Law enforcement struggles to police "dark web"

Created in the 1990's by the U.S. government to allow intelligence agencies to exchange information anonymously, the dark web today facilitates all kinds of illicit activity. (WWMT)

In the wake of recent data breaches, including September’s Equifax hack, which comprised personal information of nearly half of all Americans, security efforts have been focusing on what is called "the dark web."

And it's a place were personal data, such as stolen card credit or debit numbers and personal identification can end up in bundled packages sold on marketplaces where anonymity is standard.

The dark web isn't a actual place, but rather a hidden network of websites. It’s not illegal to use, but experts say the inconspicuousness of these websites allows criminals to stay under the radar of law enforcement.

Created in the 1990's by the U.S. government to allow intelligence agencies to exchange information anonymously, the dark web today facilitates all kinds of illicit activity.

“It’s basically used about 95 percent of the time by crime. Bizarre crime: weapons, child porn, you name it,” said Jared DeMott, owner of VDA Labs, a computer security consulting business.

Increasingly, law enforcement officers say, stolen personal data, such as online passwords, Social Security numbers and banking information are being bought and sold on the dark web.

The data can be bought on the cheap. Experts say Social Security numbers and credit card information can cost $20 or less.

“Criminals who use that technology, it makes committing crime, a wide-ranging crime, so much profitable,” said Hagen Frank, assistant U.S. attorney for the Western District of Michigan. “It poses a serious problem for law enforcement.”

Unlike a typical internet connection, which involves an IP address to trace online activity, the dark web uses anonymity software to mask the user's identity.

Sites on the dark web are accessed through special networks or web anonymizers such as “TOR” or “The Onion Router.”

“If I'm smart about this, I'm not going to be doing it through my computer at home using Comcast. I'm going to use one of these anonymizers,” Frank said.

Because dark web activity can’t be traced, Frank said, it’s tough to prosecute cases. Although the U.S. Department of Justice recently shut down AlphaBay and Hansa, two sites used to primarily purchase illicit drugs, many lesser-known sites remain active.

“The schemes I've seen have gotten more and more wide ranging, in terms of the geography, in terms of the efficiency of the schemes,” Frank said.

Jared DeMott, who once worked for the National Security Agency, fears the anonymity of the dark web provides a haven for hackers to coordinate with each other.

“If they don't have the expertise to do the crime themselves, they can go buy it on a place like the dark web,” he said.

DeMott fears hackers will do more than just steal personal data. DeMott showed us one site where users can buy and sell stolen video security feeds from Fortune 500 companies, homes and businesses, such as security video of a jewelry store.

“If a cyber-criminal or an actual criminal knew how to get access to this feed, they can potentially shut down these cameras or put in a fake feed or do the things in movies you see to rob this store. It's unlikely authorities would think to check the cyber side of the crime,” DeMott said.

There’s no fail-proof way to keep your information off the dark web because hackers are always trying the latest new thing to get your information and sell it to those looking to pay for it.

“People just need to think defensively,” Frank said.

There are many things one can do to remain vigilant, to watch for red flags that your identity is in someone else’s hands, including:

  • Monitor your accounts and statements for any information that looks off.
  • Check your credit report regularly to see if inquiries or new accounts appear that you don’t recognize.
  • Use strong passwords, and change them often.
  • Consider an online product to help you protect your identity and monitor your credit.

“The best single thing you can to protect your identity is to lock your credit,” DeMott said.

A number of websites are recommended to determine whether personal and financial information has been comprised, and possibly on the dark web.

A website called haveibeenpwned to see if an individual’s emails have been compromised. DeMott said is a good website, because the company has the ability to search the “dark web” and “deep web” for comprised personal information.

DeMott recommends the website, which specializes in identifying cyber-threats in the earliest stages, portions of the Internet where malicious hackers organize, plan, purchase malware. The company requires users to pay for their web service.

Follow Mike Krafcik on Twitter and on Facebook.

close video ad
Unmutetoggle ad audio on off