Identifying gaps in the research literature on illicit markets on-line

Abstract

As access to technology and the Internet expanded dramatically over the last three decades, so too have opportunities for criminality. Researchers have begun to consider how the Internet enables the formation of illicit markets operating via various communications media in order to sell personal information, hacking tools, and other resources. Many of these studies provide basic information on the operations of on-line illicit markets. There is, however, a need for further research in order to improve the state of the literature and identify key questions to expand our knowledge of the practices of market actors and the social dynamics that facilitate their activities. This article introduces these concepts and outlines the state of the literature generally.

Keywords:

• stolen data
• hacking
• cybercrime
• theft

Illicit markets and underground economies have been a field of inquiry for criminologists for decades, whether regarding street corner drug markets,¹ illicit sex² to the ways in which burglars, shoplifters and other property offenders dispose of stolen goods.³ These studies generate substantive insights into the economic impact that illicit markets have for offenders,⁴ as well as on the communities in which they are located,⁵ and the victims whose property or resources facilitate their existence.⁶ Research on illicit markets have also benefitted criminological theory, particularly rational choice and routine activities frameworks to identify the decision-making process of offenders and the value of restrictive deterrence to reduce the size and scope of markets.⁷

In the last few years, research has grown examining new forms of illicit markets that have emerged as a result of technological innovation and the explosion of the Internet. Online vendors now offer stolen information, malicious software, illicit drugs, counterfeit products and various illicit services through websites, forums, IRC channels and via sites hosted on Tor.⁸ On-line illicit markets are a direct result of the long history of deviant or criminal exchanges facilitated by the Internet and personal computers. The emergence of computer-mediated communication (CMCs) in the 1980s provided individuals with the ability to connect with virtually anyone anywhere, and discuss issues of interest, no matter how legal, deviant or outright illegal.⁹ Computer hackers, digital pirates and others interested in technology flocked to newsgroups and Bulletin Board Systems (BBS) during the 1980s and early 90 s to share information and connect socially.¹⁰ Individuals who had unique knowledge and resources would share them with others, but only through quid pro quo exchanges with others. For instance, a person could gain access to a BBS that hosted the cracked software if they could demonstrate their knowledge of computer hacking to the operator. Similarly, hackers would give others access to time on ‘party lines’ or multi-line telephone systems that they would compromise in order to connect with others in real time.¹¹ Thus, knowledge and resources were key resources in the larger computer underground.

The development of the World Wide Web (WWW), increased computer processing power, scanning equipment and faster internet connection speeds enhanced the experience of going on-line in the early 1990s. The global number of Internet users began to increase, as did the ways that people could share information and resources. The ability to share photographs and stills from print media fostered the growth of on-line pornography, which was initially traded as a sort of informal currency.¹² Similarly, the rise of the MP3 compression format and compact discs facilitated the growth of file sharing digital media such as music.¹³ Improvements in technology enabled the growth of various sexual subcultures as well as more sophisticated hacking and piracy communities.¹⁴

In fact, phishing emerged during the mid to late 1990s with the rise of e-commerce and Internet connectivity. At the time, Internet connectivity was typically paid in hourly increments. Hackers used this to their advantage and posed as Internet Service Providers to send out mass emails to lists of known customers, particularly from America On-Line (AOL) as it was one of the largest providers at that time.¹⁵ The content of the emails would claim that the account holder needed to validate or update information in their user profile by sending in their username and password. The hackers would then harvest these username and password credentials and either trade the accounts with others to obtain free Internet access, or gain access to pirated software or other information.

