Study suggests most “dark web” users are not engaging in illicit activities

Various parts of the internet have earned stereotypes about how people use them. Some of these are warranted, and some are mere caricatures. Perhaps no section of the internet is less pleased with its stereotype than the Tor Network, which must contend with being blamed for every crime that originates on the internet.

However, a new study shows that the dark web isn’t quite as dark as you might think. A group of researchers led by Eric Jardine of Virginia Tech suggest that only 6.7 percent of global Tor users are going to sites for what are likely malicious reasons.

For those who don’t spend all of their time on the internet, a few of these terms might be new to you. We’ll go over them first before we continue. If you do know all of these terms, you can skip ahead to the next section.

Surface Web: The regular internet that you can find with a search engine. You’re on it right now; unless these articles are shared in places we don’t know about.

Deep Web: The part of the internet not indexed by search engines. This includes things like your email inbox; you can’t get there from Google or Bing, but instead have to enter a password to find it from another page. You’ve probably visited the deep web today, too.

Dark Web: A subsection of the deep web that requires special software to access. While not everything there is bad, there are social media sites, email services, hidden forums, and even puzzle games down there; this is also where you would find the places for illegal markets and other, extremely nefarious, things.

Tor: A kind of software that allows users to browse the internet in near-total anonymity. It does this by encrypting connection data and scrambling the route a computer takes to connect to a site, thus making it difficult, but not impossible, to find who is using a particular website. The potential value of this to criminals should be evident to you.

While it often gets bad press for how it can be used for illicit purposes, it should be said it was created and used by the United States government for often banal purposes. The leaders of the Tor Project often remind the public that “normal people” use Tor for everyday internet activities as well.

As a personal example, I once used it to get around the Great Firewall of China when I wanted to get to the regular, uncensored internet.

The study observed the final destination of a random selection of Tor users to determine if they went to surface websites or more hidden areas of the internet after connecting to the Tor network. This was done by monitoring the data from entry points in the Tor network, which would allow an observer to where someone was going, but not who.

Those going to surface websites were assumed just to be using Tor for anonymity and security, while those going into the dark web were presumed more likely to be using it for illegal reasons.

Despite the popular conception of Tor as a tool for criminals looking to cover their tracks, only 6.7 percent of these users went to sites defined as the dark web, which were themselves not necessarily devoted to illegal activity.

The results were further broken down by country, which revealed another layer of information. The authors noted that in countries deemed “not free” by Freedom House, the rate of possible malicious use goes down to 4.8 percent. In countries considered free, the percentage nearly doubles to 7.8 percent.

The dark web might be a little lighter than previously suggested. While it is true that there is some horrible stuff down there, this study suggests the people getting to it using the Tor network are mostly using it for legal, and perhaps even banal, purposes. This interpretation is additionally supported by the difference in usage across countries judged free and not free. In those countries with censorship, where a variety of tools must be used to get to sites like Facebook or Wikipedia, the percentage of users going towards locations on the dark web was smaller.

The authors conclude:

“The Tor anonymity network can be used for both licit and illicit purposes. Our results provide a clear, if probabilistic, estimation of the extent to which users of Tor engage in either form of activity. Generally, users of Tor in politically ‘free’ countries are significantly more likely to be using the network in likely illicit ways.”

Additionally, they mention that the Tor network’s infrastructure is predominately in free countries, which then see higher rates of its use to reach places that could advance illegal activities. This find may be of interest to policymakers looking to balance the promotion of autonomy and the freedom of information with the goal of preventing crime.

It has been suggested that the internet is the first thing humanity ever created that we don’t fully understand. If that is true, it should surprise no one that there are objections to the methods used to study it.

The executive director of the Tor Project, Isabela Bagueros, explained their objection to the study’s methodology and assumptions to Ars Technica:

“The authors of this research paper have chosen to categorize all .onion sites and all traffic to these sites as “illicit” and all traffic on the “Clear Web” as ‘licit.’

This assumption is flawed. Many popular websites, tools, and services use onion services to offer privacy and censorship-circumvention benefits to their users. For example, Facebook offers an onion service. Global news organizations, including The New York Times, BBC, Deutsche Welle, Mada Masr, and Buzzfeed, offer onion services.

Whistleblowing platforms, filesharing tools, messaging apps, VPNs, browsers, email services, and free software projects also use onion services to offer privacy protections to their users, including Riseup, OnionShare, SecureDrop, GlobaLeaks, ProtonMail, Debian, Mullvad VPN, Ricochet Refresh, Briar, and Qubes OS……

Writing off traffic to these widely-used sites and services as “illicit” is a generalization that demonizes people and organizations who choose technology that allows them to protect their privacy and circumvent censorship. In a world of increasing surveillance capitalism and internet censorship, online privacy is necessary for many of us to exercise our human rights to freely access information, share our ideas, and communicate with one another. Incorrectly identifying all onion service traffic as “illicit” harms the fight to protect encryption and benefits the powers that be that are trying to weaken or entirely outlaw strong privacy technology.”

The critique here is justified; there are legitimate websites hidden behind layers of security which were deemed “illicit” by this study’s methods. Many people are just trying to protect their anonymity when using them. However, the study’s authors based their assumption on previous studies that demonstrate that these hidden sites are used for illegal activities at a higher rate than other parts of the internet.

Until a more rigorous and ethically ambiguous method of determining what people using the network are doing on these dark websites is utilized, the findings of studies like this will be general and based on broad assumptions.

Despite all of this, we can take a few things from this study: most people using Tor to explore the internet aren’t using it for evil, those using it in places with limited freedom of information are even less likely to use it for such purposes, and external factors can have significant impacts on how people use a tool such as the internet.