Accepted Manuscript

Title: Studying illicit drug trafficking on Darknet markets:

structure and organisation from a Canadian perspective

Author: J. Broséus D. Rhumorbarbe C. Mireault V. Ouellette

F. Crispino D. Décary-Hétu

PII: S0379-0738(16)30067-6
DOI: http://dx.doi.org/doi:10.1016/j.forsciint.2016.02.045
Reference: FSI 8352

To appear in: FSI

Received date: 31-10-2015

Revised date: 18-2-2016
Accepted date: 23-2-2016

Please cite this article as: J. Broséus, D. Rhumorbarbe, C. Mireault, V. Ouellette, F.

Crispino, D. Décary-Hétu, Studying illicit drug trafficking on Darknet markets: structure
and organisation from a Canadian perspective, Forensic Science International (2016),
http://dx.doi.org/10.1016/j.forsciint.2016.02.045

This is a PDF file of an unedited manuscript that has been accepted for publication.
As a service to our customers we are providing this early version of the manuscript.
The manuscript will undergo copyediting, typesetting, and review of the resulting proof
before it is published in its final form. Please note that during the production process
errors may be discovered which could affect the content, and all legal disclaimers that
apply to the journal pertain.
Title

Studying illicit drug trafficking on Darknet markets: structure and organisation from a
Canadian perspective

t
Authors

ip
Broséus J.1*, D. Rhumorbarbe1, C. Mireault2, V. Ouellette2, F. Crispino2, D. Décary-Hétu3

cr
Affiliations

us
1
University of Lausanne, Ecole des Sciences Criminelles, Lausanne, Switzerland

an
2
Département de Chimie, biochimie et physique, Laboratoire de recherche en criminalistique,
Université du Québec à Trois-Rivières, Québec, Canada
3
Université de Montréal, École de criminologie, Québec, Canada
M
* Corresponding author : julian.broseus@unil.ch
d
p te
ce
Ac

Page 1 of 24
Abstract

Cryptomarkets are online marketplaces that are part of the Dark Web and mainly devoted to
the sale of illicit drugs. They combine tools to ensure anonymity of participants with the
delivery of products by mail to enable the development of illicit drug trafficking.

Using data collected on eight cryptomarkets, this study provides an overview of the Canadian

t
ip
illicit drug market. It seeks to inform about the most prevalent illicit drugs vendors offer for
sale and preferred destination countries. Moreover, the research gives an insight into the

cr
structure and organisation of distribution networks existing online. In particular, we provide
information about how vendors are diversifying and replicating across marketplaces. We

us
inform on the number of listings each vendor manages, the number of cryptomarkets they are
active on and the products they offer.

an
This research demonstrates the importance of online marketplaces in the context of illicit drug
trafficking. It shows how the analysis of data available online may elicit knowledge on
criminal activities. Such knowledge is mandatory to design efficient policy for monitoring or
M
repressive purposes against anonymous marketplaces. Nevertheless, trafficking on Dark Net
markets is difficult to analyse based only on digital data. A more holistic approach for
d
investigating this crime problem should be developed. This should rely on a combined use
and interpretation of digital and physical data within a single collaborative intelligence model.
p te
ce

Keywords

Digital data ; Cybercrime ; Intelligence ; Criminal evolution ; TOR ; PGP key

Ac

Page 2 of 24
 1. Introduction

Cryptomarkets are defined as a type of website that employs advanced encryption to protect
users’ anonymity. They have been launched by entrepreneurs a few years ago to increase the
security of virtual illicit markets [1]. They are part of the Dark Web (a small part of the Deep

t
Web) and propose a wide range of illegal products, mainly illicit drugs, which are shipped by

ip
post. They share many structural features with popular marketplaces such as eBay or
Amazon, with searchable listings of products for sale and buyers being able to leave feedback

cr
on their purchases. These online markets use the virtually untraceable cryptocurrency bitcoin,
The Onion Router (TOR) service and the encryption of private messages, files and e-mails

us
using the Pretty Good Privacy (PGP) cryptosystem to ensure anonymity of both
administrators and participants [1-4]. These technologies and the delivery of products by mail

an
have significantly decreased the monitoring and detection abilities of law enforcement
agencies. Moreover, these tools combined with an escrow system have drastically changed the
structure and organisation of illicit drug trafficking. This phenomenon is characterised as a
M
revolution and a criminal evolution in drug trading [5, 6]. For instance, trafficking via
cryptomarkets put an end to physical interactions between transacting parties, which may
d

therefore reduce or eliminate physical violence [5-7].

