Forensic Science International
Buying drugs on a Darknet market: a better deal? Studying the
online illicit drug market through the analysis of digital, physical
and chemical data.
Rhumorbarbe Damiena, Staehli Ludovica, Broséus Juliana,
Rossy Quentina, Esseiva Pierrea
aEcole des Sciences Criminelles, University of Lausanne, Lausanne, Switzerland.
Darknet markets, also known as cryptomarkets, are websites located on the Darknet and designed to allow the trafﬁcking of
illicit products, mainly drugs. This study aims at presenting the added value of combining digital, chemical and physical
information to reconstruct sellers’ activities. In particular, this research focuses on Evolution, one of the most popular
cryptomarkets active from January 2014 to March 2015.
Evolution source code ﬁles were analysed using Python scripts based on regular expressions to extract information about
listings (i.e., sales proposals) and sellers. The results revealed more than 48,000 listings and around 2700 vendors claiming
to send illicit drug products from 70 countries. The most frequent categories of illicit drugs offered by vendors were
cannabis-related products (around 25%) followed by ecstasy (MDA, MDMA) and stimulants (cocaine, speed). The
cryptomarket was then especially studied from a Swiss point of view. Illicit drugs were purchased from three sellers located
in Switzerland. The purchases were carried out to confront digital information (e.g., the type of drug, the purity, the shipping
country and the concealment methods mentioned on listings) with the physical analysis of the shipment packaging and the
chemical analysis of the received product (purity, cutting agents, chemical proﬁle based on minor and major alkaloids,
chemical class). The results show that digital information, such as concealment methods and shipping country, seems
accurate. But the illicit drugs purity is found to be different from the information indicated on their respective listings.
Moreover, chemical proﬁling highlighted links between cocaine sold online and specimens seized in Western Switzerland.
This study highlights that (1) the forensic analysis of the received products allows the evaluation of the accuracy of digital
data collected on the website, and (2) the information from digital and physical/ chemical traces are complementary to
evaluate the practices of the online selling of illicit drugs on cryptomarkets.
Keywords: Cryptomarket ; Cocaine ; Drug profiling ; Evolution market ; Concealment techniques ; Source codes.
The online trading of drugs is a criminal activity that may take various forms. For example, new psychoactive
substances are already distributed through the Web, due to the different legal status of these substances from
one country to another . Prescription drugs are also sold online with consumers redirected toward online
pharmacies through massive spam campaigns . Besides, online selling of traditional illicit drugs (cocaine,
Rhumorbarbe et al. / Forensic Science International (2016) 2
heroin and cannabis) became very popular with the creation Silk Road, in 2011. Markets such as Silk Road are
commonly referred to as cryptomarkets, or Darknet markets (DNM). In this context, the Darknet is a set of
networks within the Internet, based on peer-to-peer technologies as part of encryption processes . A
cryptomarket is an online website, on which it is possible to trade illicit goods – mainly illicit drugs – while the
identity of sellers, consumers and administrators remains concealed. This anonymity is ensured because
cryptomarkets relies on several encryption features. First, cryptomarkets are hosted on the Darknet, accessing
them requires a specific communication protocol such as an onion routing. Connections are then established
through a sequence of nodes, each of them having encryption features. Some web browsers are specifically
implemented to use an onion routing. The most popular, and first to be released, is the TOR browser (The Onion
Router) . However, other networks based on enhanced routing techniques are also available, such as I2P
(Invisible Internet Project) . Moreover, communications between participants are encrypted as well, using
PGP (Pretty Good Privacy) cryptography, which implies the sharing of public keys on the marketplace [6-8].
Lastly, cryptocurrencies – mainly bitcoins – are the exclusive payment method on cryptomarkets. Transactions
in bitcoins are requested by buyers and approved collectively through the bitcoin system. For this reason, bitcoin
is not a currency centralised by a bank or guaranteed, nor controlled, by a government .
After Silk Road was shut down in October 2013, several other cryptomarkets rose on the Darknet . One
of them, Evolution, was launched on January 14, 2014 and shut down on March 18, 2015. By the end of 2014,
Evolution was one the major active cryptomarkets, along with Agora. Their success may be explained by the
fact that they survived after Operation Onymous, an international operation held in early October 2014 aiming
at shutting down several cryptomarkets . Evolution transactions were based on an escrow system, meaning
basically that, once a transaction is placed, Evolution’s administrators will hold the amount of bitcoins involved
until the buyer indicates he received the product. Besides, a feedback system was implemented, allowing
consumers to evaluate any vendor or transaction. Vendors were ranked based on their number of transactions
and the quality of the feedbacks they received (i.e. positive, negative or neutral). These features show how
important are the trust and the reputation among a cryptomarket community . As a cryptomarket grows, the
number of bitcoins held in escrow may become huge and constitute a target for hackers or even administrators
themselves. This may have led to the shutting down of Evolution on March 18, 2015, since it is hypothesised
that the administrators may have “exit scammed” .
