Computer security is the culmination of a series of subversions. Just as policing evolves in response to crime, so computer systems evolve in response to threats. When it comes to malware, while the code is clever, the social engineering is more persistent, and more depressing. Malware designers evolve their products through testing and tooling to find out what works best. What wording will mean that more victims click on that ransomware link? Do people trust social media messages more than emails? More and more, malware evolves in response to human social and economic systems, and organisational/geo-political priorities, rather than to technical vulnerabilities.

Technological histories exist, recording major developments – the first Worm, the first RootKit, the first ransomware and so on. The social history is more dispersed and is yet to be written. Elements of a theory of malware could focus on: Where was it developed, for what purpose, who by, and how? What ethical and political questions are raised by it? For example, do we have the right to destroy self replicating computer programs, and how should malware be preserved for future study? My sense is malware history is somewhat separated from other kinds of crime historiography.

We would need to begin with a basic taxonomy. Here is my first sketch of the social history of malware: First stage: technically focused malware. Often created to prove a point, or by accident, like the first computer worm. Second stage: payload. Malware delivers a technical form that does something else, like modifies a computer system, or locks you out of it. Third stage: organisational. Malware becomes an object of economic and political activity. There is a high division of labour. Stuxnet and NotPetya encode geo-political priorities. Markets like Dark0de trade and systematise it.

Methods should set out the relevant fields. Studying evolving malware means studying the evolving computer security industry, its capacity for threat detection and horizon analysis, and the back and forth between malware operators and industry personnel. Constructs to be examined include changes in how costs are calculated and understood – from direct economic losses to reputation damage, lay perceptions of malware, and popular discourse and cultural representations of the topic. There is an opportunity for theoretical innovation here, for example considering QAnon as a mimetic virus.

Early in my career I researched smoking in areas of multiple deprivation in Scotland. At the time these were places where the social, economic and physical fabric had been severely weakened due to overlapping stressors. High crime, low income, low economic activity and widespread health problems were multiple challenges for people who lived there. That is what I think of as intersectionality. Smoking was often quoted by people I interviewed as being their one reliable pleasure. The rising cost of cigarettes and tobacco was an irritant but not often an incentive to quit. Though under strain at the time, there was a strong neighbourhood environment in many places.

One set of relationships that was sustained throughout was the illicit cigarette market. Taxes were spiking and there was a wide opportunity for people who wanted to import tobacco products cheaply. As with many illicit importing operations a tricky bit is the last retail step. Shipments need to be broken into units that will be affordable and available and this needs a staged operation with sometimes multiple ‘final miles’ involved. Several competing approaches were applied. Tobacco could be sold in pubs, under the counter of existing shops, or delivered directly. In the last case pizza companies were set up as fronts for tobacco delivery.

The level of entrepreneurial innovation going on here alerted me to the aspirational nature of illicit markets. Some illicit operations are attractive because they are the only game in town, sometimes participating in them offers purpose, income and aspiration and something resembling a career. While that was going on many others in the community rejected this as a route. They viewed illicit work as harmful to the community, attracting dangerous criminals and damaging its reputation. These markets were contested, and meaningful. Therefore when they are interdicted we should be aware of the fallout, positive and negative, and the absences left behind by them.

🎵 In the year 2525, if man is still alive, if woman can survive 🎵 

Projects such as the Clock of the Long Now, the Svalbard Global Seed Vault, and deep time Nuclear Semiotics work with time horizons of millenia. These are about changing our time perspective in response to challenges created by humanity such as environmental problems and the demands of long term nuclear waste storage. These come at a time when the tools humanity set up that institute a long term consciousness, religion and orthodoxy, have been swept aside by the Smiley People Who Know Everything. The moral obligations current humans have to future society are up for grabs. What costs might we be unknowingly or uncaringly imposing on them? Maybe the only obligation you have is to live your best life. In the Douglas Adams short story Young Zaphod Plays it Safe a way of mining the past for energy is discovered. Everyone is pretty pleased with themselves at this innovation: energy from the one place where no-one will kick up a fuss. Too late they discover that mining the past creates a problem for the present, as the future is doing the same thing to them. People will only really be motivated to act, he implies, if they have something at stake. 

