Cyber Insecurity: The Dark Web

Author: Scarinci Hollenbeck, LLC|December 15, 2015

What is the Dark Web and why does it exist?

Cyber Insecurity: The Dark Web

What is the Dark Web and why does it exist?

The World Wide Web, with which most people are familiar, is generally referred to as the “Surface Web.” The name derives from the analogy of the Internet to an ocean. That is, the Surface Web is the ocean’s surface layers—visible, easily accessible, and where most life is. Thus, Internet search engines are the trawlers, casting wide nets across the surface layers. They then organize the results, presenting them to the consumer in a list with the most clicked links at the top. Beneath the Surface Web, however, there is the “Deep Web.” The Deep Web is everything on the Internet the search engines do not reach. The Deep Web is not shadowy or unfamiliar. Anyone with a Gmail account has interacted with the Deep Web, because emails are on the Internet but certainly not accessible by search engines.

The Dark Web is where people desiring anonymity post, share, and sell information. Importantly, not all of this activity is illicit, and an even smaller amount is immoral. Government dissents, whistle-blowers, and people who cannot use their public personae to voice an idea find solace in the Dark Web, as it can protect them from having their identities discovered.

Within this setting though, a market has developed for mostly illicit sales. As a general rule, when electronic data is stolen by non-governmental operatives, the Dark Web is the market where it is sold. Cracked PayPal, Netflix, Amazon, and other accounts are for sale. The more transactions a cracked account has, the more it will sell for. Uber accounts are in particularly high demand, as they can be used for free rides without giving away any information about the person who bought the illicit account. That a market exists is not unexpected, but startlingly the supply of this information is so extensive that purchasing cracked accounts is relatively cheap. Bank accounts with balances in excess of $500,000 go for $300-$500, a discount measured in orders of magnitude. Personal information is sold line by line, each line worth usually $1. Credit reports, scans of official documents, and even utility bills are also available for purchase.

Most of the illicit marketplaces of the web are accessible to anyone. A user needs only to connect to the desired network. These darknets, as they are called, are discrete areas of the Internet only accessible through special communication protocols, software, or authorizations. The most popular darknet is the Tor Network, also known as The Onion Network (an allusion to its many layers). Without getting into the specifics of how Tor works, it suffices to say that Tor routs your Internet traffic through so many servers that it is almost impossible to trace, giving the user anonymity to carry out his or her online affairs within the network.

The damage resulting from data breaches are usually impossible to quantify. To misquote a cold war veteran, “The loss of one person’s data is a tragedy; the loss of millions’ is a statistic.” Because the Dark Web is so easily accessible for anyone with the will to do so, it is surprising that its information is not more widely used for legitimate purposes. For example, in the weeks following a data breach, it is likely that at least a portion of the stolen data will appear on one of the Dark Web’s marketplaces. As these data breaches increase, the need for the courts to develop an analytical method to approximate damages will increase with it. Although in its infancy, companies are forming to provide this legwork. A breached entity can hire one of these companies to trawl the Dark Web to investigate the nature of any hacked data. Much like a sheriff would go to a local market to find stolen goods, so the investigators can go to a darknet market to find stolen data. As these companies become more established and more sophisticated, they will probably be used with increasing regularity as expert witnesses in data breach cases.

The Dark Web is neither good nor bad; it is just a tool. Situations arise where the anonymity of the Dark Web is important for achieving a good end, and there are situations where it is important for a bad end. Given the confidential nature and the pressing necessities that drive people to use the Dark Web, governmental or corporate entities will never truly succeed in monitoring it or shutting it down. Instead, cyber professionals should look at it as a source of information to both prepare for breaches and to start to understand the damages resulting from a breach. As with most issues in the connected world, the information is there if only someone would see it.

^{[1] There are increasing reports that the Tor Network may not be as opaque to national security services as it purports to be.}