Ross Ulbricht’s – founder of Silk Road – trialled and sentenced in 2015 raised the attention of the media and
wider public for trafficking through the Darknet. However, as mentioned by Martin , the media’s sensational
facts are sometimes exaggerated and misleading, revealing the need for a better understanding of the
cryptomarkets structure. From an institutional point of view, the United Nations Office on Drugs and Crime
(UNODC) emphasised the need to acquire more information about transactions occurring on the Darknet,
arguing that it would grow in importance in the future . So far, academic research regarding cryptomarkets
is essentially about Silk Road. Some of the studies give an insight and conceptualise the notion of cryptomarket
[16 ; 17]. Others aimed at estimating the revenue of sellers and at characterising the business model of
cryptomarkets [18 ; 19]. Soska and Christin  proposed a detailed analysis of cryptomarkets environment
through data obtained over a two-years monitoring period. They studied various aspects such as sales volumes,
offered products or activity of vendors and compared several cryptomarkets. Interviews of Silk Road vendors
 and users , as well as discussion threads analyses , were also conducted to describe interactions
within a cryptomarket community. The authors emphasised notably various discussions about shipping methods
and packaging, including measures and techniques to avoid packages interception. Subsequently, Silk Road and
Silk Road 2 – a new version launched in November 2013 – were compared . Methodological questions
about the comparison of cryptomarkets were raised following this research publication and led to a debate
among researchers [24-26].
Rhumorbarbe et al. / Forensic Science International (2016) 3
General monitoring of Darknet marketplaces constitutes a field of research on its own. For instance,
institutions such as the National Drug & Alcohol Research Center of the University of New South Wales (see
http://ndarc.med.unsw.edu.au) provides periodically trends about cryptomarkets, from an Australian
perspective. The Global Drug Policy Observatory of the Swansea University (see
http://www.swansea.ac.uk/gdpo) also publishes situation analysis in the field of drug policy, including Darknet
and cryptomarkets related aspects.
The purpose of this article is to provide a better understanding of the purchase process of illicit drugs on a
cryptomarket. Our first hypothesis is that the accuracy of the information available online can be evaluated
through orders. Thus, digital data extracted from the cryptomarket Evolution were analysed to draw an overview
of illicit drugs distribution and assess the most popular products offered on the market. Besides, it allows
estimating the number of active vendors and their number of transactions. Illicit drugs were then purchased on
Evolution. Shipping and packaging modus operandi were studied. Furthermore, qualitative and quantitative
analyses as well as chemical profiling of the purchased illicit drugs were performed. These results are used to
test out second hypothesis which assumes that forensic analysis of the products can be used to evaluate if
cryptomarkets are an extension of the traditional market or, on the opposite, a separate market with only a few
relationships with the later.
2.1 Digital data
This research relies on data collected throughout the period Evolution was active. This data consists of the
HTML source code of Evolution pages. Parts of the platform were indeed duplicated between January 2014 and
March 2015 (115 times) by an independent researcher, named Gwern. The data used to get an overview of the
market – and evaluate the position of Switzerland within this market – were extracted from the raw data resulting
from Gwern’s crawling. We did not perform any crawling ourselves. Gwern compiled the entire dataset into a
single archive file and made it available online via a Reddit forum on March 19th 2015 (data downloaded on
April 30th 2015 on https://reddit.com/2zllmv) .
Each time Evolution was scraped, a directory was created, including all source codes structured in
subdirectories, i.e. listings (sales proposals), vendor profiles, stores, images and category. Using Python scripts,
all drugs related listings were extracted and tagged with a unique identification code. Orange Canvas, a Python-
based visual programming software – specifically an add-on to this software, called ‘Textable’  – was used
to search source codes with regular expressions. They were designed to target listings information (i.e. listing
title, the category and price of the product, seller username and ranking, shipping country, countries available
for shipping and description). Subsequently, the extracted listings were sorted out, as some listings appeared
several times due to redundancies in scraped data. Moreover, information such as the number of transactions
and feedback were collected for each vendor from their profile pages. The listings’ description as well as the
vendors’ profile descriptions were not systematically analysed, only those related to the illicit drugs ordered for
this research were considered. This structured information was analysed and visualised using Microsoft Excel
2013 and R software .
Rhumorbarbe et al. / Forensic Science International (2016) 4
2.2 Illicit drugs ordering
2.2.1 Law Dependencies
Since purchasing illicit drugs is prohibited, a legal authorisation was granted by the Attorney General of the
Canton de Vaud in order to place illicit drugs orders for academic purpose. Indeed, the Swiss Federal Act on
Narcotics and Psychotropic Substances states: “Institutions involved in scientific research may be granted a
licence by the relevant cantonal authority to cultivate, acquire, store and use narcotics to the extent required for
their own needs.” (NarcA, art. 14 al. 2, in force since 1 July 2011).
Marketplace and Type of Illicit Drugs Selection
At the beginning of this study, Agora and Evolution were the two most popular marketplaces regarding the
number and diversity of illicit drugs offered and the total number of retailers . Products were purchased on
Evolution since Agora required to be sponsored by an active member to be accessed.
In order to compare the results with street market seizures, cannabis related products and cocaine were
targeted. They were purchased from the few active Swiss vendors offering for sale cocaine and cannabis
products. Indeed, our authorisations specified that the purchases had to be conducted on the Swiss Territory, in
other words, bought from a Swiss vendor. Since Evolution search engine included different specifications, such
as “ship from” and “ship to” filters, it was possible to target vendors claiming to deliver products from
Switzerland to Switzerland.
2.2.2 Obtaining Bitcoins
Bitcoins were obtained through the website LocalBitcoins.com. At the beginning of October 2014, 0.5183
BTC were bought for 200.00 CHF at a rate of 385.88 CHF/BTC. All bitcoins were transferred to an Evolution
account specially created for the purchases. At the end of November 2014, the process was repeated to acquire
0.7625 BTC (300.00 CHF) at a rate of 393.45 CHF/BTC) in order to make a second set of purchases.
2.2.3 Shipping Method and Packaging
In this study, physical analysis refers only to the description of the shipping method, packages and
concealment techniques of purchased products. This analysis is especially useful to discuss the exactitude of
the “ships from” statement and to provide information on the modus operandi of vendors.