So what can be employed to give us something to care about? One answer is the human delight in narrative, which explains why science fiction authors made such a contribution o the long term semiotics discussions that have come about as a result of the need to store long term nuclear waste, with a time horizon of about 10,000 years. Can a message be dispatched, interpreted, understood and acted on over a timescale greater than human civilisation? If we create a story of ourselves as heroically saving the future while also leaving a bloody big monument to it, we night be bothered to make an actual effort. The content is tricky however. It must convince the future people not to dig up this particular patch of ground and also convince the present people that it will do that. The paradox is that we might like to leave some monuments to ourselves, but any monument is attractive. Any warning sign looks like a treasure map, or just ceases to mean anything, given enough time. Gregory Benford points to problems of expert conformity and false certainty in deep time estimation, as in any enterprise.

The coming of the … society

The …isation hypothesis

That is certainly the case in future world talk in sociology. How good has sociology been at identifying valid future trends and self-correcting in the face of evidence? And can we not talk about this please? Let’s start with one of the worst charges on the docket, the secularisation hypothesis. Basically: as societies become modern, they become secular. It is pretty much not true and like most failed predictions extrapolates from a small set of cases in one moment to a general trend about societal evolution. Demographic transition is a more solid prediction, and is notable for largely existing outside mainstream sociology. Yup, everyone is getting older apart from the religo-crazies, a fact we would all just rather ignore thank you.

Lots of sociology futures now name a type of society coming into being – the metric society, the screen society, the network society, the algorithmic/platform society. Or they seek out an organising metaphor like fluidity or liquidity, using it a characteristic that in some way is central to the transformed social life and which people will have to live with. Usually the argument is presented in a motte and bailey style. It is asserted that such and such a characteristic is fluid, meaning without form or structure. Then it is pointed out that it does have form and structure, at which point the argument shifts to say that fluidity just means flexible or changing, network just means connected etc. No books have been titled ‘The Rigid Society’ or ‘Inflexible, Untroubled Gender’ or ‘The Coming Non-Crisis of Capitalism’. The traffic is all one way, which tells you how detached it is from empirical data but not from the incentives of academic publishing.

While sociology and future writing love their metaphors, they do not love their humans. Humans get a bad rep in sociology, behavioural economics and social psychology. They are usually criticised for their short termism,  various cognitive biases and a general inability to consider severe threats and fantastic opportunities that are not immediately apparent and the general set of cognitive limits I am confident nobody ever called ‘Gidden’s Paradox’. I am not sure humans suffer from the short term perspective often claimed. Giddens, the Nudgers and others speak confidently from a future that has not happened yet, and condemn humans for being insufficiently panicked at something which we have very little capacity to do much about. It is irksome because of the tendency for expert groups and elites to form their own consensus and anathematise any doubters, and the lack of humility when they turn out yet again to be wrong. 

“In the Year 2525 (Exordium & Terminus)” by Zager and Evans, RCA Victor, 1969.

This post is about crime script analysis as a method of bridging micro- and meta- analysis of criminal activity. It lays out what crime script is and how it can be used to understand the relationship between the material criminal context and the patterning of criminal action.

The origins and application of crime script analysis

Cohen and Felson (Cohen and Felson, 1979) analysed US crime rates following the Second World War. They suggested crime rates are not well correlated with socio-economic stressors such as unemployment, poverty and inequality. Crime incidence may increase in good times and slow in bad times. It does closely match opportunities. What is there matters more than what is not there. That is why crime can increase in good times. There is more stuff. As a material of theory of crime this works on a basic level. There is no car theft without cars to steal and a large enough market to sell into. That insight is the basis for Routine Activities Theory (RAT) which states that acquisitive crime is patterned and dependent on the existence of an opportunity, a motivated criminal and an absent guardian (Andersen and Farrell, 2015). It also explains some of the reduction of material crime as a result of the rise of the digital economy. As the economy becomes centred on virtual goods it becomes more difficult and less lucrative to traffic in stolen property. In this new environment criminal groups and methods either fall or adapt and exploit new opportunities presented by digital society.

An approach is needed to understand criminal innovation and the success or failure of specific criminal methods which are persistent, patterned and shared between criminals. One way of doing this is through Crime Script Analysis (CSA), developed by Cornish (Cornish, 1994). CSA characterises criminal activity as routine and purposive and identifies a criminal modus operandi. Much criminology and policing practice had focused on the crime event itself, hoping to catch criminals in the act. CSA puts the offending act itself in a context of preparation, commission, and leaving. By laying out the sequence like this the criminal act can be disrupted by situational crime prevention (SCP) measures which interfere with different stages of the script. For example a study of illicit opioid sales might identify lax or corruption prescription of painkillers as a source for drug dealers and reduce incentives for overprescribing (Moreto et al., 2020). Each stage in the script suggests a control intervention like target hardening, control of entry/exit routes, and limiting opportunities to profit from crime. Many of the steps identified might not in isolation constitute illegal acts. As a result CSA can be used to propose changes in the law, for example, criminalising ‘grooming’ by child sexual predators as a critical stage in the preparation of child abuse.

