Marketness and Governance: A Typology of Illicit Online Markets

ABSTRACT

The preceding decade has seen an explosive growth in illicit online commerce, and scholars are increasingly occupied with the study of illicit products, their buyers and sellers, and the platforms and markets in which they are found. Despite sharing one basic characteristic, the exchange of illicit goods and services, there is extensive variation between illicit online markets: Some markets employ currencies, others are based on barter. Some markets exhibit strong social control, others appear anarchic. Traditional theoretical explanations to the organization of illicit markets, which assume that optimization or evolution drives their organization, find it difficult to explain these variations. I propose a typology of illicit online markets that appreciates this heterogeneity and uses it as a theoretical point of departure. Drawing on social control theory and economic sociology, I argue that illicit online markets can be separated across two axes: administrative governance and ”marketness.” This conceptual framework is not prone to functionalist inference and instead implies a less deterministic understanding of how illicit online markets come to be. In turn, this framework encourages the classification and comparison of individual markets, as well as comparative analyses of marketplaces.

View correction statement:

Correction

Introduction

Over the preceding two decades, participants to illicit and deviant forms of commerce, exchange, and trade have vacated physical spaces and started to converge online. There is a growing body of empirical scholarship on illicit online markets (Holt 2023), and in particular the online drug trade has been sought theorized in comparison to its offline counterpart (Martin 2014b). Whereas scholars have dedicated substantial effort to theorizing, categorizing, and classifying illicit offline markets (e.g., Curtis and Wendel 2000; Naylor 2003; South and Wyatt 2011), the qualities that distinguish illicit online markets from each other have been given less attention, however. What explains this between-market variation, and how do markets differ from one another? In this paper, I synthesize scholarship and develop a typology of illicit online markets. Doing so, I follow past work on theorizing, conceptualizing, and classifying illicit markets and cybercrime, by developing concepts that allow classification and comparison (e.g., Coomber, Moyle, and South 2016; Martin 2014b; Moeller 2022; Naylor 2003; Wall 2004).

Illicit online markets now play a significant role in many types of crime and deviance. The sale of sexual services increasingly takes place online (Cunningham and Kendall 2011); child sexual abuse material and non-consensual images are shared and traded online (Van Der Bruggen and Blokland 2021; Dodge 2021); retail-distribution of drugs is increasingly digitalized (Barratt and Aldridge 2016; Demant et al. 2019), and a significant industry for fraud has proliferated online (Holt, Smirnova, and Chua 2016; Hutchings and Holt 2015). In some cases, these illicit online markets are digital versions of already existing trades, such as that of drugs or sexual services. In other cases, they cater in products and services exclusively found online, such as hacking services or stolen data. Importantly, these markets are not isolated, but tend to overlap with other offenses. For example, an online drug market may be tightly interwoven with offline networks (Martin et al. 2020), and airline tickets can be resold online after being obtained fraudulently (Hutchings 2018). What remains, however, is that these exchanges are conducted or planned online in different ways.

It is easy to focus on the particularities that distinguish these markets: the novel technologies for encryption and anonymity that are involved (Bancroft and Scott Reid 2017), and supposedly render law enforcement efforts futile (Comey 2014), or the sometimes-horrifying services that are allegedly offered to all, such as hitmen, automatic rifles, and red rooms (Taylor 2020; Weimann 2016). However, the social organization of illicit online markets is distinct and challenges key discussions in the literature on illicit markets: Illicit online markets can be more efficient than their offline counterparts while providing a high degree of security (Bakken, Moeller, and Sandberg 2018); contracts are introduced to otherwise unregulated markets (Diekmann and Przepiorka 2019); and centralized forms of governance similar to the capacities of organized criminal groups emerge as platforms concentrate power (Moeller, Munksgaard, and Demant 2017). Yet, illicit online markets are also heterogeneous: Products range from non-consensual sexual images and warez to illicit drugs, and the rewards reaped by participants can be immaterial, respect, and recognition (Décary-Hétu, Morselli, and Leman-Langlois 2012), or material (Paquet-Clouston, Décary-Hétu, and Morselli 2018). Moreover, quantities of empirical interest to researchers, such as modes of conflict resolution, predation, fraud, informal social control, competition, and cooperation vary between different illicit online markets.

To subsume a wide array of modalities of exchange under the term ”illicit online market,” obscures the heterogeneity of products, actors, practices, and crimes that are of interest to researchers. The intent of this paper is to suggest two axes that allow scholars to differentiate illicit online markets. These axes de-emphasize technology, goods, or services, in favor of emphasizing the governance and organization of illicit online exchange. The foundation for this theorization of the social organization of illicit online markets is two-fold. Empirically, I draw on a substantial body of literature on illicit online markets. Theoretically, I abandon traditional economic approaches to illicit markets in favor of a more consistent conceptualization of illicit market institutions, and further build on the application of Black’s theory of social control.

The paper proceeds as such: I begin by defining and delineating illicit markets as an object of criminological inquiry. I then turn toward illicit online markets and synthesize empirical scholarship to identify general types of products and modes of exchange. I then propose the marketness-governance typology and proceed to apply it. Finally, I discuss how this typology can inform research and what its implications are for our understanding of illicit online markets.

