Cryptomarkets are online marketplaces that are part of the Dark Web and mainly devoted to the sale of illicit drugs. They combine tools to ensure anonymity of participants with the delivery of products by mail to enable the development of illicit drug trafficking. Using data collected on eight cryptomarkets, this study provides an overview of the Canadian illicit drug market. It seeks to inform about the most prevalent illicit drugs vendors offer for sale and preferred destination countries. Moreover, the research gives an insight into the structure and organisation of distribution networks existing online. In particular, we provide information about how vendors are diversifying and replicating across marketplaces. We inform on the number of listings each vendor manages, the number of cryptomarkets they are active on and the products they offer. This research demonstrates the importance of online marketplaces in the context of illicit drug trafficking. It shows how the analysis of data available online may elicit knowledge on criminal activities. Such knowledge is mandatory to design efficient policy for monitoring or repressive purposes against anonymous marketplaces. Nevertheless, trafficking on Dark Net markets is difficult to analyse based only on digital data. A more holistic approach for investigating this crime problem should be developed. This should rely on a combined use and interpretation of digital and physical data within a single collaborative intelligence model.

Darknet markets, also known as cryptomarkets, are websites located on the Darknet and designed to allow the trafficking of illicit products, mainly drugs. This study aims at presenting the added value of combining digital, chemical and physical information to reconstruct sellers' activities. In particular, this research focuses on Evolution, one of the most popular cryptomarkets active from January 2014 to March 2015. Evolution source code files were analysed using Python scripts based on regular expressions to extract information about listings (i.e., sales proposals) and sellers. The results revealed more than 48,000 listings and around 2700 vendors claiming to send illicit drug products from 70 countries. The most frequent categories of illicit drugs offered by vendors were cannabis-related products (around 25%) followed by ecstasy (MDA, MDMA) and stimulants (cocaine, speed). The cryptomarket was then especially studied from a Swiss point of view. Illicit drugs were purchased from three sellers located in Switzerland. The purchases were carried out to confront digital information (e.g., the type of drug, the purity, the shipping country and the concealment methods mentioned on listings) with the physical analysis of the shipment packaging and the chemical analysis of the received product (purity, cutting agents, chemical profile based on minor and major alkaloids, chemical class). The results show that digital information, such as concealment methods and shipping country, seems accurate. But the illicit drugs purity is found to be different from the information indicated on their respective listings. Moreover, chemical profiling highlighted links between cocaine sold online and specimens seized in Western Switzerland. This study highlights that (1) the forensic analysis of the received products allows the evaluation of the accuracy of digital data collected on the website, and (2) the information from digital and physical/ chemical traces are complementary to evaluate the practices of the online selling of illicit drugs on cryptomarkets.

Cryptomarkets are online marketplaces, located on the darknet, that facilitate the trading of a variety of illegal goods, mostly drugs. While the literature essentially focused on drugs, various other goods and products related to financial or identity fraud, firearms or counterfeit goods, as well as doping products are also offered on these marketplaces. Through the analysis of relevant data collected on a popular marketplace in 2014-2015, Evolution, this research provides an analysis of the structure of trafficking (types and proportions of products, number of vendors, shipping countries). It also aims at highlighting geographical patterns in the trafficking of these products (e.g. trafficking flows, specialisation of vendors, role in the distribution chain). The analysis of the flow of goods between countries emphasises the role of specific countries in the international and domestic trafficking, potentially informing law enforcement agencies to target domestic mails or international posts from specific countries. The research also highlights the large proportion of licit and illicit drug listings and vendors on Evolution, followed by various fraud issues (in particular, financial fraud), the sharing of knowledge (tutorials) and finally goods, currencies and precious metals (principally luxury goods). Looking at the country of origin, there seems to be a clear division between digital and physical products, with more specific information for physical goods. This reveals that the spatial analysis of trafficking is particularly meaningful in the case of physical products (such as illicit drugs) and to a lesser extent for digital products. Finally, the geographical analysis reveals that spatial patterns on Evolution tend to reflect the structure of the traditional illicit market. However, regarding illicit drugs, country-specificity have been observed and are presented in this article.

