ArticlePDF Available

Abstract and Figures

Cryptomarkets are online marketplaces, located on the darknet, that facilitate the trading of a variety of illegal goods, mostly drugs. While the literature essentially focus on drugs, various other goods and products related to financial or identity fraud, firearms, counterfeit goods, as well as doping products are also offered on these marketplaces. Through the analysis of relevant data collected on a popular marketplace in 2014-2015, Evolution, this research provides an analysis of the structure of trafficking (types and proportions of products, number of vendors and shipping countries). It also aims at highlighting geographical patterns in the trafficking of these products (e.g. trafficking flows, specialisation of vendors and assessment of their role in the distribution chain). The analysis of the flow of goods between countries emphasises the role of specific countries in the international and domestic trafficking, potentially informing law enforcement agencies to target domestic mails or international posts from specific countries. The research also highlights the large proportion of licit and illicit drug listings and vendors on Evolution, followed by various fraud issues (in particular, financial fraud), the sharing of knowledge (tutorials) and finally goods, currencies and precious metals (principally luxury goods). Looking at the shipping country, there seems to be a clear division between digital and physical products, with more specific information for physical goods. This reveals that the spatial analysis of trafficking is particularly meaningful in the case of physical products (such as illicit drugs) and to a lesser extent for digital products. Finally, the geographical analysis reveals that spatial patterns on Evolution tend to reflect the structure of the traditional illicit market. However, regarding illicit drugs, country-specificity has been observed and are presented in this article.
Content may be subject to copyright.
A geographical analysis of trafficking on a popular darknet market
Julian Broséus1, Damien Rhumorbarbe1, Marie Morelato2, Ludovic Staehli1, Quentin Rossy1
1 : Ecole des Sciences Criminelles, University of Lausanne, Lausanne, Switzerland
2 : Centre for Forensic Science, University of Technology, Sydney, Broadway, NSW,
Corresponding authors :
Abstract 6
Cryptomarkets are online marketplaces, located on the darknet, that facilitate the trading of a 7
variety of illegal goods, mostly drugs. While the literature essentially focus on drugs, various 8
other goods and products related to financial or identity fraud, firearms or counterfeit goods, as 9
well as doping products are also offered on these marketplaces. 10
Through the analysis of relevant data collected on a popular marketplace in 2014-2015, 11
Evolution, this research provides an analysis of the structure of trafficking (types and proportions 12
of products, number of vendors, shipping countries). It also aims at highlighting geographical 13
patterns in the trafficking of these products (e.g. trafficking flows, specialisation of vendors, role 14
in the distribution chain). 15
The analysis of the flow of goods between countries emphasises the role of specific countries in 16
the international and domestic trafficking, potentially informing law enforcement agencies to 17
target domestic mails or international posts from specific countries. The research also highlights 18
the large proportion of licit and illicit drug listings and vendors on Evolution, followed by various 19
fraud issues (in particular, financial fraud), the sharing of knowledge (tutorials) and finally goods, 20
currencies and precious metals (principally luxury goods). Looking at the country of origin, there 21
seems to be a clear division between digital and physical products, with more specific 22
information for physical goods. This reveals that the spatial analysis of trafficking is particularly 23
meaningful in the case of physical products (such as illicit drugs) and to a lesser extent for digital 24
products. Finally, the geographical analysis reveals that spatial patterns on Evolution tend to 25
reflect the structure of the traditional illicit market. However, regarding illicit drugs, country-26
specificity have been observed and are presented in this article. 27
Keywords : cryptomarket ; digital traces ; NPS ; trafficking flows; illicit market; spatial analysis 30
1. Introduction 31
The Internet continues to play an important role in illegal trafficking. It acts as a facilitator, 32
providing another medium for sales and purchases, and a platform for information sharing 33
between users. Users can access both legal and illegal commodities online from anywhere around 34
the world [1]. Cryptomarkets, located on the darknet, are only the last illustration of the transition 35
from illegal markets in the real world to the virtual world [2]. Visually very similar to popular 36
merchant websites like eBay and Amazon, cryptomarkets share several structural features with 37
conventional online sales sites. Lists of products and services offered by sellers are organised into 38
categories and subcategories. Sellers - and their products - are evaluated according to the 39
feedback left by their previous customers, trust and reputation being central components of the 40
trade on cryptomarkets [3]. Unlike conventional sales sites, however, cryptomarkets facilitate 41
exchanges in a context where the anonymity of administrators and participants is protected thanks 42
to the combination of encryption features. They are the connections through relays to make them 43
anonymous (using for instance the TOR - The Onion Router - browser) [4], the automatic 44
encryption of all communications through PGP - Pretty Good Privacy - cryptography [5] and the 45
payments with decentralised cryptocurrencies, mainly bitcoins [6]. 46
Considering the perpetual evolution of crime and the importance of the Internet in illicit 47
activities, analysing any illicit market should rely on a more holistic approach and take into 48
account the physical (i.e. traditional trafficking) as well as the virtual (i.e. online trafficking) 49
dimensions of the market. This analysis would enable a deeper understanding of the structure of 50
criminal groups online and potentially draw the link between the virtual world and the physical 51
world which is not currently known. Furthermore, analysing cryptomarkets represents an 52
interesting approach to inform on trends and dynamics that may affect the offline market. A 53
geographical analysis would also fuel hypotheses to better understand the role of cryptomarkets 54
as a new distribution channel, as sellers can source as well as sell drugs online. Sellers may also 55
move their trade to sell all or part of their merchandise while producers may decide to eliminate 56
certain intermediaries and sell directly to consumers [7]. Combining geographical analysis to 57
general knowledge about the traditional market might highlight the presence of new actors (e.g. 58
producers or retailers) and clarify the role played by cryptomarkets in the distribution chain. In 59
addition, from a country-specific perspective, trends regarding different categories of product 60
might be detected, and eventually monitored, from both demand and supply points of view. 61
Despite the added value of a geographical analysis, only a few studies provides a country-specific 62
perspective and they are focused on drugs trafficking and the darknet market named Agora [8,9]. 63
Differences in the availability of specific substances among shipping countries were observed by 64
these research works. It was concluded that spatial specificity can be due to different factors 65
affecting countries differently, such as geographic isolation, stringent border controls, relaxed 66
laws in regards to illicit goods, high prices of goods, strict control of internet access, proximity to 67
producing countries, domestic productions of goods and relative availability of illicit goods [8]. 68
Most research on cryptomarkets has focussed on drugs to evaluate the structure of the market 69
[2,10,11], characteristics of vendors [1214], consumers/users’ demand [15,16], the investigation of sales 70
volume [11], vendors’ activity [17], wholesale vs. retail [18] and the coherence between digital and 71
physical information [19]. In a few words, literature shows that cryptomarkets are dominated by 72
English-speaking countries (the United States, the United Kingdom, Australia) and Western 73
European countries (in particular, the Netherlands) and the main offered and purchased illicit 74
drugs are cannabis, stimulants (cocaine and amphetamines), ecstasy (MDMA) and psychedelics 75
(NPS, LSD) [8,10,16,20]. 76
Although drugs are offered and sold prolifically online; various illegal services and products 77
related to financial or identity fraud as well as counterfeit goods are also offered on the 78
cryptomarkets. To our knowledge, no information is available on the proportions these categories 79
represent on darknet markets. In this context, this study will provide information on the types and 80
frequencies of all the products offered on the cryptomarket Evolution. Geographic information 81
will also be analysed to highlight specific patterns in the trafficking of certain substances or 82
goods and reveal specificities of the illicit market for a particular country (e.g. the specialisation 83
in the distribution of certain types of products). Such analysis will provide a comparison of the 84
distribution of physical and digital products and help to explain the relation between the origin 85
country and the type of product. In most studies, only the origin country is analysed. Here, a 86
combined analysis of shipping countries and destinations will be performed to highlight 87
trafficking flows and therefore evaluate the trafficking nature from certain countries (i.e. 88
domestic vs. international). Lastly, the structure of illicit drugs trafficking as well as its 89
geographic distribution will be investigated. The results will be confronted to knowledge 90
regarding the traditional market to assess the relationship between the online and offline markets. 91
The NPS will be specifically studied to evaluate which countries are at the forefront of the 92
trafficking and even their role in the distribution chain. This specific example will indicate how 93
the online trade reflect knowledge regarding the traditional trafficking. 94
2. Dataset and methodology 96
The cryptomarket Evolution was studied since it was a popular cryptomarket during its period of 97
activity, from January to March 20151. In particular, it was very attractive to users since it 98
survived “Operation Onymous” in late 2014 [21]. The dataset used in this study is a compilation of 99
source codes collected, gathered and released by an independent researcher named Gwern 100
Brawnen2. He performed data collection over 115 days between January 2014 and March 2015. 101
Although the data is not exhaustive as the crawling was not conducted every day and the pages 102
that presented an error were not downloaded, the crawls were frequent enough (weekly) and 103
millions of pages were downloaded by the researcher [22]. As a consequence, the dataset used in 104
this study can be considered representative for the purpose of the research. 105
This dataset has already been used in a previous research in order to provide an overview of 106
Evolution in an attempt to test the reliability of vendors’ listings by purchasing illicit drugs and 107
analysing them [19]. The present research is not only focused on drugs related listings but on all 108
goods offered on Evolution. Each listing of every category was parsed by the authors through a 109
Python script to extract its title, price and classification within the cryptomarket, as well as the 110
vendor pseudonym and the geographical information - i.e. the mentioned shipping country and 111
destination(s). Vendor username was used to evaluate the total number of vendors present on a 112
cryptomarket as well as the product category where vendors were the most present [11,17]. 113
Trafficking flows between countries were also obtained using country of origin and destination 114
country. Section 3.5 deals with the evaluation of the role of countries within the distribution 115
chain of NPS. For this purpose, the quantity and price of the offered products were investigated 116
for each listing. All information was structured to allow further analysis and to accurately study 117
1 It is assumed that the administrators of Evolution “exit scammed” (DeepDotWeb, 2015)
2 Data available on the Reddit page
the trafficking structure on Evolution. A new classification of listings was carried out. Indeed, the 118
overview of the worldwide market would otherwise be uncertain and specific patterns 119
(predominance of a product category, specific spatial distribution, etc.) could also be unclear or 120
even hidden (see Appendix 1 for details about the new classification we performed), as also 121
observed by other researchers [8,9,18,22]. 122
Data analysis was performed using R [23], RStudio v. 1.0.136, Tableau Software Professional 123
Edition v. 9.3 and Microsoft Excel v. 15.31. Trafficking flows (section 3.3) were represented as 124
chord diagrams using the R library circlize3. Only for this particular analysis, listings with 125
unstated shipping destinations were removed (n = 40,851). 126
3. Results and discussion 127
3.1. Products offered 129
The extraction of each listing source code for every crawling date led to the identification of 130
92,980 unique sale proposals, after discarding six listings that stated unclear shipping country 131
information. A total number of 4,171 distinct vendor usernames was detected. Results show that 132
a vendor may manage one or more listings (min = one listing, max = 1,441, median = 9, mean = 133
22, standard deviation = 49). 134
Most of the sale proposals (63%) concern licit or illicit drugs and paraphernalia, in particular, 135
illicit drugs (close to 50% of all listings), as illustrated in Table 1 below. This is also the sub-136
category where vendors are the most present (close to 60% of vendors offer at least one product 137
classified as illicit drug). Specific trends concerning the distribution of illicit drugs will be 138
discussed in the section 3.5. This category also includes prescription drugs and medicines 139
(mainly benzodiazepines - 34% and synthetic opioids - 31%), performance and image enhancing 140
drugs (PIEDs, mainly steroids) as well as, to a lesser extent, laboratory supplies and 141
paraphernalia. Listings related to various fraud issues represent almost a third of the total number 142
of listings and close to half of vendors propose products classified in this category. Several 143
activities and services related to carding4 are particularly covered (listings classified as carding 144
represent close to 70% of the listings grouped in “Fraud Related”). Goods with a high probability 145
of forgeries are mainly concerned in the third category “Goods, currencies and precious metals”. 146
Indeed, luxury goods (essentially watches - 89%) and clothes and accessories (glasses - 21%, 147
bags - 18% and shirts - 14%) represent about 60% of the sale proposals in this category. 148
Interestingly, only a few vendors offer goods in these two categories. The “ID Relatedcategory 149
includes sale proposals related to ID theft (37%), various types of licences and legitimation 150
documents such as bank statements or university diplomas (35%) and IDs (28%). ID theft mainly 151
consists in fullz”, as advertised by vendors, that are archives containing financial information 152
(bank account logins or credit card numbers) and personal information (name, address, e-mail, 153
security social number, date of birth, mother’s maiden name, etc.). According to the listing titles, 154
the IDs subcategory includes scans of ID cards or passports, editable graphical material as well as 155
genuine or forged IDs. Lastly, about 1,000 listings were classified as Firearms & Weaponsin 156
which a third of sale proposals concerns firearms. 157
Insert Table 1 159
4 Carding concerns the acquisition (through skimmers at ATMs or hacking an e-commerce, for instance) and resale
of credit cards and bank accounts as well as related activities such as money laundering (e.g. money transfer using
bitcoins, money transfer companies or acquisition of prepaid cards) or reshipping services through mules.