As the push for on-line banking and e-commerce grew along with the number of Internet users, hackers and cybercriminals realised that they could reap substantial profits by attacking these resources. In the early 2000s, hackers began to transition from phishing ISP customers to targeting banks and credit card services. They were able to collect thousands of customer accounts in a short amount of time, leading some to attempt to sell this information to interested parties in much the same way as they traded ISP data.¹⁶ As both the supply and demand for card data increased, so did the market for personal information and services to engage in fraud and theft. Initially, these markets operated via advertisements in Internet Relay Chat (IRC) channels and web forums.¹⁷

During the same time, malware writers shifted their focus from large-scale attacks targeting all computer users via worms towards unique tools to capture sensitive personal information through trojan horse programmes.¹⁸ A unique form of malware was also created during this period called botnet malware, combining multiple aspects of the existing malware into a single programme. ¹⁹ This malware infects a user’s system and enables it to receive and execute commands received through Internet Relay Chat or other means by an attacker. The infected systems can also be linked together and sent commands to execute at the same time, allowing the attacker to use these systems for various forms of cybercrime, including the distribution of spam, denial of service attacks and network scanning.²⁰ Botnet operators recognised that their infrastructure could be leased to others as a way to turn a simple profit to less skilled actors. As a result, botnet malware ushered in what some refer to as ‘crimeware’ and the growth of cybercrime markets where hacking is a service.²¹

As a consequence, there is now a robust online market where hackers, malware writers, and data thieves sell their services to others. There are a range of forums, websites and content hosted on open parts of the Internet, as well as encrypted networks engaged in the sale of various products and services involving both virtual and real commodities.²² For instance, there are a number of forums and shops operating where hackers sell malicious software and cybercrime as a service to interested parties.²³ These markets enable individuals to buy new forms of malicious software, or lease the existing infrastructure established through botnets and other malware platforms to engage in spamming, carding, and other forms of theft and fraud.

There are other illicit markets operating in virtual spaces beyond those focused on cybercrime, as individuals now offer services and products in virtual spaces that can only be used in the real world. For instance, sex workers and their customers use web forums and e-commerce sites as a means to advertise and review services, and even pay for a session and validate client identities prior to a sexual assignation.²⁴ The use of technology enables some sex workers and customers to move away from street-based public advertising and work behind closed doors with much less risk of detection and arrest in the United States.²⁵

The sale of illicit drugs, ranging from prescription medications to hard drugs like cocaine, has also begun to transition into on-line markets as well.²⁶ The majority of these markets operate on the encrypted Tor network, which uses specialised software and protocols that anonymise the location of both the content of the hosting site and the IP addresses of users.²⁷ The use of Tor has led some to refer to the markets for drugs and other products as cryptomarkets, recognising their use of encryption to protect user identities. In addition, participants in these markets are encouraged to use on-line payment systems like BitCoin which is referred to as a crypto-currency, meaning that the transaction is delivered through various encryption protocols that conceal the identity of the payer and the payee.²⁸ These conditions all help to provide a degree of protection to market actors that are not present on the traditional ‘open’ web.

The emergence and expansion of underground on-line economies demonstrates how effective the Internet can be as a tool for criminality. Criminological inquiry on this phenomenon is, however, in its relative infancy. Many of the studies on cybercrime-specific markets tend to be descriptive in nature, focusing on the distribution of products and their pricing,²⁹ or the potential profits earned by vendors and buyers.³⁰ A small number of studies have identified the social norms that govern the social interactions between participants, which are useful to understand the extent to which these technical forms of offending are governed by human interactions.³¹ A few researchers have also considered the social organisation of market actors, and the network structures that form in cybercrime markets as a function of trust between participants.³² These studies are especially valuable as they demonstrate the ways that sellers and buyers relate to one another over time, and the role of social reputation and reliability in fostering connections between participants. Furthermore, such research demonstrates commonalities in the practices of illicit markets operating on-line and off-line.

The benefits of these studies are, however, offset by limitations in the data sources used to examine on-line illicit markets. Many studies are based on small samples of posts made in English language forums that are temporally bound, though a small proportion utilise translated versions of foreign language posts.³³ These studies typically include publicly accessible forums operating on the open web, though a small proportion includes samples of posts from registration-only forums.³⁴ A small proportion of studies also utilise larger samples of posts generated from closed forums, including public and private posts made between individuals.³⁵ Examining private posting behaviour can be valuable to identify hidden network relationships and market practices, though the findings may not be applicable to the current operations of active markets.³⁶

As a result, researchers must find ways to access hidden and sophisticated markets operating in forums on the open and dark web. Creating datasets that include posts from open forums, closed by registration, and registration-only vetted communities would enable researchers to better estimate the scope of products and services offered in illicit markets, and improve our understanding of the pricing structures that exist across markets generally.³⁷ Additionally, research incorporating more private exchanges between participants in the markets could greatly improve our understanding of the negotiation process and decision-making among actors.

