Drugs and the darknet Perspectives for enforcement, research and policyDrugs and the darknet Perspectives for enforcement, research and policy 2017Legal notice This publication of the European Monitoring Centre for Drugs and Drug Addiction EMCDDA and Europol is protected by copyright. Neither the EMCDDA, Europol nor any person acting on behalf of either the EMCDDA or Europol is responsible for the use that might be made of the following ination. More ination on the European Union is available on the internet http//europa.eu. Luxembourg Publications Office of the European Union, 2017 Print ISBN 978-92-9497-241-5 doi10.2810/834620 TD-04-17-834-EN-C PDF ISBN 978-92-9497-240-8 doi10.2810/783427 TD-04-17-834-EN-N Reproduction is authorised provided the source is acknowledged. European Monitoring Centre for Drugs and Drug Addiction, 2017 Praa Europa 1, Cais do Sodr, 1249–289 Lisbon, Portugal Tel. 351 211210200 infoemcdda.europa.eu | www.emcdda.europa.eu | Europol, 2017 The Hague, the Netherlands File No EDOC 918590 Publications https//www.europol.europa.eu/publications/ Credits for cover photos from left to right iStockphoto photos 1, 2 and 4; IDC 2.0 Market photo 3. Recommended citation European Monitoring Centre for Drugs and Drug Addiction and Europol 2017, Drugs and the darknet Perspectives for enforcement, research and policy, EMCDDA–Europol Joint publications, Publications Office of the European Union, Luxembourg. Contents5 IForeword7 IAcknowledgements9 Icutive summary15 ICHAPTER 1Key concepts31 ICHAPTER 2Global phenomenon EU focus51 ICHAPTER 3Law enforcement perspectives67 ICHAPTER 4Conclusions and recommendations73 IReferences77 IGlossary81 IAnnex 183 IAnnex 285 IAbbreviations5 Foreword Illicit trade on darknet markets is one manifestation of the increasingly complex nature of transnational organised crime in the European Union EU. Darknet markets, also known as cryptomarkets, provide a largely anonymous plat for trading in illicit goods and services. Drugs are estimated to account for around two thirds of darknet market activity. Almost any type of drug is accessible to buyers with basic technical understanding within a few clicks, including new psychoactive substances. This development poses a significant threat to the health and security of citizens and communities across the EU. This report summarises our current understanding of the functioning of darknet markets and outlines potential countermeasures for policymakers and law enforcement professionals engaged in the fight against this phenomenon. Our point of departure is a review of the threat we face in this area, bringing together the latest findings from international research, fresh empirical data, operational ination and intelligence. This analysis provides us with the opportunity to identify priority areas for targeted actions, and leads us to the conclusion that Europe needs greater investment and continuous innovation, if we are to keep pace with the challenges we face in this area. For this report, the EMCDDA and Europol have combined the latest available data and outlined law enforcement strategies to reduce criminal opportunities in the darknet ecosystem. We present a multidisciplinary analysis of how darknet markets function and how they relate to criminal behaviour. We explore the implications of this for drug control policies, research and monitoring approaches, and law enforcement activities. We would like to particularly acknowledge the from experts in academia and law enforcement officials, without which this report would not have been possible. This analysis is timely, following the recent takedown, in July 2017, of Alphabay and Hansa, two of the largest darknet markets. We can learn from this achievement, while at the same time recognising that those involved in the online trade in drugs are likely to be quick to adapt and develop new strategies and business models to reduce the risk of detection. This means that on-going research, monitoring and surveillance will remain critically important for both agencies. We believe that the new insights provided by this joint EMCDDA–Europol analysis will make an important contribution to ining and preparing Europe’s response to the growing threat posed by darknet drug sales. The online trade in illicit goods and services has been recognised as a key threat to the safety of EU citizens in the SOCTA 2017 and is being tackled as part of the EU’s coordinated response to serious and organised crime – the EU Policy Cycle for organised and serious international crime from 2018 to 2021. Our analysis is necessarily forward-looking, as the challenges we face in this area are constantly evolving. It demonstrates the added value of bringing together the analytical 6 Drugs and the darknet Perspectives for enforcement, research and policy expertise of both agencies, allowing us to approach the topic with scientific rigour and the ined