te

A few researchers evaluated the impact of such marketplaces on consumers and vendors as
well as the spread of this trafficking. In particular, studies focussed on Silk Road, the first
p

cryptomarket to appear at the beginning of 2011 [1, 5, 6, 8-13]. Silk Road was first
ce

characterised as an “eBay for Drugs”, with drug consumers making personal use-sized
purchases, and transactions were described as ‘business-to-customers’ [1-3]. Instead, a study
showed that a significant proportion of transactions on Silk Road was best characterised as
Ac

‘business-to-business’. Indeed, sales, in terms of quantities and prices, were typical of

purchases made by dealers sourcing stock [6]. Just before its closure, more than 1000 vendors
were active on Silk Road and annual sales were estimated at 89.7 millions USD [6]. United-
States was the most frequent country of origin of vendors and sellers proposed to ship their
illicit products mostly worldwide [3]. Lastly, a long-term measurement analysis of 16
different marketplaces, between 2013 and 2015, was undertaken [7]. Researchers concluded
that the online anonymous marketplace ecosystem appeared to be resilient, on the long term,
to adverse events such as law enforcement takedowns or “exit scams”. Moreover, they

Page 3 of 24
assessed that cryptomarkets were primarily competing with street dealers, in the retail space,
rather than with established criminal organisations, which focus on bulk sales [7].

While cryptomarkets contribute little to the global illicit drug trade, more than 50% of drug
consumers in Australia, England and United-States know they exist and about 15% of them
have performed at least one transaction [13]. Cryptomarkets show benefits for both vendors

t
(security, worldwide market) and consumers (diversity of available drugs, information about

ip
products and vendors, quality of products, security) compared to traditional market [11-13].
At the time of writing, about 20 cryptomarkets are active. This illustrates the strong demand

cr
for this kind of marketplace as well as the growing importance of cryptomarkets in the
trafficking of illicit products. It seems unlikely that cryptomarkets are going to disappear, in

us
spite of law enforcement crackdowns [6, 7].

Thus, this research aims at gaining knowledge on these marketplaces. In particular, the study

an
investigates the structure and organisation of the illicit drug trafficking from a Canadian
perspective. Data were collected in 2014 from eight cryptomarkets and consist in about 4000
M
listings and 200 vendor profiles originating from Canada.
d

2. Material and methods

te

Listings and vendor profiles present on eight cryptomarkets were indexed and collected
between August and September 2014 using a web crawler [14]. Each listing had its own
p

webpage that contained a title (drug name and quantity), a description, product category,
ce

price, vendor identification number, the shipping country, shipping destinations and postage
options. Feedback from past customers on both product and vendor is available for
consultation (see Figure 1). Each vendor also had his own profile page, which contained the
Ac

registration date, a personal description, his public PGP key, a metric related to feedback (i.e.
good/bad reputation), and number of past transactions. Since our study aims at analysing the
Canadian illicit drug market on Darknet, only listings and vendors from Canada (i.e. where
Canada was mentioned as the “ships from” country) were considered. Thus, our dataset
contained 3685 listings and 198 vendor profiles. Data analysis and visualisation were
performed using RStudio v.0.99 and R v.3.1.2 [15].

Page 4 of 24
 t
ip
cr
us
an
M
d
te

Figure 1. Example of a listing with collected information in red

(screenshot of the cryptomarket Evolution)

p

In this paper, we first provide an overview of the Canadian drug market with information such
ce

as the types of illicit drugs on sale and the destination countries. We then investigate how the
online market is structured and organised through a combined analysis of vendor names and
Ac

their corresponding public PGP keys. This provides information on how vendors are
diversifying and replicating across cryptomarkets and therefore reveals vendor behaviour.

PGP is an encryption protocol that allows anyone to encrypt a message in a way that only the
recipient can decrypt the data [4]. This implies that participants share their respective public
PGP keys. The keys also serve as an important identity-verification tool between users [16].
Therefore, PGP keys analysis may confirm the membership of similar usernames to the same
distribution network and also reveal the existence of relationships between different
usernames.