Defining and delineating illicit markets

Illicit markets come in a variety of forms, and there is no established criminological theory of them (Moeller 2018). In both theory and empirical research, the ”market” is rarely defined, despite distinct disciplinary definitions, and by extension, underlying assumptions. For example, works on drug markets rarely define the market or delineate its borders (Adler 1993; Moeller and Sandberg 2019; Naylor 2003). The vague notion of what exactly constitutes a market is not isolated to criminological scholarship (Hodgson 2021), and Murji (2007) suggests that the term market ”refers to the conditions of supply and demand in economics, in criminology it refers largely to a realm of illegal behaviors and transactions, and a space or arena of calculated social relations in sociology” (p. 782, see also Ritter 2006). These realms are distinguished by both the nature of the products and services for sale, and the specific crimes that take place within them.

Beckert and Dewey (2017) suggest that illicit markets can be placed along two continua, from legality to illegality, and legitimacy to illegitimacy. The former refers to the legal status of the products and services, and the latter to the ”tolerance, acceptance, or moral rejection” thereof (p. 12). For criminologists, this Weberian notion of illegitimacy can be replaced with the concept deviance. Legitimacy and legality are not static properties, and these will vary across time and space. One example is substances, which undergo processes of criminalization and legalization (Bewley-Taylor 2012), and which vary in legitimacy (Coomber, Moyle, and South 2016).

Naylor (2003) distinguishes market-based offenses from other profit-driven crimes. Whereas the latter allocates resources (e.g., theft, tax fraud), market-based offenses are distinguished by being mutually beneficial for seller and buyer; exchange, production of goods, provision of services and so forth. Similarly, Jacques and Wright (2008) draw attention to the preponderance of peaceful exchange in illicit markets. Functionally, market-based offenses do not need to involve violence or exploitation, though violence, predation, and exploitation may be involved nevertheless (Levitt and Venkatesh 1998; Moeller and Hesse 2013; Reuter 2009; Torres, D’Alessio, and Stolzenberg 2021). This distinction may motivate a conception of illicit markets as markets without a state (e.g., Brooks 2020), but this is decidedly not the case, as the state in illicit markets is arguably more ever-present than in licit ones through processes of criminalization and delegitimization (Andreas and Nadelmann 2006; Beckert and Dewey 2017).

An operational definition of illicit markets is therefore that they are realms in which actors for their mutual benefit engage in the exchange of services and/or products that are illegal and/or illegitimate. For criminological inquiry, the market, or realm, of interest tends to be restricted by some geographical or social boundary, for example, being in a city, class, area, or social network (e.g., Bourgois 2003; Jacques and Wright 2015; Moeller, Munksgaard, and Demant 2021). In a similar manner, when criminologists study illicit online markets they tend to discuss individual platforms or marketplaces (e.g., Décary-Hétu and Giommoni 2017; Holt 2013). Illicit online markets, for criminologists, therefore, typically denote clearly demarcated online spaces, such as a chatroom, forum, or website, rather than abstract constructs like the supply and demand of a particular product. Arguably, this differs from the market for a good, as it is typically conceived of by economists (Murji 2007).

Products and places

Typically, one realm of illegal behaviors caters to a limited industry or market: A child sexual exploitation forum organizes the distribution of sexual material, a web shop sells new psychoactive substances, and an illegal platform economy offers stolen credit cards and illicit drugs. I suggest that this heterogeneity is not unsystematic, and that there is a tendency for products of the same type to be sold in a similar manner. In the following sections, I provide an overview of illicit online markets across two dimensions, products, and places. The former roughly equates to how economists conceive of markets, whereas the latter corresponds to how criminologists approach them.

The overview relies on an ideal typical separation of products and platforms, and has two significant limitations: First, an ideal typical classification cannot capture all variation and is only an analytical tool. These classes are intended to document the heterogeneity of illicit online markets for analytical purposes, not to serve as an exhaustive list of all illicit markets and products. Second, the size and legitimacy of platforms and products is not given (Herley and Florêncio 2010). While the coming sections rely on peer-reviewed scholarship, it is important to note that there is concrete evidence for the large size of some economies, and little evidence for the size of others. For example, blockchain analysis has documented the size of cryptomarkets (ElBahrawy et al. 2020), while evidence on the legitimacy and size of the online weapons trade is very limited (Holt and Lee 2023). Thus, the following sections serve to demonstrate and identify classes of illicit online markets, but they do not imply that all markets are similar in size.

Products

Table 1 suggests 3 overarching types of goods and services exchanged in illicit online markets with examples for each. Type is meant as a general separation of product classes, whereas the examples may be treated either as products or as markets in an abstract economic sense as well (e.g., the market for stolen credit card data online).

Table 1. Product types in illicit online markets.

Type	Examples
Software, stolen data and media.	Hacking tools. Credit card data. Bank accounts. Stalkerware. Warez. Child Sexual Abuse Material (CSAM). Non-consensual explicit images.
Physical products.	Illicit drugs. New Psychoactive Substances (NPS). Weapons. Counterfeit goods. Stolen goods.
Services.	Prostitution. Hacking services. Botnets. Money mules. Cryptocurrency”mixing.”