Table 1. Listings’ and vendors’ proportions for the different categories of products. Listing/Vendor percentages are 161
calculated as the ratio between the respective number of listings/vendors for each product main categories and the 162
respective total number of listings/vendors in the whole market (n = 92,980 listings and 4,171 vendors). 163
* : Since a same vendor account may manage listings classified in different (sub-)categories, the number of vendors 164
may be higher than the total number of vendors calculated according to their usernames. 165
: Listing/Vendor percentages of subcategories are calculated as the ratio between the respective number of 166
listings/vendors for each subcategory and the total number of listings/vendors of the main category. 167
ATS : Amphetamine Type Substances (Amphetamine and Methamphetamine) 168
3.2. Shipping countries 169
On Evolution, vendors may inform on the shipping country and destination(s) of their products 170
by selecting countries/regions from a preset list. According to our dataset, 93 shipping countries 171
and 164 shipping destinations have been mentioned (see Appendix 2 Table B1). On a given sale 172
proposal, vendors always mentioned one shipping country only, while a list of destination 173
countries was sometimes stated. Vendors may manage several listings. A combined study of 174
vendor usernames and shipping countries shows that vendors may state different shipping 175
countries between their sale proposals, even though they mostly mention only one shipping 176
country (see Figure 1). 177
Insert Figure 1 178
Figure 1. Number of vendors mentioning one or more shipping countries in their sale proposals 180
An analysis of the frequency of shipping countries indicates that “Worldwide” was mentioned by 183
close to 50% of all vendors and stated in close to 40% of all listings. The predominance of this 184
statement may be seen as a limitation for a valid assessment of the trafficking magnitude of 185
specific countries when analysing the global market. Indeed, this high proportion implies that we 186
may underestimate the position of a specific country in the market. However, we may also 187
assume that vendors from any country may choose to indicate “Worldwide”. In this case, the 188
proportions may be quite accurate. Interestingly, stating “Worldwide” depends on the nature of 189
the product proposed by vendors, as shown in Table 2. There is a clear division between digital 190
and physical products. For instance, hacking services or material related to financial fraud 191
(“Fraud related” category), manuals (“Guides and tutorials”) and scans of IDs or legitimation 192
documents (“ID related”) are digital products. Instead, counterfeit goods (“Goods, currencies 193
and precious metals”), chemicals (“Lab supplies and paraphernalia”) or any type of drugs 194
(“Prescription drugs and medicines, PIED and Illicit drugs”) are physical. The origin country 195
does not represent a meaningful information for digital goods that are sent through the Internet, 196
which may explain the high proportion of vendors selecting “Worldwide” as the shipping 197
country. To the contrary, the delivery mode of physical material makes it possible to check the 198
coherence between the origin country stated online and that written down on the postal parcel. 199
Therefore, vendors may not have interest to provide incorrect information since customers may 200
leave negative feedbacks in the case of inaccurate data [8]. This would explain why vendors 201
mainly provide a meaningful shipping country when offering physical products and do not utilise 202
the “Worldwide” statement. Vendors still stating their physical products as shipped from 203
“Worldwide” may like to conceal the true origin of their merchandise or they prefer to provide 204
details in the description part of the listing. Thus, the spatial analysis of trafficking on 205
cryptomarkets is particularly meaningful in the case of physical products and to a lesser extent for 206
digital products. 207
Table 2. Listings and vendors’ proportions where “Worldwide” was mentioned as the origin country for each 210
product category 211
Without considering “Worldwide”, the analysis of the stated origin countries shows the dominant 213
position of English speaking countries (the United States, the United Kingdom and Australia) and 214
Western European countries (Germany and Netherlands) which was also observed in [20] (see 215
Table 3). Although since 2013, several non-English language markets have appeared, English 216
seems to remain the dominant language. This might be a result of the central position of English-217
speaking countries in online trades or the fact that English is usually the trading language which 218
might deter non-English vendors from offering goods [20]. It is worth noting that while some 219
countries have similar proportions of both listings and vendors (the United Kingdom, Germany or 220
Sweden, for instance), the listing proportions of China & Hong Kong are three times higher than 221
their respective vendor proportions. This clearly reveals a specificity of their market structure: a 222
few vendors are involved but they manage a large number of listings. Since each listing may be 223
purchased several times by customers, this result may indicate that vendors have stock and thus 224
have access to a steady long-term supply of the products they offer. The small number of Chinese 225
vendors may be explained by the very strict control of China’s Internet traffic [24]. In addition, 226
trafficking on online darknet platforms might not be considered as effective for Chinese vendors 227
for various reasons. Indeed, the registration process on the darknet markets (e.g. fees, access 228
constraints, etc.) may be considered by Chinese vendors as too restrictive, urging them to adopt 229
other ways of distribution such as dedicated websites on the clear web. Thus, the clear web may 230
be the main reason explaining the relatively minor position of the Chinese market on the darknet, 231
since it represents an efficient method for the distribution of products in which Chinese vendors 232
specialise, as it will be discussed further below (see sections 3.4 to 3.6). 233
Insert Table 3 235
Table 3. Proportion of listings and vendors for the shipping countries having at least 1% of the total number of 237
listings 238
* : Since vendors may mention different shipping countries between their listings, the sum of percentages is higher 239
than 100% 240
3.3. Trafficking flows 247
A combined analysis of shipping countries and destinations was performed to evaluate the nature 248
of trafficking for the main countries (see Figure 2). First, Figure 2 clearly shows the distinction 249
between physical (e.g. illicit drugs) and digital (e.g. ID related) goods discussed above. The 250
“Worldwide” origin is much more mentioned for ID related goods than for illicit drugs (see Table 251
2 and Figure 2). 252
In addition, such analysis reveals the behaviour of vendors and the market dynamics for each 253
country, and reciprocally. Interestingly, the flow of illicit drugs is essentially domestic in 254
Australia (i.e. Australian sellers only propose products to customers living within the country) or 255
mainly in the United States. The domestic pattern may be explained by the intent of both 256
customers and vendors to reduce their risks (such as parcel loss, interception by authorities or 257
arrest) by selling or purchasing only within their country of residence [25]. Accordingly, Kruithof 258
et al. [20] mentioned that many vendors appear to be reluctant to ship to countries with stricter law 259
enforcement and border controls such as Finland, Australia, the United States and Canada. By 260
contrast, Germany, Canada and the Netherlands mainly export internationally. This may be 261
related to the role of these countries in the production of synthetic drugs, such as Ecstasy & 262
MDMA and amphetamines (see section 3.5) [26,27]. In the same line, a relative easy access to illicit 263
drugs in the domestic market would not stimulate local users to purchase substances on 264
cryptomarkets and would motivate sellers to export to foreign customers [25]. A more competitive 265
domestic market from vendors’ point of view would have the same consequence. The analysis of 266
trafficking flows also helps to understand and explain the offer patterns. For instance, if a 267
domestic market is observed, we may expect good correlation between the types and frequencies 268
of products offered and the prevalence data of the local population (or at least, the sub-population 269
sourcing drugs on cryptomarkets) (see section 3.5). 270
In an intelligence perspective, the identification of an important domestic market such as the one 271
in Australia or the United States may encourage a tighter control of mails inside the country. The 272
determination of the main countries that export internationally (e.g. China, the Netherlands or 273
Germany) may help to target posts from these specific countries. Furthermore, combining the 274
trafficking flows information to the types of good and the concealment methods indicated by 275
sellers online, which tends to match that of the delivered packages [19], may be of added value and 276
could help targeting specific types of packages from specific countries. 277
Figure 2. Structure of trafficking considering the whole market (left) and two categories of physical (top right) and 281
virtual products (bottom right). The circular plot shows the directional flows (origin and destination) of products for 282
the most frequent couples of origin and destination countries (i.e. couples having a frequency of at least 1% in 283
relation to the total number of existing combinations) 5 284
5 The origins and destinations of products are represented by the circle’s segments. A specific color is assigned to the
flows and circle’s segments of a particular country. The size of the flow is indicated by the width of the link and its
basis. The direction of the flow is encoded both by the origin color and by the gap between link and circle segment at
the destination. The direction goes from a non-gap to a gap. Listings with unstated shipping destinations were
removed from the analysis (n = 40,851).