Page 5 of 24
 3. Overview of the illicit drug trafficking

Canada was in the Top 5 of the most frequent shipping origins on Silk Road, with 6% of the
listings originating from Canada [3].

t
According to our dataset, Agora, Silk Road 2 and Evolution are the three main cryptomarkets

ip
in terms of the number of vendors active on them and products on sale, as illustrated by Table
1. None of these cryptomarkets are currently running, for various reasons [17, 18], illustrating

cr
the volatility of Dark Net markets [19].

us
Cryptomarkets Number of vendors Number of listings

Agora 57 1109

an
Evolution 44 691

Silk Road 2 36 748

M
Cloud-nine 27 395

Pandora 18 398

Hydra 8 79
d

Andromeda 5 149
te

Blue sky 3 116

Total 198 3685

p
ce

Table 1. Number of vendors and listings originating from Canada on the eight cryptomarkets
Ac

Marketplaces have very similar interfaces and product categories are typically self-selected by
vendors from an existing list (see Figure 2). Cryptomarkets use different categories and sub-
categories, which makes merging and comparison difficult. As we are interested on illicit
drugs only, we have thus decided to combine sub-categories to focus on the five following
types of illicit drugs: cannabis-, ecstasy-, opioids-, psychedelics- and stimulants-related
products. 2906 listings concern these categories of illicit drugs, which represent about 80% of
the total number of drug listings collected on the eight cryptomarkets (n = 3685).

Page 6 of 24
 t
ip
cr
us
an
M
Figure 2. Example of categories and drugs sub-categories on Evolution
d
te

Cannabis (mainly weed/marijuana but also resin, concentrates, etc.) is largely offered,
followed by products sold as Ecstasy, Psychedelics and Stimulants (see Table 2). Ecstasy,
p

MDA and MDMA are mainly offered under Ecstasy. Psychedelics comprise mostly
ce

substances such as LSD blotters/crystal, mushrooms, mescaline, dissociatives (mainly GHB

and ketamine) and Research Chemicals. Substances particularly mentioned in the category
Ac

Stimulants are cocaine, speed/methamphetamine and amphetamine; more rarely we find

ephedrine, methylone and MDVP. While heroin is principally present in the category Opioids,
fentanyl, hydromorphone and oxycodone are also offered.

Page 7 of 24
 Percentage
Category1 Number of listings
(n = 3685)
Cannabis 1334 36
Ecstasy 549 15
Psychedelics 428 12
Stimulants 410 11
Opioids 185 5

t
ip
Table 2. Number of listings and proportions per category of illicit drug

cr
Canadian vendors propose to ship illicit products mainly all over the world, as illustrated by

us
Table 3. Such information does not allow to infer the precise country the illicit drug may be
sent to but reveals the capability of vendors to handle worldwide shipping. They are not
reluctant to ship illicit drug across borders. A range of techniques used by sellers to make

an
interception of mails unlikely (e.g., vacuum sealing, “professional-looking” envelops with
typed destination addresses) may explain this [3, 11, 12]. Since some vendors also ask to be
paid at the time of the transaction, shipping drugs worldwide represents a relatively low risk
M
for them [3].

Canada, United-States or both of them are the only possible destinations of a few listings.
d

Such shipments are considered as domestics and have low chances to be seized by law
te

enforcement authorities, according to vendors’ statements on their profiles. Lastly, it is worth

noting the presence of listings not to be intended for Australia, since this country
p

implemented efficient methodologies to control importations of illicit products by post [20,

ce

21].
Ac

1
There were some additional categories under which drugs were sold on the investigated marketplaces. We have
decided not to present them in our tables, because the substances involved were not illegal: other (n = 143),
paraphernalia (n = 1), prescription (n = 197), steroids (n = 6), supplements (n = 1), undefined (n = 390) and
weight loss (n=3).

Page 8 of 24
 Percentage
Destination Number of listings
(n = 2906*)
Worldwide 1801 62
Domestic 388 13
Information not available 367 13
List of countries 311 11

t
Worldwide except Australia 17 <1

ip
Worldwide except Domestic 22 <1

cr
Table 3. Destinations of the shipments as mentioned by the vendors (* : number of listings concerning cannabis,
ecstasy, psychedelics, stimulants and opioids)

us
4. Structure of the trafficking

a. Analysing vendor names an

M
At first, an insight into the structure of distribution networks on Dark Net markets is carried
out through the analysis of vendor names (nicknames). Our preliminary hypothesis is to
d

consider that when usernames are different, even the case, we are in front of different sellers
te

(for instance, BCBUDKING and BCBUDking are considered different). Thus, 146 unique
names are identified among our 198 vendor profiles.
p

Most of the Canadian vendors manage less than ten listings each (69 vendors, representing
ce

47% of the total number of vendors, see Figure 3). This is probably because of the difficulty
of managing several listings at the same time (that may concern different types of illicit
drugs), since customers may order the same listing more than once. Therefore, each vendor
Ac

has to manage its supply and corresponding orders. However, some vendors offer a relatively
high number of products. For instance, five vendors possess more than 100 listings each. This
observation may reveal that they play a major role in the illicit drug trafficking. Moreover,
this raises questions on their supply chain management. They may source stock online or
outside to fulfil all the orders in timely fashion and get positive customer reviews to keep their
reputation [5].

