Organized Crime Research Highlights Number 5

Organized Crime Research Highlights Number 5 PDF Version (388 KB)

Table of contents

• Anonymous Online Marketplace for Illicit Goods
• Victim-Offender Mediation and Organized Crime
• Locating the Source of Diffusion in Large-Scale Networks
• Drug Market Disruption and Violence
• Quebec's Synthetic Drug Market

Anonymous Online Marketplace for Illicit Goods

Silk Road is an online anonymous marketplace that provides a virtual platform for buyers and sellers to conduct black market transactions in complete anonymity.

The author undertook to describe the Silk Road (SR) marketplace, by studying activity on the SR over a six month period (February to July 2012). The collected data was used to characterize items being sold on SR and the seller population. Using the mandatory buyer feedback reports as a proxy for sales, the author tabulated sales volumes, giving an estimate of the daily sales conducted on SR, which was used to infer the amount of commission collected by people operating the SR. As of 2012, SR's monthly sales were estimated to be over USD 1.2 million, which corresponded to about USD 92,000 per month in commissions for the SR operators.

The free software, the TOR (The Onion Router), enables people to browse information on the Internet without fear of being monitored. TOR software directs Internet traffic through a worldwide volunteer network of servers to conceal a user's location or use from anyone conducting network surveillance or traffic analysis. Because the SR exists within a TOR environment, black market goods can be bought and sold anonymously. The SR places very few restrictions on the types of goods sellers can offer. Operators of the SR prohibit the sale of goods and services that could harm others; specifically, stolen credit card numbers, counterfeit currency, firearms, personal information, assassinations, weapons of mass destruction, and child pornography are not permitted on the site. Not all of the SR listings are public, since the platform also supports stealth listings, which are accessed separately. These are accessible only to buyers who have given their URL.

All transactions on SR use Bitcoins (BTC) for currency, which exists exclusively online and is independent of any government or company. Like other currencies, it is used to buy goods and services. The BTC is attractive due to its relative anonymity. The user can make as many BTC addresses as wanted to preserve their anonymity during and post transactions. Each person can be given a different BTC address, which makes using BTCs untraceable to a specific individual. Besides using BTCs, the SR provides a system for automatic pegging of its prices to the US dollar if requested by sellers.

The author's SR account was registered in November 2011, and the study began with a systematic exploration of the mechanics of the website. This allowed the author to discover how the SR functions including how the webservers determined whether a user is logged in or not, and under which account the user was logged in. Using this approach, the author had up to a week-long window of anonymous research time without having to re-establish his settings.

The author completed a few test crawls of the website using the software HTTrack (a website copier). Specifically, the author crawled all 'item,' 'user' (i.e., seller) and 'category' webpages. To have accurate sample information, the author used separate timestamps for each visit to the website.

Aside from the change in SR images on the website, the author found nothing else to indicate that the operators of the SR noticed the crawl activity since the account remained valid without inquiries made about the crawl activity. To avoid detection, the author periodically discarded all circuits and had new circuits built and used random sample times.

Despite these precautions, SR made a number of changes on March 7, 2012 to prevent profiling of the site, including listing 20 feedback messages, undated, across all the items sold by one buyer. Due to very strong pushback from buyers, the operators of the SR returned to their time stamped, per item feedback shortly thereafter. The author continued to collect publicly accessible data over the TOR network and other SR pages. This excluded buyer and seller data, particularly when the latter operated in stealth mode and stealth listings. All data were contained in two databases, Dt for snapshots of the site and D for cumulative data. This allowed the establishment of lower and upper bounds on the amount of feedback posted on the SR site (an indicator of sales).

SR sales items are grouped by categories, using 220 distinct categories ranging from digital goods to various kinds of narcotics or prescription medicines. During the study period, 24,385 items were sold. More than two-thirds of all products sold on SR during the data collection were from one of the top 20 categories. In the top 20 categories, 'Weed' (marijuana) was the most popular item, followed by 'Drugs,' which included any form of narcotics or prescription medicines the seller did not want further classified, and included prescription drugs and 'Benzos' (benzodiazepines), such as Valium and other drugs used for insomnia and anxiety treatment. The four most popular sales categories were drug-related, with sixteen out of the top twenty trading categories being drug-related.

A majority of items offered on SR were sold within three weeks, and more than 25% of the items were sold within three days. The majority of sellers stayed on the SR site under the same seller name for about 100 days. About 20% of all seller names were present for less than three weeks. The data also identified a 'core' of 112 seller names that were present for the entire study period. Destinations for purchased items included Worldwide (49.67%), the United States (35.15%), the European Union (6.19%) and Canada (6.05%). Most items were shipped from the United States (43.83%), the United Kingdom (10.15%), the Netherlands (6.52%) and Canada (5.89%).

The seller having the largest volume of sales received about 4,847 feedback messages over the study period. The marketplace was spread out between sellers, and about 100 sellers correspond to 60% of all transactions. Since seller anonymity is guaranteed on SR, there is no legal recourse against scammers. The author also noted that not all transactions had feedback reported, due to a number of transactions being made directly between the seller and the buyer. For instance, 20,884 instances of feedback contained variations of 'finalizing early,' a common practice on SR.

During the study period, the total volume of sales changed significantly, from 6,000 BTC per day to about 9,500 BTC per day, before dropping to 7,000 BTC per day. The author attributed the latter drop to the appreciation in the value of the BTC. The daily volume of sales approached 7,665 BTC per day during the study period.