Target attraction is based on VIVA (value, inertia, visibility and accessibility). Felson (Felson, 2000) argues the theory helps avoid common mistakes which assume in a common-sense fashion that social disorder leads to more crime. He argues: “Shabby paint on buildings might be ugly, but it probably does not itself contribute to more crime. Graffiti in subways probably does not lead to more robberies. Extreme deterioration of a neighborhood might cause vice crimes to decline by scaring away customers”. These factors are likely to be correlated not causal. For instance, street drug markets operate in the absence of the guardian, not because the neighourhood lacks streetlighting. ‘Broken windows’ theory of crime might correlate to reality because it signals the absence of a guardian rather than indicating a generalised lawlessness which criminals take advantage of.

Crime script analysis in microsocial detail

CSA is a microsocial analysis of routine criminal activities which at its most basic level divides the crime sequence into three stages: precursors, commission and resolution/departure. Or Sue, Grabbit and Runne. Each stage can be further subdivided into more detailed stages, such as preparation, entry, precondition, instrumental initiation, instrumental actualisation, continuation, post-condition, exit/reset. Each element is required to complete the whole crime chain. Cases for the script are collected from various sources. These might be police investigation files, court transcripts, or raw accounts by those involved given to interviewers.

In order to compile the crime script, begin with a blank sheet of categories to be populated:

The script can be adapted to a wide range of criminal activity. A study of illicit meth production might identify sources of precursor chemicals, spaces used for laboratories, and processes of integrating with cartel buyers or other distributors. Many non-or semi-criminal actors are involved in activities such as facilitating infrastructure, finding transport, security, and sorting out legal and administrative issues for example by creating front companies. Larger illicit operations use front entities like fake pharmaceutical buyers, requiring a greater degree of network extent and complexity. A point we learn from this is that there is no such actor as ‘the criminal’. The person running the lab may be a part time hire, they may be supplied by a knowing person in the chemical industry. One task assigned was popping Sudafed out of thousands of pill blisters (Chiu et al., 2011).

When we use the CSA method then we see that there may be no central criminal actor and guiding mind. Scripts then connect to further scripts, for example, one for drug distribution which might involve a different subset of actors. Scripts can also be incomplete. The hacking group LAPSUS$ was very successful in applying login credentials purchased in a criminal marketplace to access Electronic Arts’ internal systems – potentially a major breach. However it had no idea what to do after that and was reduced to begging a journalist for contact details for the company in order to make a failed attempt to blackmail them (Cox, 2022).

A reason for using CSA is it allows analysts to identify control conditions that can be applied at different stages. How might absent guardians be substituted? How might opportunities be reduced? How might motivated actors be demotivated? The script can be used to recommend actions at each stage and evaluate their potential cost effectiveness. For example, knowing that counterfeit cigarette manufactures buy second hand cigarette manufacturing machines and also draw on cash rich businesses as a ready source of capital, then manufacturers might be required to account for those sold into the second hand market and the accounts of nightclubs closely monitored (Antonopoulos and Hall, 2016). For that reason, each sequence stage must be necessary for completion of the whole script. The analysis must separate out extraneous activity and focus on those conditions without which the script would fail.

Applied to digital and hybrid crime

The digital sphere appears to lack some of the qualities involved in routine activities theory however, time-space stretching means co-presence in the same time and space are not needed but there does need to be some kind of shared networked connection. The digital environment may enable absent guardianship through anonymity and other features of distanced responsibility, de-personalisation and remoteness of consequences. As increasingly digital crime is hybridised scripts can usefully identified transition points between online and face to face action (Brown, 2006; Roks et al., 2020). Leukfeldt (Leukfeldt, 2014) describes a situation where a phishing network largely coordinates in person and uses social engineering rather than malware to suborn victims.

The lens might need to shift from capable guardianship to relative visibility (Leukfeldt and Yar, 2016). We also need to rethink motivation. A study of web defacement in the Netherlands showed that those motivated by fun, patriotism and revenge tended to stick to local websites and use known SQL vulnerabilities, and so were more easily deterred than those doing it to demonstrate skill (Holt et al., 2020).