Within the first type, software, stolen data and media, products are distinguished by being virtual in nature, reproducible at negligible or no cost, and transmissible through the internet as data. Historically, both the distribution of warez and CSAM are some of the earliest observed illicit online markets (Quayle and Taylor 2002). A newer phenomenon is the distribution of non-consensual images and videos, sometimes referred to as ”revenge pornography” (Jørgensen and Demant 2021). The burgeoning economy for fraud, hacking tools, and stolen data also falls within this category (Hutchings and Holt 2015), and there is an exhaustive literature on these markets and their continuous growth (Macdonald and Frank 2017). There are, however, some distinctions within the category, namely with regard to product legality and longevity. First, some are legal products distributed illegally through copyright infringement, sometimes referred to as warez (Décary-Hétu, Morselli, and Leman-Langlois 2012). Others are illegal by their very nature, namely child sexual abuse material (CSAM) and non-consensual images. Some may be legal products used for illegal ends, such as stalkerware (Khoo, Robertson, and Deibert 2019). Second, some products can be reproduced without losing value, warez for example, whereas others can only be used a limited number of times such as a bank account or credit card data. Despite these differences, reproducibility and digital transmission are common qualities within this genre.

The second type, physical products, encompasses a range of goods that are physical in nature, such as weapons, drugs, and counterfeit goods. As opposed to the former, these cannot be duplicated at negligible cost, and being physical they necessitate delivery. Mail delivery, physical meetings, and hidden caches are means for distributing these (Georgoulias et al. 2021; Martin 2014a). Within this type, the drug economy is substantial and well documented (Martin, Cunliffe, and Munksgaard 2019), whereas there is evidence of a smaller online weapons trade and limited research on stolen and counterfeit goods (Aniello and Caneppele 2018; Holt & Lee, 2023).

Finally, there is a burgeoning market for services or labor. Examples include money laundering and money mules (Leukfeldt, Kleemans, and Wouter 2016), cryptocurrency anonymization (”mixing”) services (Holt, Lee, and Griffith 2023), and sexual services (Pajnik et al. 2016). Some products may also be closely intertwined with certain services. For example, the use of cryptocurrencies, such as in the online drug trade and fraud economy, may involve or necessitate”mixing” services.

Individual products and services within these broad categories can be situated along the continua of legality and legitimacy proposed by Beckert and Dewey (2017). Some products are more or less abhorred and deviant, such as CSAM contrasted to warez. Similarly, products are also criminalized and prosecuted to varying degrees. NPS, for example, are found in legal gray areas as opposed to heroin and cocaine, and the legality of sex work varies by country.

Places

Empirical research on illicit online markets tends to focus on clearly delineated places or websites. For example, there are substantial bodies of research on markets for stolen data organized as forums (Holt 2023), platforms for drugs known as cryptomarkets (Martin, Cunliffe, and Munksgaard 2019), and classified ads for sexual services (Campbell et al. 2019; Cunningham and Kendall 2011). However, as with products, some general patterns may also be identified in the social organization of illicit exchange online. To elucidate such patterns, it is utile to ignore the goods and services sold, and the technologies utilized, and instead emphasize the organization of economic exchange. How do sellers and buyers meet? How are products advertised? How do sellers compete? In Table 2 I suggest 5 ideal typical modes of organizing the exchange of illicit goods and services online.

Table 2. Platform ideal types.

Ideal type platform	Organization	Examples
Forums	Modeled as bulletin board systems (BBS) and newsgroups.	Hacker forums; Darkode; CSAM forums.
Shops	Modeled as webshops.	NPS webshops; botnets for hire; rogue pharmacies.
Group	Closed groups on social media.	Facebook drug dealing groups.
Channel	Networked modes of communication such as e-mail or chat.	Drug dealing using Wickr or Telegram.
Platform	Organized similar to licit platform economies.	Cryptomarkets; listings for sexual services.

Forums are one of the earliest types of illicit market observed online. These are similar to traditional Bulletin board Systems (BBS), and often based on the same software (Holt 2020). Forums have been described as”virtual offender convergence settings,” similar to bars and other offender hangouts (Soudijn and Zegers 2012). In cybercrime forums, multiple sellers compete over buyers, and the sale of hacking services, stolen data, and CSAM have especially been organized in this manner (Holt 2013; Holt et al. 2012). In comparison, forums for the distribution of CSAM and non-consensual images are more likely to be “communities” rather than host profit-driven activities (Van Der Bruggen and Blokland 2021; Van Der Bruggen and Blokland 2022).

Shops take the form of traditional webshops in which a buyer can purchase products from a single supplier. Some products for which shops have historically been used are the sale of stolen credit cards, NPS, prescription medicine, and botnets (Littlejohn et al. 2005; Orsolini et al. 2017; Wehinger 2011). Recently, traditional illicit drugs and weapons have also been observed sold through shops (Flamand and Décary-Hétu 2019; Holt & Lee, 2023).

Channels consist of closed one-to-many or many-to-many communication and are characterized by their closed nature, often requiring knowledge or invitation. Early instances include the distribution of CSAM on IRC (Internet Relay Chat) as well as the trade in stolen data (Herley and Florêncio 2010; Quayle and Taylor 2002). In both cases, products and services may be exchanged between all participants. A newer incarnation is the increasing use of closed channels used by ring-and-bring services in which individual drug sellers advertise their products (Leah et al. 2019; Søgaard et al. 2019). As opposed to their earlier counterparts, these channels are predominantly observed to be one-way advertising of products.