3.4. Spatial specificity 289
To evaluate the specialisation of vendors from any country and their respective importance in the 290
trafficking of products, the distribution of listings and vendors for every country was analysed 291
(Figures 3 and 4) as well as their contribution to the total number of listings for each product 292
category (Figure 5). For instance, Figure 3 indicates that illicit drugs and prescription drugs 293
represent respectively 66.3% and 18.5% of all listings (when worldwide is excluded). We also 294
observe that 64% and 6.5% of the listings “from” respectively American and Indian vendors 295
concern illicit drugs. They are respectively managed by 710 and 8 vendors (see Figure 4). Lastly, 296
the analysis of Figure 5 shows that the United States accounts for 30% of all sale proposals on 297
Evolution (worldwide excluded). Moreover, vendors from the United States - in line with their 298
number (see Figure 4) - are the main contributors on Evolution since they dominate the 299
distribution of illicit drugs (29.2% of listings classified in the category are managed by 300
“American” vendors), prescription drugs (41.6%), fraud related (30.4%), lab supplies (48.1%) 301
and ID Related (59.1%). 302
Figure 3. Distribution of listings in product categories for every shipping country (without considering the 305
worldwide statement). * Country with less than 1% of the total number of listings 306
Figure 4. Number of vendors for each shipping country and product categories. 309
* Country with less than 1% of the total number of listings 310
Figure 5. Contribution (in terms of listing proportions) of each shipping country in product categories (without 313
considering the worldwide statement). * Country with less than 1% of the total number of listings 314
Figures 3 and 4 highlight the specialisation in prescription and illicit drugs of vendors from the 316
Netherlands (98% of listings and 93% of vendors), Canada (97% each), Spain (96% and 94%) or 317
Sweden (94% each). The specialisation of ‘Dutch vendors’ has also been observed by a study 318
based on more recent datasets that concluded that they use cryptomarkets almost exclusively for 319
drug sales and particularly ecstasy-type drugs and stimulants [20]. The specialisation of Indian 320
vendors in the distribution of prescription drugs (see Figure 3) is also worth to be highlighted, 321
especially when considering the small number of vendors they represent, compared to that of the 322
other countries present in the category (see Figures 4 and 5). This was also observed on the 323
cryptomarket Agora [9]. By contrast, sellers ‘from’ Australia, Germany, the United Kingdom or 324
the United States seem to diversify their activities. In line with their number of vendors (see 325
Table 3) they are predominant in each of all categories (Figure 4), which is also corroborated by 326
the study of the origin of listings for each category (Figure 5). In fact, these four countries 327
together dominate the distribution of products in the majority of categories, such as illicit drugs 328
(about 77% relative to the total number of listings of the category), prescription drugs (73%), 329
PIEDs (63%), fraud related (77%), lab supplies (86%), firearms (71%) and ID related (86%). 330
Guides and Tutorials’ and “Goods, currencies and precious metalsare the only two categories 331
where vendors from these countries are not predominant. “Guides and Tutorials” has been 332
flooded by one Belgian vendor who is responsible of 68% of listings in the category. The 333
Goods, currencies and precious metals” category seems to be controlled by Chinese vendors 334
(71.8% of the listings, see Figure 5), while their number (13) is lower than other countries present 335
in the category such as the United States (67), the United Kingdom (31), Germany (17) and 336
Australia (16) (see Figure 4). In particular, they manage almost 99% of all listings classified as 337
Luxury goods”, which mainly consist in watches & jewellery, and 85% of that classified as 338
Clothes and accessories”. Most of the listing titles mention luxury brands, contain the term 339
“replica” and are sold at cheap prices. For instance, concerning watches (n = 1’347 listings), 340
Rolex is the most proposed brand (n = 314) followed by Omega (n = 217), Emporio Armani (n = 341
197), Breitling (n = 172) and Audemars Piguet (n = 149) and their prices range from 50 to 200 342
USD. Overall, all watch brands but one (Emporio Armani collection of the Giorgio Armani 343
industry) are affiliated to the Federation of the Swiss Watch Industry (FH), according to its 344
official website6. These results are consistent with the few sources of information regarding the 345
trafficking of luxury goods [28]. 346
The evaluation of the impact of countries in the trafficking of specific products as well as their 348
role in the distribution chain was found to be particularly relevant in the case of illicit drugs and 349
is therefore developed in the following section. Indeed, they represent the main good offered (see 350
Table 1) as well as the category where Worldwide is less stated (see Table 2 and Figure 2). 351
3.5. Illicit drugs 353
As mentioned in the introduction, English-speaking countries (e.g. the United States, the United 354
Kingdom, Australia) and Western European countries (e.g. the Netherlands) dominates the 355
trafficking of illicit drugs on cryptomarkets while cannabis, stimulants (cocaine and 356
amphetamines), ecstasy (MDMA) and psychedelics (NPS, LSD) are the main drugs offered on 357
cryptomarkets. In addition, compared to the traditional market, the relative low offer and 358
purchase of substances such as cocaine and heroin was noted by Kruithof et al. (2016). This may 359
be the consequence of the predominance of recreational consumers or psychonauts on 360
cryptomarkets [14,29,30]. The elements of planning and having to wait for delivery which 361
characterised cryptomarkets might deter excessive consumers or the ones not able to plan their 362
consumption [12,20]. This may be the case of regular cocaine and heroin consumers, which may 363
have timely access to their substances through traditional means of supply (street dealer, 364
contacts). These observations are further emphasised in our study (see Figures 6-8). 365
Similarly to the previous section, Figures 6, 7 and 8 provide information about the distribution of 366
illicit drug listings and vendors for every country (Figures 6 and 7) and their contribution to the 367
total number of listings for each category of illicit drugs (Figure 8). 368
Figure 6. Distribution of illicit drug listings for every shipping country (without considering the worldwide 371
statement). * Country with less than 2% of the total number of illicit drugs listings 372
373 Figure 7. Number of vendors for each shipping country and categories of illicit drugs. 374
* Country with less than 2% of the total number of listings 375
Figure 8. Contribution (in terms of listing proportions) of each shipping country in illicit drug categories (without 378
considering the worldwide statement). * Country with less than 2% of the total number of illicit drugs listings 379
Most countries propose cannabis related products which is also the illicit drug mainly offered 381
(38.6%) of all illicit drug listings (see Figures 6 and 7). In addition to the adaptation to the 382
customer demand, the predominance of cannabis may be explained by the easy access to 383
cannabis. Indeed, cannabis is not only the most consumed drug worldwide, it also represents the 384
most widely cultivated drug crop according to the UNODC [26]. Among the main stated countries, 385
Australia, China and the Netherlands are the only ones that do not mainly propose cannabis. For 386
instance, vendors from Australia propose at similar frequencies Ecstasy & MDMA, cannabis and 387
methamphetamine, which is tightly related to the indicators of the traditional market (arrests, 388
seizures and prevalence data) according to the Australian Intelligence Crime Commission [31]. We 389
may reasonably assume that such trend is the consequence of the domestic pattern observed for 390
the Australian illicit drug trafficking (see Figure 2). Lastly, the high proportions of listings of 391
Ecstasy & MDMA and amphetamine from Dutch vendors, and to a lesser extent from German 392
vendors (see Figure 6), can be explained by the main role these countries play in the production 393
of such drugs [27]. As shown in Figure 8, together they cover more than half of the sale proposals 394
of both Ecstasy & MDMA (50.7% of all listings in the category) and amphetamine (56.8%). 395
Concerning Ecstasy & MDMA, while production is now global, Europe, in particular the 396
Netherlands, is considered as the world’s leading source of the drug [32]. Clear spatial specificity 397
can be observed for amphetamines, which are mainly proposed by Germany, the Netherlands and 398
even Sweden (Figure 6) and methamphetamine, which is mainly offered by Australia and the 399
United States. Amphetamine is still mainly produced in Europe while methamphetamine 400
production is limited to the Baltic region and Central European countries. Moreover, the use of 401
methamphetamine in Europe is limited compared to that of amphetamine and is restricted to a 402
group of geographically close countries [33]. By contrast, as noted in the last World Drug Report 403
[26], « although methamphetamine is a feature of ATS markets worldwide, it is particularly 404
dominant in East and South-East Asia and North America ». In Australia, methamphetamine 405
remains the main drug produced in clandestine laboratories detected [31]. Finally, the United 406
States are responsible for the main proportion of illicit drug listings (29%), concentrate the 407
largest number of vendors (more than twice that of the United Kingdom) and is the lead country 408
of a wide number of illicit drug categories (see Figure 8). For instance, its leadership in the 409
opioids category may be explained by the increase in heroin use in North America in the past 410
decade (high prevalence compared to the worldwide mean). In contrast, Western and Central 411
Europe have seen stable or declining long-term trends of heroin consumption since the late 1990s 412
[26]. Finally, Chinese vendors, while five times fewer in number than Americans, lead the NPS 413
category (27.7% of NPS listings). As further developed below, they specialise in the distribution 414
of NPS (see also Figures 6 and 7), in which they play a strategic role. Another interesting 415
observation is the non-existence of cocaine and heroin producing countries (e.g. South American 416
countries or Middle East/South East/South West Asia). In general, these countries do not have 417
access to the same technological infrastructure (e.g. the Internet, secure mail system) as 418
westernised countries [7,18]. Furthermore, cryptomarkets may not represent a relevant distribution 419
channel between producers and retailers in the case of cocaine and heroin. 420
3.6. A specific analysis of New Psychoactive Substances 422
Regarding the worldwide market, 363 vendors manage 3,936 listings classified in NPS (all three 423
NPS related categories grouped). This represents almost 11% of the illicit drugs category (see 424
Figure 8). As shown in Table 3, listings about illicit drugs shipped from China and Hong Kong 425
represent about 4% of the total number of listings proposed on Evolution. However, the majority 426
of their illicit drug listings concern new psychoactive substances (93% precisely, see Figure 6). 427
They cover almost 28% of all the NPS listings proposed on Evolution with only 22 vendors, 428
which makes it the lead country, followed by the United States (26.5% - 115 vendors) and the 429
United Kingdom (13.9% - 83 vendors) (see Figure 8). 430