Case: A Darknet Counterfeit Currency Vendor

I am using a case where I mapped counterfeit currency distributor and user crime scripts using a sales and discussion thread scraped from a darknet market. The distributor sold fake US Dollars in $20, $50 and $100 denominations. The discussion thread was extensive and took place over several years. The distributor ‘Benjamin’ and their customers discussed the quality of the notes and how to successfully use them. The thread was open coded using NVIVO and then recoded according to crime script stages for both distributor and user. Contextualisation codes were also used which identified the material and social context of the criminal community. For instance, one code which became important in relation to the users’ moral justification for what they were doing was ‘Politics’. Users justified their activity in relation to the US Federal Reserve’s degrading the currency.

Matrix coding was then conducted, cross tabulating the contextualizing codes with the CSA codes. These codes fed into the crime script coding, for example, technical features were coded and then distributed according to their function in the precondition/actualisation parts of the script. That exposed the technical, stealth, performative and organisational features at different stages of the script execution.

Cases were created for each contributor to the forum and the attribute function was used to record their role/stance. While some roles were immediately obvious, such as Benjamin, others emerged during the contextualising analysis. For example, some contributors took on the role of mediating the crime script, advising others on how to successfully use the notes in different contexts and de-risk their use.  The following crime script was developed:

Distribution of counterfeit currency in this way is an example of a hybrid crime combining online distribution and offline actualisation. The script required understanding the meta-criminal context in which Benjamin and the users operated. Benjamin was a secondary distributor for the primary note producer. Therefore they had to manage both their supply and manage expectations within the darknet community about the effectiveness of the notes. Benjamin’s second stage role meant they could palm off some of the responsibility for poor quality product onto the supplier but still needed to maintain a reasonably high hit rate among their customers. It was vital in order to keep selling the notes that users reported success with them. So Benjamin and some key contributors maintained a modus operandi document, effectively their own crime script, to guide users through the process. This involved ensuring users did not try too high and invite suspicion, for example, by buying a one dollar item with a one hundred dollar note.

The discussion was open to different kinds of qualitative analysis. A narrative analysis was also conducted which showed the evolution of the community over time. It began well. Buyers expressed excitement at a new source of counterfeit notes which appeared to come directly from a well known producer. Initial batches were received well and were passed off successfully. The second batch had a noticeable drop in quality. Gradually the group turns against Benjamin and they withdraw from the forum. The narrative analysis also allowed me to understand much more about how the script was developed and finessed by the group. It showed how much criminal innovation is about learning and adapting in the moment.

Strengths and limits

CSA itself is scaleable. Examples of its application run from smash and grab robberies, interest rate market manipulation, polluting a river, the assault on the US Capitol Building in January 2021. This makes it eminently suitable for darknet and other digital crime research which uses a range of data covering for example drug dealing enforcement to cross-border ransomware activity. The offender themselves is less central to this theory and it therefore means we might miss significant demographic attributes such as sex, or assume they are irrelevant or not present. Sex is critical to many crimes, particularly those involving sexual predation. It does not  account for effervescence, feedback loops and the seductions of crime which may make digital offending more attractive in itself (Goldsmith and Wall, 2019; Katz, 1988). On the counterfeit currency thread it was questionable how profitable the activity really was, given the likely costs. One motive some users had was a political one, getting something for nothing and engaging in the thrill of purchase using counterfeit notes. These elements are likely to keep criminals involved and looking for opportunities even as some are closed off.

Conclusion

Crime Script Analysis can be used effectively with a large volume of qualitative data scraped from the Tor darknet. I used it to derive two distinct scripts for different criminal actor types. Further data would have allowed for further scripts to be developed, for example, coving the notes producer, or the supporting characters who guided others through their own scripts.

Mar 28, 2022

Some further thoughts on the long term future of illicit drug markets.

10-15 years ago most people buying drugs would do it from a known contact, arranged by telephone, handing over cash in person. Now a deal typically is arranged by social media, sometimes through the open web or darknet, dropped by delivery and paid for electronically, including by cryptocurrency. The drugs being bought would often be the big 6, heroin, cocaine, ecstasy, LSD, amphetamines and cannabis, with known supply routes and methods. Now the classic illegal drugs mix with pharmaceuticals, enhancement and lifestyle drugs, and a vast array of novel psychoactives. As much as new drugs, we have existing drugs being used in new ways, with varying degrees of social legitimacy. For a perspective on the future we can ask how drugs combine chemistry and culture, and how risks and benefits are distributed in Scottish society.