Page 9 of 24
 t
ip
cr
us
an
Figure 3. Distribution of the number of listings for each vendor
M
A complementary way to evaluate which vendors may be important actors of the trafficking
d

consists in studying the structure of their illicit activity (i.e. their presence on one or several
te

markets). This analysis reveals that most of the vendors (114 vendors, about 80% of the total
number of vendors) focus their activity on only one market (Figure 4). Furthermore, their
p

presence on several cryptomarkets at the same time decreases when the number of
ce

cryptomarkets increases. Nevertheless, some vendors do operate on several markets, even

though a fee is due for each opened seller account [3]. They thus show a heightened visibility
on Dark Net markets compared to vendors focussing on the same cryptomarket. As any
Ac

businessman, they seek to increase profit and market share. Moreover, this result may be
explained by the volatility of this kind of marketplaces, which may close for many –
sometimes unexplained – reasons, either as a result of law enforcement operations, scams, etc.
[19]. Furthermore, trafficking via cryptomarkets is competitive and some sellers report on
their profiles that their accounts were hacked or that someone was using it without their
permission. Thus, a presence on several cryptomarkets may guarantee a continuous activity
on Dark Net markets, despite the problems certain sellers may be faced with. Consequently,
the practice of having multiple vendor accounts on several sites only really took hold in 2014,
after many marketplaces failed in the Fall of 2013 [7].

Page 10 of 24
Sellers with several accounts may be defined as important actors of drug trafficking since
vendors present on several cryptomarkets usually manage a high number of listings: the
number of listings of a vendor is correlated to the number of markets where he is present
(correlation of 0.6, p-value < 10-16). For instance, 17 vendors are present from 3 to 6 markets.
The number of listings each of them manages varies between 19 and 438. The minimum of

t
this range is relatively high according to Figure 3 (see above).

ip
cr
us
an
M
d
p te

Figure 4. Occurrence of vendor names and PGP keys on one or several cryptomarkets
ce

b. Analysing PGP keys

Ac

It is worth noting that the results obtained through the analysis of usernames are uncertain.
Indeed, presence of similar vendor names on different marketplaces does not mean they are
part of the same distribution network. Moreover, semantic or phonetic similarities between
virtual usernames may not be a relevant indicator of their use by the same
people/organisation. For instance, on Andromeda a vendor named Cannabisking says in his
profile:

“WE ARE NOT ASSOCIATED WITH CANNABISKING FROM CLOUD-NINE. WE ARE

CANNABISKING EVERYWHERE ELSE. ON CLOUD-NINE WE ARE CANNABISKINGS”.

Page 11 of 24
The analysis of the public PGP key associated with each vendor provides meaningful
information to address such issue. Since the key serves as an authentication tool between
users, this analysis objectifies the determination of the structure of the online market and
makes less uncertain the characterisation of distribution networks (see Material and methods).
Thus, a vendor mentions on Evolution that (quotations underlined by authors):

t
“Also I have hear someone was pretending to be me on Cannabis Road so always verify its

ip
really me with my PGP […] I NEVER CHANGE MY PGP FROM WHATEVER SITE IM ON”.

cr
Likewise, another one states:

”Formerly BCBUDking on Silk Road and MarijuanaMan39 on Atlantis, BCBUDKING on

us
BMR, Sheepmarket and TORMarket - Pandora - My PGP has not changed it is still me! ”.

Lastly, another vendor named TessellatedMDMA mentions on his profile:

an
”We are the same vendor as "Tessellated". This is the account we sell our MDMA on. You
can confirm we are the same because we are both using the same PGP key and this
M
message is signed with that key”.
d

The combined analysis of vendor names and public PGP keys shows that 89% of usernames
te

are associated with only one key and 83% of keys are associated with only one username.
This shows that vendors generally use one and only one public PGP key. Conversely, one key
p

is mostly associated with one and only one username. These results illustrate the individual
character of the association username - public PGP key. Most of the vendors are present on
ce

only one cryptomarket (see Figure 4), which may partly explains these high percentages.