2.2.4 Illicit Drugs Chemical Analysis and Profiling
In Western Switzerland, the chemical analysis (qualification, quantitation and chemical profiling) of illicit
drug specimens confiscated by police and customs is centralised in our laboratory, hosted by the University of
In particular, cocaine specimens are analysed through gas chromatography-mass spectrometry (GC-MS)
using the analytical method validated in our laboratory . For cannabis-related products, qualification is
performed by GC-MS while quantification of THC (9-tetrahydrocannabinol) is carried out with gas
chromatography interfaced with a flame ionisation detector (GC-FID) (see Appendix A). Seizures of cannabis-
related products are not systematically profiled in our laboratory, since the main objective of the analysis is to
discriminate between legal and illegal cannabis. Depending on the country, growing some subspecies of
Cannabis sativa for legal utilisations (e.g. production of textile, edible seeds, essential oils, etc.) is authorized,
though restricted. A distinction is possible between these plants and the drug-type varieties [30 ; 31].
Rhumorbarbe et al. / Forensic Science International (2016) 5
A deep explanation of the profiling process (e.g. the selection of target compounds, the statistical methods
for the comparison of profiles, and the interpretation of outcomes) is out of the scope of this publication.
Therefore, interested readers are kindly requested to refer to previous publications [29 ; 32 ; 33].
Chemical (purity, cutting agent, profile based on major and minor alkaloids and chemical class) and physical
information (description of the packaging and appearance) information are gathered in a dedicated database
since 2006. They result from the analysis of cocaine specimens confiscated by police and customs.
Circumstantial information (criminal case number, mass of drugs seized, date and place of the seizure) is also
collated [34-36]. In this research work, cocaine specimens purchased on Evolution were profiled and then
compared to the profiles stored in this database.
3 Results and discussion
3.1 Overview of the Swiss Market on Evolution
The extraction process applied to the digital data revealed 48’026 different listings offering illicit drugs over
the period Evolution was functioning (from January 2014 to March 2015). Table 1 shows the most frequent
countries mentioned in the “ship from” field of Evolution listings.
Country of origin Listings Percentage
United States 11,996 24.9%
United Kingdom 5,972 12.4%
Netherlands 4,764 9.9%
Germany 4,579 9.5%
Australia 3,047 6.3%
Canada 2,092 4.3%
Sweden 1,410 3.0%
China 1,142 2.7%
France 949 2.0%
Switzerland 205 0.4%
Worldwide 7’939 16.5%
Others 3931 8.1%
Table 1. Switzerland compared to the top 10 countries of origin mentioned on listings (n=48’026).
Significantly, 16.5% of studied listings do not include any origin information since “Worldwide” is indicated
in their “ship from” field. The way countries are listed in that field – namely a structured list of non-misspelled
country names – suggests that a pre-filled list of countries is proposed to sellers when creating their listings. A
“Worldwide” indication may be explained by a will to hide the true origin of products or a preference for another
way to display that information. Indeed, sellers alternatively may give more shipping details in their listing
descriptions or on their profile page.
Switzerland stands at the 19th position of the ranking with 205 listings. Regarding destinations toward which
illicit drugs may be delivered from Switzerland (see Table 2), around 80% of all listings may be shipped to
Rhumorbarbe et al. / Forensic Science International (2016) 6
Switzerland. Otherwise, only a list of European countries is available. Besides, listings limited by a delivery to
Switzerland represent less than 5.9% of all listings.
Switzerland only 12 5.9%
Switzerland and a selection of European countries 62 30.2%
Switzerland and rest of the world 91 44.4%
European countries excluding Switzerland 40 19.5%
Table 2. Shipping destinations available for Swiss listings (n = 205).
Thus, Swiss sellers do not appear to be reluctant to send their products across borders, even though it may
imply greater risks of detection. We may assume that sellers are very confident about their packaging techniques
to avoid detection. Finally, they may accept such a risk of detection at borders because the purchased quantities
are generally small. Certainly, they may favour an international expansion of their market, even if it implies
refunding a few customers when a shipment is seized . Results provided in Table 2 corroborate this, since
listings from around the world are likely to be shipped worldwide rather than to a specific location. This supports
the hypothesis that sellers may join a cryptomarket community to expend their distribution area and thus
increase their incomes.
Figure 1 shows the distribution of the listings by the drug category according to the terminology used on
Figure 1. Distribution of the number of listings according to product categories for the whole market
(n = 48,026) and Switzerland (n = 205).
Rhumorbarbe et al. / Forensic Science International (2016) 7
More than 25% of the market is about cannabis related products, including marijuana, hashish, seeds, oil and
synthetic cannabinoids. Categories such as ‘Ecstasy’ (MDA, MDMA), ‘Stimulants’ (cocaine, speed, crystal
MDMA) and ‘Psychedelics’ (LSD, mushrooms) are less represented with 10 to 16% of the listings. To a lesser
extent, respectively 7% and 2%, ‘Opioids’ (heroin, opium) and dissociative products (ketamine, MXE, GHB)
are also offered. Prescription drugs such as analgesics or erectile dysfunction treatment were also offered on
Evolution, specific categories were created for substances such as benzodiazepines and weight loss products.
These medicine products represent almost 18% of all listings while steroids have a proportion fewer than 4%.
Tobacco and paraphernalia (i.e. equipment to use drugs) appear to be rather anecdotal categories. Finally, fewer
than 2% of listings were not inserted in any category or were classified as ‘Other’.