We can look back to some pre-made futures. Here is Star Trek’s Data serving Scotty some synthehol, an artificial alcohol providing pleasure without suffering. A gentle future without human nature in it. Like Data himself. In contrast the 2005 Foresight/Office of Science and Technology Project Drugs Futures 2025 (Nutt, Robbins and Stimson, 2007) recognised that  ‘for thousands of years individuals have used some form of mind-altering chemicals, ranging from comparatively harmless substances, like coffee, to others with substantial scope for harm and abuse’. DF 2025 suggested trends continuing: More sympathy towards people with drug dependence, more understanding of the risks deriving from improved brain science, and improved prediction of problems due to better genetic data and understanding of drug-body-mind interactions. The prediction of magic bullet treatment was confident:  ‘By 2025, vaccinations for a growing number of common drugs of addiction, such as cocaine, heroin, nicotine, amphetamines and cannabis, will almost certainly be available to prevent initiation of, or to treat, drug misuse.’ Also predicted was non-pharmacological neural manipulation e.g. transcranial magnetic stimulation. The scientific predictions didn’t work too well but the organisational, cultural and economic ones are more in evidence. Human nature being obdurate.

In that spirit we can be guided by looking at ethics, care, and human hybridity.

The authors suggest a number of more interesting cultural developments: Extended ‘youth’ leading to more extended drug use life course. Indeed we see much more consumption across the life course and experimentation throughout. We see business executives using LSD. The drug market tends to keep prices down. New drug types have emerged such as smart drug use, use of drugs for cognition enhancement and improvement.  Behavioural addictions are more recognised. Digital life is noted as a vector for behavioural addictions. ‘the Internet and mobile phones may lead to an increase in gambling and to new behavioural addictions, for example, to Internet chat rooms.’ These developments have change the setting of drug use and the kind of normalisation at work. They are less normalised for leisure, and more normalised for work/self. A very good call was the intersection of crime and foreign policy which we see in the alignment of major ransomware/crimeware outfits and Russian foreign policy.

Beyond trends we invite new ethical questions, such as using drugs for enhanced work performance, new kinds of social coercion and competition involved.

What was not present is the digital as an independent factor in drug production, distribution and use. This is the wild card. On a closer look it obeys many of the same rules as before – governed by culture, economics, social shame/desire.

To understand the future of digital drug use we can also recognised past digital myths. In the 1990s the ‘cyber’ was reckoned to be decentralised, voluntary and free flowing. It was separated from geography, nation-states and from pre-digital governance. This describes a moment in time. The digital world is not smooth, light, autonomous, network space. It is disjointed, centralised, heavy. The digital has qualities of permanence, scarcity, and memory over virtuality, abundance, anonymity. It exploits and polarises. It mixes the criminal and the political. Networks used by organised criminals also provide valuable space for dissidents, refugees and others. Conceptually there is no such thing as ‘the digital’ understood as a single, globalised, flat open virtual space. In part it is a digital extension of other institutions such as the mass media, states, corporations, education systems and others,  So how do we develop/adapt investigatory methods to work across that? What configurations of health, harm, and the illicit are borne out of it?

Let us look at an unexpected confluence which nobody predicted but emerged from the ferment of digital innovation. The darknet and cryptocurrency came together to allow for online anonymous markets in illicit goods and services. Drugs could be browsed, bought and paid for, contactless, remotely and in relative anonymity.. Why trust a dealer when you can read reviews and demand next day delivery? Like the early internet, the darknet devolved from a politicised anarchy to something more dominated by big players, with service integration and automation. It developed national, linguistic cultures as in the Russian centred ‘Hydra’ site, which provides secret shopper sampling of drugs sold, and also violent enforcement of contracted gig economy style employees. As well as being functional it also shows a morality of exchange. Networks of people advising each other and learning from them – not wholly individualistic and transactional but also meaningful.

Policing action tended to demonstrate the resilience of darknet operations rather than their vulnerability. Operation Onymous in 2014 had near term effects but that and later operations were often met with innovation and reformation of the markets on other platforms.The NCA and other agencies use other forms of disruption not easily represented here, and whose effectiveness is not always measurable in the same way. Law enforcement interventions allow participants to calibrate their expectations of security and risk. Interventions scrub weaker and more vulnerable players, hence change can be noted prior to intervention. Tactical displacement means drug markets move on-phone and indoors.

We are best seeing this as a reactive moral economy. Crimes you opt into – dodging council tax, TV license, overblown insurance claims, faking school eligibility, as opposed to survival crimes.

