Crawling the dark web: the economics of online drug markets

In August, Nicholas Christin and Kyle Soska of Carnegie Mellon published an extensive paper on the ecosystem behind cryptomarkets - like the now closed Silk Road 1 and its successors. By webscraping 35 of the most important markets they were able to estimate that cryptomarkets generate a turnover between $300,000 and $500,000 per day, and are growing fast. There are fears that the proliferation of online, anonymous drug markets might encourage more direct-to-consumer trading. At the moment, the Crime Survey for England and Wales show that only 22% of people in the UK buy their drugs from a dealer. Is this likely to rise as online markets become more common?  

Previously, Judith Aldridge and David Décary-Hétu (of the University of Manchester and the University of Montreal respectively) created software that crawled the original Silk Road website, downloading all drugs listings in September 2013. High price and large quantity sales generated between 31-45% of drug revenue, making sales to customers that may include drug dealers a key source of revenue. So it looks like online markets are used for business-to-business and not just consumer sales. 

Following the closure of Silk Road 1, new marketplaces have opened. At the start of 2015 Judith and David, supported by a Nesta grant, led the development of improved software (DATACRYPTO) that pulled data on transactions, vendors, price and source countries of shipments for a subset of these markets. Like the original market, the new generation of cryptomarkets offer a large variety of different drugs; cannabis, ecstasy and stimulants were most popular. Prescription drugs, psychedelics and opioids were also widely available, as well as a variety of non-drug products. Judith and David focused their analysis on the drug component of these markets. In this blogpost we share some of their results.  

Though the data collected in this trial run wasn't cleaned or analysed to the standards of the Silk Road 1 project, conclusions from this work show similar patterns to the first analysis. This suggests that the nature of transactions through cryptomarkets has not changed much in the last two years.

Who’s buying: resale or private use?

DATACRYPTO crawled five different cryptomarkets during the first months of 2015: Evolution, Nucleus, Abraxas, BlackBank and Silkkitien. The sample of scraped markets only included those markets that kept a complete record of user feedbacks on individual listings. That is why a large market like Agora was left out of the analysis, as its feedback history does not go back more than twenty ratings. Having complete information on feedbacks is necessary to be able to approximate sales volumes and quantities for individual sellers later on.

Cryptomarkets are often described as marketplaces similar to eBay, where vendors sell direct to drug-using customers, thereby serving the retail end of the drugs market. David and Judith's analysis shows that the vast majority of transactions involved small quantities of drugs, often only one or few doses. This strongly suggests that many purchases were made directly by consumers. To approximate sales volumes, listings in each drug category were divided in five different quintiles based on their price level. These quintiles - groups of 20% - could then be compared based on the average number of sales each listing in the different quintiles generated over 2014.

David and Judith's analysis shows that the vast majority of transactions involved small quantities of drugs, often only one or few doses. 

Because official statistics on completed transactions per listing are not available, David and Judith used the number of feedbacks on individual listings as an indicator of total sales volumes. Feedbacks serve as a reliable proxy, as leaving reviews is an important part of the culture in crypto-communities. To illustrate: an average ecstasy listing in the lowest-priced quintile of listings (transactions under $40) saw 86 annual sales, listings in the top quintile (priced between $836 and $22,528) saw only five.  

This similarity with regular direct-to-consumer online marketplaces falls apart however, when we instead look at the total value generated per price-quintile. The largest share of suppliers’ revenue comes from a small number of the highest quantity transactions. Sales in the top 20% price range for cannabis made $11.8 million in total annual revenue. The bottom 20% only added $880,000 to suppliers’ total income.These findings paint a picture of marketplaces also very much reliant on business-to-business sales, as transactions of large quantities of drugs are very likely to have included customers who are drug dealers sourcing stock for resale.

These findings paint a picture of marketplaces also very much reliant on business-to-business sales, as transactions of large quantities of drugs are very likely to have included customers who are drug dealers sourcing stock for resale.

This trend is consistent across all the different categories of drugs offered on cryptomarkets, especially for the types of drugs that are decriminalised or legal in some countries. For both cannabis and prescription drugs the top quintile makes up 46% of annual revenue (versus for example ‘only’ 26% of stimulants) on the market. We imagine this could mean that suppliers and dealers are more willing to take risks with shipping large quantities of these generally cheaper and less enforced types of drugs.

Another explanation might be that drugs that carry harsher penalties, such as heroin, are simply not captured in the results. Crawled listings with missing key values such as country of origin or product categories were filtered out of this analysis. Reading Judith and David’s paper, we speculate whether suppliers deliberately conceal identifiable information for these types of drugs, listing them under code-names only more seasoned buyers, particularly dealers, would pick up on. Indeed, DATACRYPTO only found 67 listings for opioids (versus 4,031 for cannabis), with 71% of market share coming from the top quintile.

On the vendor side, we also see the importance of the larger operators: Christin and Soska’s analysis found that the top one percent vendors account for 51.5% of total sales volumes. Though their efforts are not focused on just the largest transactions, vendors usually sell at multiple price points. So vendors selling large quantity listings also sell in small quantities. But not all small quantity vendors also sell in large quantities.

A new kind of open, networked global criminal market?

Organised crime is traditionally limited in geographical scope (Reuter, 1983). It is easier for a crime group to control its network when its activities stay in close physical proximity. Cryptomarkets, and the internet more generally, have allowed organised crime to expand their efforts globally. Indeed, Judith and David found that 78% of suppliers in the dataset were willing to ship their products abroad (with ‘abroad’ broadly defined as anything ranging from neighbouring countries to worldwide availability).