Groups are a more recent form of illicit online market observed in studies of social media drug dealing (Demant et al. 2019). These are observed on namely Facebook wherein they exist as private, closed or invite-only groups. Within the groups, sellers advertise products in a similar manner to licit goods (Aniello and Caneppele 2018; Bakken 2021). After contact is established, communication is then moved to a channel.

Finally, the recent decade has seen a genre of platforms emerge. Platforms for drugs are sometimes referred to as cryptomarkets, anonymous online markets, or darknet markets (Martin, Cunliffe, and Munksgaard 2019). Fundamentally, these mimic the organization of eBay (Barratt 2012) and cater predominantly in illicit drugs (Soska and Christin 2015). The defining characteristic of these places is the competition of multiple sellers, usually on a platform owned by a third party, and an organization that is more similar to a modern platform economy like Amazon or eBay than the forum ideal type. Consequently, websites in which multiple sex workers compete can also be subsumed under this type (Cunningham and Kendall 2011).

The correlation between platforms and products

From the preceding discussion it is clear that there is extensive heterogeneity in a) products, and b) the social organization of exchange, of illicit online markets. Yet, it is also apparent that this variation is not unsystematic. For example, markets for hacking, fraud, and stolen data tend to be organized as forums, whereas the market for drugs appears to have followed a historical trajectory from webshops, to platforms and now as channels and groups, though all forms continue to co-exist (Demant et al. 2019). This spurs two questions: Why do modalities of exchange vary, and why is there a tendency for types of products to be sold in the same manner? Broadly, the scholarship suggests two explanations, evolution, or efficiency.

First, modalities of organization may be seen as evolutionary stages (Przepiorka, Norbutas, and Corten 2017), or as mirroring trends in licit online commerce (EMCDDA 2016). Such a development is exemplified in the changes to the drug economy, which has evolved from webshops to platforms that increase efficiency to an unprecedented degree (Bakken, Moeller, and Sandberg 2018). Second, variation may be approached through the frameworks of transaction cost or industrial economics, often applied within the criminology of illicit markets (Moeller 2018; Reuter 1984). Within this framework, actors economize on transaction costs leading to different types of organization. Uncertainty thus leads to different governance relations, price (market) and authority (hierarchy) (Williams 1979). In broad strokes, low uncertainty allows transactions to take place in ”spot markets,” the ideal type being a stock exchange, whereas high uncertainty motivates contracts and internal transactions (Block 1990:64). An example of this approach is provided by Herley and Florêncio (2010) who argue that the extensive information asymmetry in the market for stolen credit cards leads to two concurrent market forms: an open market prone to fraud and a hierarchical organization with lower uncertainty. Distinct modes of organizing illicit online exchange may therefore be seen as ways to economize on transaction costs: Some market forms are simply more prevalent because they reduce these costs in the most optimal manner.

Neither model is satisfactory, however. First, if markets are evolving toward more efficient and modern modalities, then it appears a problem that all of the platform types detailed continue to co-exist. Second, explaining variation through the optimization of transaction costs is an”adaptive story” (Granovetter 2017), which Dow (1987) explains as such: ”governance structure X exists because efficiency requirements dictate X for transactions of type Y” (p. 26). Thus, explanations rooted in evolutionary or optimizing processes fail to explain the continued existence of less efficient modes of exchange or they become tautological. Put bluntly, if efficiency or evolution drives the organization of illicit online commerce, then why are stolen credit cards sold in IRC, forums, autoshops and cryptomarkets simultaneously, and not exclusively in the most optimal or efficient one?

For the sellers and buyers of these markets, the reasons to pick one market over another are likely to be mundane: Access to markets may only be available to an exclusive group (Holt and Dupont 2019); the costs of migrating from one platform to a similar one another after closure may be minimal (Ladegaard 2019, 2020); there may be a lack of technical competencies or unwillingness to learn new systems; or people may plainly be conservative in their business, preferring to only adapt when it appears safe or convenient. That is, for the participants of these markets there can be many practical reasons to prefer inefficient or insecure markets above their alternatives. Furthermore, these reasons may be inherently conservative, privileging the already existing markets.

An example of this paradox, the availability of more efficient and secure alternatives but preference for the already established, is the organization of cryptomarkets. Martin, Cunliffe, and Munksgaard (2019:32) show that despite novel technological developments that should enhance their security and efficiency, decentralized multi-signature escrow, I2P, and decentralized commerce, these innovations never reached mass adoption.

The tendency for less efficient and secure markets to continue to exist, and the many individual motivations there may be for preferring these, can be accommodated by drawing on institutional strands of economic sociology. Here, economic institutions are viewed as social constructions and markets as fields in which actors seek stability (Beckert 2009). The tendency for some modes of organization to persist, despite superior alternatives, is due to path dependency; once institutional arrangements have settled, as in the case of cryptomarkets, they hardly change unless fundamentally challenged (Fligstein 2001). Organizations within a field exhibit isomorphism, and ”model themselves after organizations in their field” (DiMaggio and Powell 1983:152). In the case of cybercriminal markets and cryptomarkets, these dynamics are particularly evident, as past and contemporary markets can appear almost identical in terms of organization (e.g., Décary-Hétu and Leppänen 2013; Holt and Dupont 2019). Cryptomarkets, for example, continue to be organized in a similar manner today as the first cryptomarket, Silk Road (Martin, Cunliffe, and Munksgaard 2019). From the perspective of sellers, buyers, and market administrators, business-as-usual may not be the most efficient or secure way of trading, but it provides stability. Should a platform be seized, buyers and sellers can simply move to the next but identical one, and should an entrepreneur wish to start a new platform, they might choose to bet on this dynamic.