The distribution for the listings marked as shipped from Switzerland is quite similar to the whole market
except for products classified as ‘Stimulants’ and ‘Opioids’. In proportion, cannabis is also the largest illicit
drug category offered by Swiss sellers. Ecstasy products are still in the three following categories. To the
contrary, stimulants and opioids frequencies for the Swiss market – 20.0% and 16.6% respectively – exceed
proportions observed in the general distribution.
In regards to the hypothesis that sellers may join the cryptomarket community to expend their distribution
area and incomes (see Table 2), the type of illicit drugs sold seems influenced by its accessibility. For example,
according to the World Drug Report 2015 , Western and Central Europe are among the main destinations
of opiates trafficking route originating from Afghanistan, which is the main producer of opiates. This could
explain the high proportion of opiates available on the Swiss market. The demand could also explain such
differences. To address this question, other indicators – such as the number of vendors or the number of
feedbacks of each listing – should be studied. Finally, it seems difficult to explain more precisely the differences
observed in Figure 1 without stating to which category each listing truly belongs. Such a classification was not
performed in this study, since its purpose was to draw an overview of the Swiss market.
However, the total number of listings with a Swiss origin is quite limited to 205 listings. Furthermore,
assessing trends according to the listings’ categorisation of Evolution is not without uncertainties. Indeed,
misclassifications are possible and some products may fall into several categories (e.g. new psychoactive
substances may be classified as ‘Stimulants’, ‘Psychedelics’, sub-categories of ‘Ecstasy’ or ‘Dissociatives,
RC’). Besides, the number of listings does not equal the number of different products offered on the
cryptomarket. Actually, some vendors offer several listings with similar titles except for quantities of product
(e.g. 6 listings for 5 to 1000 g of speed paste or 5 listings for 5 to 100 g of cocaine). Aldridge and Décary-Hétu
 noted the same practice on Silk Road. Such observation could indicate that vendors sell different products,
or try to target different kind of customers (i.e. we may assume that consumers would be interested in low
quantities for consumption while retailers would source bulk quantities).
3.2 Vendors Information
While some other cryptomarkets only display buyers’ feedback, Evolution vendors’ profiles also include the
number of transactions completed by the corresponding seller. Considering the whole population of sellers
offering illicit drugs on Evolution (n = 2,702), the number of transactions per seller is very wide (from 1 to
more than 9,000). Thus, among the most prolific sellers, 100 of them concentrate about 40% of all transactions.
Besides, it is worth noting that, on average, 62% of the transactions are subjected to some feedback. Such result
may help to discuss studies aiming at evaluating vendors’ income based on their amount of feedbacks [8 ; 18].
These studies assume that each transaction really occurred, while sellers may generate fictitious transactions to
achieve a better ranking or a higher positive feedback rate .
Rhumorbarbe et al. / Forensic Science International (2016) 8
Thirteen sellers claim to send products from Switzerland and they offer between 1 and 53 listings. Figure 2
shows the progression of nine Swiss sellers according to their number of completed transactions. For the sake
of readability, only those having completed more than 50 transactions are displayed.
Figure 2. Number of transactions for sellers shipping from Switzerland (with more than 50 transactions)
from August 2014 to March 2015.
Swiss sellers started to register on Evolution in June 2014. The first transactions occurred on August 2014.
Then, their progression is quite variable, and only four of them completed more than 100 transactions. Besides,
these four sellers managed to double their number of transactions (from 100 to 200) over a few months. They
may be considered as efficient sellers, exploiting their good reputation. For example, one of them received
feedbacks including comments such as “Very Quick delivery. Best quality. Thanks! FE is OK”. Likewise,
another seller’s profile page displayed comments about his products and concealment techniques: “hash is
definitely of good quality. Shipping was fast, with reliable stealth” or “Excellent product, professional vendor”.
It is worth reminding that Operation Onymous took place in late 2014. Since Evolution has not been taken
down, sellers with a rather good reputation before the Operation may have benefited from the closing down of
other marketplaces. Indeed, only one of them used his previous experience on other marketplaces to advertise
his products. This information was displayed on a “legacy sales” page, linked to the seller profile and featured
a number of verified transactions on Silk Road, Black Market Reloaded and Agora.
Rhumorbarbe et al. / Forensic Science International (2016) 9
3.3 Online orders
Among the items offered by Swiss sellers, three of them were chosen for purchase – two individual grams
of cocaine and one gram of cannabis concentrate (see Table 3). The first item was ordered a second time, after
performing the chemical analyses (see further below). For cocaine hydrochloride, price of ordered products are
higher than prices encountered on the street market – around 100 USD per gram – in Switzerland, according to
UNODC . Similarly, the cannabis concentrate purchased on Evolution is more expensive (around 13 USD
per gram on the street market). Beyond the fact that cryptocurrencies such as bitcoin tend to be versatile, price
differences may be explained by the selling process on cryptomarkets. Indeed, compared with the street market,
the service itself may lead to an increase of the price. From the consumer point of view, buying illicit drugs on
a cryptomarket is safer (relative anonymity and no physical contact with the seller) and more discrete due to
post delivery. The later could also induce postages fees since packaging material and techniques may be
expensive and time consuming. Overall, for customers, high prices are not an obstacle to the purchase of illicit
drugs on a cryptomarket. Besides, some researchers noted that consumers may agree to spend more money for
illicit drugs bought online, as they expect a better quality consumers [22 ; 39].
