The dark web is sometimes portrayed as a mysterious and anonymous environment. Yet, studies in recent years suggest we should perhaps rethink those preconceptions.

The surface web / dark web connection

“The dark web is maybe not as dark as it seems,” stated Spanish security and privacy researcher Iskander Sanchez-Rola who led a study on the Tor network in 2017 , a dark web network that utilizes encryption to hide users’ identity. The University of Deusto, Spain-based group discovered close links between the dark web and surface web. More than 20 per cent of the 1.5 million dark web pages they analyzed imported resources such as pictures, documents and Javascript files from surface websites.

“History of the Dark Web/Deep Web” by Dark Web Academy, YouTube.

Owners and operators of these resources can track when they are loaded by a user, giving them a window into a hidden domain. Google could monitor traffic to 13 per cent of the domains in the study’s dataset this way, the researchers concluded.

If a dark web service uses the same script as a site on the surface web, anyone using it could start tracking a user’s activity.

Moreover, they found tracking scripts, made to analyze users’ browsing behavior, on 27 per cent of the hidden pages they looked at. Nearly one third of these came from the surface web, and 43 per cent of those were from Google. “If a dark web service uses the same script as a site on the surface web, anyone using it could start tracking a user’s activity and potentially identify them when they visit less private sites” said Sanchez-Rola.

New AI tools, new insights

Fast forward to 2019: the MIT Lincoln Laboratory is conceiving new machine learning software tools to analyze surface- and dark-web data.

Like the University of Deusto research team, such tools focus on the interconnection among different layers of the web: connections online sellers and buyers maintain from surface to dark, and across dark-web forums. “This constant switching between sites is now an established part of how dark web marketplaces operate,” states Charlie Dagli, a researcher at Lincoln Laboratory.

Users are making new profiles on a regular basis. They may not be employing the same usernames from one site to another, but they are keeping their connections alive by signaling to each other via their content.

Users are making new profiles on a regular basis. They may not be employing the same usernames from one site to another, but they are keeping their connections alive by signaling to each other via their content. Such signals can be utilized to link personas belonging to the same user across dark web forums and, more revealingly, to link personas on the dark web to the surface web to uncover a user’s true identity.

The Lincoln Laboratory is training its machine learning algorithms to compute the commonality between users on different forums. The computations are based on three key aspects of users’ communications: “How they identify to others, what they write about, and with whom they write to,” Dagli pointed out.

Those recent studies are shedding light on how dark web users truly operate and law enforcement agencies are all ears.