David Décary-Hétu

Crime facilitation purposes of social networking sites: A review and analysis of the ‘cyberbanging’ phenomenon

There have been growing claims in media circles and law-enforcement settings that street gangs and criminal groups are turning to Internet-based social networking sites for various reasons ranging from the showcasing of their images and exploits to the suspected recruitment of members. The present study investigates whether such a trend is, in fact, in place. The presence of street gangs on these Internet sites is referred to as cyberbanging. While there is some anecdotal evidence suggesting that gangs are turning to social networking sites, there is little available research on exactly how street gangs and criminal groups use the Internet. Our main argument is that gang culture is in many ways an individualized phenomenon and this feature ties in directly with recent assessments of the Internet as a setting that is governed by a process of networked individualism. This theoretical link between the individualized gang setting and the presence of gang members on social networking sites helps us understand why recruitment is improbable even in a context where people are openly diffusing their image and exploits to a growing number of Internet users. The empirical segment of this research adds to this general outlook. Based on a keyword search of over 50 street gang names, the three main social networking sites (Twitter, Facebook, and MySpace) were monitored for street gang presence. Results illustrate that gang presence on social networking sites is linked primarily to promoting a general gang or street culture through individual displays. In regard to the visitors to such sites, there is no evidence that they are being tricked or manipulated in any way. They are, however, showing their curiosity in regard to such groups and, for those who share their comments and opinions, signs of support are evident. Thus, whereas criminal gangs are not proactively using the Internet to convert anyone into being gang members, social networking sites are creating a new venue for people who share or are sensitive to the values underlying street gang lifestyle to come together. These sites essentially create a new convergence setting for gang members to interact with a wider number of people who would probably never have been exposed to their lifestyles and exploits through physical interactions. The studys conclusion extends these findings toward further research in this area, as well as outlining the more relevant implications for law-enforcement monitoring of this growing phenomenon.

The ecology of trust among hackers

Malicious hackers profit from the division of labour among highly skilled associates. However, duplicity and betrayal form an intrinsic part of their daily operations. This article examines how a community of hackers uses an automated reputation system to enhance trust among its members. We analyse 449,478 feedbacks collected over 27 months that rate the trustworthiness of 29,985 individuals belonging to the largest computer hacking forum. Only a tiny fraction of the forum membership (2.4%) participates in the vast majority (75%) of ‘trust exchanges’, limiting its utility. We observe a reporting bias where the propensity to report positive outcomes is 2.81 times greater among beginner hackers than among forum administrators. Reputation systems do not protect against trust decay caused here by the rapid expansion of the community. Finally, a qualitative analysis of 25,000 randomly selected feedbacks indicates that a diverse set of behaviours, skills and attitudes trigger assessments of trustworthiness.

A response to Dolliver's “Evaluating drug trafficking on the Tor Network: Silk Road 2, the sequel”

The leading aim of Dollivers (2015)) paper “Evaluating drug trafficking on the Tor Network: Silk Road 2, the sequel” is to document changes in the size and structure of cryptomarkets following the demise of SILK ROAD 1 (SR1) using data she collected from SILK ROAD 2 (SR2), which she casts as successor to its namesake. There are undoubted strengths in Dollivers study. She should be commended for the use of automated collection of ‘digital traces’ (Decary-Hetu & Aldridge, in press). This methodology allows researchers access to full populations rather than to the more limited samples generated by self-disclosures of market participants (e.g. Caulkins, Gurga, & Little, 2009). We also applaud Dolliver for having thoroughly cleaned and recoded her data. Although this is standard good practice, the ‘big data’ generated from Internet-derived data can make doing so exceptionally resource intensive. As we have discovered, the categories into which cryptomarket vendors place their products for sale do not always correspond to their own product descriptions. The analysis we produced for a working paper on SR1 (Aldridge & Decary-Hetu, 2014), without recoding, resulted in occasional erroneous estimation of the revenue generated by different drug types, which we identified only after cleaning and recoding the nearly 12,000 listing dataset. These strengths aside, we identify two main problems with Dollivers paper.... Language: en