The drawback of disregarding the transaction cost reasoning in favor of notions of path dependency and isomorphism are that they may de-emphasize efficiency and transaction costs, both crucial concepts when studying the organization of illicit exchange (e.g., Bichler, Malm, and Cooper 2017; Moeller 2018). Quantifying, for example, product uncertainty, competition, and control mechanisms that reduce fraud and predation in illicit online markets remain highly relevant (see for example Espinosa 2019; Paquet-Clouston, Décary-Hétu, and Morselli 2018). One way to resolve this problem, is to remain focused on these concepts, which are central to the dynamics of illicit markets, but abandon the assumption that markets are optimal solutions with regard to efficiency and security. Instead, one can operate under the assumption that a) platforms vary in organization due to processes of path dependency, and exhibit similarity due to isomorphism, and b) different modes of organization may be more or less hierarchical and/or efficient. To infer dynamics or forces that lead to optimal solutions in terms of efficiency and security is simply unnecessary and may even distract from the between-market variation of interest to researchers.

Marketness and administrative governance: a typology of illicit online markets

In the preceding section I have suggested abandoning transaction cost or evolutionary reasoning in favor of accepting that there are simply many ways to sell illicit products and services, and that people cannot be assumed to gravitate toward the most secure or efficient ones. I have also suggested that economic qualities of these realms, efficiency, search costs, and uncertainty should not be disregarded. This conceptualization avoids the problem of functionalist inference but retains crucial concepts. However, there is still the task of systematizing the qualities that differentiate illicit online markets. I propose that the heterogeneity of illicit online markets may be systematized across two axes: Marketness and administrative governance. Importantly, this distinction is agnostic to whether one conceives of a market as restricted to places or products.

Marketness

It is difficult to separate the social and economic content of illicit exchange, in general, and illicit economies have some ”pre-modern” qualities (Beckert and Wehinger 2013). This remains the case online. Jørgensen and Demant (2021), for example, detail an economy of illicit image sharing that is akin to a barter economy, a misogynistic exchange of”pokemon” or”hockey” cards (Dodge 2021). Van Der Bruggen and Blokland (2021) observe a similar tendency toward barter in CSAM content above payment in currency. Conversely, markets for drugs and stolen data tend to resemble modern markets more, facilitating sale and purchase in actual currencies or virtual equivalents (see for example Cunliffe et al. 2017; Holt, Smirnova, and Chua 2016). Moeller (2018) appropriates the notion of”marketness” from Block (1990), suggesting that ”marketness can be observed in the relative importance of the price consideration compared to more social concerns like status and friendship” in drug markets (p. 192). Block (1990) more broadly suggests that ”[It] is not as though prices are irrelevant under conditions of low marketness, it is just that they compete with other variables” (p. 51).

Whereas the original definition of marketness seeks to explain variations in modern licit markets, with internal- and spot markets as two ideal types at their own ends of the continuum, the attention to market-like characteristics is utile in differentiating illicit online markets. For example, the distribution of warez online, which borders on even being a market under a strict definition since products are often free, is distinguished by a high social value attached to reputation (Décary-Hétu, Morselli, and Leman-Langlois 2012). Conversely, the highly streamlined platforms for illicit drugs, cryptomarkets, in which thousands of sellers compete on price and quality exhibit high marketness (Martin 2014a; Paquet-Clouston, Décary-Hétu, and Morselli 2018). In the middle, some forum-type markets, such as markets for stolen data and fraud, exhibit higher search costs and less transparency, but sellers still compete within the same platform (Dupont et al. 2017). Though these markets differ significantly from licit ones, it is evident that some are more reminiscent of ideal typical spot markets than others, and some border on being more community than markets.

It is thus possible to situate the distribution of a product or the modality of exchange on a continuum from community to market. Qualities that indicate a high degree of marketness are mechanisms, processes, and organizational qualities that support competition and efficiency. For example, qualities that reduce search costs and increase transparency by allowing comparison between products and sellers (e.g., transparent pricing, search functionality). Conversely, qualities that suggest low marketness are their inverse or an emphasis on status above profits.

Administrative governance

A recurrent theme within the scholarship on illicit online markets is the exercise of governance. Martin (2014a) applies a notion of”nodal governance” to conceptualize the power exercised by administrators in online drug markets, and Lusthaus (2012) suggests administrators are crucial to establishing trust and orderly market conditions in cybercrime markets. Odabaş, Holt, and Breiger (2017) argue that administrative governance is found on a continuum from high to low, in which administrators to varying degrees intervene and regulate in markets through authentication and mediation. Authentication entails the vetting of market participants, testing of product, and ranking of sellers. Mediation entails dispute resolution based on escrow systems, in which the administrator acts as an intermediary to all exchanges. Diekmann and Przepiorka (2019) suggest these mediation practices resemble a type of”contract law.”