Mass crime is a kind of protest/reaction and withdrawal of consent after a threshold is reached. Karsted and Farrall point to 4 anomic cycles. 1 – market society’s emphasis on risk/choice blurs the line between licit and illicit risk. 2. Buyer beware lessens mutual obligation between business and consumer 3. Blurring between fair, shady and outright criminal 4. Growing rules/regulation based society means paradoxically they become meaningless and people/businesses violate the spirit while adhering to the letter. A rote compliance replaces organic solidarity. ‘Legal cynicism’.

Developing the idea that drugs are a system. Drugs are a great internet commodity as much like Jeff Bezos’ decision to start Amazon by selling books, they are relatively easy to warehouse and distribute.  Noticed how criminal groups move from e.g. drugs to cigarette smuggling to malware. There’s not a ‘criminal mode’ they are committed to.  Moving from commodities to services in the illicit drug economy What is a service? I mean it as supply beyond trade, ie there’s a function which is shared. So not necessarily ‘customer service’ though that exists. 

Two claims: reality: services around drug production, distribution, knowledge framework, data infrastructure, substitution/functional effect Directed, functional, not things in themselves. Empirical: And drugs themselves as being services and shaped by a self-referential service culture.  Characteristics of a maturing service market: Expertise can be rented rather than acquired. Decreasing cultural capital and skill demands – lower ‘cost of entry’.  Not human centric, modular, remote contact. Automated e.g. trust systems not local cultural capital, branded pharmaceuticals. Open sourced drug production formulae. Multiple user identities and biographies – not a ‘cocaine user’ ‘ritalin user’ etc

Systems operate across territories – a drone delivery- drug ordering and feedback system is an integrated system involving a service organisation and a digital front end. Infrastructure effects feed off developments in the economy. Distributed industrial production can be retasked to illicit product, as in see counterfeit cigarettes, illicit Xanax production using second hand pill machines, and 3-D printed weapons. Harms can be driven by supply chain needs such as fentanyl displacing heroin/opioids. As in the Country Lines instance, these methods provide vectors for exploitative control. It also opens the way to algorithmic control over operatives.

 

Mar 23, 2022

The internet has been turned into a disclosing machine. Anonymous communication is rare and difficult to achieve. Digital worlds are characterised by affordances, the technological qualities that enable and promote some kinds of human action and which hinder or disable others. Some of these qualities are so fundamental we scarcely are aware of them. One is the tendency of digital platforms to define, identify and label their users. It is a capacity fundamental to their business model. As well as enabling a cash for clicks advertising business it also provides unprecedented technological scope for mass surveillance and digital fingerprinting (Linder, 2019). The surveillant assemblage, as Haggerty and Ericson (2000) coin it, is the melding of different data types such as video, audio, location data and social media streams with automatic analysis and prioritisation in order to identify threats. Private companies compete to offer these services to police, military and private security agencies (Aas, 2011). These qualities are not natural outgrowths of what the internet is but are actively produced according to the economic, social and political priorities that are set by governing forces in our societies. Just as these features are made so they can be contested and disrupted through rival assemblages. One of these is the Tor darknet, a combination of technologies, services and infrastructures that limits monitoring and promotes anonymity (Dingledine et al., 2004).

A darknet redistributes visibility. Facebook and Instagram for example operate as self-contained private networks. Users are visible to Meta and its advertisers, to each other with some limits, but invisible to google or other web search engines. Darknets like Tor (henceforth ‘the darknet’), the focus of this post, shift the disclosure locus of control from the designed-in affordances of the platform to the decisions of the user. The darknet is one of several community supported, technical solutions to the surveilling internet (Collier, 2020). It is intended to bypass censorship and contribute to a sphere of privacy and autonomy. Users often see it as a valued place of privacy and anonymity (Mirea et al., 2019).

Tor is a routing system which encrypts connection data in order to disrupt what is called traffic analysis. Doing so makes it difficult for a third party to tell who is connecting from where. Effectively it means an internet user can browse websites and send messages without being easily traced. The design of Tor allows for relatively fast communication compared to for example Freenet, a peer-to-peer darknet. Tor is relatively easily accessible and useable. To connect to the Tor network a user just has to download the Tor Browser from the Tor foundation (see Web Resources section). The Tor Browser is built on Mozilla Firefox so its interface is familiar to web users. It is designed to work with the user’s mental model of how a web browser functions (Perry et al., 2018). When the user launches the browser it seeks to connect to a node on the Tor network, called a relay.  A start or guard relay, a connecting or middle relay, and a final or exit relay makeup a complete circuit. The network routes and encrypts data packets between relays to reduce the risk of identification. Nodes are hosted by volunteers. The code on which the network runs is maintained by the Tor Project’s developers and by a wider community.