perspective that comes from operational experience. Our successful partnership also underlines, in our view, one of the key messages running throughout this report European-level cooperation and coordination are likely to be critically important for an effective response in this area. Alexis Goosdeel Rob Wainwright Director, EMCDDA cutive Director, Europol7 Acknowledgements This joint EMCDDA–Europol publication is based on a synthesis of ination from a range of sources. The EMCDDA and Europol would like to acknowledge the work carried out by Nicolas Christin Carnegie Mellon University, USA, which has ined parts of this publication. This work was made possible by original funding from the United States Department of Homeland Security Science and Technology Directorate, Cyber Security Division. We would like to highlight the contributions of the many partners, in EU Member States and outside the EU, who have contributed data to this report and continue to work closely with the EMCDDA and Europol to counter the trade in illicit drugs online. We would particularly like to thank the European Commission for its continued support. We would also to like to acknowledge the insightful we have received from experts and members of the EMCDDA Scientific Committee, who have made an invaluable contribution to this analysis. A full list of acknowledgements can be found in Annex 2 of this report.9 cutive summary Report background and context Developments in ination technology are transing many aspects of modern life and this includes the way that illicit goods are traded. This report focuses on online anonymous markets or ‘cryptomarkets’. Such markets are a relatively recent development that enables sellers and buyers to transact online without disclosing any personal details, hence creating a considerable degree of anonymity. This development has led to the proliferation of the trade in illicit goods online, and it is now recognised as a growth area for the activities of organised crime in the European Union EU that is undermining conventional law enforcement approaches. It is estimated that about two thirds of the offers on darknet markets are drug related, with the remainder related to a range of other illicit goods and services. However, any analysis has to be made with caution because of not only the difficulties inherent in monitoring developments but also simply the pace of change in this extremely dynamic area. Europol’s 2017 European Union Serious and Organised Crime Threat Assessment EU SOCTA identified the online trade in illicit goods and services as one of the engines of organised crime. An improved intelligence picture and a coordinated law enforcement approach across the EU in addressing criminality on the darknet are now at the heart of the EU Policy Cycle for organised and serious international crime 2018-2021. This has been reflected in law enforcement approaches, as illustrated by two recent significant coordinated international law enforcement operations on two of the largest darknet markets. Structure of the report This report has three main chapters. The first reviews the key concepts necessary to understand the development of darknet markets. The second chapter highlights the growing importance of this area for drug sales within the EU through the presentation of an analysis of market activity. This includes an analysis of drug supply on global darknet markets 2011-2015. The analysis focuses on drug supply originating from the EU, and includes an assessment of the relative significance of EU suppliers in both the global darknet drug trade and the overall European retail drug market. This second chapter then also considers non-English language darknet markets for specific European countries, before providing an analysis focused on AlphaBay one of the largest markets to have existed thus far from its original emergence to its recent closure 2015-2017. In the third chapter, the darknet phenomenon is reviewed from a law-enforcement perspective. Not only are the challenges for law enforcement elaborated, but examples of successful recent actions are also provided, which are useful for ining discussions on future interventions in this area. Taken together, this analysis provides a comprehensive but accessible policy-orientated review, intended to facilitate discussions at EU level on how to respond to the growth of darknet drug markets. This is accompanied by the identification of key priority areas that require attention and where activities are likely to have most impact. When interpreting the findings from any analysis of this topic, the considerable difficulties of collecting data on an area of activity that is, by definition, designed to remain hidden needs to be borne in mind. Notwithstanding this, some key findings and recommendations for action emerge from this report.10 Drugs and the darknet Perspectives for enforcement, research and policy