The degree of control exercised by administrators in illicit online markets varies (Odabaş, Holt, and Breiger 2017). Dupont et al. (2017) for example, study vetting processes in a closed cybercrime market, in which prospective members had to pass authentication. Conversely, Herley and Florêncio (2010) describe a stolen data market absent any regulation in which predation and fraud is ripe. The degree of control which may be exercised is contingent on control over technical infrastructure: When administrators run their own platforms, there are no restrictions on the sanctions they can administer. Dupont et al. (2016) for example, describe how administrators can remove the rank and tarnish the reputation of opportunistic sellers on their platform. Similarly, sellers may be banned or even have their fortunes expropriated in others (Moeller, Munksgaard, and Demant 2017). These are examples that exhibit substantial administrative governance. Conversely, in other cases sanctions are administered by peers through the tarnishing of reputations or threats (Holt and Lampke 2010).

The exercise of governance in illicit markets is often approached through the lens of Black’s theory of social control and conflict resolution (e.g., Jacques and Wright 2008; Morselli et al. 2017). Within Black’s (1976) original formulation, formal social control is exercised by the state, whereas informal social control is exercised by non-state actors. Consequently, the governance of illicit markets falls under the scope of the latter. However, social control in illicit online markets manifests in qualitatively distinct ways compared to traditional illicit markets. Principally, the capacity and exercise of violence is greatly reduced (Morselli et al. 2017), but Bakken, Moeller, and Sandberg (2018) highlight that a degree of formalization is operational as well. Griffiths (1984) suggests abandoning the formal/informal social control distinction, in favor of conceiving of it as varying degrees of ”legalness;” a continuum of the division of social control labor from simple toward complex forms. The delegation of informal social control labor in some illicit online markets, namely forum and platform-based types, exhibits such tendencies toward more complex and formalized modes of social control. In such cases, scholars have observed centralized testing of products, verification of sellers, paid moderators, dispute resolution systems, escrow systems, taxation of transactions through fees, and vetting processes (Dupont et al. 2017; Holt and Lampke 2010; Martin, Cunliffe, and Munksgaard 2019).

Thus, since the exercise, scope, and formalization of informal social control in illicit online markets vary across types, it can be used as another axis of differentiation, administrative governance – a continuum that represents the centralization and formalization of informal social control. Qualities that may be used to differentiate markets are authentication and mediation practices, the existence of moderators and administrators, de facto courts and contracts through escrow and dispute resolution, administrative sanctioning capacity, and the complexity of the division of social control labor. Essentially, the question is to what extent, and how, third parties are involved in facilitating exchange. Since many illicit online markets actually exist as networks within legal services such as social media, it is necessary to emphasize that such third parties should actively take part in the trade. For example, the administrators of a cybercrime forum, who own the infrastructure, wield substantially more power than the administrator of a social media group on a website like Facebook.

Applying the marketness-governance typology

I have suggested that illicit online markets, both conceived of as products and as places, may be differentiated with regard to their relative marketness and administrative governance. The intuition behind the typology is summarized in Figure 1, in which types of illicit online markets can be placed along the axes of administrative governance and marketness. Notably, the placement of a market, product or place, is only informative relative to other markets. I use the term typology and use a grid for illustrative purposes, but these should be treated as ideal types. In reality, markets fall somewhere on a continuum from low to high on both axes, as shown in Figures 2 and 3. In this section I return to examples discussed previously in this paper, to illustrate the application of the typology across the two axes.

Figure 1. Axes of differentiation. Illicit online markets may be placed along these continua.

Figure 2. Illicit online markets placed along a continuum of administrative governance from high to low.

Figure 3. Illicit online markets placed along a continuum of marketness from high to low.

The first axis of differentiation is marketness, appropriated from Block (1990) and Moeller (2022). Fundamentally, the degree of marketness is a question of where a market is placed on the continuum between a community and spot market. Indicators of where a market should be placed are the use of currencies as opposed to barter, the presence of multiple sellers, the degree and manner of competition, the existence of reputation systems, the ease of price comparison, and the relative weight given to status above profit. Figure 2 situates some of the examples discussed across the continuum of marketness. At the low end, markets for warez and copyrighted media are found. In these, product is exchanged at no cost and distributors compete on status, thus suggesting low marketness (Décary-Hétu, Morselli, and Leman-Langlois 2012). Conversely, although they also distribute reproducible content, economies for CSAM and non-consensual images tend to be organized as barter economies (Jørgensen and Demant 2021; Quayle and Taylor 2002). From here on, single-seller channels, multi-seller groups, webshops, forums, and platforms all utilize currencies and prices, suggesting higher marketness. Price comparison between sellers, however, is time-consuming in webshops and single-seller channels since buyers must identify multiple sellers and websites, whereas cybercrime forums, sex work advertisement websites, and cryptomarkets allow the comparison of multiple sellers on one platform. Notably, however, cybercrime forums tend to mix business and socialization (Soudijn and Zegers 2012), and some forums are only for members (Dupont et al. 2017). Conversely, websites in which sex workers advertise are open and allow comparison of prices and services, although transactions are facilitated outside the website (Cunningham and Kendall 2011). Most high in marketness are cryptomarkets, which, similar to forums, allow competition between multiple sellers, but also provide detailed information for price comparison (Martin, Cunliffe, and Munksgaard 2019). Indeed, the cryptomarket Hydra has even provided centralized product testing increasing transparency even more (Meylakhs and Saidashev 2021).