Date of order
Date of receipt
1 14.10.2014 16.10.2014 Cocaine ca. $135
2 14.10.2014 16.10.2014 Cannabis concentrate ca. $60
3 27.11.2014 03.12.2014 Cocaine ca. $110
not ordered 03.12.2014 MDMA
4 10.12.2014 12.12.2014 Cocaine ca. $150
Table 3. Orders details of cocaine and cannabis products. One gram of product was ordered for each
For the third order, two extra pills were also received, probably as part of a development of customer loyalty
strategy. The corresponding vendor was active during a short period of time and only performed a limited
number of transactions. Concerning the two other vendors from which purchases were made, one of them left
the market shortly after the ordered was placed, while the other was active until Evolution closed.
3.4 Shipping method and packaging analysis
Table 4 summarises the package descriptions, and concealment measures used by vendors to ensure the
delivery to the customer. Every illicit drug ordered was sent through the standard Swiss postal services. A Swiss
return address with a fictitious name was indicated on one of the sending, most likely to avoid suspicion.
Thus, according to our four purchases, these results confirm the origin claimed by the vendors. In
regards to our specimen, the ‘ship from’ digital evidence thus seems reliable information to analyse the market
based on the country of origin.
External packaging is a conventional envelope with a “professional looking” as mentioned by Christin .
Concealed measures – e.g. vacuum sealing, a static shielding bag – were used by sellers and constitute what is
* Prices converted according to the exchange rate on Evolution index page and rounded to the nearest 5 USD.
Rhumorbarbe et al. / Forensic Science International (2016) 10
referred to as “stealth” methods by Martin  (see Appendix B for further illustrations). Indeed, these methods
seem obviously used to get through package inspection.
Padded envelope in C5 standard format
with self-adhesive label including printed
receiver address (see Fig. 3).
Heat-sealed static shielding bag containing
heat-sealed plastic bag with a Minigrip® bag
of the drug product (see Fig 4).
Paper envelope in C5 standard format with
fake printed sender address (see Fig 5.).
Heat-sealed plastic bag containing the
product on blotting paper. Plastic bag taped
to a post office sheet of paper (see Fig. 6).
3 Windowed paper envelope in C5 standard
format. DVD keep case containing heat-sealed
aluminium plastic laminated bags with a
Minigrip® bag of the drug product (see Fig.
4 Padded craft envelope in C5 standard
format with self-adhesive label including
printed receiver address (see Fig. 8).
Heat-sealed static shielding bag containing
heat-sealed plastic bag with a Minigrip® bag
of the drug product (see Fig. 9).
Table 4. Packaging descriptions (see Appendix B for Figures 3 to 9).
Overall, information about packaging displayed on the cryptomarket is consistent with the postal shipping
we received. For example, some sellers’ profile pages include a description of the external packaging – often
presented as regular letters – while others focus on concealment techniques (e.g. multiple sealing or special
boxing). Thus, the observations made on the packaging are overall in line with the online description. We can
infer that sellers explain their real modus operandi to reassure customers that their products have a good chance
to reach its destination. Even if our sample is limited, the physical analysis tends to confirm that the description
of packaging can be used as a relevant digital evidence to better understand sellers’ practices. A systematic
analysis of the online descriptions may thus lead to detect and follow the evolution of concealment strategies.
3.5 Chemical Analyses of the Products
Qualitative analyses confirmed the presence of the main psychoactive substance claimed to be sold for each
illicit drug purchased on Evolution. In other words, the advertised substance was present in the received
samples. Differences were, however, observed regarding the chemical composition. For instance, the purity
advertised on the listings always differed from the results of the quantitative analyses. In particular, it was lower
for every cocaine specimen (see Table 5). Lastly, composition of the ordered cocaine products did not differ
significantly from the cocaine specimen seized by law enforcement authorities in Western Switzerland in terms
of purity and cutting agents .
After the first set of orders in October-November 2014, a message was sent through the Evolution message
handler, to the seller who offered the first item (Order 1). The purpose of this message – stating that the product
Rhumorbarbe et al. / Forensic Science International (2016) 11
quality was not as good as expected – was to assess the influence of such a comment on the seller’s marketing
decision. No response to this message was ever received. However, since the corresponding listing was still
available, a second order was placed for the same product. It turned out to contain a product of similar quality
than the first one in terms of purity and cutting agents. The process was not replicated with the other sellers
since they were not active on Evolution anymore.
3.6 Chemical profiling of cocaine specimens
Cocaine products ordered in October and November 2014 (Orders 1 and 3) were not associated with any
existing chemical classes of our database. They are therefore not linked to any previously analysed cocaine
specimen. By contrast, the cocaine product ordered on December 10th (Order 4) was chemically linked to
specimens originating from three seizures confiscated in the Canton de Vaud; two seizures were performed in
May and September 2014 in Lausanne and one in May 2013 in Vevey. This chemical link based on profiling
means that the specimens were once part of the same physical unit before it was broken up for further
Order Advertised product
Active ingredient Average purity† Cutting agents
1 1g of cocaine (≥ 95%) Cocaine HCl 33.7 ± 0.8% glucose, levamisole
2 1 g of cannabis concentrate
THC‡ 49.6 ± 8.3% N/A
3 1g of cocaine (≥ 85%) Cocaine HCl 69.0 ± 1.2% levamisole, phenacetin
MDMA§ 26.7 ± 0.2% palmitic acid, stearic acid
4 1 g of cocaine (≥ 95%) Cocaine HCl 30.2 ± 0.1% glucose, inositol, levamisole,
Table 5. Results of the chemical analyses on ordered products.