Background: The rapid emergence of new psychoactive substances (NPS) is a challenge for public health authorities and law enforcement. The phenomenon is strengthened since the increase of the Internet usage. Not only used to trade NPS, the Web is an important source of information for both potential drug consumers and experienced users. Discussion forums are among these sources of information. They are meeting points for different groups of users and include a wide range of trip reports, questions and consumption tips. Since the discussions are archived over a long period, they can be used to monitor the interest of consumers for particular substances over time. This research aims at understanding the contribution of data extracted from a major online discussion forum within a systematic monitoring process. Method: Data were collected from a discussion forum (i.e. Drugs-forum). Within the sections of the forum, the titles, content of discussion, number of replies, and the date of the first discussion were crawled and stored in a dedicated database. The intensity of the discussions related to 42 substances considered as NPS was measured through an indicator allowing to assess the popularity of substances. Furthermore, the appearance of 15 substances on the forum was compared to the date of formal notification to the EU early warning system. Results: An evolution of the different classes of substances, as well as an evolution of specific substances within a class were highlighted. Some substances were discussed for a long period of time (e.g. Kratom, 25i-NBOMe, MDPV) while others were discussed very briefly (e.g. 5-MeO-DPT, NM-2AI). Out of the fifteen substances subjected to a risk assessment from the European Monitoring Centre for Drugs and Drug Addiction (EMCDDA), nine of them appeared on the forum before or at the same time as their first date of notification to the EU early warning system. Conclusion: In line with previous research on doping products, this article shows the potential of the monitoring of online forums in the context of psychoactive substances. Besides, the system designed to collect the data is flexible and can be systematically updated to fuel a monitoring process. It informs not only on the presence/absence of a substance in discussions between consumers, but also on its evolution over time. Such results could benefit academic research and organizations studying the NPS phenomenon. Precisely, it could complement existing early warning systems and benefit law enforcement agencies and policy makers.

The present study aimed at providing data to assess the secondary transfer of organic gunshot residues (OGSR). Three scenarios were evaluated in controlled conditions, namely displacing a firearm from point A to point B, a simple handshake and an arrest involving handcuffing on the ground. Specimens were collected from the firearm, the hands of the shooter and the non-shooter undergoing the secondary transfer in order to compare the amounts detected. Secondary transfer was observed for the three scenarios, but to a different extent. It was found that displacing a firearm resulted in secondary transfer in less than 50% of the experiments. The firearm also had an influence, as contrary to the pistol, no secondary OGSR were detected using the revolver. Shaking the hand of the shooter also transferred OGSR to the non-shooter's hand. In that case, the amount of OGSR was generally higher on the shooter than on the non-shooter. Finally, the largest secondary transfer was observed after the arrest with handcuffing with positive results in all cases using the pistol. In that scenario, the amounts on the shooter and the non-shooter were in the same range. This study highlights that the secondary transfer must be taken into account in the interpretation of OGSR. Indeed, an individual's hands might be contaminated by handling a firearm or having physical contact with a shooter.

The Liberator is a firearm that can be manufactured from its blueprints, using a 3D-printer. This weapon made of nineteen pieces - eighteen in printed plastic and one metallic nail - raises questions such as its ability to fire a round, its wounding potential and the traces produced by its discharge. In particular, knowledge must be gained to infer that a 3D-printed handgun was used, reconstruct the shooting event involving such handgun, and gather information related to the type of 3D-printed handgun used. This study focused on the traces that could orientate forensic investigations when the use of a 3D-printed Liberator is suspected. In a first step, the Liberator was investigated to study its behaviour during the discharge and characterize traces produced by the discharge. To fulfil this goal, some Liberators were printed and assembled. Six Liberators fired a round. The discharge of the weapons was done under specific conditions allowing to collect ballistics data and traces produced by the shooting. The results showed that the barrel tended to break between the ignition of the primer and the moment the projectile exited the muzzle. The speed of the projectiles reached 140m/s when the barrel broke, while it was about 170m/s when barrel remained intact. The trajectory of the projectiles was sometimes disrupted, and the projectile tumbled on itself. It was thus very difficult to characterize the trajectory. The cavity wound caused by the fastest bullet was typical of a handgun wound firing a FMJ projectile (penetration of 21cm in ballistics soap). On the other hand, the cavity caused by the slowest bullet was more representative of a splinter wound (penetration of 14cm in ballistics soap). The study of gunshot residues collected on adhesive targets showed the presence of unburnt particles and small perforations caused by polymer pieces that concentrated around the entry holes.

No abstract

Weapons related webpages from nine cryptomarkets were manually duplicated in February 2016. Information about the listings (i.e. sales proposals) and vendors' profiles were extracted to draw an overview of the actual online trafficking of weapons. Relationships between vendors were also inferred through the analysis of online digital traces and content similarities. Weapons trafficking is mainly concentrated on two major cryptomarkets. Besides, it accounts for a very small proportion of the illicit trafficking on cryptomarkets compared to the illicit drugs trafficking. Among all weapon related listings (n=386), firearms only account for approximately 25% of sales proposal since the proportion of non-lethal and melee weapons is important (around 46%). Based on the recorded pseudonyms, a total of 96 vendor profiles were highlighted. Some pseudonyms were encountered on several cryptomarkets, suggesting that some vendors may manage accounts on different markets. This hypothesis was strengthened by comparing pseudonyms to online traces such as PGP keys, images and profiles descriptions. Such a method allowed to estimate more accurately the number of vendors offering weapons across cryptomarkets. Finally, according to the gathered data, the extent of the weapons trafficking on the cryptomarkets appear to be limited compared to other illicit goods.