Behind the Curtain – Comprehensive Notes

Preface and Background

  • Public concern surged post-2015–2016 terrorist attacks (Paris, Munich) allegedly linked to dark-web firearms.
  • Existing literature focused on drugs; systematic evidence on arms was largely anecdotal.
  • Project funded by UK PaCCS; endorsed by UNODC Global Firearms Programme.
  • Seven research objectives clustered in three pillars: size & scope, value, shipping routes/techniques; plus modus operandi, scamming viability, impact & policy implications.
  • Mixed-methods design:
    • Literature & grey-lit review, dark-net forum monitoring.
    • DATACRYPTO crawler/scraper (snapshot 19–25 Sep 2016).
    • Expert workshop (Mar 2017, 16 externals) and interviews.
    • Annex by UNODC analysing legal frameworks (UNTOC, Firearms Protocol, ATT).

Dark Web & Market Functioning

  • Layers of Web
    • Clear web (indexed)
    • Deep web (un-indexed intranets, login-only)
    • Dark web (hidden .onion reachable via Tor/I2P).
  • Cryptomarkets
    • Multi-vendor, escrow, feedback aggregation, cryptocurrency only.
    • Admins earn commissions; provide dispute resolution.
  • Vendor Shops (Single-vendor markets)
    • One seller ⇢ lower fees, higher scam risk, often rely on prior cryptomarket reputation.
  • Trust Mechanics
    • PGP-encrypted messaging, multisig escrow (2-of-3).
    • Feedback ≈ proxy for transactions; known under- or over-count biases.
  • Payment Flow (escrow variant): Buyer→BTCEscrow→OKVendor\text{Buyer} \xrightarrow{BTC}\text{Escrow} \xrightarrow{OK}\text{Vendor}
    • Multi-sig prevents single-party theft.
  • Shipping Tactics
    • Dead-drops, disassembly & multi-parcel, concealment in electronics/musical cases, false returns.
    • High-risk step recognised by users.

Methodology Snapshot

  • 24 English/French cryptomarkets listed on DeepDotWeb (19 Sep 2016).
    • 18 accessible, 15 allowed arms, 9 had firearms category.
  • Snapshot dataset: 167 693167\,693 listings → 811811 arms-related ( 0.5%0.5\% ).
  • Vendor deduplication via PGP: 6060 accounts → 5252 unique vendors.
  • Manual coding schema: Firearms, Ammunition, Parts/Components, Accessories, Explosives, Digital, Other Weapons.

Size & Scope Findings

  • Distribution of 811811 arms listings:
    • Firearms 42%42\% (n=339)
    • Digital 27%27\% (n=222)
    • Other weapons 22%22\% (n=178)
    • Ammunition stand-alone 7%7\% (n=54) but doubles when bundled.
  • Firearm types (n=339):
    • Pistols 84%84\% (live replicas 17\%)
    • Rifles 10%10\%
    • SMG/FA pistols 6%6\% (replicas majority 59%59\%).
  • Condition: 57%57\% unspecified; Used > New (25 vs 18 %).
  • Common makes (>10 listings): Glock (60), Colt (30), Sig Sauer (19), Ruger (18), Beretta (18), S&W (13).
  • Digital goods: DIY manuals, 3-D CAD packs (11 listings); sample pack advertised 35 printable parts.

Value & Pricing

  • Live firearms sold alone: mean $1,187\$1{,}187; bundled mean $1,457\$1{,}457.
  • Replica pistols standalone mean $132\$132 — but some replicas >$450>\$450.
  • Price table highlights:
    Glockmean=$1,189\text{Glock}_{mean}=\$1{,}189 (stand-alone)
    Glockmax=$2,200\text{Glock}_{max}=\$2{,}200; retail MSRP US ~ \$749.
  • Monthly sales estimate (feedback-based):
    • Total arms-related transactions =136=136 (firearms 56)
    • Monthly gross revenue ≈$80 000\approx\$80\,000 (firearms ~\$75k).
  • Drugs benchmark: $14.2 million\$14.2\text{ million} monthly (Kruithof 2016) ⇒ arms market quantitatively marginal (<1 %).

Shipping Analysis

  • Ship-from (n=339):
    • USA 59.9%59.9\% listings; Denmark 13%13\%; Germany 5%5\%; UK 1.5%1.5\%; Unknown 12%12\%.
  • Revenue-weighted origins (sales subset n=46): USA ~$25k\$25k/mo; Multiple/Unknown routes $29k\$29k.
  • Ship-to:
    • Worldwide option in 307307 listings; Europe-only 9; USA-only 7.
    • Observed sales suggest majority of trade is International (~>80%>80\%).
  • Techniques: multi-parcel, plastic replica decoys, vacuum seal, tracking numbers, optional insurance; refund/ reship policies vary (from 0 % to 100 % guarantee).

Scamming & Viability

  • Community perception: firearms vendors often viewed as scams or LE honeypots.
  • Metrics comparison (mean ratings out of 5):
    drugs=4.86drugs=4.86, fraud=4.79fraud=4.79, firearms=4.51firearms=4.51, ammo=4.99ammo=4.99.
  • Listing lifespan (mean days): Drugs 148, Other weapons 169, Firearms 112 (short ≈ selective scamming or low stock).
  • Conclusion: scams significant but not dominant; even 1 genuine sale ⇒ security risk.

Implications

Market Dynamics

  • Dark-web = global facilitator; removes geography & social barriers, enabling ‘parcel not container’ trade.
  • Scale too small for conflict-zone bulk supply; attractive to lone actors, gangs, extremists.
  • Pistols dominate due to concealability & postal practicality.
  • Digital proliferation of CAD files may increase untraceable ‘ghost guns’.
    Risk ∝ quality of home 3-D printers ↑\uparrow.

Actors

  • New roles: Administrators, Developers, Moderators – analogous to traditional brokers but in virtual space.
  • Buyers include: organised criminals, terrorists, lone offenders, vulnerable ‘fixated’ individuals (e.g., Munich shooter, UK teens).

Law-Enforcement Challenges & Strategies

  • Interventions:
    • Traditional ops (controlled deliveries) – costly, parcel-scale.
    • Postal detection – high volume, stealth packaging, commercial vs security priorities.
    • Online monitoring – encryption, attribution hurdles; need big-data & blockchain analytics.
    • Market disruption – exit scams, honeypot vendors; causes displacement/substitution.
  • National level: dedicate units, train cyber–firearms investigators, harmonise part/component regulations, soft prevention (education).
  • International: enhance Mutual Legal Assistance, tracing cooperation (UNTOC art. 18), implement Firearms Protocol controls (marking ++ record-keeping), regulate brokering incl. marketplace admins.
  • UNODC legal analysis:
    • Organized Crime Convention almost universal (187 parties).
    • Firearms Protocol only 114114 parties; ATT 9292; key players (e.g., USA) not in Protocol/ATT.
    • Instruments already cover manufacturing, trafficking, tracing; need better domestic transposition, cover digital files & replica conversion loopholes.

Conclusions & Recommendations

  • Empirical snapshot shows arms listings <1%<1\% of market, yet monthly ∼136\sim136 sales ⇒\Rightarrow non-trivial security risk.
  • Dark web offers wider range & higher quality arms than street markets; pistols most traded.
  • U.S. major origin; Europe major destination; trade largely international.
  • Policy: treat every listing as potentially real, invest in continuous monitoring, consider broker-style liability for market admins, tighten postal screening, pursue universal adherence to Firearms Protocol & ATT.
  • Research gap: longitudinal crawling, vendor typologies, effectiveness of disruption tactics, interaction with emerging B2C e-commerce logistics.