However, a few keys are associated with usernames that are different (14% of PGP keys are
Ac

related to two different names and 2% to three different names). In other words, different
usernames/seller accounts are using the same public PGP key. Most of these seller accounts
exist on different cryptomarkets. In a few words, illicit drug trafficking on Darknet is more
structured than we would have thought through the analysis of vendor names.

Page 12 of 24
In particular, the analysis of public PGP keys shows that, for the most part, names used by a
same distribution network are quite similar, with names differing only from the case or
addition of a word (see the names associated with P2, P4, P5, P6 and P8 in Table 4). This
makes sense as the vendor sells commodity and relies on repeat custom, sometimes

t
interacting with the same people. The reputation and the name of a vendor are strongly

ip
connected. Once a seller has reached a good reputation, he will keep his username since it
vouches for the quality of the commodity he sells. For instance, a vendor named Straightbiz

cr
mentions in his profile:

us
“You can find me on Silk Road & Agora under the same vendor name I have great
feedbacks (perfect 5/5 so far which took me months of honest selling)“.

an
Thus, reputation and username play a major role regarding income. In the drugs cryptomarket
era, a good customer service and a good reputation via feedback are important assets to the
success of distribution networks [6].
M
Number of cryptomarkets where Vendor names associated with
PGP Key
the PGP key has been used the PGP Key
d

P1 5 Scaptain / tomorrowman
P2 4 goingpostal / GoingPostal / GoingPostalGroup
te

P3 4 BudBoss
P4 4 northernconnect / northernconnection
p

P5 3 BCBUDKING / BCBUDking
P6 2 Tessellated / TessellatedMDMA
ce

P7 2 BudBoss
P8 2 medicineman420 / medicine420
P9 2 skeletor / MeGrimlock
P10 1 goingpostal
Ac

Table 4. Examples of public PGP keys shared by one or several seller accounts

Public PGP keys also reveal relationships between vendors that were uncertain or not
suspected because of differences in their usernames (see especially P1 and P9 in Table 4).
These results confirm the information provided by vendors on their profiles. For instance, on
the profile of Scaptain (associated with P1) we read:

“[...] NEW OWNER--- TOMORROWMAN!! Purchased this account on april 17th. Identity can
be verified by my pgp”.

Page 13 of 24
Likewise, MeGrimlock and skeletor (P9) use exactly the same words in the description of
their profiles. Moreover, vendors associated with P4 refer to the same e-mail address in the
description of their profiles. Furthermore, BCBUDking and Tessellated/TessellatedMDMA
are also linked through their respective keys, confirming their statements on their profiles (see
above). Lastly, usernames associated with P2 (see Table 4) are mentioned as part of the

t
“Going Postal Group” and on the cryptomarket Pandora the vendor associated with P8 clearly

ip
says:

”Currently on AGORA, Blue Sky and Pandora(medicineman420) and SR2(medicine420)”.

cr
Some vendors, while using exactly the same name on the cryptomarkets they are active on, do

us
not necessarily use the same public PGP key (10% of vendors are associated with two keys
and 1% with three keys) (see a few examples in Table 5). This may be due to the period of
validity of PGP keys that has expired. Sellers therefore have to generate new ones.

an
Consequently, this shows the importance of combining the analysis of vendor names and PGP
keys to fully highlight distribution networks.
M
Number of cryptomarkets Number of PGP keys
Vendor names
where the same name is used used by the vendor
d

BudBoss 6 2
tomorrowman 5 2
te

CanadianExpress 4 2
MeGrimlock 3 2
goingpostal 2 2
p

medicineman420 2 2
northernconnection 3 1
ce

GoingPostal 2 1
BCBUDking 1 1
GoingPostalGroup 1 1
Ac

Table 5. Examples of vendor names associated with one or several PGP keys

Page 14 of 24
 5. Organisation of the trafficking

According to the results obtained through the combined analysis of vendor names and PGP
keys, we may summarise the methodology to reveal relationships between vendors as follows
(see Figure 5). The methodology we present has been elaborated through the analysis of a

t
limited dataset and should be confirmed using a larger one.