The combined analysis of masses and prices of the NPS proposed reveals geographical 431
differences between the shipping countries (see Figure 8). Most countries are characterised by a 432
majority of listings offering small quantities of NPS (less than one gram or less than ten grams). 433
However, vendors from China and Hong Kong offer larger quantities of NPS, between 10g and 434
100g, or even more. Thus, we may assume that vendors from China have the capacity to provide 435
bulk quantities. Indeed, typical quantities for NPS consumption are usually very low, suggesting 436
that quantities over 100g may already be considered as bulk. Price ranges also corroborate this 437
finding. Listings offered for sale from China and Hong Kong show a median price lower than 10 438
USD per gram, while median prices are relatively higher for every other country. Of course, 439
vendors usually propose products at prices decreasing gradually when quantity increases. 440
However, Chinese vendors are able to offer a lot of listings at high quantities at competitive 441
prices in comparison to vendors from other countries. In conclusion, these results may indicate 442
that Chinese vendors have easily access to these products or even may be involved in their 443
production which would be in agreement with Smith & Garlich (2013) who stated that China 444
played an active role in the domestic production of NPS [34]. Furthermore, this analysis 445
corroborates the statements of vendors on their profiles concerning their ability to offer both 446
small and very large quantities of NPS at lower prices. 447
Insert Figure 8 450
Figure 8. Proportions of listings (%) and median prices per gram (USD) according to the shipping country and the 452
quantity proposed. The global median price per gram is mentioned into brackets along with the number of listings for 453
each shipping country. Only the main shipping countries proposing NPS are represented. 454
The importance of Chinese sellers in NPS production or distribution does not seem to be 455
cryptomarket specific. Indeed, recent researches studying country specific differences in 456
substance availability on the Agora cryptomarket found that China, despite a small number of 457
sellers, was overrepresented in NPS. Using only the number of listings and sellers to draw their 458
conclusions, the authors mentioned that China was probably involved in the production of NPS 459
[8,9]. Another study, investigating wholesale activity on cryptomarkets, found that wholesale 460
transactions were especially concentrated in China. According to the authors, this may be related 461
to the role of China in the production of these substances [18]. 462
Regarding NPS in general, or more specifically synthetic cannabinoids, China has always been 463
suspected of being the place where these products are synthesised since the first appearance of 464
“spice” products in 2004 [3437]. It was also suggested that some substances are sent to Europe, or 465
even North America, and then reconditioned for retail shipping [35]. On the clear web, China was 466
also mentioned as the country of origin of websites offering MT-45, an opioid-like substance 467
often referred to as a NPS [38]. However, this was not investigated further, for example by 468
performing controlled purchases. Meyers and al. [39] also noted the accessibility of purchasing 469
cathinones (a major class of NPS) on the clear web. They highlighted United States, together 470
with Germany and the United Kingdom, as the three main countries where retailing websites 471
were hosted. Concerning NPS shipments confiscated at borders, most cathinones seizures in 2009 472
in New Zealand originated from the United Kingdom or directly from China [40]. In Australia, in 473
the period 2013 2014, NPS in kilogram quantities came primarily from China [41]. Thus, 474
although based on only one cryptomarket, the results obtained through our study support various 475
assumptions regarding the position of China within the NPS market. 476
4. General discussion and conclusion 481
Through the analysis of a dataset containing information on 4,171 vendors and 92,980 sale 482
proposals, this study aimed first at investigating the type and proportions of products offered for 483
sale on Evolution, a popular darknet marketplace in 2014-2015. Then, this article studied the 484
trafficking flows and geographical specificities in the trafficking of the different types of 485
products, in particular illicit drugs. Finally, NPS were especially studied to show how digital data 486
can inform on the role of specific countries in the distribution chain of products. 487
The results illustrate that the trafficking on Evolution is mainly devoted to the trade of illicit 488
drugs. These substances represent 46% of all listings and 57% of vendors offer for sale at least 489
one product classified as illicit drugs. Nevertheless, a wide range of other illicit products or 490
services are offered as well. In particular, sale proposals related to various fraud issues (carding, 491
ID theft, counterfeit goods, etc.) represent almost a third of the total number of listings and close 492
to half of vendors propose products classified in this category. The spatial analysis we performed 493
showed that English-speaking countries (especially the United States but also the United 494
Kingdom and Australia) and Western European countries (the Netherlands, Germany) dominate 495
the market, which is in line with past and more recent studies carried out on other cryptomarkets 496
[8,10,11,16,20]. The study of trafficking flows reveals the domestic (e.g. Australia) and international 497
(e.g. the Netherlands, Germany and China) nature of the trade of some countries. The spatial 498
analysis also shows the specialisation of vendors and which countries are at the forefront of the 499
distribution of specific types of products. For instance, vendors from the Netherlands and Canada 500
specialise in trafficking prescription and illicit drugs, Indian vendors in prescription drugs, 501
Chinese vendors specialise in luxury goods and NPS, while vendors from the United States 502
dominate in a wide range of product categories. The combination of our results and other sources 503
of information shows that geographical trends in the trafficking of specific type of illicit drugs 504
tend to reflect the structure of the traditional market (e.g. prevalence data and role in the 505
production of synthetic drugs). This may corroborate that sellers use cryptomarkets as a new 506
distribution channel to sell all or part of their merchandise. 507
Nevertheless, the analysis of the number of vendors and sale proposals performed provides only 508
information on the supply side of the market. To properly evaluate the role of countries on 509
Evolution, as well as that of cryptomarkets in the distribution chain, it would be interesting to get 510
an insight into the volume of sales of each country using the feedbacks left by past customers 511
[2,11]. This would also better inform on the availability of the products offered for sale [18]. 512
Unfortunately, the way data on Evolution were collected did not make possible such analysis. 513
The data collected online, and used by researchers to evaluate different aspects of the trade on 514
cryptomarkets - such as the vendor name, type of product, quantity, price, shipping country and 515
destination(s) - are uncertain. Indeed, they depend on what the sellers state on their sale proposals 516
and profiles. The only viable way to verify the accuracy of the online information is to purchase 517
and evaluate a product [19,42]. However, an incoherence between the stated online information and 518
that of the physical product shipped by post could have a negative impact on the reputation of the 519
seller and consequently on his revenue [8]. A previous study showed that sellers seem to describe 520
accurately their sale proposals, in particular their origin country and products offered for sale [14]. 521
Indeed, customers can easily verify the country of origin of the purchased product, when they 522
received it by mail since it is stated on mails shipped internationally [8]. Thus, even if the 523
possibility exists that sellers do not provide accurate information, it seems unlikely that they do 524
so in regards to the shipping country and the products offered for sale [8,18,25]. In addition, the 525
stated origin country tends to be accurate, as evidenced by studies based on darknet orders [19], 526
seizures of postal parcels at the borders [43] and coherence between online information and 527
knowledge regarding the offline market [8,9]. 528
In conclusion, the analysis of cryptomarkets should be integrated in a more global approach that 529
aims to improve the knowledge of illicit market structures and trafficking, which is in line with a 530
forensic intelligence approach. Developing strategies to monitor Internet activities on 531
cryptomarkets and on dedicated forums are powerful means to observe and detect global and 532
specific trends for different categories of products on the illicit market. This research 533
demonstrates the importance of analysing all the data available on a cryptomarket to inform on 534
the structure (e.g. type and frequencies of products, number of vendors, shipping countries and 535
destinations, etc.) and dynamics (e.g. trafficking flows, emerging substances, specific trends, etc.) 536
of the trade as well as on the role of certain countries in the trafficking and even specificities of 537
their illicit market. In addition, our observations validate the hypothesis that the use of the 538
shipping country statement truly inform on the origin of the products offered for sale. Performing 539
a geographical analysis of trafficking on darknet marketplaces based on such statement can 540
therefore be considered as appropriate. Since monitoring cryptomarkets may reveal country-541
specific trends, it could be seen as a new data source that would inform from a different 542
perspective on the characteristics of the illicit market within the domestic context of particular 543
countries. This would be particularly meaningful in the case of physical products such as (illicit) 544
drugs. The knowledge obtained through this analysis could then be used at a tactical and 545
operational level (e.g. to support specific operations) or at a strategic level (e.g. to obtain an 546
understanding of the criminal activity) [44]. 547
5. References 551
[1] EUROPOL. Internet Organised Crime Threat Assessment (IOCTA), The Hague, The 553
Netherlands, 2016. 554
[2] J. Aldridge, D. Décary-Hétu. Not an “Ebay for Drugs”: The Cryptomarket “Silk Road” as 555
a Paradigm Shifting Criminal Innovation. Soc. Sci. Res. Netw., 2014. 556
[3] M. Tzanetakis, G. Kamphausen, B. Werse, R. Von Laufenberg. The transparency paradox. 557
Building trust, resolving disputes and optimising logistics on conventional and online 558
drugs markets. Int. J. Drug Policy, 2016, 35, 5868. 559
[4] A. AlQahtani, E. El-Alfy. Anonymous connections based on onion routing: a review and a 560
visualization tool. Procedia Comput. Sci., 2015, 52, 121128. 561
[5] F. Reid, M. Harrigan. An analysis of anonymity in the bitcoin system, in Proc. Int. Conf. 562
Privacy, Secur. Risk Trust Int. Conf. Soc. Comput., Boston, USA, 2011, pp. 13181326. 563
[6] J. Cox. Staying in the shadows: the use of bitcoin and encryption in cryptomarkets. 2016, 564
The internet and drug markets, 4147. 565
[7] J. Martin. Lost on the Silk Road: Online drug distribution and the “cryptomarket.” 566
Criminol. Crim. Justice, 2014, 14, 351367. 567
[8] J. Van Buskirk, S. Naicker, A. Roxburgh, R. Bruno, L. Burns. Who sells what? Country 568
specific differences in substance availability on the Agora cryptomarket. Int. J. Drug 569
Policy, 2016, 35, 1623. 570
