July 22, 2022

The Dark Web: An Overview
Many observers of the World Wide Web (web) havedescribed it as having layers. One layer, the surface web,contains indexed content easily accessible with a traditional
search engine such as Google. Another layer, the deep web,contains unindexed content that cannot be accessed with asimple Google search. Within the deep web is a segment
known as the dark web—a layer where content isintentionally concealed. The dark web may be used forlegitimate purposes as well as to conceal criminal orotherwise malicious activities. It is the exploitation of thedark web for illegal practices that has garnered particularinterest from law enforcement officials and policymakers.

Layers of the Web
Many consider the internet and web to be synonymous;they are not. The web is just one portion of the internet, anda medium through which information may be accessed.
(The internet is also used for email, file transfers, and direct
messaging, among other things.)

 Within the web, one portion is known as the surface
web, comprised of content that has been indexed and isaccessible through traditional search engines such asGoogle.

 Another portion of the web is the deep web, whichcontains content that has not been indexed and thus is
not accessible through traditional search engines. This
includes content on private intranets (internal networks
such as those at corporations, government agencies, oruniversities), and commercial databases like Westlaw.
Accessing this content often requires authentication (i.e.,verification of the user’s identity) and permission toaccess the content.

 Within the deep web is the dark web, the segment of thedeep web that has been intentionally hidden. It refers tointernet sites that users generally cannot access without
using special software. While the content of these sites
may be accessed using this software, publishers of thesesites are often concealed. Users access the dark web
with the expectation of being able to share information
and/or files with little risk of detection.

Accessing and Navigating the Dark Web
The dark web can be reached through decentralized,
anonymized nodes on various networks including Tor(short for The Onion Router) or I2P (Invisible InternetProject). Tor, which was initially released as The Onion
Routing project in 2002, was originally created by the U.S.
Naval Research Laboratory as a tool for anonymously
communicating online. Some privacy and security
advocates have noted that using Tor may not be completely
anonymous (e.g., some internet service providers can seethat an individual is using Tor—but not the content) andhave suggested that using Tor in conjunction with a virtualprivate network (VPN) can provide additional privacy
because a VPN may conceal internet activity, including theuse of Tor.
How Tor Works
Tor works by routing users’ web traffic through other users’
computers, thus connecting to internet sites indirectly rather
than directly and preventing the traffic from being traced tothe original user. To do this, Tor creates layers (like layersof an onion) and routes traffic through those layers toconceal users’ identities. To get from layer to layer, Torestablishes relays on computers around the world throughwhich information passes. Information is encrypted
between relays and is routed through three relays before
reaching its destination. The final relay is called the exit
relay, and the IP address of this relay is viewed as thesource of the Tor traffic. When using Tor software, users’
IP addresses remain hidden; as such, it appears that theconnection to any given website is coming from the IP
address of a Tor exit relay.
While data on the magnitude of the deep web and dark web
and how they relate to the surface web are unclear, data on
Tor users do exist. According to metrics from the Tor
Project, the mean number of daily Tor users in the UnitedStates across the first six months of 2022 was 545,028—or
21.3% of total mean daily Tor users worldwide. The UnitedStates had the largest number of mean daily Tor users
during this time period, followed by Germany (10.29%),
Finland (5.43%), Russia (4.94%), and India (4.08).
Navigating the Dark Web
Traditional search engines often use web crawlers to accesswebsites on the surface web. Web crawlers search the weband gather websites that the search engines can then catalog
and index. Content on the deep web and dark web,however, may not be caught by web crawlers (andsubsequently indexed by traditional search engines) for anumber of reasons, including that it may be unstructured,
unlinked, or temporary content. As such, there are different
mechanisms for navigating the deep web and the dark web.
Users often navigate dark websites through directories suchas the Hidden Wiki, which organizes sites by category,similar to Wikipedia. Individuals can also search the dark
web with search engines. For instance, Ahmia searches
across hidden services on the Tor network, and Kilos
searches markets, known as darknet markets, notorious forserving the cybercriminal underground.
Tor is often slower than other web browsers, in part
because Tor traffic is routed through multiple relays andthere can be delays anywhere along its path. Speed can also

https://crsreports.congress.gov

The Dark Web: An Overview

be reduced when more users are simultaneously on the Tor
network. However, increases in users who allow the use of
their computers as relays can improve the speed on Tor.
There are also tools—such as Tor2web—that may allow
access to Tor-hosted content without downloading andinstalling the Tor software, but these tools do not have theTor-related privacy protections.