ip
As aforementioned, usernames and reputation are tightly connected and usernames play a
major role in the business strategy of sellers. Identical or similar nicknames may therefore

cr
reveal the membership to the same distribution network. Thus, studying the structure of
distribution networks through the analysis of usernames is a good starting point. By “similar”

us
we mean that usernames share slight differences (e.g. the case or the only addition of a word).
Nevertheless, it is worth noting that identical/similar usernames on different cryptomarkets

an
might refer to different distribution networks. Therefore, the analysis of PGP keys should be
performed to confirm or refute the hypothesis that vendors are part of the same organisation.
While a similarity of the PGP keys would confirm such hypothesis, a difference between PGP
M
keys may be explained by at least two reasons and thus would not necessarily mean that
vendors are not related. First, the use of a specific PGP key may depend on the cryptomarket
the distribution network is active on. Secondly, the validity period of the PGP key previously
d

used by a vendor may have expired, implying the calculation of a new one. In cases when we
te

have doubts in the highlighted connections (e.g. similar usernames but different PGP keys),
information provided by vendors on their profiles could help us conclude on the membership
p

to the same organisation (i.e. when sellers clearly mention they are present on different
ce

cryptomarkets using specific usernames). The possibility of such an analysis of vendor

profiles obviously depends of the amount of data. In conclusion, when names are identical or
similar, we may hypothesise that seller accounts are part of the same distribution network, the
Ac

key being identical (see P2, P4 to P6, P8, Table 4) or different (see P3 and P7 as well as P2
and P10, Table 4).
Then, we could analyse PGP keys to reveal connections between different usernames (see
Figure 5). When seller accounts share important name differences but are associated with the
same key, we may infer that they are part of the same distribution network (see P1 and P9,
Table 4), since keys serve as an important identity-verification tool between users. Lastly,
differences between both names and keys may be considered as significant and the hypothesis
about membership to the same organisation would be rejected.

Page 15 of 24
 t
ip
cr
us
an
M
d
p te
ce
Ac

Figure 5. Flow chart of the methodology to highlight distribution networks through the combined analysis of
usernames and PGP keys

Page 16 of 24
Figure 6 illustrates the proportions of illicit drugs certain vendors offer for sale. They are
linked through their usernames and/or public PGP keys using the methodology explained
above (see Table 4, Table 5 and Figure 5). This analysis gives an insight into vendors’
behaviour. It shows that some vendors are highly specialised in selling one category of illicit
drug whatever the cryptomarket where they sell (see BudBoss and

t
northernconnect/northernconnection, which manage 478 and 73 listings, respectively). This

ip
observation may indicate that they have access to a steady long-term supply of cannabis- and
ecstasy- related products, respectively. Even if cryptomarkets use different categories and

cr
sub-categories to organise listings, making comparison difficult and uncertain, a difference of
vendor’s behaviour according to the marketplace is also revealed by such analysis. Straightbiz

us
(25 listings) only offers two types of illicit drugs. Nevertheless, he focuses on selling
psychedelics on Agora and stimulants on Evolution. The distribution networks respectively

an
composed of Scaptain/tomorrowman (who share the same PGP key and manage 107 listings)
and goingpostal/GoingPostal/GoingPostalGroup (294 listings) offer a wide range of illicit
drugs and are present on several marketplaces (on Evolution, GoingPostal and
M
GoingPostalGroup are associated with the same public PGP key). Therefore, this raises
questions on their supply chain management and they probably have access to many different
sources. Scaptain/tomorrowman do not offer all their products on the markets they are active
d

on (for instance, opioids on Agora and Hydra; psychedelics on Hydra and Pandora). Lastly,
te

differences are also observed when several sellers, whom are part of the same distribution
network, are active on the same cryptomarket. On Evolution, GoingPostalGroup offers
p

opioids, psychedelics and cannabis while another entity of the same distribution network
ce

mainly focuses on selling ecstasy and stimulants.

Ac

Page 17 of 24
 t
ip
cr
us
an
M
Figure 6. Proportions, expressed as percentages, of the types of illicit drugs offered for sale by some Canadian
vendors
d
te

A study of illicit drug quantities and prices offered by sellers would provide meaningful
information on distribution networks. For instance, we may hypothesise on the type of
p

purchasers targeted by sellers (i.e. consumers or dealers) as well as the role of sellers in the
distribution chain. Moreover, sales volumes may be estimated for each seller [6, 7, 22]. This
ce

would be a relevant analysis to corroborate the importance of specific vendors in the