Such an endeavour would require researchers to employ creative data collection methods as such information is typically unavailable. For instance, researchers could obtain private exchanges through analyses of so-called ‘cracked’ forums that have been shuttered and archived on-line for download.³⁸ Alternatively, a researcher could pose as a potential customer in order to engage in negotiations with vendors to better understand their practices. This sort of covert research may be difficult to perform due to ethical guidelines for research based on variations in Institutional Review Board policies across universities.³⁹

An individual could also present themselves as a researcher and ask individuals to participate in a research study, though such a strategy may lead to a small response rate or only represent those actors with generally little concern for their privacy or reputation. ⁴⁰ Hutchings and Clayton recently engaged in a study interviewing denial of service attack service providers, and received multiple participants who were actively engaged in this market. Thus, it is not impossible to conduct such research, but uncommon in the current literature.

An additional possibility would be to directly collaborate with a law enforcement agency or computer security firm that investigates cybercrime markets. There have been a number of high-profile operations against cybercrime markets over the last decade, suggesting that agencies have repositories of information on forums and market actors engaging in cybercrime.⁴¹ At the same time, such data may be difficult to access due to the potential that it may compromise an investigation or harm the chain of evidence used in a prosecution. There is no substitute for such information, thus it is advantageous for researchers to foster relationships with law enforcement and the security industry in order to create opportunities to improve the quality and quantity of information that may be available to understand the practices of illicit market actors.⁴²

In much the same way, there is a need to greatly expand the range of criminological and sociological theories assessed with respect to on-line illicit markets. Researchers examining cryptomarkets for drugs have developed unique methodologies to understand the extent to which on-line markets are affecting consumer behaviours. Barratt, Ferris, and Winstock⁴³ used survey data of 9,470 drug using respondents in Australia, the UK, and the US and found that 35% of this group had consumed drugs purchased from one of the most recognisable cryptomarkets called the Silk Road. A much larger proportion of respondents had heard of the market, but not made a purchase from an on-line vendor. The survey participants who completed a purchase through the market primarily bought MDMA or cannabis, and indicated that the cryptomarket had a better range of products at a higher quality that could be readily determined that in the real world.⁴⁴ Additionally, respondents in Australia and the US were statistically more likely to purchase products through the Silk Road because products are sold at lower prices and produce a lower risk of being caught engaging in illegal activity.

The findings from this study provide a valuable demonstration of the extent to which these markets may displace traditional illicit markets in the real world. Though there is no analogous market for cybercrime services in the real world, the unique methods employed by Barratt and colleagues demonstrates the need for researchers to find distinct ways to assess the impact of illicit markets generally. Assessments of the size and scope of active botnets made available by vendors in illicit markets could be instrumental in documenting the prevalence of active malware infections affecting home and business computer users. Similarly, documenting the total number of active participants engaged in either the sale of data and services or those requesting to purchase these resources could improve our understanding of the prevalence of cybercriminals globally. This sort of analysis would require interdisciplinary collaboration with computer scientists, linguists, and data scientists in order to appropriately parse the language in posts and link usernames to distinct identities.⁴⁵ The benefits of such an endeavour would, however, transform our knowledge of cybercrime markets generally.