4 General discussion and conclusion
4.1 Ethical considerations and further research
Despite the value of the information obtained through the analysis of illicit drugs bought online, such
research raises ethical questions. First, it implies encouraging illicit markets since orders and transactions are
actually carried out. Admittedly, quantities purchased are not excessive, but if further research was undertaken,
orders would need to be justified and planned to address specific questions. The fact that online purchases found
† For cocaine specimen, average purity is calculated for the base form of cocaine.
Rhumorbarbe et al. / Forensic Science International (2016) 12
illicit activities may restrain the capacity to reproduce the experiment at a larger scale. Besides, as mentioned
by Soska and Christin  regarding their measurement, our study does not aim to support law enforcement
units to arrest sellers. This is the reason why we avoided identifying vendors from which the orders were placed
by mentioning their usernames in this article . Finally, cryptomarkets versatility may constitute an obstacle
to a longitudinal analysis, especially if the aim is to address questions regarding sellers’ activities (e.g. chemical
links on a larger scale, stability according to vendors).
4.2 Digital Data Reliability
Crawling cryptomarkets is a challenging step. As mentioned by Dolliver , using a web crawler may result
in reliability issues. Hence, comparing data obtained through different crawling methods might be difficult, if
not possible. Consequently, it is worth reminding that information obtained by exploring this kind of data would
only lead to trends. Data is indeed partial, first because the crawling process is not repeated every day or the
same number of times each month. Secondly, when the crawling is performed, every single source code file is
not necessarily duplicated, as illustrated by the missing listing page for one of the orders. However, using such
data allows the estimation of the online prevalence of illicit drugs offers, as well as the number and activity of
vendors. The comparison of digital evidence with the results of the physical and chemical analysis performed
on purchased products helped to evaluate the reliability of the collected information. Since our number of
purchases is limited, our conclusions should, of course, be considered as indicative. Globally, it seems that
digital information about the type of product, the country of origin and the concealment techniques used by
sellers are accurate. The claimed quality of the products seems, however, less reliable information.
4.3 Perspectives for Forensic and Investigation Purposes
Presently, packages received in this study are made of plastic, paper or adhesive tape. Their forensic analysis
may lead to the detection of fingermarks or DNA traces. However, our legal authorization stated that our
research aimed only at studying the products sold online by purchasing illicit drugs and performing analyses.
Therefore, exploiting DNA traces or fingermarks for investigative purposes was not part of this study.
Interestingly, Van Hout and Bingham  pointed out, through online interviews of vendors, that many sellers
are using latex gloves and masks to avoid leaving fingermarks or DNA traces into or onto packages. The
packages of ordered products may lead to the detection of such traces for investigation purposes. Besides, in
the frame of an investigation, postal stamp notifies by which mail distribution centre a parcel went through,
providing a geographical indication of the region the sender may be located. In a multilingual country like
Switzerland, the use of additional material, such as printed paper for the second order (see Appendix B), may
provide information about the linguistic region where the seller comes from. Since they appear to be accurate,
packaging and concealment techniques descriptions should be more systematically studied. Indeed, they may
constitute an interesting lead to detect such packages while they are handled by postal services and customs for
4.4 Drugs Quality Assessment and Profiling
Studying packaging and chemical results for the three ordered illicit drugs revealed both concordance and
discrepancies with what was advertised. As Van Hout and Bingham  noted, packaging is an important
component of quality assessment. The vendors from whom orders were placed used “stealth” methods
consistent with their profile pages. However, it appears not to be essential. Indeed, one of the Swiss sellers
turned out to be a rather successful vendor – according to his number of transactions – even though his profile
Rhumorbarbe et al. / Forensic Science International (2016) 13
page did not mention any packaging information. On the other hand, other sellers described meticulously their
products – as well as their packaging, concealment techniques and refund process – without achieving a
particular success on Evolution. The popularity of a seller appears to be the result of a complex process.
Specifically since assessing products quality may be a difficult task for consumers who consequently rely on
other aspects such as sellers ranking, packaging, previous comments or product appearances. Thus, as argued
by Bancroft and Scott Reid , quality takes a whole different meaning within a cryptomarket community
than in the chemical sense. Qualitative research also revealed the influence of the information found on
marketplaces – or their related forums – on consumers’ practices [21 ; 22 ; 39]. The same questions arose
regarding illicit drugs sold on the traditional market. Studies have shown the lack of knowledge of Belgian
consumers back in the 1990s . While we may assume that online forums facilitated finding information and
sharing knowledge about illicit drugs more recently, the situation barely evolved. Indeed, more recently Evrard
and al.  highlighted that from a user perspective, the perceived quality of the cocaine depends on information
provided by the dealer and also on price. These factors continue to affect consumers after use, despite
adjustment on the actual cocaine content .
The chemical composition (i.e. purity, cutting agents) of cocaine purchased online is similar to specimens
confiscated by police and customs in Western Switzerland. It is worth noting that this observation is only
representative of cocaine hydrochloride sold from and to Switzerland. Generalising these results to other
shipping and destination countries is, so far, impossible. However, despite the limited number of orders, the
highlighted chemical links indicate that the products sold online and in the street share similar chemical
characteristics. On the one hand, an explanation would be that online sellers buy their products from street
dealers. On the other hand, both of them could share the same source of supply. Finally, a last hypothesis would
be that cryptomarkets allow street retailers to diversify their distribution channels. Nevertheless, as noted by
Martin , the limited knowledge of online distribution networks (e.g. online sellers’ position in the
distribution process) prevents a better assessment of this relationship. A recent study showed, however, that
analysing digital data might reveal important actors and distribution networks in Darknet markets .