A second crawl by DATACRYPTO found listings and buyers spanning all continents, representing 55 countries. The United States continues to lead in number of suppliers, accounting for 15% of all listings. Other top twelve countries include China and a range of countries in Europe. There is an interesting correlation between vendors' willing to ship abroad and the nature of their domestic market. Vendors from countries with small customer bases in their home market are more willing to ship abroad. Perhaps more surprising is that the level of enforcement and corruption in a country also seems to play a large role in a vendor’s willingness to take the additional risk of trying to get their products past customs.

The level of enforcement and corruption in a country seems to play a large role in a vendor’s willingness to take the additional risk of trying to get their products past customs.

Customer satisfaction, too, appears to be an important factor. Listings that specify willingness to ship products abroad are more likely to have received lower ratings from customers, suggesting vendors have to widen their customer base to attract buyers willing to accept lower standards. Further research is however necessary to make any real claims about these possible trends in shipping, as the data currently available is too limited. Especially the dominance of the United States as both a supplier and customer in the cryptomarkets we studied, is likely to colour our overall results.  

Caveats

There are good reasons why we don't have a full picture of these markets yet. For instance, when looking at the kinds of drugs on sale, Judith and David included 12,103 listings. But this meant leaving out 34,507 that were not labelled as a specific drug or were for other kinds of products, such as stolen credit card information or Netflix log-ins. Finally they removed listings priced over $50,000, which was assumed to be used as placeholders (known as “holding prices”) to signal that a vendor was out of stock rather than a reflection of the usual price of goods they supply. 

Another limitation of the data is the likely presence of a form of self-selection bias in a vendor’s decision to disclose certain pieces of information. 40% of listings do not have accurate country information. Vendors either leave the country field empty or fill in region names like ‘Europe’ or fictional names like ‘Torland’. For those that do list their origin, vendors from the United States, the Netherlands or the United Kingdom might see a benefit in listing their country, acting as a seal of quality of sorts, whereas bias against ‘Made in China’ labels might have affected drug markets as well.  

Are anonymous drug markets necessarily a bad thing?

Those wary of the rise of cryptomarkets warn of new customers entering the market, increasing population levels of illegal drug use. The wide variety of drugs available may additionally allow users and dealers access to substances they may not otherwise have access to. Whether this increases drug use overall will need further research to answer.

Proponents of anonymous drug markets argue that removing the need for physical interaction may reduce opportunities for drug market-related violence. Communication skills and customer service may be more important skills for online dealers than strong-arming debtors.

Communication skills and customer service may be more important skills for online dealers than strong-arming debtors.

It is however not yet clear if the disruption of cryptomarkets has actually led to any noteworthy reductions in violence. Despite the high amount of attention they generate, cryptomarkets still make up only a small share of the overall market, the majority of the supply chain still anchored in traditional offline drugs markets. Cryptomarkets may improve drug quality (with customers more likely to get what they pay for), which can reduce unintended experiences or overdoses. Safety measures such as escrow and eBay-style feedback systems hold online sellers accountable in a way that street sellers are not.

Safety measures such as escrow and eBay-style feedback systems hold online sellers accountable in a way that street sellers are not.

Indeed, listings generally receive high feedback ratings, suggesting that customers felt they were provided with a good product. Research by Caudevilla-Gálligo in 2015 suggested that cryptomarket-purchased drugs were of high quality. 129 samples submitted by Spanish cryptomarket customers to drug testing service Energy Control were analysed for purity of product. In 93% of samples submitted, the drugs that customers thought they had purchased was the only psychoactive substance detected.

To further answer some of these questions, additional research on cryptomarkets is necessary and important. Studying market dynamics through crawling data has proven an interesting way of doing so.  

Advice for developing crawlers software 

DATACRYPTO is not the first crawler to mirror the dark web, but is novel in its ability to pull information from a variety of cryptomarkets at once, despite differences in page structure and naming conventions across sites. For example, "$..." on one market may give you the price of a listing. On another market, price might be signified by "VALUE..." or "PRICE..." instead.

Researchers who want to create a similar tool to gather data through crawling the web should detail which information exactly they would like to extract. When building a web crawler it is, for example, very important to carefully study the structure and characteristics of the websites to be mirrored. Before setting the crawler loose, ensure that it extracts and parses correct and complete information. Because the process of building a crawler-tool like DATACRYPTO can be costly and time consuming, it is also important to anticipate on future data needs, and build in capabilities to extract that kind of data later on, so no large future modifications are necessary. 

Building a complex tool like DATACRYPTO is no easy feat. The crawler needs to be able to copy pages, but also stealthily get around CAPTCHAs and log itself in onto the TOR server. Due to their bulkiness, web crawlers can place a heavy burden on a website’s server, and are easily detected due to their repetitive pattern moving between pages. Site administrators are therefore not afraid to IP-ban badly designed crawlers from their sites.

Image credit: ebertek on Flickr, CC:20

Author

Katja Bego

Katja Bego

Katja Bego

Principal Researcher, Next Generation Internet

Katja Bego was Principal Researcher and data scientist in Nesta’s technology futures and explorations team.

View profile
Jessica Bland

Jessica Bland

Jessica Bland

Principal Researcher in Futures

Jessica was a principal researcher in the Policy and Research team. She explored how Nesta could best support responsible development of disruptive technology. She organised Hot Topics…

View profile