In much the same way, research pushing our knowledge of the decision-making practices of offenders and deterrence strategies would also greatly improve our understanding of the practices of market actors. Seminal studies interviewing active or former drug dealers and clients have demonstrated the rational decision-making processes employed by actors and their views on the formal and informal risks of participating in the market.⁴⁶ These factors structure the behaviour of vendors and customers in order to avoid law enforcement sanctions and minimise the risk of extralegal violence from competing vendors.⁴⁷ There is only one study that the author is aware of examining these issues in data markets, though it uses forum data to understand market forces and their structure to minimise risks.⁴⁸ Performing in-depth qualitative interviews with incarcerated cybercriminals who were actively engaged in illicit markets could also enhance our understanding of the practices of vendors and buyers in their own words.⁴⁹

Research evaluating the disruption strategies employed to affect illicit markets would also greatly enhance our knowledge of their structure and vulnerabilities. A range of studies have examined the role of hotspot policing and other policing strategies to reduce the size of real-world illicit markets for drugs,⁵⁰ prostitution⁵¹ and stolen goods.⁵² There is, however, a paucity of research on the efficacy of legal or extralegal strategies to affect on-line illicit markets despite the fact that some have been in operation for over a decade.⁵³ Developing a body of research on these issues is essential in order to inform the utility of the existing criminal laws and undercover operations to effectively dismantle the forums and on-line communities that support illicit markets on-line.

The articles in this special issue attempt to address some of these critical issues in criminological discourse through various means. For example, Hutchings and Holt provide an overview of the methods that have been employed to disrupt stolen data markets over the last few years and identify strategies that may have greater utility in large scale disruption. Though research has expanded on stolen data markets, much of the discussion regarding means of disruption are theoretical and focused primarily in either computer science or criminology. This work attempts to combine these perspectives and considers the benefits of a multidisciplinary approach to affect stolen data market operations. In turn, this study has direct relevance for law enforcement and academia to consider how disruption techniques may be refined in the future.

Zabyelina provides an analysis of the opportunities that may exist for criminals to engage in a unique form of offending involving counterfeit medical products, including pharmaceuticals. Specifically, she applies elements of routine activities and rational choice theory to identify potential opportunities for actors to engage in cybercrime through a review of three case studies related to spam and on-line pharmacy advertising. Zabyelina also provides a detailed discussion of the use of malicious software and false claims in advertisements, called malvertising, to entice consumers into making purchases. This study extends our understanding of individual-oriented criminological theories to technology-facilitated crimes in a novel way.

Finally, Frank and MacDonald examine the relationships between actors in a long-standing hacker forum to identify relationships between malware writers and the larger community of hackers and forum users who post in the site. The authors astutely identify the lack of empirical research on the social networks that are present between actors in illicit on-line markets, and in the larger research literature on hacking as a whole. Though a small number of studies have examined the social organisation of hacker communities and the market for stolen data, few have considered this issue with respect to malware or the broader interplay between malware writers and users. Examining these issues demonstrates how connected market actors may be and the value of attacking relationships within the market in order to disrupt supply chains and markets. Thus, this study provides a valuable attempt to identify the ties between participants with particular focus on malicious software distributors.

Taken as a whole, the studies included in this issue add to our understanding of illicit markets on-line, but also provide direction for future scholarship. I hope that readers are emboldened by this issue and continue to expand the criminological dialogue on these markets.

Disclosure statement

No potential conflict of interest was reported by the author.

Additional information

Notes on contributors

Thomas J. Holt

Thomas J. Holt is a professor in the School of Criminal Justice at Michigan State University whose research focuses on computer hacking, malware, and the role of the Internet in facilitating all manner of crime and deviance. His work has been published in various journals including Crime and Delinquency, Deviant Behavior, the Journal of Criminal Justice, and Youth and Society.

Notes

1. See Jacobs, Dealing Crack; Maher, Sexed work; Maher and Daly, “Women in the street-level drug economy,” 465–492.

2. Edwards, “The legal regulation of prostitution,” 57; Holzman and Pines, “Buying Sex,” 89–116; Matthews, Kerb-crawling, prostitution, and multi-agency policing; Weitzer, “NewDirections in research on prostitution,” 57.

3. Cromwell and Olson, Breaking and Entering; Wright and Decker, Burglars on theJob, 75-95.

4. See note 1 above.

5. See Goldstein, “The drugs/violence nexus,”493–506; Sterk and Elifson, “Drug related violence andstreet prostituiton,”208–220.

6. Cromwell et al., “Who buys stolen property?” 75-95; Jaques and Wright “How Victimized DrugTraders Mobilize Police,”545–575; Schneider, “Stolen-goods Markets,”129–140.