The second axis of differentiation is administrative governance. I suggest that illicit online markets exhibit degrees of formalization and centralization of informal social control. Crucially, I emphasize social control exercised by third parties over sellers and buyers, and the distribution of social control. Social control in illicit online markets, administrative governance, appears in a variety of ways. Examples include rules of conduct and trade (e.g., what can and cannot be sold), escrow systems, sophisticated divisions of social control labor (moderators, administrators), dispute resolution systems, third party verification, third-party fees, vetting processes, and more. Revisiting previous examples, Figure 3 suggests the placement of markets across a continuum of governance. At the lowest end I suggest that single-seller channels and webshops exhibit low administrative governance. In such cases, the website or channel will be fully under the control of one firm, who may set rules as they please, though they do not exercise control over other sellers. Conversely, groups which have multiple sellers will have an owner or administrator who can impose rules and order. Similarly, websites that distribute warez, CSAM, and non-consensual images may have an owner or administrator, can employ moderators, and may have rules. For example, a service that distributes warez, such as a torrent tracker, may moderate content and remove CSAM material. The exercise of social control, however, takes on a more complex form in cybercrime forums and cryptomarkets. In such marketplaces, there is typically a division of social control labor with both moderators and administrators, and a strict set of rules and sanctions. Dupont et al. (2016), for example, describes a forum in which moderators would strip the reputation of rulebreakers. Similarly, Ladegaard (2019) describes cryptomarket administrators that regulate against the sale of fentanyl. Notably, it is also in cybercrime forums and cryptomarkets where complex regimes of social control are found. Here, scholars have observed de facto court and contract systems when administrators offer escrow solutions and dispute resolution (Martin 2014a; Moeller, Munksgaard, and Demant 2017; Tzanetakis 2018).

Discussion

In this paper I have proposed a typology of illicit online markets that abandons functionalist inference in favor of taking the heterogeneity of platforms and products as a starting point. There are three components to the argument I present. First, I argue that optimization and evolution are poor explanations of how illicit online commerce is organized: Products and services are sold in many ways, and in many cases there may be more secure or efficient ways to do so. Moreover, highly hierarchical organizations appear to also be the most market-like (Moeller 2022). Second, I suggest that functionalist inference, in which a story of optimization is adapted to a certain type of organization, can be avoided by disregarding the question of origin in favor of a general economic sociological assumption: Market institutions are quite stable, and organizations tend to exhibit isomorphism. Finally, I suggest that we can instead organize illicit online markets against two continua. Some markets are high in “marketness,” others less so, some markets exhibit strong administrative governance, others do not.

The classification of illicit online markets that I have proposed remains purely descriptive, and there is no reason to infer that evolutionary processes or efficiency requirements led to one particular mode of organization. Instead, I have suggested that illicit online markets are heterogeneous because they emerge from distinct social processes. At the same time, places and products correlate because of isomorphism and path dependency (DiMaggio and Powell 1983; Granovetter 2017). That is, the reason why credit cards tend to be sold in a similar manner, and drugs in another, is better explained by tradition than efficiency. For buyers, sellers, and administrators, doing business-as-usual may simply be more preferable. By operating under this assumption, it is possible to avoid the problem of both functionalist inference and theory that does not align entirely with observations (see for example Bakken, Moeller, and Sandberg 2018), and instead focus on the particular qualities of individual markets through comparison with other markets.

This framework offers a comparative point of departure to study illicit online markets, both as individual platforms and as ecosystems. The concepts of marketness and administrative governance subsume qualities and quantities that vary between illicit online markets, whether conceived of as realms of exchange, places, or markets for different products. Modalities of exchange are diverse, and commodities vary, but the exercise of administrative governance and the degree of marketness are two axes across which illicit online markets can be situated. I suggest three immediate ways in which the marketness-governance typology may be utilized in research. First, it allows the classification of types of illicit online commerce with respect to other modalities of exchange. Second, it draws attention to qualities that are of interest in applied research. Third, it provides a starting point for theorizing the dynamics of illicit online markets. In turn, these may inform enforcement and practice. I briefly discuss each application:

What kind of market are we dealing with, and how does it differ from what we have seen before? Whether researchers examine goods or platforms, the marketness-governance typology is an analytical tool that can be used to differentiate markets from each other. As shown in Section 5.3, it is also possible to find common patterns in the organization of illicit online markets. New illicit online markets, both as products and as platforms, continue to emerge and grouping their qualities can yield analytical insights. For example, the marketness-governance typology reveals distinct variations in the organization of the online drug trade across social media, private channels, and cryptomarkets.

What are the qualities of interest when studying an illicit online market, and what influences the behavior of its participants? Key topics in scholarship on illicit online markets are governance and social control, and market characteristics such as competition and price (e.g., Lusthaus 2012; Paquet-Clouston, Décary-Hétu, and Morselli 2018). By situating markets along the marketness-governance typology the qualities of individual markets become apparent: Some markets appear anarchic, with implications for informal social control, others appear driven by a competition for status rather than for profit. Market characteristics such as reputation systems, escrow, and status rankings, as well as organizational qualities such as the division of social control labor (Griffiths 1984), are central to the marketness-governance typology. The classification of markets therefore inevitably draws attention to these qualities through comparison.