Exploiting chemical information related to products sold on Darknet markets is a developing activity, mainly
for harm reduction purposes. . The chemical profiling methodology we applied on the ordered substances
provide another perspective about chemical information. It constitutes an interesting tool to study distribution
networks, fuel hypotheses about sellers’ practices, show relations between traditional and online markets as
well as inform on products level within distribution channel.
The authors would like to thank Laetitia Gasté, from the ESC forensic laboratory, for performing the
chemical analyses and profiling of the illicit drugs.
The authors are also very grateful for Gwern’s work in the crawling process and for providing the data on
Rhumorbarbe et al. / Forensic Science International (2016) 14
 Meyers K, Kaynak Ö, Bresani E, Curtis B, McNamara A, Brownfield K, and al. (2015). The availability and depiction of
synthetic cathinones (bath salts) on the Internet: do online suppliers employ features to maximize purchases? International Journal of Drug
Policy, 26 (7), 670-4.
 Gelatti U, Pedrazzani R, Marcantoni C, Mascaretti S, Repice C, Filippucci L, and al. (2013). 'You've got m@il: fluoxetine
coming soon!': accessibility and quality of a prescription drug sold on the web. International Journal of Drug Policy, 24 (5), 392-401.
 Aked S, Bolan C, Brand M (2013). Determining what characteristics constitute a Darknet. Proceedings of the 11th Australian
Information Security Management Conference. Perth, Australia. 12-20.
 AlQahtani A, El-Alfy E (2015). Anonymous connections based on onion routing: A review and a visualization tool. Procedia
Computer Science, 52, 121-8.
 Zantout B, Haraty R (2011). I2P data communication system. Proceedings of the Tenth International Conference on Networks.
Sint Marteen, Netherlands Antilles. 401-9.
 Broséus J, Rhumorbarbe D, Mireault C, Ouellette V, Crispino F, Décary-Hétu D (2016). Studying illicit drug trafficking on
Darknet markets: structure and organisation from a Canadian perspective. Forensic Science International, 264, 7-14.
 Reid F, Harrigan M (2011). An analysis of anonymity in the bitcoin system. Proceedings of the International Conference on
Privacy, Security, Risk and Trust (PASSAT) and International Conference on Social Computing (SocialCom). Boston, USA. 1318-26.
 Soska K, Christin N (2015). Measuring the longitudinal evolution of the online anonymous marketplace ecosystem. Proceedings
of the 24th USENIX Security Symposium. Washington D.C., USA. 33-48.
 Böhme R, Christin N, Edelman B, Moore T (2014). Bitcoin: economics, technology, and governance. Journal of Economic
Perspectives, 29, Harvard Business School NOM Unit Working Paper No. 15-015. Available at http://ssrn.com/abstract=2495572
 Van Buskirk J, Roxburgh A, Bruno R, Burns L (2014). Drugs and the Internet, Issue 2. Available at
 Van Buskirk J, Roxburgh A, Bruno R, Burns L (2015). Drugs and the Internet, Issue 4. Available at
https://ndarc.med.unsw.edu.au/sites/default/files/ndarc/resources/Drugs & The Internet Issue 4.pdf (12.01.16).
 Tzanetakis M, Kamphausen G, Werse B, von Laufenberg R (2016). The transparency paradox. Building trust, resolving disputes
and optimising logistics on conventional and online drugs markets. International Journal of Drug Policy,
http://dx.doi.org/10.1016/j.drugpo.2015.12.010 (35), 58-68.
 Van Buskirk J, Roxburgh A, Bruno R, Burns L (2015). Drugs and the Internet, Issue 5. Available at
https://ndarc.med.unsw.edu.au/sites/default/files/ndarc/resources/Drugs & The Internet Issue 5.pdf (12.01.16).
 Martin J (2014). Drugs on the dark net - How cryptomarkets are transforming the global trade in illicit drugs. Basingstoke, UK:
 UNODC (2014). World Drug Report 2014. United Nations publication, Sales n° E.14.XI.7, 1-51.
 Phelps A, Watt A (2014). I shop online – recreationally! Internet anonymity and Silk Road enabling drug use in Australia.
Digital Investigation, 11 (4), 261-72.
 Martin J (2014). Lost on the Silk Road: Online drug distribution and the 'cryptomarket'. Criminology & Criminal Justice, 14
 Aldridge J, Décary-Hétu D (2014). Not an ‘eBay for drugs’: the cryptomarket “Silk Road” as a paradigm shifting criminal
innovation. Social Science Research Network. Available at http://ssrn.com/abstract=2436643 (12.01.16).
 Christin N (2013). Traveling the Silk Road: a measurement analysis of a large anonymous online marketplace. Proceedings of
the 22nd International World Wide Web Conference. Rio de Janeiro, Brazil. 213-24.
 Van Hout MC, Bingham T (2014). Responsible vendors, intelligent consumers: Silk Road, the online revolution in drug trading.
International Journal of Drug Policy, 25 (2), 183-9.
 Van Hout MC, Bingham T (2013). 'Silk Road', the virtual drug marketplace: A single case study of user experiences.
International Journal of Drug Policy, 24 (5), 385-91.
Rhumorbarbe et al. / Forensic Science International (2016) 15
 Van Hout MC, Bingham T (2013). 'Surfing the Silk Road': A study of users' experiences. International Journal of Drug Policy,
24 (6), 524-9.
 Dolliver DS (2015). Evaluating drug trafficking on the Tor Network: Silk Road 2, the sequel. International Journal of Drug
Policy, 26 (11), 1113-23.