Understanding the threat All markets, including illicit ones, function to facilitate the exchange of goods or services. Therefore, markets will prosper if they confer advantages to both buyers and sellers. Considerations for consumers can include the level of choice, ease of availability, convenience, perceived quality and price. For illicit drug markets, the level of risk is also an important factor, as vendors and consumers will be attracted to markets that are associated with relatively low risks of detection, experiencing market-related violence and ‘rip offs’. Darknet markets provide a convenient sales channel to technologically knowledgeable customers. This approach to drug sales appears to have considerable potential to grow. It is possible that darknet markets will disrupt traditional drug markets in the same way as has been seen in some areas for legitimate commodities. This is especially likely to occur if darknet markets become more accessible to new consumers and are viewed as a relatively low-risk way of acquiring drugs. Importantly, such changes will not occur in isolation but will be influenced by other developments in the illicit drug market. These may include the potential use of other technologies and plats; the overall impact of law enforcement and regulatory efforts; and broader social and policy developments which may shape the supply of and demand for drugs in more general ways. The need to keep pace with changes in this area is illustrated by the fact that, recently, evidence has emerged of the use of instant messaging and social media applications using GPS global positioning system technologies for drug distribution in some European cities. This underlines the need for the systematic monitoring and assessment of the anonymous online ecosystem, conducted in the context of understanding the operation of the illicit drug market overall. A number of potential threats can be identified that may increase the challenges of responding to online-facilitated drug transactions. These include the development of decentralised software and new encryption technology; new s of parcel delivery and collection systems; the greater integration of darknet markets with existing local drug markets; nationally based darknet markets; and the growing use of GPS-enabled apps for distribution at the local level. Key findings ƒ ƒ The trade in illicit drugs on darknet markets is a dynamic area subject to rapid change as marketplaces appear and disappear. Overall, the importance of this area seems to be expanding and it now affects most EU Member States in some way. ƒ ƒ When compared with current estimates of the annual retail value of the overall EU drug market, sales volumes on darknet markets are currently modest, but are significant and have the potential to grow. ƒ ƒ EU-based suppliers are important players in the darknet ecosystem. In the 2011-2015 period, they accounted for around 46 of all drug sales in terms of revenue on the darknet markets analysed. ƒ ƒ Between 2015 and 2017 on AlphaBay, which, at the time, was the largest darknet marketplace, EU-based suppliers accounted for around 28 of all drug sales. ƒ ƒ In both study periods Germany, the Netherlands and the United Kingdom were the most important countries with respect to EU-based darknet drug supply. Stimulant drugs represented the majority of all European drug sales.11 cutive summary ƒ ƒ New psychoactive substances NPS are less commonly sold than illicit drugs on the darknet market, probably reflecting the significant role played by surface web sales in this sector. The United Kingdom was the most frequently noted origin of NPS sales, which may reflect both patterns of demand and recent changes in legislation. ƒ ƒ The rationale underpinning darknet markets suggests that they will be most commonly used for mid- or low-volume market sales or sales directly to consumers. This is supported by the data presented here. Large-volume sales wholesale are relatively uncommon. ƒ ƒ The highest market activity in terms of number of transactions was observed at the retail level, and retail sales values were greatest for cannabis and cocaine. The picture was different for MDMA and opioids, however, where mid-level sales represented a relatively large proportion of all sales although still less in absolute terms, and the value of the mid-level sales was greater than the value of the retail sales. This suggests that darknet markets may play a different role in the supply chain for these substances. ƒ ƒ Law enforcement interventions in the of darknet market takedowns disrupt darknet markets, although the overall ecosystem appears to be fairly resilient with new markets quickly becoming established. ƒ ƒ Significant knowledge gaps exist with respect to the role of traditional organised crime groups OCGs in darknet markets. In particular, the extent to which OCGs are involved in the production, traffic