How the use of the internet is affecting drug trafficking practices

A cryptomarket is an online marketplace platform bringing together multiple vendors and listing mostly illegal and illicit goods and services for sale. Cryptomarkets have the same look and feel as surface web, or ‘clearweb’, marketplaces such as eBay and Amazon, and they allow their customers to search and compare products and vendors. What differentiates these markets from established clearweb marketplaces, however, is that they offer anonymity. Cryptomarkets employ a range of strategies to hide the identities of their participants, make transactions anonymous and conceal the physical locations of servers. These include anonymisation services, such as Tor (The Onion Router), that hide a computer’s IP address when accessing the site (see Chapter 3); decentralised and relatively untraceable cryptocurrencies, such as bitcoin and litecoin, for making payments; and encrypted communication between market participants. Like some others (e.g. Barratt, 2012; Martin, 2013) we employ the term ‘cryptomarkets’, following early use of this term in hacker forums, but we note that the term ‘dark net markets’ is also gaining currency (e.g. Buxton and Bingham, 2015).

Effect of restricting the legal supply of prescription opioids on buying through online illicit marketplaces: interrupted time series analysis

Abstract Objective To examine the effect on the trade in opioids through online illicit markets (“cryptomarkets”) of the US Drug Enforcement Administration’s ruling in 2014 to reschedule hydrocodone combination products. Design Interrupted time series analysis. Setting 31 of the world’s largest cryptomarkets operating from October 2013 to July 2016. Main outcome measures The proportion of total transactions, advertised and active listings for prescription opioids, prescription sedatives, prescription steroids, prescription stimulants, and illicit opioids, and the composition of the prescription opioid market between the US and elsewhere. Results The sale of prescription opioids through US cryptomarkets increased after the schedule change, with no statistically significant changes in sales of prescription sedatives, prescription steroids, prescription stimulants, or illicit opioids. In July 2016 sales of opioids through US cryptomarkets represented 13.7% of all drug sales (95% confidence interval 11.5% to 16.0%) compared with a modelled estimate of 6.7% of all sales (3.7% to 9.6%) had the new schedule not been introduced. This corresponds to a 4 percentage point yearly increase in the amount of trade that prescription opioids represent in the US market, set against no corresponding changes for comparable products or for prescription opioids sold outside the US. This change was first observed for sales, and later observed for product availability. There was also a change in the composition of the prescription opioid market: fentanyl was the least purchased product during July to September 2014, then the second most frequently purchased by July 2016. Conclusions The scheduling change in hydrocodone combination products coincided with a statistically significant, sustained increase in illicit trading of opioids through online US cryptomarkets. These changes were not observed for other drug groups or in other countries. A subsequent move was observed towards the purchase of more potent forms of prescription opioids, particularly oxycodone and fentanyl.

Conflict Management in Illicit Drug Cryptomarkets

Illegal drug markets have been described as “stateless” systems. Drug dealers, moreover, are commonly considered to have a predilection toward the use of violence to resolve disputes arising from dealing activities. While some studies have undermined this popular perception, new trends surrounding the distribution of illegal drugs via online channels (drug cryptomarkets) have shifted the transactional setting from the physical to virtual realm, thus decreasing the likelihood of violent resolution outcomes even further. This article examines conflict management strategies within cryptomarkets by coding discussion forums between vendors and buyers. Violence, as expected, is absent. Strategies more likely reflect alternatives that have been recognized in conflict management research within and beyond illegal market settings: tolerance, avoidance, ostracism, third-party intervention, negotiation, and threats. The overall setting from which such resolutions emerge is clearly not subject to formal regulations, but our analyses illustrate the multitude of informal social control mechanisms that are consistently at play and which underlie the self-regulatory and communal processes that are firmly in place.

