not who is connecting to them" he wrote, which seems like wishful thinking.
Social site monitoring
Regular web sites such as Pastebin, where links to dark web sites are often posted, should be "kept
under constant observation," Cherto wrote.
Hidden service monitoring
Dark web sites go oine and resurface all the timeCherto notes that it's "essential to get a
snapshot of every new site as soon as it is spotted, for later analysis or to monitor its online activity."
Semantic analysis
(/EN_US?TRK_SOURCE=HEADER-LOGO)
Once a dark
web site is found, it should be downloaded and its information should be put into a
database for future analysis and to compare to other hidden services to "associate them with
malicious actors," he suggested.
Marketplace proling
He suggests that security agencies should create databases of dark web dealersthe same dealers
often move between dierent drug markets, for instance. "Individual proles could be built up over
time," he wrote.

The dark web is still something of a wild west, but security agencies have increasingly spent lots of
time trying to bring down sites like Silk Road. That doesn't sound likely to change anytime soon, and it
Like 621K

Share

Follow

138Kfollowers

YouTube

710K

Motherboard

seems like international governments may soon take a hard look at doing whatever they can to map
everything that lurks just below the surface.

NEWSLETTER(HTTPS://CONFIRMSUBSCRIPTION.COM/H/I/62B347AD88B7A90A)

-TOPICS: tor (/tag/tor), dark web (/tag/dark+web), dark net (/tag/dark+net), deep web (/tag/deep+web),
anonymity (/tag/anonymity), privacy (/tag/privacy), law enforcement (/tag/law+enforcement), power
(/tag/power)

Contact the author by email (mailto:jason.koebler@vice.com) or Twitter

(https://twitter.com/jason_koebler).
You can reach us at letters@motherboard.tv (mailto:letters@motherboard.tv). Letters may be
published. Want to see other people talking about Motherboard? Check out our letters to the
editor (http://motherboard.vice.com/tag/letters+to+the+editor).

(/EN_US?TRK_SOURCE=HEADER-LOGO)

RECOMMENDED

(/read/tor-captchas?trk_source=recommended)
Like 621K

Share

(/read/illegal-wildlife-traders-arent-welcome-onthe-dark-web?trk_source=recommended)
Follow

138Kfollowers

YouTube

710K

Motherboard

NEWSLETTER(HTTPS://CONFIRMSUBSCRIPTION.COM/H/I/62B347AD88B7A90A)

Tor Users Might Soon Have a Way to Avoid Those

Annoying CAPTCHAs (/read/tor-captchas?
trk_source=recommended)

(/read/the-luxury-dark-web-trade-of-disneylandtickets-and-dinners-for-two?
trk_source=recommended)

Illegal Wildlife Traders Aren't Welcome on the Dark

Web (/read/illegal-wildlife-traders-arent-welcome-onthe-dark-web?trk_source=recommended)

(/read/this-tool-lets-you-check-if-your-personalinfo-is-on-the-dark-web?
trk_source=recommended)

The Dawn Of Kille...

The Luxury Dark Web Trade of Disneyland Tickets and
Dinners for Two (/read/the-luxury-dark-web-trade-ofdisneyland-tickets-and-dinners-for-two?
trk_source=recommended)

This Tool Lets You Check If Your Personal Info Is on the

Dark Web (/read/this-tool-lets-you-check-if-yourpersonal-info-is-on-the-dark-web?
trk_source=recommended)

(/read/how-a-hacker-can-steal-monerocrypotocurrency-more-anonymous-bitcoin-csrf(/EN_US?TRK_SOURCE=HEADER-LOGO)
wallet?trk_source=recommended)

(/read/monero-cryptocurrency-dark-net-drugdealers-hope-more-anonymous-than-bitcoinalphabay?trk_source=recommended)

MOST POPULAR

How a Hacker Can Steal Monero, a Cryptocurrency

More Anonymous Than Bitcoin (/read/how-a-hackercan-steal-monero-crypotocurrency-more-anonymousbitcoin-csrf-wallet?trk_source=recommended)

Meet Monero, the Currency Dark Net Dealers Hope Is

More Anonymous Than Bitcoin (/read/monerocryptocurrency-dark-net-drug-dealers-hope-moreanonymous-than-bitcoin-alphabay?

anonymous-than-bitcoin-alphabay?

(/read/goodbye-world-weve-passed-the-carbon-tipping-point-for-good?trk_source=popular)
trk_source=recommended)
Goodbye World: Weve Passed the Carbon
Tipping
For Good
(/read/goodbye-world-weve-passed-theLike 621K
YouTube 710K
Share PointFollow
138Kfollowers
Motherboard
carbon-tipping-point-for-good?trk_source=popular)
NEWSLETTER(HTTPS://CONFIRMSUBSCRIPTION.COM/H/I/62B347AD88B7A90A)

(/read/this-is-how-ultra-rich-stoners-get-baked-with-class?trk_source=popular)
How the Ultra-Rich Smoke Weed (/read/this-is-how-ultra-rich-stoners-get-baked-with-class?
trk_source=popular)

(/read/north-korea-has-just-28-websites?trk_source=popular)
North Korea Has Just 28 Websites (/read/north-korea-has-just-28-websites?trk_source=popular)

(/EN_US?TRK_SOURCE=HEADER-LOGO)

(/read/watch-a-speed-test-comparing-all-the-iphones-ever-made?trk_source=popular)
Watch a Speed Test Comparing All the iPhones Ever Made (/read/watch-a-speed-test-comparing-all-theiphones-ever-made?trk_source=popular)

iphones-ever-made?trk_source=popular)

Like 621K

Share

Follow

138Kfollowers

YouTube

710K

Motherboard

NEWSLETTER(HTTPS://CONFIRMSUBSCRIPTION.COM/H/I/62B347AD88B7A90A)

(/read/apple-employees-company-is-hiding-iphone-6-plus-touch-disease-truth-from-customers?
trk_source=popular)
Geniuses Say Apple Knows About iPhone 6 Touch Disease, Won't Admit It Publicly (/read/apple-employeescompany-is-hiding-iphone-6-plus-touch-disease-truth-from-customers?trk_source=popular)

(/EN_US?TRK_SOURCE=HEADER-LOGO)

(/read/a-loud-sound-just-shut-down-a-banks-data-center-for-10-hours?trk_source=popular)
A Loud Sound Just Shut Down a Bank's Data Center for 10 Hours (/read/a-loud-sound-just-shut-down-a-banksdata-center-for-10-hours?trk_source=popular)

Like 621K

Share

Follow

138Kfollowers

YouTube

710K

Motherboard

NEWSLETTER(HTTPS://CONFIRMSUBSCRIPTION.COM/H/I/62B347AD88B7A90A)

2016 Vice Media LLC

About

Contact

Privacy Policy

Terms of Use

print

(/EN_US?TRK_SOURCE=HEADER-LOGO)