[9] D. S. Dolliver, S. P. Ericson, K. L. Love. A Geographic Analysis of Drug Trafficking 571
Patterns on the TOR Network. Geogr. Rev., 2016, 124. 572
[10] N. Christin. Traveling the Silk Road: A measurement analysis of a large anonymous online 573
marketplace. Proc. 22nd Int. World Wide Web Conf., 2012, Rio de Janeiro, Brazil. 574
[11] K. Soska, N. Christin. Measuring the Longitudinal Evolution of the Online Anonymous 575
Marketplace Ecosystem, in Proc. 22nd USENIX Secur. Symp. (USENIX Secur. 2015), 576
Washington, DC., 2015, pp. 3348. 577
[12] M. C. Van Hout, T. Bingham. “Surfing the Silk Road”: A study of users’ experiences. Int. 578
J. Drug Policy, 2013, 24, 524529. 579
[13] M. C. Van Hout, T. Bingham. “Silk Road”, the virtual drug marketplace: A single case 581
study of user experiences. Int. J. Drug Policy, 2013, 24, 385391. 582
[14] M. C. Van Hout, T. Bingham. Responsible vendors, intelligent consumers: Silk Road, the 583
online revolution in drug trading. Int. J. Drug Policy, 2014, 25, 183189. 584
[15] M. J. Barratt, J. A. Ferris, A. R. Winstock. Use of Silk Road, the online drug marketplace, 585
in the United Kingdom, Australia and the United States. Addiction, 2014, 109, 774783. 586
[16] M. J. Barratt, J. A. Ferris, A. R. Winstock. Safer scoring? Cryptomarkets, social supply 587
and drug market violence. Int. J. Drug Policy, 2016, 35, 2431. 588
[17] J. Broséus, D. Rhumorbarbe, C. Mireault, V. Ouellette, F. Crispino, D. Décary-Hétu. 589
Studying illicit drug trafficking on Darknet markets: Structure and organisation from a 590
Canadian perspective. Forensic Sci. Int., 2016, 264, DOI 10.1016/j.forsciint.2016.02.045. 591
[18] J. Aldridge, D. Décary-Hétu. Hidden wholesale: The drug diffusing capacity of online 592
drug cryptomarkets. Int. J. Drug Policy, 2016, 35, 715. 593
[19] D. Rhumorbarbe, L. Staehli, J. Broséus, Q. Rossy, P. Esseiva. Buying drugs on a Darknet 594
market: A better deal? Studying the online illicit drug market through the analysis of 595
digital, physical and chemical data. Forensic Sci. Int., 2016, 267, DOI 596
10.1016/j.forsciint.2016.08.032. 597
[20] K. Kruithof, J. Aldridge, D. Décary-Hétu, M. Sim, E. Dujso, S. Hoorens. Internet-598
Facilitated Drugs Trade: An Analysis of the Size, Scope and the Role of the Netherlands. 599
RAND EUROPE, 2016. 600
[21] J. Van Buskirk, A. Roxburgh, R. Bruno, L. Burns. Drugs and the Internet, 2015. 601
[22] J. Demant, R. Munksgaard, E. Houborg. Personal use, social supply or redistribution? 602
cryptomarket demand on Silk Road 2 and Agora. Trends Organ. Crime, 2016, 120. 603
[23] R-Core-Team. R: A language and environment for statistical computing. R Found. Stat. 604
Comput., 2016. 605
[24] R. Ensafi, P. Winter, A. Mueen, J. R. Crandall. Analyzing the Great Firewall of China 606
Over Space and Time. Proc. Priv. Enhancing Technol., 2015, 2015, 6176. 607
[25] D. Décary-Hétu, M. Paquet-Clouston, J. Aldridge. Going international? Risk taking by 608
cryptomarket drug vendors. Int. J. Drug Policy, 2016, 35, 6976. 609
[26] UNODC. World Drug Report, United Nations Office On Drugs And Crime, Vienna, 2016. 610
[27] EMCDDA. Rapport Sur Les Marchés Des Drogues Dans l’UE: Synthèse, Publications 611
Conjointes de l’EMCDDA et d’Europol, Office Des Publications de l’Union Européenne, 612
Luxembourg., 2016. 613
[28] Europol and the Office for Harmonization in the Internal Market. Situation Report on 614
Counterfeiting in the European Union, 2015. 615
[29] E. Ormsby. Silk Road: insights from interviews with users and vendors. In “The Internet 616
and drug markets,” (Ed: EMCDDA), Publications Office Of The European Union, 617
Lisbonne, Portugal, 2016. 618
[30] M. J. Barratt. Silk Road : eBay for Drugs. Addiction, 2012, 107, 683. 619
[31] ACIC. Report, 2014-2015 Illicit Drug Data, 2016. 620
[32] UNODC. Ecstasy and Amphetamines Global Survey, Vienna, 2003. 621
[33] EMCDDA, EUROPOL. EU Drugs Market Report : A Strategic Analysis, European 622
Monitoring Centre For Drugs And Drug AddictionEuropean Police Office, Luxembourg, 623
2013. 624
[34] S. Smith, F. Garlich. Availability and supply of novel psychoactive substances, in Nov. 625
Psychoact. Subst., (Eds: P. Dargan, D.M. Wood), Elsevier Academic Press, Amsterdam, 626
Netherlands, 2013. 627
[35] EMCDDA. New Psychoactive Substances in Europe. An Update from the EU Early 628
Warning System (March 2015)., Publications Office Of The European Union, 629
Luxembourg, 2015. 630
[36] I. Bigdeli, O. Corazza, Z. Aslanpour, F. Schifano. Novel Psychoactive Substances (NPS): 631
a study on Persian language websites. Iran J. Public Heal., 2013, 42, 511515. 632
[37] ACMD. Consideration of the Novel Psychoactive Substances (’Legal Highs’), Home 633
Office, Londres, 2011. 634
[38] S. Siddiqi, C. Verney, P. Dargan, D. M. Wood. Understanding the availability, prevalence 635
of use, desired effects, acute toxicity and dependence potential of the novel opioid MT-45. 636
Clin. Toxicol., 2015, 53, 5459. 637
[39] K. Meyers, Ö. Kaynak, E. Bresani, B. Curtis, A. McNamara, K. Brownfield, K. Kirby. The 638
availability and depiction of synthetic cathinones (bath salts) on the Internet: do online 639
suppliers employ features to maximize purchases? Int. J. Drug Policy, 2015, 26, 670674. 640
[40] INCB. Report of the International Narcotics Control Board for 2010., International 641
Narcotics Control Board (INCB). 2011, United Nations, New York, NY, 2011. 642
[41] ACIC. 2013-2014 Illicit Drug Data Report, Australian Intelligence Crime Commission. 643
2014, Canberra, Australia, 2015. 644
[42] F. Caudevilla, M. Ventura, I. Fornís, M. J. Barratt, C. Vidal, C. G. Lladanosa, P. Quintana, 645
A. Muñoz, N. Calzada. Results of an international drug testing service for cryptomarket 646
users. Int. J. Drug Policy, 2016, 35, 3841. 647
[43] N. Horne, K. Edmondson, M. Harrison, B. Scott. The applied use of forensic intelligence 648
for community and organised crime. Aust. J. Forensic Sci., 2015, 47, 7282. 649
[44] M. Morelato, S. Baechler, O. Ribaux, A. Beavis, M. Tahtouh, P. Kirkbride, C. Roux, P. 650
Margot. Forensic intelligence framework-Part I: Induction of a transversal model by 651
comparing illicit drugs and false identity documents monitoring. Forensic Sci. Int., 2014, 652
236, 181190. 653
[45] L. A. King. Legal classification of novel psychoactive substances - An international 654
comparison , in Nov. Psychoact. Subst. Classif. Pharmacol. Toxicol., (Eds: P.I. Dargan, 655
D.M. Wood), Elsevier/Academic Press, London ; Waltham, MA, 2013, pp. 327. 656
[46] I. Vardakou, C. Pistos, C. Spiliopoulou. Spice drugs as a new trend: Mode of action, 657
identification and legislation. Toxicol. Lett., 2010, 197, 157162. 658
6. Appendix 663
Appendix 1 664
On Evolution, product categories are typically self-selected by vendors from an existing list when 665
creating a sale proposal, which is a source of uncertainty. Indeed, category names administrators 666
had chosen did not inform on the type of products that was actually proposed. For instance, most 667
of the illicit drugs or medicines categories were not defined according to the chemical structure of 668
the products but instead to their effects. Moreover, it was not rare that vendors misclassified their 669
listings. Furthermore, categories that were defined by administrators were not necessarily 670
coherent considering the diversity in the type of products they contained. Lastly, it was possible 671
to merge in the same category several listings spread into different categories since they 672
concerned the same type of fraud issue or illicit activity (see Figures A1 and A2). Thus, sale 673
proposals were semi-automatically classified according to a list of keywords that we defined after 674
a thorough analysis of all the listing titles. The new classification was performed according to the 675
type of products offered for sale or to the nature of the illicit activity involved and included three 676
main categories, in particular Illicit drugs, drugs and paraphernalia”, Various fraud issues677
and “Other. In a few words, listings originally classified in Drugs” were reorganised in a 678
number of categories in “Illicit drugs, drugs and paraphernalia” according to the general type of 679
licit or illicit drug or equipment offered. In particular, apart from the usual illicit drugs (e.g. 680
cannabis, cocaine, opioids, ecstasy, LSD), the products known as new psychoactive substances 681
(NPS) were distributed between three subcategories. The four major classes - phenethylamines, 682
cathinones, piperazines and tryptamines [45] - were listed as NPS”. Their classification is based 683
on the general chemical structure, shared by every substance of each category. Synthetic 684
cannabinoids were classified separately since they may include herbal components and synthetic 685
substances [46]. Substances not included in the two previous subcategories due to a complex or 686
anecdotal chemical characterization were classified as NPS - Other”. It includes for example 687
benzofurans (e.g. 5-APB, 6-EAPB) or aminoindane analogues (e.g. MDAI) (see Figure A2). 688
Ketamine was classified in “Other”. In the Various fraud issues category, a significant 689
proportion of the listings are part of the Fraud Related category. The latter mainly concerns 690
listings on financial fraud and hacking services. In particular, most of the listings are related to 691
carding. We also defined the Goods, currencies and precious metals category, which 692
especially contains Luxury goods(mostly watches followed by jewellery and perfumes) and 693
Clothes and accessories” (mainly glasses, shirts, jackets and bags). These two categories 694
contain products with a high probability of forgeries, as will be discussed below. The Various 695
fraud issues” also includes sale proposals about material related to identity theft such as false or 696
stolen ID documents as well as data related to identity (“ID Related”). Moreover, a variety of 697
electronic documents explaining how to perform some hacking or fraud related activities were 698
listed as “Guides & Tutorials”. To a lesser extent, a number of sale proposals concern “Firearms 699
& Weapons”, which is essentially constituted by the original Weapons category. Lastly, 700
customers may request a specific listing from a vendor through private messaging [10]. A listing 701
specifically designed for the customer will then be created, without necessarily stating the 702
concerned product. They were classified in the Custom listings” category if their title did not 703
include any relevant keyword that may be used for classification in one aforementioned category 704
(see Figure A2). 705
Appendix 1 Figure A1. Categories of products as created by administrators of Evolution 717
Appendix 1 Figure A2. Classification of sale proposals performed by the authors 722
Appendix 2 726
Countries & regions mentioned
Afghanistan, Albania, Andorra, Argentina, Aruba, Australia,
Austria, Azerbaijan, Bangladesh, Belgium, Bolivia, Bosnia and
Herzegovina, Brazil, Bulgaria, Cambodia, Canada, Cayman
Islands, Central African Republic, Chile, China, Christmas Island,
Colombia, Czech Republic, Denmark, Dominican Republic, Egypt,
El Salvador, Estonia, Ethiopia, Fiji, Finland, France, Gabon,
Gambia, Georgia, Germany, Ghana, Greece, Guatemala, Guernsey,
Hong Kong SAR China, Hungary, India, Ireland, Italy, Jamaica,
Kenya, Latvia, Libya, Lithuania, Luxembourg, Malaysia, Mexico,
Netherlands, Netherlands Antilles, New Zealand, North Korea,
Norway, Pakistan, Peru, Philippines, Poland, Portugal, Romania,
Russia, Saint Kitts and Nevis, Sao Tome and Principe, Saudi
Arabia, Serbia, Singapore, Slovakia, Slovenia, South Africa, Spain,
Sri Lanka, Svalbard and Jan Mayen, Swaziland, Sweden,
Switzerland, Taiwan, Tanzania, Thailand, Timor-Leste, Togo,
Uganda, Ukraine, United Kingdom, United States, Uruguay,
Western Sahara, Worldwide, Yemen, Zimbabwe.
