On March 14, a 26-year-old woman in Vinnytsia, a city in central Ukraine some 125 kilometres southwest of Kyiv, was arrested by cyber detectives for conducting an alleged criminal scheme on the so-called dark web. But unlike many online criminals, she wasn’t selling counterfeit money, forged documents or hacking services. Her goods on offer to the highest foreign bidders were much darker indeed.
She had, according to police, been selling video clips at about $100 each through a shady, dark web forum. In the videos, she is alleged to be raping her four-year-old son.
Police have charged the woman with rape and sexual corruption of minors as well as other offences related to distributing the videos. She faces 10 years in prison if convicted. The child victim was taken into care and the alleged parent’s name was withheld to protect the child’s identity.
Cases like this are not infrequent in Ukraine, and highlight how the darkest and most depraved areas of the Internet are used.
On Feb. 28, Ukrainian police busted another dark web child porn operation, this time in cooperation with the British National Crime Agency, or NCA.
Two men accused of abusing children and then selling the videos were arrested and charged. Just days earlier, police in Ukraine say they exposed yet another illicit, underage porn scheme, this time involving alleged criminals from Ukraine and Belarus.
Dark web criminals
“The dark web is rapidly becoming a haven, also for Ukrainian criminals,” said Volydmyr Rudnychenko, lead counsel specializing in white collar crime at the Integrites law firm in Kyiv.
Rudnychenko says that some 300 cyber criminals have been successfully prosecuted in Ukraine throughout the last two years, with many of those guilty of fraud and scams.
Ukrainian police say they launched 11,000 cybercrime proceedings through 2018 alone — about 915 criminal cases per month.
“The dark web is giving law enforcement a hard time, when it comes to tracking down criminals,” said Igor Kotsiuba, a legal partner with the CyberDesk security company in Kyiv, also head of the Cybersecurity Group at the American Chamber of Commerce.
“But the Ukrainian police seem to be taking strong steps forward in the fight…and Ukraine is a trusted party of law enforcement ecosystems such as Interpol and Europol,” he added.
Dark web explained
If the Internet we think of is a public building that’s accessible to everyone via the front door, or an Internet browser, then the so-called deep web can be seen as an extensive, sprawling basement beneath the building that’s accessible only to people with certain keys and a specific desire to venture into its depths.
This basement contains 96 percent of the World Wide Web, where confidential data, records and reports are stored. In its most secluded corners is the dark web — a wild and uncontrolled place where information flows freely and shady business deals go down in anonymous chat rooms and encrypted messages.
As can be expected, the dark web is often not a place for the faint-hearted.
Users who venture into the dark web can easily find marketplaces where illegal goods and services can be purchased, usually with cryptocurrencies like Bitcoin. For those who want to find it, illegal pornography and images of child abuse can be found. While harder than it used to be, weapons and explosives can also be bought in chatrooms or forums.
According to research by academics at Kings College London, who scoured 2,723 sites throughout the dark web over a five-week period, 57 percent of the hosted content was illegal or illicit material.
Illegal markets flourish
“The internet, as well as the dark web, has no boundaries,” said Serhiy Demedyuk, Head of the Cyberpolice Department of the National Police of Ukraine. ”
“Since the technology behind the dark web complicates the identification of users, it is very popular among those who have something to hide… most dark web tools were developed in order to ensure the reliability and safety of legitimate communications. Unfortunately, it is also used by criminals and Ukraine is no exception here.
Law enforcement agencies are constantly busting sites throughout the deep and dark web if they deal in illicit goods and services. Weapons attract a whole new level of unwanted, inter-agency attention. Layers of complex anonymity makes tracking people and servers very complicated for the police, but they’re improving their techniques.
In order to research what kinds of goods and services are available on the dark web, the Kyiv Post connected to the Internet via a Virtual Proxy Network and dove deep into the shadiest recesses of the Web via a specialized TOR Browser.
Multiple online marketplaces are still active across the dark web. The most active online store, called Dream Market, currently boasts 120,000 listings for illicit goods or services, half of them narcotics.
Vendors are spread across the world, from Hong Kong to Los Angeles, but often they lie about their location, and determining where they actually are requires an in-depth police investigation.
Many vendors claim to be in the European Union or United States and almost all offer worldwide shipment on their goods, often delivered to a secret drop-off point by a local intermediary.
These days, weapons and firearms are harder to find as even dark web moderators, faced with the threat of life-long prison sentences, have cracked down this area. In one Russian-language corner of the dark web, the Kyiv Post saw discussion of AK‑47 assault rifles being sold from Ukraine’s eastern Donbas region to buyers in Russia, but could not confirm the veracity of any supposed auction.
Across various shady marketplaces and forums, the Kyiv Post found vendors selling forged documents, fake passports (Malta was a popular choice), counterfeit money, hacking services and, in abundance, stolen credit card details and hacked bank accounts.
One vendor located in Ukraine found by the Kyiv Post has a popular and successful racket in the worldwide shipping of highly authentic counterfeit U.S. dollars, although they can also produce British pounds, Canadian dollars and euros. Buyers can purchase $5,000 in counterfeit money for an equivalent crypto payment of $500. At least 13 happy customers had left the vendor anonymous, positive reviews, after successfully purchasing fake American money.
Covert criminals
Offences related to online payment tools, theft of credit card data, the sale of counterfeit goods and distribution of illegal pornography have become priority areas for Ukrainian cyber police, Rudnychenko said.
“Illegal activities have been moved there (the dark web) because cash transactions and the rest of the Internet didn’t provide a sufficient level of anonymity,” said Igor Kotsiuba.
Kotsiuba says that all kinds of criminals on the dark web pose a threat in Ukraine, but the days of selling weapons and hiring contract killers could be over.
“Strict rules are being applied by marketplaces in order to avoid law enforcement take-downs… by forbidding services, such as an assassination, marketplaces avoid becoming a big law enforcement target,” he said.
“The most usual usage of the dark web (in Ukraine) is for purchasing personal data, passwords for credit cards and bank accounts. That data is used in fraud or other offences,” said Rudnychenko.
In an annual report, police said they caught 800 Ukrainian cyber criminals in 2018, exposed eight transnational hacking groups and participated in 30 different international operations.
According to experts, cross-border cooperation between Ukraine and the authorities in other partner countries is yielding strong results. As it becomes increasingly frequent, the noose is tightening around the necks of alleged, dark web criminals.