 Aldridge J, Décary-Hétu D (2015). A response to Dolliver's “Evaluating drug trafficking on the Tor Network: Silk Road 2, the
sequel”. International Journal of Drug Policy, 26 (11), 1124-5.
 Van Buskirk J, Roxburgh A, Naicker S, Burns L (2015). A response to Dolliver's “Evaluating drug trafficking on the Tor
network”. International Journal of Drug Policy, 26 (11), 1126-7.
 Dolliver DS (2015). A rejoinder to authors: Data collection on Tor. International Journal of Drug Policy, 26 (11), 1128-9.
 Xanthos A (2014). Textable: programmation visuelle pour l’analyse de données textuelles. Proceedings of the 12th international
Conference on Textual Data statistical Analysis. Paris, France. 691-703.
 R Core Team (2015). R: a language and environment for statistical computing. Vienna, Austria: R Foundation for Statistical
Computing. Available at https://www.R-project.org.
 Esseiva P, Gaste L, Alvarez D, Anglada F (2011). Illicit drug profiling, reflection on statistical comparisons. Forensic Science
International, 207 (1-3), 27-34.
 Broséus J, Anglada F, Esseiva P (2010). The differentiation of fibre- and drug type Cannabis seedlings by gas
chromatography/mass spectrometry and chemometric tools. Forensic Science International, 200 (1–3), 87-92.
 Broséus J, Vallat M, Esseiva P (2011). Multi-class differentiation of cannabis seedlings in a forensic context. Chemometrics
and Intelligent Laboratory Systems, 107 (2), 343-50.
 Esseiva P, Ioset S, Anglada F, Gasté L, Ribaux O, Margot P, and al. (2007). Forensic drug Intelligence: An important tool in
law enforcement. Forensic Science International, 167 (2-3), 247-54.
 Ioset S, Esseiva P, Ribaux O, Weyermann C, Anglada F, Lociciro S, and al. (2005). Establishment of an operational system for
drug profiling: a Swiss experience. Bulletin on narcotics of United Nations Office on Drugs and Crime, 57 (1-2), 121-47.
 Broséus J, Gentile N, Bonadio Pont F, Garcia Gongora JM, Gasté L, Esseiva P (2015). Qualitative, quantitative and temporal
study of cutting agents for cocaine and heroin over 9 years. Forensic Science International, 257, 307-13.
 Broséus J, Huhtala S, Esseiva P (2015). First systematic chemical profiling of cocaine police seizures in Finland in the
framework of an intelligence-led approach. Forensic Science International, 251, 87-94.
 Broséus J, Baechler S, Gaste L, Bonadio Pont F, Garcia Gongora JM, Gentile G, and al. (2016). Chemical Profiling: a tool to
decipher the structure and organisation of illicit drugs markets. An 8-year study in Western Switzerland. Forensic Science International,
 UNODC (2015). World Drug Report 2015. United Nations publication, Sales n° E.15.XI.6, 41-56.
 UNODC. UNODC Statistics - Drug prices repoort (cocaine-type in Switzerland). https://data.unodc.org/. 2012.
 Barratt MJ, Ferris JA, Winstock AR (2014). Use of Silk Road, the online drug marketplace, in the United Kingdom, Australia
and the United States. Addiction, 109 (5), 774-83.
 Markham A, Buchanan E (2012). Ethical decision-making and Internet research - recommendations from the AoIR Ethics
Working Committee. Association of Internet Researchers. Available at http://www.aoir.org/reports/ethics2.pdf (12.01.16).
 Bancroft A, Scott Reid P (2016). Concepts of illicit drug quality among darknet market users: Purity, embodied experience,
craft and chemical knowledge. International Journal of Drug Policy, 35, 42-9.
 Decorte T (2001). Quality control by cocaine users: Underdeveloped harm reduction strategies. European Addiction Research,
7 (4), 161-75.
 Evrard I, Legleye S, Cadet-Taïrou A (2010). Composition, purity and perceived quality of street cocaine in France. International
Journal of Drug Policy, 21 (5), 399-406.
 Caudevilla F (2016). The emergence of deep web marketplaces: a health perspective. The internet and drugs market (European
Monitoring Center for Drugs and Drug Addiction). Luxembourg: Publications Office of the European Union.
Rhumorbarbe et al. / Forensic Science International (2016) 16
6.1.1 GC-FID analysis methods
GC Agilent 7891A
GC Agilent 7891A
Agilent 19091s-101: 1
HP-5MS 20m x 200µm x 0.33µm
Agilent 19091S-101: 1
HP-5MS 20m x 200µm x 0.33µm
Split 68:1 at 250°C
Splitless at 250°C
100°C for 0 min
60°C/min to 280°C for 3 min
70°C for 0.203 min
39.465°C/min to 300°C for 2.027 min
Flame ionisation detector
Flame ionisation detector
6.1.2 Order 1 – Cocaine hydrochloride – Seller_7
Figure 4. External packaging
Figure 5. Internal parcel containing cocaine
hydrochloride in different bags
Rhumorbarbe et al. / Forensic Science International (2016) 17
6.1.3 Order 2 – Cannabis concentrate – Seller_5
Figure 6. External packaging
Figure 7. Internal parcel containing cannabis
concentrate taped on a piece of paper
6.1.4 Order 3 – Cocaine hydrochloride – Seller_10
Figure 8. DVD keep case containing cocaine and MDMA pills in two different bags
Rhumorbarbe et al. / Forensic Science International (2016) 18
6.1.5 Order 4 – Cocaine hydrochloride – Seller_7
Figure 9. External packaging
Figure 10. Internal parcel containing cocaine
hydrochloride in different bags