Tor allows users to browse the web and connect to services. It has a significant second function also. It allows services to connect directly through its network, called onion or location-hidden services. Onion services allow a server to be connected without its location being revealed. Users can set up web services without the host’s IP address being known. The investigative journalism institution ProPublica and the privacy focused email service Protonmail both offer onion services along with their normal web sites, as does Facebook. The British Broadcasting Corporation (BBC) provides an onion mirror for its international news to help citizens of authoritarian countries. These services protect users and provide an anonymous route to using them. It is possible to combine an onion service with a payment system using cryptocurrency. That allows for illicit services called ‘cryptomarkets’ to be offered (Martin, 2014). The focus of much research on the darknet is about this criminogenic aspect, in part because it offers a place where illicit markets can be researched with relative ease.

What kind of questions can be asked of and with the darknet

Research questions can be asked about Tor, and of Tor. Tor is part of a much wider movement for online anonymity and privacy. As Collier (2021) shows, Tor is itself a place where the meaning of privacy is contested. It has a fascinating history having emerged from a collaboration between the US Naval Research Laboratory and the Free Haven Project. The development and evolution of Tor can be used to trace shifting political and ethical debates about privacy and autonomy and the degree to which social values can be embedded in infrastructure (Bancroft and Scott Reid, 2017).

Onion services are a social sphere in themselves. For example, The Hub hosts Reddit like discussions about the darknet itself, and about various social and political issues.

The cryptomarkets are sites of illicit exchange and also typically host discussion forums that focus on drug quality, trust and reliability of the illicit markets, and issues like harm reduction. As the markets evolve new social formations emerge. For example, Hydra is the predominant cryptomarket operating in the Russian and post-Soviet space. Cryptomarkets focused on Western nations separate drug selling from drug delivery which is mostly carried out through the postal system. Hydra has a hybrid system of dead drops in operation and is a far more integrated business than other cryptomarkets. The historical evolution and adaption of criminal business models can be studied in its context through examining different cryptomarkets and their history. National differences can be explored as can the specific state formations they operate in. Using this approach criminological models and concepts regarding criminal organisation and exchange can be tested.

The demographics of who uses the darknet and how they come to use it is a set of questions which link to themes of the digital divide, digital literacy and varying degrees of online censorship and repression throughout the work. As the world becomes more authoritarian data on darknet usage can provide one metric of shifting repression and political activism. It can also be used to examine the privacy divide. Much like the digital divide, the privacy divide means that the resources to protect one’s own privacy are very unevenly distributed. Varied technological, economic and cultural resources make a significant difference to the legal and social exposure of digital citizens. The ability to protect oneself against public shaming and cancellation and to recover from reputational damage matter alongside legal liability.

 

Mar 15, 2022

The future has arrived, said William Gibson. It just has not happened to you yet. Count yourself lucky. Participating in discussions on the future of policing gives me a chance to think about the role of futurology in social science. Futurology often shows up in a way that gives it a bad name. It is always wrong, except for my go at it, which you should definitely listen to. Breathless predictions of the coming of network societies, freedom from the bonds of the real, and unlikely tech innovations merge together in a techno-libertarian monster. They flounder in the face of humanity’s limitless ability to screw it all up. There are some obvious flaws in these visions which I still need to point out: they assume change is driven by technology as an independent force, rather than human interests. It is a damn sight easier to change the past than the future. They read from ideal world relations to real world uses. The lol-worthy elements of this should not detain us for long. Instead let us look at what predictions have already come about, using our first trick – the old is the new thing:

We already have driverless cars. They are called ‘metros’ and ‘railways’.

We already have nuclear fusion. It is called the sun. And also ‘global thermonuclear war’.

England had a social network operating since 1516, called ‘The Royal Mail’. And since the late 19th century, ‘Have you called your mother recently?’.

We definitely already have killer robots operating in the battlefield.

I am dipping into futurology because I am examining the future of digital drug markets.

The second trick is to predict the past. Let us start from the past, usually a good, predictable place. 10-15 years ago most people buying drugs would do it from a known contact, arranged by telephone, handing over cash in person. Now a deal typically is arranged by social media, sometimes through the open web or darknet, dropped by delivery and paid for electronically, including by cryptocurrency. The drugs being bought would often be the big 6, heroin, cocaine, ecstasy, LSD, amphetamines and cannabis. Now the classic illegal drugs mix with pharmaceuticals, enhancement and lifestyle drugs, and a vast array of novel psychoactives. 