7. Jacobs, “Creak Dealers and Restrictive Deterrence,”409–431; Jacobs, “Crack Dealers Apprehension Avoidance,” 359–381; Jacobs, Robbing Drug Dealers; Jacobs, “Undercover Deception Clues,” 281–299; Wright and Decker, Burglars on the Job, 75-95.

8. See Holt and Bossler, Cybercrime in Progress.

9. Meyer, The Social Organization of the Computer Underground; Taylor, Hackers.

10. See note 9 above.

11. See note 9 above.

12. See Lane, Obscene Profits.

13. Cooper and Harrison, “Social Organization of Audio Piracy on the Internet,” 71–89.

14. Quinn and Forsyth “Describing sexual behavior in the era of the Internet,” 191–207; Taylor,Hackers.

15. James, Phishing Exposed; Jakobsson and Myers, Phishing and Countermeasures.

16. See note 15 above.

17. Franklin et al., “An inquiry,” 375– 388; Holt and Lampke, “Exploring stolen data markets,” 33–50; Hutchings and Holt, “A crime script analysis,” 596–614; Motoyama et al., “Analysis ofunderground forums,” 71–80; Peretti, “Data Breaches,” 375–413; Wehinger, “The dark net”.

18. see Schultz, “Where have the worms and viruses gone?” 4–8.

19. Bacher et al., Tracking Botnets; Choo, Zombies and Botnets; Ianelli and Hackworth, Botnets as a vehicle for online crime, 19.

20. See note 19 above.

21. Emig, “The Crimeware Landscape”; Jakobsson and Ramzan, Crimeware.

22. See note 8 above.

23. Gad, “Crimeware Marketplaces,” 11; Holt, “Examiningthe Forces Shaping Cybercrime Markets Online”; Motoyama et al., “Analysis ofunderground forums,” 71–80; Rajab et al., “A Multifaceted Approach,” 41–52; Sood and Enbody,”Crimeware-as-a-service,” 28–38.

24. Holt et al., “Examining Diffusion and Arrest Avoidance,” 261–283; Sanders “Selling Sex,” 704–716.

25. See note 24 above

26. Christin, “Traveling the Silk Road.”

27. Barratt, “Silk Road,”683-683; Barratt et al., “Use of Silk Road,” 774–783; Martin, “Lost on the Silk Road,” 351–367; McCoy et al., “Shining Light in Dark Places.”

28. see note 27 above.

29. Franklin et al., “An inquiry,” 375– 388; Holt and Lampke, “Exploring stolen data markets,” 33–50; Motoyama et al., “Analysis of underground forums,” 71–80.

30. Holt et al., “An Exploration of the Factors.”

31. Holt, “Examining the Forces Shaping Cybercrime Markets Online”; Holt and Lampke,“Exploring stolen data markets,” 33–50; Hutchings and Holt, “A crime script analysis,” 596–614.

32. Holt, “Exploring the Social Organization,”155–174; Motoyama et al., “Analysis of undergroundforums,” 71–80; Yip et al., “Trust among cybercirminals,” 516–539.

33. See note 29 above.

34. Holt, “Exploring the Social Organization,” 155–174; Holt et al., “An Exploration of the Factors.”

35. Dupont et al., “The ecology of trust,” 129–151; Yip et al., “Trust among cybercirminals,” 516–539.

36. Motoyama et al., “Analysis of underground forums,” 71–80

37. See note 8 above.

38. See note 35 above.

39. See note 37 above.

40. Hutchings and Clayton, “Exploring the Provision of Online,” 1–16.

41. See note 37 above.

42. See note 34 above.

43. Barratt et al., “Use of Silk Road,” 774–783.

44. See note 43 above.

45. See note 37 above.

46. See note 7 above.

47. See note 7 above.

48. Holt et al., “Examining the Risk Reduction Strategies,” 81–103.

49. See note 40 above.

50. See note 7 above.

51. Scott and Dedel, “Street Prostitution,” 208–220.

52. Sutton et al., “Tackling Theft.”

53. See note 37 above.