Canadian illicit drug market.
Ac

Page 18 of 24
We are on the same wavelength as authors who call for alternative strategies with regard to
intervention policies against anonymous marketplaces [5-7, 22]. Indeed, the actual strategy –
both expensive and time and resources consuming – that consists in taking down
cryptomarkets does not seem to be efficient to disrupt trafficking on Dark Net markets [7].
Instead, the knowledge gathered through the analysis of digital data should guide the set-up of

t
ip
efficient strategies in the physical world. From a law enforcement perspective, interventions
should be targeted to the main actors of illicit drug trafficking. Certain sellers have a well-

cr
organised structure according to the number of listings they manage and/or the number of
marketplaces they are active on and/or the types of illicit drug they offer for sale. Focussing

us
efforts on these important actors may disturb the economy and the trafficking on Dark Net
markets, while making sure investigation and enforcement resources are deployed efficiently.
Moreover, the physical and chemical profiling of products purchased on cryptomarkets and

an
sent by post could provide objective results that will improve knowledge of Dark Net markets
(country of origin and quality of products, distribution strategies, etc.). Furthermore, it may
M
corroborate the structure of the distribution networks highlighted through the analysis of
digital data. Lastly, it may provide invaluable information to effectively disrupt illicit drug
trafficking. For instance, the profiling of packages, containing illicit drugs intended for
d

Australia, helped to reveal and dismantle a distribution network originating from Canada,
te

thanks to a collaboration between the Australian Federal Police and the Royal Canadian
Mounted Police [21]. Thus, the investigation of illicit trade on Dark Net markets would
p

benefit from a combined use and interpretation of digital and physical data within a single
collaborative intelligence model [23]. The integration of such data to better understand a same
ce

crime problem was carried out to decipher the distribution market of GBL, a chemical
precursor of GHB, and should serve as an example [24].
Ac

Page 19 of 24
 6. Conclusion

This study investigates illicit drug trafficking from a Canadian perspective through the
analysis of 3685 listings and 198 vendor profiles collected during two months on eight
cryptomarkets.

t
ip
Canadian vendors offer a wide range of products and can handle worldwide shipping. The
results reveal the presence of key actors of the Canadian illicit drug trafficking. They are

cr
characterised by the number of listings they manage, the diversity in the types of products
they offer for sale and the number of cryptomarkets they are active on. The combined analysis

us
of vendor names and public PGP keys gives an insight into the structure of the trafficking and
reveals the existence of distribution networks. It shows that vendors may be active on several

an
cryptomarkets and may use similar or different usernames. This study also addresses vendors’
behaviour. The results illustrate that some vendors are highly specialised in selling one
category of illicit drug while others offer a wide range of illicit drugs. Moreover, sellers are
M
diversifying depending on the marketplace where they sell. In a few words, distribution
networks exist on Dark Net markets and are well structured and organised to ensure an
d
efficient trafficking. They can manage different seller accounts, can be present on several
cryptomarkets and have a supply chain management making possible the sale of several types
te

of illicit drugs.
p

This research demonstrates that data available online help to better understand illicit drug
trafficking on the Darknet. Moreover, they enable to highlight the main actors and to draw
ce

hypotheses on the structure and distribution of the online market. Thus, knowledge gathered
through the analysis of this data is invaluable to design efficient policy for monitoring or
Ac

repressive purposes. Indeed, the seizures of cryptomarkets along with the arrests of
administrators by law enforcement authorities did not prove to be an efficient approach to
disrupt trafficking on the Darknet and to disturb the development of this phenomenon.

Yet, these data are virtual and uncertain, making the study of this criminal evolution difficult.
The forensic profiling of mails and the illicit drugs they contain may provide a better
understanding of all the aspects of this trafficking.

As a conclusion, the investigation of illicit trade on Dark Net markets would benefit from a
combined use and interpretation of digital and physical data within a single collaborative

Page 20 of 24
intelligence model.

t
ip
cr
us
an
M
d
p te
ce
Ac

Page 21 of 24
References

1. Martin, J., Lost on the Silk Road: Online drug distribution and the ‘cryptomarket’.
Criminology and Criminal Justice, 2014. 14(3): p. 351-367.
2. Barratt, M.J., Silk Road : eBay for Drugs. Addiction, 2012. 107(3): p. 683-683.
3. Christin, N., Traveling the Silk Road: A measurement analysis of a large anonymous

t
online marketplace. Technical Reports, 2012. CMU-CyLab-12-018.

ip
4. Zimmermann, P., The Official PGP User's Guide, ed. MIT Press Cambridge. 1995,
MA, USA.

cr
5. Van Hout, M.C. and T. Bingham, Responsible vendors, intelligent consumers: Silk
Road, the online revolution in drug trading. International Journal of Drug Policy,
2014. 25(2): p. 183-189.