Anonymity and the Dark Web
Anonymity on the dark web is not guaranteed. While tools
such as Tor aim to anonymize content and activity,researchers, security experts, hackers, law enforcement, andother officials are constantly developing means by which
certain hidden services or individuals could be identified, ordeanonymized. For instance, law enforcement uses network
investigative techniques, their term for specially designed
malware engineered to take advantage of a specifictechnology vulnerability and bypass anonymity protections.
Reasons for Anonymizing Online Activity
A number of reasons have been cited for why individuals
might use services such as Tor to anonymize online
activity. Anonymizing services have been used for legal
and illegal activities ranging from keeping sensitive
communications private to selling illicit contraband.
Individuals around the world may use internet-based
anonymizing services to maintain free speech, privacy, andanonymity. For instance, they may use them as anticensorship tools to reach and share blocked content or toconduct political activism online as part of dissident
movements. Individuals may use Tor and similar services toseek out forums for discussing private issues such as
victimization or physical or mental illnesses, and businesses
may use them to protect their projects from spies and others
who may try to gain a competitive advantage. Journalists
may also rely on anonymizing services to communicate
with dissidents or whistleblowers who may want to conceal
their identity or share leaked documents.
Anonymizing services and the dark web may also be used
for nefarious activity. Just as criminal activity can occur
through the surface web, it occurs on the deep web and darkweb. A range of malicious actors, from criminals toterrorists to state-sponsored spies, leverage cyberspace. Theweb can serve as a forum for conversation, coordination,and action, and malicious actors may rely on the dark web
to help carry out their activities with reduced risk ofdetection.
Much of the illicit activity on the dark web occurs on
darknet markets, where administrators provide a forum forbuyers and sellers to communicate and leveragetransactions. In some arenas, such as illicit drug sales,
vendors rely on reviews from buyers to build their brandand customer base just like they do on the surface web.
Researchers have examined the types of malicious activity
facilitated through darknet markets, and they haveidentified some of the major market categories to include
illicit drugs (e.g., marijuana, cocaine, methamphetamine,heroin, fentanyl, other illicit opioids); pharmaceuticals (e.g.,prescription medication, recalled drugs, unregulatedsupplements); falsified documents and counterfeits (e.g.,materials for creating a fake identity); fraud (e.g., the saleof personal information, credentials, or accounts); hacking
and exploits (e.g., malicious software, exploit kits, hackers
for hire); exploitation (e.g., child sexual abuse material—
distinct from explicit content such as legal pornography);and markets with multiple types of illicit activity (thoseakin to an Amazon-style site for illicit goods on the darkweb). Cryptocurrency, such as Bitcoin and Monero, is thecommon form of payment on darknet markets.

Investigations and the Dark Web
Just as criminals can leverage the anonymity of the dark
web, so too can law enforcement. They can use it to
conduct online surveillance and sting operations and tomaintain anonymous tip lines. Federal investigations ofdark web cases are often multiagency initiatives. For
instance, the Joint Criminal and Opioid Darknet
Enforcement (JCODE) team is a Department of Justice(DOJ) initiative, led by the Federal Bureau of Investigation(FBI), which coordinates federal investigations focused on
dismantling online sales of illicit drugs—particularlyopioids—and other illicit goods. In April 2022, the JCODE
team supported and helped coordinate the multiagency
investigation and seizure of the Hydra Market, which DOJ
described as “the world’s largest and longest-runningdarknet market.” Hydra enabled users, largely in Russianspeaking countries, to trade in illicit goods and services
such as illicit drugs, stolen financial information, andfraudulent identification documents. Reportedly, Hydra
accounted for about 80% of darknet market-related
cryptocurrency transactions in 2021, and had amassed about$5.2 billion since 2015.
Researchers have helped identify areas in which law
enforcement can improve dark web investigations. DOJ’s
National Institute of Justice, through the RAND
Corporation and Police Executive Research Forum,sponsored an expert’s workshop to identify law
enforcement’s high-priority needs with respect to dark web
investigations. Recommendations included enhancing
training for investigators to spot dark web evidence,
improving information sharing between agencies,
examining new structures for cross-agency cooperation,
developing new standards for collecting dark web evidence,
modernizing laws regarding inspections of mail andoverseas packages, and increasing research on therelationship between traditional crime and less-visible
crime facilitated by the dark web.

Concluding Observations
Policymakers may question how best to contend withevolving technology, such as the challenges of attribution inan anonymous environment, to effectively combat
malicious actors who exploit cyberspace, including the darkweb. Congress may look to recommendations fromresearchers and law enforcement as it debates whether or
how to bolster knowledge regarding criminal activity online
and support law enforcement’s dark web investigations.
For more information, see CRS Report R44101, Dark Web.
Kristin Finklea, Specialist in Domestic Security

https://crsreports.congress.gov

IF12172

The Dark Web: An Overview

Disclaimer
This document was prepared by the Congressional Research Service (CRS). CRS serves as nonpartisan shared staff tocongressional committees and Members of Congress. It operates solely at the behest of and under the direction of Congress.
Information in a CRS Report should not be relied upon for purposes other than public understanding of information that has
been provided by CRS to Members of Congress in connection with CRS’s institutional role. CRS Reports, as a work of theUnited States Government, are not subject to copyright protection in the United States. Any CRS Report may be
reproduced and distributed in its entirety without permission from CRS. However, as a CRS Report may include
copyrighted images or material from a third party, you may need to obtain the permission of the copyright holder if you
wish to copy or otherwise use copyrighted material.

https://crsreports.congress.gov | IF12172 · VERSION 2 · NEW