Are Repeat Buyers in Cryptomarkets Loyal Customers? Repeat Business Between Dyads of Cryptomarket Vendors and Users:

Organizations involved in the sale of illicit products and services have been described as small, ephemeral, and local rather than global. Given their limited size, such organizations are often unable to attract large pools of customers, but it has been noted that organizations that manage to build a small but loyal customer base are likely to be more secure and to incur fewer risks of arrest and victimization. There has been little previous research into the loyalty of repeat buyers on Internet markets but a new technological innovation, cryptomarkets, makes it now more possible to track transactions between vendors and their customers. This article looks at the level of loyalty of cryptomarket repeat buyers by tracking their purchases over time. We find that, on average, customers make 60% of their purchases from the same vendor and that providing increased amounts of information to customers increases the loyalty of cryptomarket vendors’ customer base.

Going local on a global platform. A critical analysis of the transformative potential of cryptomarkets for organized illicit drug crime

Objective: There is broad agreement in the literature on the transformative potential of drug cryptomarkets that allow sourcing on a global market and consequently the circumvention of existing supply chains between producer and end user. We examine whether the transformative potential of drug cryptomarkets has been realized in two ways: Are cryptomarket drug sellers found in production and transit countries? and Do we see the increased use of shipping across international borders over time? Method: Using data collected by the DATACRYPTO software tool between 2013 and 2016, we characterize cryptomarket buyer behavior through the product reviews (i.e., sales transactions) posted on 15 cryptomarkets. Findings: Cryptomarket drug sellers are predominantly based in countries of Europe, North America, and Oceania. For both cannabis resin and cocaine sold on cryptomarkets, we find that known production and transit countries are not the primary sources of supplied drugs but rather key countries of consumption. In the case of 3,4-methylenedioxymethamphetamine, we observe that the Netherlands, a known production country, is the largest supplier. We further observe tendencies over time toward increased localization of cryptomarkets with regard to product destinations. Discussion: Though cryptomarkets offer a potentially global platform for drug distribution, they do not tend to be used as such. We explain our results with reference to buyers’ preferences regarding safety, risk, and convenience, alongside structural limitations for cryptomarket use such as bitcoin availability.

Can We Trust Social Media Data? Social Network Manipulation by an IoT Botnet

The size of a social media accounts audience -- in terms of followers or friends count -- is believed to be a good measure of its influence and popularity. To gain quick artificial popularity on online social networks (OSN), one can buy likes, follows and views, from social media fraud (SMF) services. SMF is the generation of likes, follows and views on OSN such as Facebook, Twitter, YouTube, and Instagram. Using a research method that combines computer sciences and social sciences, this paper provides a deeper understanding of the illicit market for SMF. It conducts a market price analysis for SMF, describes the operations of a supplier -- an Internet of things (IoT) botnet performing SMF -- and provides a profile of the potential customers of such fraud. The paper explains how an IoT botnet conducts social network manipulation and illustrates that the fraud is driven by OSN users, mainly entertainers, small online shops and private users. It also illustrates that OSN strategy to suspend fake accounts only cleans the networks a posteriori of the fraud and does not deter the crime -- the botnet -- or the fraud -- SMF -- from happening. Several solutions to deter the fraud are provided.

Follow the traffic: Stopping click fraud by disrupting the value chain

Advertising fraud, particularly click fraud, is a growing concern for the online advertising industry. The use of click bots, malware that automatically clicks on ads to generate fraudulent traffic, has steadily increased over the last years. While the security industry has focused on detecting and removing malicious binaries associated with click bots, a better understanding of how fraudsters operate within the ad ecosystem is needed to be able to disrupt it efficiently. This paper provides a detailed dissection of the advertising fraud scheme employed by Boaxxe, a malware specializing in click fraud. By monitoring its activities during a 7-month longitudinal study, we were able to create of map of the actors involved in the ecosystem enabling this fraudulent activity. We then applied a Social Network Analysis (SNA) technique to identify the key actors of this ecosystem that could be effectively influenced in order to maximize disruption of click-fraud monetization. The results show that it would be possible to efficiently disrupt the ability of click-fraud traffic to enter the legitimate market by pressuring a limited number of these actors. We assert that this approach would produce better long term effects than the use of take downs as it renders the ecosystem unusable for monetization.