Afghanistan, Albania, Algeria, American Samoa, Andorra, Angola,
Anguilla, Antarctica, Antigua and Barbuda, Argentina, Armenia,
Aruba, Australia, Austria, Azerbaijan, Bahamas, Bahrain,
Bangladesh, Barbados, Belarus, Belgium, Belize, Benin, Bermuda,
Bhutan, Bolivia, Bosnia and Herzegovina, Botswana, Bouvet
Island, Brazil, Brunei, Bulgaria, Burkina Faso, Burundi, Cambodia,
Cameroon, Canada, Canton and Enderbury Islands, Cape Verde,
Cayman Islands, Central African Republic, Chad, Chile, China,
Christmas Island, Cocos [Keeling] Islands, Colombia, Comoros,
Congo - Brazzaville, Congo - Kinshasa, Cook Islands, Costa Rica,
Cote d'Ivoire, Croatia, Cuba, Cyprus, Czech Republic, Denmark,
Djibouti, Dominica, Dominican Republic, Dronning Maud Land,
Ecuador, Egypt, El Salvador, Equatorial Guinea, Eritrea, Estonia,
Ethiopia, Falkland Islands, Faroe Islands, Fiji, Finland, France,
French Guiana, French Polynesia, Gabon, Gambia, Georgia,
Germany, Ghana, Gibraltar, Greece, Greenland, Grenada,
Guadeloupe, Guam, Guatemala, Guernsey, Hong Kong SAR
China, Hungary, Iceland, India, Indonesia, Ireland, Isle of Man,
Israel, Italy, Japan, Latvia, Lebanon, Lesotho, Liechtenstein,
Lithuania, Luxembourg, Macau SAR China, Macedonia,
Madagascar, Malaysia, Malta, Mauritius, Metropolitan France,
Mexico, Moldova, Monaco, Montenegro, Morocco, Netherlands,
Netherlands Antilles, New Zealand, North Korea, Norway,
Panama, Paraguay, Peru, Philippines, Poland, Portugal, Puerto
Rico, Romania, Russia, Saint Lucia, San Marino, Sao Tome and
Principe, Senegal, Serbia, Serbia and Montenegro, Singapore,
Slovakia, Slovenia, Somalia, South Africa, South Korea, Spain, Sri
Lanka, Svalbard and Jan Mayen, Swaziland, Sweden, Switzerland,
Taiwan, Thailand, Trinidad and Tobago, Tunisia, Turkey, Tuvalu,
Ukraine, United Kingdom, United States, Uruguay, Vatican City,
Venezuela, Vietnam, Worldwide, Zimbabwe.
Appendix 2 Table B1. Shipping countries and destinations mentioned by vendors 728
... However, the origin of the drugs could also affect their online sales. Countries like Germany, Canada, and the Netherlands, known for producing synthetic drugs like ecstasy, MDMA, and amphetamines (UNODC, 2022;EMCDDA, 2023), seem to favor international exports over domestic sales (Broséus et al., 2017). ...
... Our understanding of the factors influencing international drug trafficking via cryptomarkets remains limited. Previous research largely focuses on the concentration of sales, sellers, or buyers within countries instead of cross-border trafficking (Broséus et al., 2017;Christin, 2013;Demant et al., 2018;Dittus et al., 2018;Kruithof et al., 2016;Morelato et al., 2018;Soska & Christin, 2015). This methodology can highlight active countries within the cryptomarket ecosystem but provides little insight into why some countries export to or import from others. ...
... This methodology can highlight active countries within the cryptomarket ecosystem but provides little insight into why some countries export to or import from others. Cryptomarket data also tend to be inadequate for tracking trafficking flows (Broséus et al., 2017;Dittus et al., 2018;Morelato et al., 2018), with nearly 40% of sellers claiming to ship 'worldwide,' which hampers precise mapping of trafficking routes (Broséus et al., 2017). ...
Full-text available
Drug cryptomarkets are a significant development in the recent history of illicit drug markets. Dealers and buyers can now finalize transactions with people they have never met, who could be located anywhere across the globe. What factors shape the geography of international drug trafficking via these cryptomarkets? In our current study, we test the determinants of drug trafficking through cryptomarkets by using a mix of social network analysis and a new dataset composed of self-reported transactions. Our findings contribute to existing research by demonstrating that a country’s level of technological advancement increases the probability of forming trafficking connections on cryptomarkets. Additionally, we found that a country’s capacity to police cryptomarkets reduces the number of trafficking connections with other countries. We also observed that trafficking on cryptomarkets is more likely to occur between countries that are geographically close. In summary, our study highlights the need to consider both online and offline factors in research on cryptomarkets.
... Whilst there are a small number of Chinese-language darknet sites, most use Tor to access censored content on the surface web rather than hidden services (Cox, 2015). In an analysis of various darknet marketplaces, Broséus et al. (2017) find relatively few Chinese vendors, with most serving international as opposed to domestic clients. Whilst this may be a result of language barriers or the existence of alternative illicit trade routes, it also reflects the fact that, though growing, Tor usage is still relatively low in China. ...
... Whilst this may be a result of language barriers or the existence of alternative illicit trade routes, it also reflects the fact that, though growing, Tor usage is still relatively low in China. Most Chinese listings relate to counterfeit goods and new psychoactive substances (such as synthetic cannabinoids), suggesting Chinese involvement in the global production and trade of these items (Broséus et al., 2017). ...
... The suggestion here is that where citizens' internet rights are protected, individuals use Tor for personal benefit rather than out of political necessity. Although Russia is something of an exception, studies of darknet marketplaces have supported this claim by showing that vendors and consumers are largely concentrated in the US, Western Europe, and Australia (Broséus et al., 2017). Therefore, it is incumbent on policymakers to assess the full range of sociopolitical factors that draw people to use Tor in the first place. ...
Full-text available
Tor is a service which provides users with unparalleled online anonymity. It can be used for browsing the surface web or to access a hidden layer of the internet known as the ‘dark web’. It is a prime example of a ‘dual use’ technology, as its uses range from enabling freedom of speech to disseminating child pornography. Understanding Tor should be a priority for policymakers as its usage grows. Using four case studies, this paper finds that national approaches to the dark web are highly influenced by two competing internet ideologies: ‘free internet’ (championed by the US and UK), and ‘internet sovereignty’ (promoted in recent years by China and Russia). This paper emphasises that banning Tor will not work, and that attempts at regulation or shutting down sites often leads to new and more sophisticated criminal innovations. Therefore, policymakers need to work with the technology rather than against it and exploit its beneficial uses.
... In 2022, WADA published a report into trafficking of performance enhancing substances (PES) on the darknet. According to Broséus, Rhumorbarbe, Morelato, Staehli and Rossy (2017), the darknet is a layer of the internet that cannot be indexed and searched through popular search engines such as the google. Features of the darknet include websites visually similar to eBay and Amazon, discussion forums, and marketplaces that trade in both legitimate and illicit products and services (Broséus et al., 2017).WADA in 2022 tried to investigate the nature of trafficking, to assess the type and quality of PES, detect novel substances that evade detection, and to understand the structure of darknet markets for PES (WADA, 2022). ...
... According to Broséus, Rhumorbarbe, Morelato, Staehli and Rossy (2017), the darknet is a layer of the internet that cannot be indexed and searched through popular search engines such as the google. Features of the darknet include websites visually similar to eBay and Amazon, discussion forums, and marketplaces that trade in both legitimate and illicit products and services (Broséus et al., 2017).WADA in 2022 tried to investigate the nature of trafficking, to assess the type and quality of PES, detect novel substances that evade detection, and to understand the structure of darknet markets for PES (WADA, 2022). The findings indicated that darknet marketplaces offer thousands of PES advertisements, although still substantially less than advertised through the surface net. ...
Purpose: The main objective of this study was to explore the prevalence of drug abuse as it relates to psychosocial reasons that include peer pressure, social environment, emotional state and relationships; among university athletes involved in selected competitive sports. Methodology: The study used a mixed methods research design with an intention to capture and utilize both qualitative and quantitative data. The study sample comprised 300 respondents. Out of the 300 students, 173 (57.7%) were male and 127 (42.3%) were female players derived from six selected competitive sports at the universities in Kenya. The selected sports were badminton, tennis, basketball, volleyball, soccer and rugby. Stratified sampling followed by simple random sampling was used to select 10 universities proportionately (4 private and 6 public), the method was the most appropriate to capture universities with women rugby in addition to the five other selected sports. The study sought to investigate the prevalence of drug abuse due to factors such as psychosocial, medicinal and competition. SPSS computer version 20 was used to process data. The data was presented in form of tables. Findings: Data indicated clearly that athletes had abused drugs due to various psychosocial reasons. The prevalence per gender was close at 18% and 12.12% for males and females respectively. Peer pressure was regarded as a great contributor to drug abuse among the youth. Another psychosocial indicator is the emotional state of a particular individual. Students, just like other members of society, go through various challenging situations in life. The other indicator regarding drug abuse due to psychosocial factors is depression. Four (4, 40%) of the 10 dean of students interviewed said that students were victims of drug abuse due to depression. They alluded the depression cases mostly to relationship issues and financial challenges while the students are in session. The data was presented in form of Tables. Unique Contribution to Theory, Practice and Policy: Social Learning Theory, Stress-Coping Theory and Social Control Theory may be used to anchor future studies. It is recommended that university athletes be sensitized on proper use of sports to relieve stress and maintain emotional balance. Further, only qualified coaches and sports officers should be allowed to mentor and man sports in the universities. According to some heads of sports seven out of the ten (70%) and 4 of the 10 (40%) deans of students interviewed, some coaches may not report cases of drug abuse by athletes. This could be attributed to the fact that the coaches, who mostly are on casual basis, could fear experiencing bad blood with the players thereby threatening their jobs. Trained sports officers and coaches should accompany the university athletes always and act as worthy mentors to the young athletes.