us
6. Aldridge, J. and D. Décary-Hétu, Not an 'Ebay for Drugs': The Cryptomarket 'Silk
Road' as a Paradigm Shifting Criminal Innovation. Social Science Research Network,
2014.
7. Soska, K. and N. Christin. Measuring the Longitudinal Evolution of the Online

an
Anonymous Marketplace Ecosystem. in Proceedings of the 22nd USENIX Security
Symposium (USENIX Security 2015). 2015. Washington, DC.
8. Burns, L., A. Roxburgh, R. Bruno, and J. Van Buskirk, Monitoring drug markets in
the Internet age and the evolution of drug monitoring systems in Australia. Drug
M
Testing and Analysis, 2014. 6(7-8): p. 840-845.
9. Buxton, J. and T. Bingham, The Rise and Challenge of Dark Net Drug Markets.
Policy Brief 7, 2015.
10. Phelps, A. and A. Watt, I shop online – recreationally! Internet anonymity and Silk
d

Road enabling drug use in Australia. Digital Investigation, 2014. 11(4): p. 261-272.
11. Van Hout, M.C. and T. Bingham, ‘Surfing the Silk Road’: A study of users’
te

experiences. International Journal of Drug Policy, 2013. 24(6): p. 524-529.

12. Van Hout, M.C. and T. Bingham, ‘Silk Road’, the virtual drug marketplace: A single
case study of user experiences. International Journal of Drug Policy, 2013. 24(5): p.
p

385-391.
13. Barratt, M.J., J.A. Ferris, and A.R. Winstock, Use of Silk Road, the online drug
ce

marketplace, in the United Kingdom, Australia and the United States. Addiction,
2014. 109(5): p. 774-783.
14. Décary-Hétu, D. and J. Aldridge, DATACRYPTO: the Dark Net Crawler And Scraper.
http://www.daviddh.com, 2013.
Ac

15. R-Core-Team, R: A language and environment for statistical computing, in R

Foundation for Statistical Computing. 2014: Vienna, Austria.
16. Afilipoaie, A. and P. Shortis, From Dealer to Doorstep – How Drugs Are Sold On the
Dark Net, in Global Drug Policy Observatory Situation Analysis. June 2015: Swansea
University.
17. DarkNetStats. [cited 2015 October]; Available from: https://dnstats.net/.
18. U.S. ATTORNEY’S OFFICE. Dozens Of Online “Dark Markets” Seized Pursuant To
Forfeiture Complaint Filed In Manhattan Federal Court In Conjunction With The
Arrest Of The Operator Of Silk Road 2.0. 2014 [cited 2015 October]; Available from:
http://www.justice.gov/usao-sdny/pr/dozens-online-dark-markets-seized-pursuant-
forfeiture-complaint-filed-manhattan-federal.
19. Van Buskirk, J., A. Roxburgh, R. Bruno, and L. Burns, Drugs and the Internet. 2014:
Sydney: National Drug and Alcohol Research Centre.

Page 22 of 24
20. Parkinson, A., Illicit Material in International Mail: The Application of Forensic
Intelligence, in ANZFSS International Symposium. 2014: Adelaide.
21. Horne, N., K. Edmondson, M. Harrison, and B. Scott, The applied use of forensic
intelligence for community and organised crime. Australian Journal of Forensic
Sciences, 2015. 47(1): p. 72-82.
22. Mireault, C., V. Ouellete, J. Aldridge, D. Décary-Hétu, F. Crispino, and J. Broséus,
Potentiel criminalistique de l'étude de la distribution et la consommation de drogues
au Canada à partir des données collectées sur les cryptomarchés. Canadian Society of

t
Forensic Science Journal, 2015. Accepted for publication.

ip
23. Ribaux, O., S.J. Walsh, and P. Margot, The contribution of forensic science to crime
analysis and investigation: Forensic intelligence. Forensic Science International,
2006. 156(2-3): p. 171-181.

cr
24. Pazos, D., P. Giannasi, Q. Rossy, and P. Esseiva, Combining Internet monitoring
processes, packaging and isotopic analyses to determine the market structure:
Example of Gamma Butyrolactone. Forensic Science International, 2013. 230(1-3): p.

us
29-36.

an
M
d
p te
ce
Ac

Page 23 of 24
Highlights

- Study of illicit drug trafficking using data collected on 8 cryptomarkets

- Knowledge on the structure and organisation of distribution networks

- Use of an approach combining the analysis of vendor names and PGP keys

t
- Results reveal the presence of key actors of the Canadian illicit drug trafficking

ip
cr
us
an
M
d
p te
ce
Ac

Page 24 of 24