Let us draw some generalisable conclusions:

• There is no direct correlation between economic development and digitisation of the drug market. The darknet is much more prevalent in Russia than the West for example. 
• Over time, illicit labour organisation and distribution of wealth have become more like licit models
• The digital has become embedded in everyday life so there no segment untouched by it
• Increasingly digital operating criminals are innovative rather than reactive

Final trick, it is safe to assume some trends will gather steam. Other have inbuilt limits which we already know:

• Some of these trends will continue, particularly innovation. The digital world is fracturing politically and nationally, for example, as alt-right alternatives to social media are launched. Criminal groups are likely to take the lead or take advantage of the development of infrastructures that are independent of the tech economy mainstream.
• Early trends we can see now will expand, particularly localisation and compartmentalisation. Drug businesses will be sold as an integrated package, including hosting, services and delivery.
• We will see the replacement of the core/distributor model of drug business operation with one where the most successful will be ‘meta criminals’ who can license others to act on their behalf. 
• The cryptocurrency moment is probably over as Bitcoin collapses under its own weight and blockchain analysis makes deanonymisation much more likely. Instead we will see payments through other non-cash systems.

Futurology tends towards the untestable and it is reasonable that social scientists do not like it very much.  Our role is often to burst the bubble at the Ted-talk party. However we have a number of jobs we have to do in order to serve our societies and communities. We need to be able to confidently predict the threat horizon. We should sketch out different possible developments and show how likely it is we will get there from here. We should be able to feedback and to pull the alarm about where these developments lead. We need to prepare people for future shocks and enhance societal resilience. 

Find out more at the Institute for the Future 

Mar 8, 2022

Okay, someone writing a crime script analysis should probably not be saying this but here we go.

One of the lightulb moments in teaching sociology is when you introduce Erving Goffman’s Presentation of Self in Everyday Life. It tells on us. In a compelling way it shows what we are like when we act in front of an imagined audience. It shows the pose of normality and agreeableness demanded by modern social life. It is immediately tangible because it feels like everyone does it – poses while waiting to meet someone in public, gives off ‘I’m not suspicous’ signals when talking out of a shop past the eletronic detector. It’s why everyone around the Queen tries to sound posher than her.

The language of drama, scripting and front/backstage is very compelling. It is a bit harder to sustain as an exciting revelation when this is not a revelation at all but an explicit feature of the technology of life. I picture a billion Insta users saying ‘well, duh! Filters!’. As with all good sociological ideas it has been generalised to within an inch of its life. There is a tendency to code everything as performance – data, sex, nations, emotions, it is all a performance. There is a constant presence of explicit impression management tools in our social media and validation of impression management in British culture. Be yourself! but the better self, with the nicer complexion y’know. That beguiles us into thinking that these practices are typical and fundamental to social life.

What do contemporary writers mean by performance? They make several implied claims that are not the same and do not in face validate each other. These are:

1. People act into their socially defined role, beyond what is necessary to fulfil its functions.
2. A lot of work is put into a kind of ‘demonstration of the self as suitable to this function’
3. There is a fundamental dramaturgical structure to social life, for example, gender is only ever a performance with no ground floor in biological sex. Yes I know Judith Butler says gender is a performative in the speech-act sense but we all know they do not really mean that.
4. Meaning that the world is a text.

Here is an example of one way performance appears a lot of the time. I have taken this from Holt and Lee’s (2021) crime script analysis of purveyors of forged documents. They do not make claims about performance, this is just a good bit of data for me. In it a vendor of counterfeit documents says: ‘After we receive your message, our support team will get in touch with you directly with all the necessary follow up and complimentary details for the transaction.’ I noticed a lot of text used in online crime transactions of this type are used to give the impression of a honed, complex professional operation at work. It is an open question how incidental these elements are to the crime script.

Whether in the case quoted by Holt and Lee that is true we do not know. Criminal operations adopt the customer care language of the service economy. In part this is grease on the wheels, which is intended to make the transaction more trustworthy in the eyes of the buyer. In part, it becomes a part of the culture: you just talk in that way because that is how it is done. As a previous generation of criminals would be adapt in the language of intimidation so the new generation of service criminals are adept at the global language of human resource management. But at its heart they still need to know how to inveigle, deceive, manipulate and sometimes bring violence to bear on a target. The right performance might help them do that, and it might have evolved as the way of doing things in that context. But it does not make sense to say that the essence of what we are looking at is a performance.

Jan 24, 2022