... Enfin, des études ponctuelles qui tendent à compléter la veille s'appuient sur tous ces développements, ainsi que d'autres, comme l'analyse des seringues usagées qui indiquent les produits ou les combinaisons de produits injectés par les consommateurs (Brunt et al. 2021 ;Lefrançois 2021). Un suivi des sources ouvertes et du dark web renseigne par ailleurs sur l'ampleur et l'évolution de la vente des produits sur des plateformes (Broséus et al. 2017 ;Rossy et al. 2018b). Des éléments de toxicologie, en particulier en relation avec la conduite automobile (Maurer et al. 2021) montrent que les possibilités d'intégrer des données sur les substances dans une veille sont très variées. ...
... La fabrication et la diffusion des montres contrefaites sont par exemple observées avec attention (Dubey 2009 ;Schoenenweid et al. 2010 ;Decker 2012 ;Erne et al. 2014 ;Hochholdinger 2019). Cette veille présente beaucoup d'analogies avec le suivi des marchés de produits dopants (Marclay et al. 2013 ;Pineau et al. 2016 ;Broséus et al. 2017). La confection et la diffusion des médicaments contrefaits s'appuient également sur une approche similaire (Been et al. 2011 ;Degardin, Roggo et Margot 2014). ...
Le rôle de la police scientifique est d’abord d’exploiter les traces laissées lors d’activités criminelles. Elle est aujourd’hui équipée de technologies de traçabilité si puissantes que celles-ci ont, en peu de temps, démultiplié la quantité et la variété de données mises à disposition de l’enquête judiciaire et du renseignement criminel. Or cette évolution rapide a paradoxalement eu pour conséquence une remise en question du rôle, du statut et de l’action de la police scientifique : qu’attend-on aujourd’hui de ces services ? Que sont-ils supposés conclure à partir de données devenues aussi considérables que spécialisées et fragmentées ? L’auteur décrit comment la police scientifique évolue vers une nouvelle discipline appelée « traçologie ». Celle-ci s’oppose à l’hyper-spécialisation en encourageant les professionnels à adopter une vision d’ensemble essentielle pour résoudre des enquêtes complexes, analyser la criminalité sérielle et renseigner l’action de sécurité. Un ouvrage manifeste, principalement destiné aux criminalistes et criminologues concernés par l’avenir de la police scientifique, mais aussi à tous les professionnels de la sécurité, qui trouveront dans ces pages des méthodes et des modèles directement applicables, aux étudiants en sciences criminelles, aux chercheurs en quête d’interdisciplinarité et au public intéressé par les méthodes d’investigation et curieux d’en découvrir les arcanes.
... Ainsi, dans un contexte caractérisé par une fluctuation des frontières traditionnelles du champ de la criminologie, il est peu surprenant de constater que lors des six derniers colloques de l'Association Internationale des Criminologues de Langue Française (AICLF) -en 2010 à Fribourg, en 2012 à Montréal, en 2014 à Liège, en 2016 à Versailles, en 2018 à Lausanne et, plus récemment, en 2022 à Ottawa -, bon nombre d'ateliers et conférences se sont affairés à rapprocher la science forensique et la criminologie dans une tentative de co-construction des savoirs sur le phénomène criminel et sa régulation Rossy & Mulone, 2015). Cette collaboration interdisciplinaire s'est notamment manifestée via la mobilisation des connaissances criminologiques -empiriques et/ou théoriques -pour interpréter la signification des traces, et la mise à profit de ces traces pour produire des savoirs novateurs sur des phénomènes criminels divers (Broséus et al., 2017 ;Delémont et al., 2017 ;Lavergne et al., 2022). Quoique plus rare, il convient d'ajouter une tierce avenue à ce rapprochement interdisciplinaire, où la trace n'est pas étudiée pour son potentiel informatif sur l'activité criminelle à son origine, mais plutôt pour sa capacité à éclairer l'activité policière à l'origine de sa détection, de son stockage et du sens qui lui est donné (Bitzer, 2016 ;Hazard, 2014). ...
Full-text available
Les traces révélatrices de sources et d’activités à leur origine représentent inévitablement des données hautement pertinentes pour étudier le crime, la criminalité, le criminel et leur régulation (sans toutefois se limiter à ces thématiques), objets de recherche de la criminologie. En ce sens, le présent article vise à exposer différents contextes d’étude où l’exploitation de ces traces représente une contribution originale à la compréhension de certaines pratiques délinquantes, policières et judiciaires. L’apport de la science forensique numérique, du profilage des traces chimiques et de l’étude des traces recherchées, prélevées et analysées par les corps policiers y sont notamment décortiqués. Cependant, le défi d’intégrer ce type d’approche dans le suivi opérationnel des phénomènes criminels, policiers et judiciaires impose une réflexion sur la portée de la diffusion de ces nouveaux savoirs à l’interface de la science forensique et de la criminologie dans les milieux professionnels. Forensic traces, revealing remains of the sources and activities at their origin, inevitably represent highly relevant data for studying crime, criminality, criminals, and their regulation (without being limited to these themes), fields of study of criminology. In this sense, this article aims to expose different study contexts where forensic science may represent an innovative contribution to the understanding of some delinquent, police and judicial practices and behaviours. It describes criminology contributions from digital forensic science, profiling of chemical traces, as well as traces researched, collected, and analyzed by crime scene investigators. However, the challenge of integrating this type of approach into the operational monitoring of criminal, police and judicial phenomena requires a reflection on the scope of the dissemination of this new knowledge at the interface of forensic science and criminology in professional circles.
... Supplemental material for this article is available online. Notes 1. Missing or obscured geographic information is a particular challenge to using this data (Décary-Hétu et al., 2016;Broséus, et al., 2017). For instance, using 6 months of online transactions, Duxbury and Haynie (2018) find that crypto markets exhibit highly localized structures centralized on a few key vendors selected via trust-based preferential attachment. ...
If it is possible to overcome significant data challenges, social network analytics could be used to expose structural vulnerabilities in transnational drug smuggling operations, offering clear targets for crime control efforts that aim to disrupt transhipment. This study explores the extent to which data inclusion decisions might distort the emergent structure of nation-to-nation smuggling networks mapped with aggregate intelligence using United Nations Office on Drugs and Crime (UNODC) incident level seizure data (2010–2016). Bivariate exponential random graph models (ERGM) show that relaxing data inclusion standards exposes illicit backchannels (reciprocity) and a more complete picture of major transhipment activity (activity and popularity spread) than would be otherwise undetected. Relaxed data inclusion standards may help to adjust for the data limitations associated with the detection of rare events and inconsistent reporting practices, if usage rules are followed.
... There has also been research on analyzing specific information found on darknet marketplaces: In [6] Broséus et al. collect data from the Evolution marketplace and show which geographical information can be derived from it. Wang et al. focus on the detection of multiple identities of vendors in darknet marketplaces by utilizing deep learning based image matching in [30]. ...
Full-text available
Darknet marketplaces in the Tor network are popular places to anonymously buy and sell various kinds of illegal goods. Previous research on marketplaces ranged from analyses of type, availability and quality of goods to methods for identifying users. Although many darknet marketplaces exist, their lifespan is usually short, especially for very popular marketplaces that are in focus of law enforcement agencies. We built a data acquisition architecture to collect data from White House Market, one of the largest darknet marketplaces in 2021. In this paper we describe our architecture and the problems we had to solve, and present findings from our analysis of the collected data.
Cryptomarkets are increasingly requiring users to purchase products with Monero (a ‘privacy coin’) to further obfuscate the digital trail of money compared to conventional cryptocurrencies (e.g. Bitcoin). This is the first study to explore how cryptomarket communities are used to facilitate norms and behaviours to expedite these emerging cryptocurrency practices. Through a qualitative analysis of Monero threads in a Reddit cryptomarket community (3451 total posts), this research illustrates how online communities often underpin the adoption of new technologies in cryptomarkets. The findings reveal: how the online community functions, adapts, and fails to support cryptocurrency transitions; the appraisal and contestation of cryptocurrency risks; and the ideological drivers and symbolic resources used to align community practices to adopt Monero. This research contributes to an understanding of the processes that underpin the constant evolution of online illicit markets as human and non-human elements are constantly re-assembled.
Practice and Policy-Oriented Abstract Law enforcement bodies have largely responded to the increase in darknet activities through site shutdowns, which involve significant investment of policing resources. Despite these efforts, new darknet sites continue to show up after the site takedowns. We offer a new look at this issue by assessing the viability of selectively targeting large drug vendors operating on darknet sites. We find that the arrest of a major drug vendor reduced subsequent transaction levels by 39% and the number of remaining vendors by 56% on Silk Road 2.0. This deterrent effect also spilled over to drug vendors located in countries beyond the prosecutorial jurisdiction of the arrested vendor. We further find that small darknet drug vendors were most deterred by the arrest and vendors selling dangerous drugs were relatively more deterred. Our study findings hold policy-relevant implications to government agencies and law enforcement. Whereas site shutdowns can disrupt these markets momentarily, the selective targeting of large-scale drug vendors should be given serious consideration and used to a broader extent. The design of future enforcement strategies should also account for the finding that darknet markets are made up of both small-scale drug dealers new to the drug trade and large-scale drug syndicates.