The typology I have proposed does not imply testable hypotheses and it is first and foremost intended for the purpose of classification and comparison. However, when identifying key characteristics of a market, such as strong administrative governance, or high levels of marketness, classification may generate testable hypotheses which may in turn advance scholarship further. For example, escrow systems, a strong mechanism of social control in illicit markets, appear to explain little with respect to price or purchase size in cryptomarkets (Munksgaard & Tzanetakis, 2022; Munksgaard, 2023). However, such mechanisms may function differently in contexts with otherwise low degrees of social control. Similarly, other well-examined market characteristics like status and reputation may also be mediated by their context. The utility of the marketness-governance typology, therefore, is primarily analytical and comparative when studying one or more markets, but this classification may also generate hypotheses.

Law enforcement, and the external pressure exerted on illicit market actors from the state, are purposively excluded from the analysis and proposed typology. This helps avoid functionalist inference, by way of replacing or combining efficiency with security: Markets are the way they are, because they are the most secure and/or efficient way of conducting this type of transaction. Such an analysis does not provide any thorough insight into how actors avoid detection. Beckert (2009) suggests that market actors need to resolve three problems: cooperation, valuation, and competition to ensure stable worlds of exchange. In later work, Beckert (2013) shows how these are resolved in illicit markets (see also Bakken, Moeller, and Sandberg 2018). In illicit markets, the resolution of these problems is often shaped by the oppositional relation to the state, which among other things include the absence of formal regulation and a need to evade law enforcement. The qualities that place individual markets across the two continua can be approached as different ways of solving the coordination problems of illicit markets under illegality. The marketness-governance typology therefore offers a starting point to understand ways in which actors avoid and adapt to law enforcement and illegality in different ways to resolve the coordination problems of illicit markets.

The differentiation of illicit online markets based on governance and marketness leads to an observation that contradicts the transaction cost reasoning, but which is empirically consistent: The illicit online markets that display the most complex types of administrative governance tend to also exhibit the highest degrees of marketness. Hacker forums and cryptomarkets, platforms that are exclusively under the control of administrators, host thousands of sellers and products, implement their own dispute resolution systems, offer escrow services, and they rank and rate products and sellers (Dupont et al. 2017; Odabaş, Holt, and Breiger 2017; Soska and Christin 2015). In his seminal work Polanyi (2001) detailed how the modern state, and the violence it exercised, was crucial in the transformation to market society. Similarly, Fligstein (2001) highlights the centrality of states in the construction of modern markets. At a more practical level, Garcia (1986) details the work of multiple actors coming together to construct a “perfect market” for produce. In a similar vein, administrators of illicit online markets construct spaces and platforms in which marketness is higher, for example, by reducing search costs and uncertainty through search machines and rankings. These qualities do not emerge spontaneously but require dedicated effort and control. Thus, differentiating illicit online markets across these two axes suggests a radically different narrative, one in which marketness and administrative governance are not mutually exclusive but constitutive.

A significant discussion in cybercrime scholarship have been whether some organizations, and by extension platforms, can be conceived of as mafias, organized criminal groups (OCG) or similarly (Lavorgna 2019; Lusthaus 2013). Offline, illegal or criminal governance over territory and markets is exercised by organized groups (Pereda and Décary-Hetu 2023), and it is qualitatively different from the governance discussed in studies of illicit online markets (e.g., Bakken, Moeller, and Sandberg 2018; Lusthaus 2013; Martin 2014a; Moeller 2022). Criminal groups of varying degrees of organization can act as administrators, buyers, and sellers within the illicit online markets described in this paper, and they may therefore in some cases exercise governance in a manner reminiscent of criminal governance observed offline such as the enforcement of contracts (escrow), tax collection (fees) and regulation based on norms (see Lessing 2021, for examples of criminal governance). However, the notion of administrative governance does not imply organized actors, nor are they relevant to the marketness-governance typology. Rather, the marketness-governance typology is intended to aid the classification and analysis of individual markets, whether products or places, within a broader ecosystem of illicit online commerce.

Conclusion

Illicit online markets span products ranging from weapons to warez, and they manifest in as diverse forms as closed groups on social media and platform economies. In this paper, I have drawn on economic sociology and social control theory to argue that this heterogeneity may be captured by situating markets, whether conceived of as places or products, across two continua: marketness and administrative governance. Some appear as modern markets with efficient, transparent, and seamless exchange, whereas status and barter characterize others. Similarly, some markets are distinguished by a complex division of social control labor and formalized modes of dispute resolution, whereas participants in other markets rely on communal modes of social control. This typology allows comparative analysis of illicit online markets, while remaining focused on the empirical qualities that occupy criminologists.

Disclosure statement

No potential conflict of interest was reported by the author(s).

Correction Statement

This article was originally published with errors, which have now been corrected in the online version. Please see Correction (10.1080/01639625.2024.2330830).

Additional information

Notes on contributors

Rasmus Munksgaard

Rasmus Munksgaard is an Associate Professor of Criminology at the Department of Sociology and Social Work at Aalborg University. His research revolves around illicit markets, online and offline, cybercrime, and drugs.