Full-text available
Darknet markets, also known as cryptomarkets, are websites located on the Darknet and designed to allow the trafficking of illicit products, mainly drugs. This study aims at presenting the added value of combining digital, chemical and physical information to reconstruct sellers' activities. In particular, this research focuses on Evolution, one of the most popular cryptomarkets active from January 2014 to March 2015. Evolution source code files were analysed using Python scripts based on regular expressions to extract information about listings (i.e., sales proposals) and sellers. The results revealed more than 48,000 listings and around 2700 vendors claiming to send illicit drug products from 70 countries. The most frequent categories of illicit drugs offered by vendors were cannabis-related products (around 25%) followed by ecstasy (MDA, MDMA) and stimulants (cocaine, speed). The cryptomarket was then especially studied from a Swiss point of view. Illicit drugs were purchased from three sellers located in Switzerland. The purchases were carried out to confront digital information (e.g., the type of drug, the purity, the shipping country and the concealment methods mentioned on listings) with the physical analysis of the shipment packaging and the chemical analysis of the received product (purity, cutting agents, chemical profile based on minor and major alkaloids, chemical class). The results show that digital information, such as concealment methods and shipping country, seems accurate. But the illicit drugs purity is found to be different from the information indicated on their respective listings. Moreover, chemical profiling highlighted links between cocaine sold online and specimens seized in Western Switzerland. This study highlights that (1) the forensic analysis of the received products allows the evaluation of the accuracy of digital data collected on the website, and (2) the information from digital and physical/chemical traces are complementary to evaluate the practices of the online selling of illicit drugs on cryptomarkets.
Technical Report
Full-text available
The potential role of the Internet in facilitating drugs trade first gained mass attention with the rise and fall of Silk Road; the first major online market place for illegal goods on the hidden web. After Silk Road was taken down by the FBI in October 2013, it was only a matter of weeks before copycats filled the void. Today, there are around 50 so-called cryptomarkets and vendor shops where anonymous sellers and buyers find each other to trade illegal drugs, new psychoactive substances, prescription drugs and other goods and services. But it is not just the obscure parts of the Internet where drugs are on offer. There are numerous web shops, easily found by search engines, which offer new psychoactive substances, often labelled as 'research chemicals'. The Netherlands occupies a crucial position in European illicit drug markets. Data from the European Monitoring Centre for Drugs and Drug Addiction suggested it is the main producer of MDMA, ecstasy and herbal cannabis and a key distribution hub for cannabis resin and cocaine. Whether the pivotal role of the Netherlands also extends online, has yet been unclear. The Netherlands Ministry of Security and Justice commissioned RAND Europe to provide a firmer evidence base to this phenomenon and, in particular, the role of the Netherlands. This report analyses the size and scope of Internet-facilitated drugs trade both on the so-called clear and hidden web, paying special attention to the Netherlands, and delineates potential avenues for law enforcement for detection and intervention. Key Findings Monthly revenues from drugs on cryptomarkets are in the double-digit million dollars Of all products and services on offer, this study found that 57 per cent of listings across the eight analysed cryptomarkets offered drugs. The results indicate that these cryptomarkets generated a total monthly revenue of $14.2m (€12.6m) in January 2016, $12.0m (€10.5m) when prescription drugs and alcohol and tobacco are excluded (lower-boundary estimate). An upper-boundary estimate for monthly drug revenues via visible listings on all cryptomarkets would be $25.0m (€22.1m) and $21.1m (€18.5m) when prescription drugs and alcohol and tobacco are excluded. Cannabis, stimulants and ecstasy were responsible for 70 per cent of all revenues on the analysed cryptomarkets. No information was identified on revenues on the clear net. The values are based on EUR/USD exchange rate of 1.14 as of April 2016. Cryptomarkets are not just an 'eBay for Drugs' Large 'wholesale' level transactions (those greater than $1,000) are important for cryptomarkets, generating nearly one quarter of overall revenue both in September 2013 and in January 2016. Based on these findings it is likely that many cryptomarket customers are drug dealers sourcing stock intended for offline distribution. Most revenues are generated by vendors who indicate they are operating from Anglo-Saxon countries or Western Europe Most vendors appeared to be operating from the United States (890), followed by the United Kingdom (338), and Germany (225). Vendors indicating they ship from the United States generated 36% per cent of all drug revenues within our sample. Other Anglo-Saxon (Canada and the United Kingdom) as well as Western European countries (the Netherlands, Germany, Spain, France) also generate substantial proportions of revenues. Revenues from vendors operating from the Netherlands are by far the largest on a per capita basis Revenues to vendors reporting to operate from the Netherlands on cryptomarkets accounted for 8 per cent of total drug revenues. On a per capita basis, revenues to vendors operating from the Netherlands were 2.4 times higher than those from the United Kingdom and 4.5 higher than those from the United States. Vendors and buyers on online markets seem to have similar characteristics Traditional investigation techniques applied in the drug chain, postal detection and interception, online detection and online disruption are potential law enforcement strategies in the detection and intervention of Internet-facilitated drugs trade. In addition, international cooperation and coordination (and the accompanying legal challenges), capacity and resources and (technical) capabilities could play a facilitating role in deploying the different strategies to tackle Internet-facilitated drugs trade. There are four broad categories of modes of detection and intervention Traditional investigation techniques applied in the drug chain, postal detection and interception, online detection and online disruption are potential law enforcement strategies in the detection and intervention of Internet-facilitated drugs trade. In addition, international cooperation and coordination (and the accompanying legal challenges), capacity and resources and (technical) capabilities could play a facilitating role in deploying the different strategies to tackle Internet-facilitated drugs trade.
Conference Paper
Full-text available
We perform a comprehensive measurement analysis of Silk Road, an anonymous, international online marketplace that operates as a Tor hidden service and uses Bitcoin as its exchange currency. We gather and analyze data over eight months between the end of 2011 and 2012, including daily crawls of the marketplace for nearly six months in 2012. We obtain a detailed picture of the type of goods sold on Silk Road, and of the revenues made both by sellers and Silk Road operators. Through examining over 24,400 separate items sold on the site, we show that Silk Road is overwhelmingly used as a market for controlled substances and narcotics, and that most items sold are available for less than three weeks. The majority of sellers disappears within roughly three months of their arrival, but a core of 112 sellers has been present throughout our measurement interval. We evaluate the total revenue made by all sellers, from public listings, to slightly over USD 1.2 million per month; this corresponds to about USD 92,000 per month in commissions for the Silk Road operators. We further show that the marketplace has been operating steadily, with daily sales and number of sellers overall increasing over our measurement interval. We discuss economic and policy implications of our analysis and results, including ethical considerations for future research in this area.
Full-text available
In 2011, Silk Road became the first black market, or "cryptomarket", for illicit drugs. This study examines two of the largest cryptomarkets which have operated, Silk Road 2.0 and Agora Marketplace. We hypothesize that cryptomarkets cater to buyers who intend to resell or redistribute the products, specifically in the form of social drug dealing, and that larger quantities will be purchased on the cryptomarkets over time. We examine these hypotheses through a descriptive and qualitative assessment of the distribution of drugs sold, and an estimated trend line based on simple linear regression. Data was collected using a custom web crawler which was supplemented with a dataset collected by independent researcher Gwern Branwen, community members and researchers in total spanning the period from February 28th 2014 to April 2015. The observed demand was primarily for quantities intended for personal use or social drug dealing. The majority of sales fell within the lower price ranges, although a significant part of the revenue was generated in price ranges that suggested business-to-business dealing. Furthermore, we found that the sizes of the purchases decreased significantly in both the case of Silk Road 2.0 and Agora Marketplace. The results suggest that cryptomarkets resemble traditional drug markets in terms of the distribution and revenues. As such, it is relevant to include cryptomarkets in discussions about potential reductions of the harmful social consequences of drug markets, as well as in general discussions about drug markets and drug trafficking.
As globalization processes continue to impact patterns in drug-trafficking operations worldwide, a cyber-based dimension of the drug trade has recently emerged via the Tor Network. This study employed geovisualization and exploratory spatial data analysis to examine drug distributions of heroin, cocaine, new psychoactive substances, and prescription drugs advertised on Agora, the largest international marketplace on the Tor Network at the time of data collection. Data were collected using webcrawling software and mapped to determine the presence of statistical outliers internationally or hotspots within Europe. Global Moran's I testing revealed that drugs sourced from Europe were randomly distributed. Box maps confirmed the visual analysis that six countries (including Canada and the United States) dominated world listings across the four drug types. Globally, heroin and cocaine markets were found to be almost exclusively retail based, while new psychoactive substances and prescription drugs were sold from countries with established pharmaceutical and chemical industries. This article is protected by copyright. All rights reserved.
Background: To date monitoring of cryptomarkets operating on the dark net has largely focused on market size and substance availability. Less is known of country specific differences in these indicators and how they may corroborate population prevalence estimates for substance use in different countries. Methods: All substance listings from the cryptomarket Agora were recorded over seven time points throughout February and March 2015. Agora was chosen due to its size as the second largest cryptomarket operating and the level of detail of information provided in individual substance listings. Data were collated and the number of unique sellers selling each substance by country of origin was analysed. Results: An average of 14,456.7 substance listings were identified across sampled days from 868.7 unique sellers. The top five countries by number of listings were the USA, United Kingdom, Australia, China and the Netherlands, collectively accounting for 61.8% of all identified listings and 68% of all unique sellers. Australia was over represented in terms of sellers per capita, while China was over represented in new psychoactive substance (NPS) listings. When examined by number of listings per seller, the Netherlands and China stood out as particularly large, likely due to these countries' role in the local production of various illicit and new psychoactive substances. Conclusions: Numbers of sellers by country of origin appear to be influenced by several factors. Australia's overrepresentation in sellers per capita may indicate its relative geographical isolation and the potential for profit margins from selling online, while China's overrepresentation in NPS listings may reflect domestic production of these substances. Continued monitoring will provide enhanced understanding of the increasingly complex and globalised nature of illicit drug markets.
Background: Since 2011, we have witnessed the rise of ‘dark net’ drug marketplaces known as cryptomarkets. Cryptomarkets operate on the same model as eBay as they provide a platform where authorized vendors can set up a virtual shop and place listings. Building on a growing body of literature that seeks to understand cryptomarket participants, this paper seeks to explain the decision of cryptomarket vendors to take on risk. Methods: We collected data on Silk Road 1 (SR1), the first cryptomarket launched in 2011. We propose a multilevel model that takes into account the characteristics of listings, vendors and their environment to explain the decision of vendors to take on risk. Results: Our results demonstrate that all levels in the model significantly explain the decision to take on risk. Risk taking, operationalized as a willingness to ship drugs across international borders, was associated with the weights of drug packages mailed, the vendors' reputations and numbers of listings, the country-level perceived effectiveness of law enforcement according to experts, and the opportunities available to vendors as measured by the wealth and the drug expenditures of potential customers. Conclusions: Our results support some previous research findings on the factors explaining risk taking. We extend existing literature by emphasizing the relevance of the environment of drug dealers to predict risk taking.