The operators of the SR collect a commission on all realized sales on the website. Initially their rate was set at 6.23% of the sales price. This was revised in January 2012 using a model similar to that of the eBay's fee structure. This led to an average commission corresponding to about 7.4% of the item's sale price. Under the new fee schedule, the SR operators had their commissions increase from over USD 2,200 per day in March 2012 to about USD 4,000 per day in late July 2012. Over the study period, the author calculated that SR operators collected on average, about USD 92,000 per month in commissions. Over a year, the revenue for the operators of the SR would be about USD 1.1 million.

Sales volumes were obtained from indirect indicators (buyer feedback) and represented an estimate, not actual verified volumes. The author observed that the risk of ruining one's reputation for little financial gain on the SR seems to be enough of a deterrent that fabricated feedback represented a small fraction of all feedback. Since buyers leave one instance of feedback per order, and orders can contain a large quantity of an item, the study only estimates the total volume and value of transactions and not the volume of goods or services provided.

The data was collected from a SR account created to access it. Registration is open to the public who chooses to connect to the site.

Given the type of goods sold on SR, a number of law enforcement agencies may have a strong interest in disrupting SR operations.

Four possible intervention strategies were suggested for intervening with the Silk Road network, including disrupting its financial infrastructure, disrupting the delivery model, and laissez-faire (21).

Disrupting the TOR network would be difficult to accomplish and could result in a high collateral cost due to adverse impacts on communication and research of oppressed individuals who also use the network. The author notes that the TOR has, in the past, been resilient to a large number of attacks due to its design and the significant amount of support it receives from legitimate users interested in freedom of speech and academic freedom. Disrupting the SR's financial infrastructure by destabilizing the BTC currency may not be effective in the short-term since the SR provides hedging mechanisms against fluctuations in the value of BTC. These have allowed the SR to prosper despite BTC's volatility. Disrupting the delivery model involves reinforcing controls at the post office or customs to prevent the items from reaching their destination. Seized packages are usually destroyed or returned to the sender. The author notes that the 'laissez-faire' approach, which is free of government intervention, is likely untenable from a policy perspective, however, it may become more attractive due to budget constraints.

The author concluded that while the SR mostly caters to illicit drugs sales, other items were also available. Its clientele largely consisted of an international community, and most of the items were sold quickly. In addition, the number of active sellers and sales volume were seen to be increasing; with slightly more than USD 1.2 million per month in sales and about USD 92,000 per month in commissions for the operators of the SR. The volume of transactions on the SR study represented a tiny fraction of global drug transactions, but possibly represents an important technical innovation in the mechanics of drug markets.  Each of the proposed SR intervention strategies presents significant associated costs (i.e., time, resources and impacts). The author recommended reduction of consumer demand from prevention campaigns as the most viable anti-drug strategy.

Editor's Note: On October 3, 2013 it was announced that Ross William Ulbricht, known online as “Dread Pirate Roberts” and “altoid,” had been arrested by the Federal Bureau of Investigation. He will face charges related to running Silk Road in a New York court and charges of contracting for torture and murder in a Maryland court. The status of the Silk Road site is uncertain, but the technology, payment methods and business processes used by the site are well-known and can be reproduced, on other web sites such as Atlantis.

Victim-Offender Mediation and Organized Crime

Victim-Offender Mediation (VOM) is extremely hard to implement in areas that are Mafia entrenched.

In this discussion piece, the author considers the implementation of VOM in Northern and Southern Italy – two regions where the concepts of restorative justice and VOM have had variable success.  VOM is a process through which the parties in conflict (i.e., the victim and the offender) consent to mediation session(s) that are facilitated by a third party. The goal of the process is to create a dialogue between the parties with an aim to resolve the conflict and promote a plausible resolution to the conflict.

The Italian Parliament recently passed legislation that introduced VOM into the judicial system. VOM has been reviewed as very effective and successful in Northern Italy, where organized crime elements are not as pertinent and pervasive when compared to Southern Italy, especially Sicily. In the South, where the Italian Mafia and other competing organized crime groups are present and very active, VOM has not been nearly as successful.

Among the reasons provided for the failure of VOM in Southern Italy is the culture of the Mafia entrenched regions.  Their hierarchical, pyramid-like structure is built around their own laws that are based on honour and respect for authority. The Mafia specializes in providing the services of extra-legal governance and both black and gray market power brokerage, which includes the application of a significant amount of mediation services. In many instances, the Italian legislature and law enforcement authorities are helpless in areas where active Mafia is present. In fact, the author asserts that it has been the case that Italian law enforcement authorities have turned to Mafia to resolve ongoing conflicts between families. Thus, VOM and Mafia-style conflict resolution can be seen as similar, competing and mutually-exclusive processes that cannot co-exist.

There are many similarities between VOM and Mafia-style conflict resolution that should not be overlooked.

• The conflict is managed by a community leader.
• The process of mediation engages extended families.
• The greater community manages the restoration and the social control after the resolution, as well as acts as a guarantor of social order.

However, the author argues that there are some notable differences between VOM and the Mafia-style conflict resolution.

• The authority of the Mafia has an overriding authority over the mediation process, whereas the mediator in VOM acts on a more neutral basis. Moreover, the Mafia recognizes power imbalances; the Mafia mediator usually has an interest in a particular outcome of the mediation, thus steering the mediation towards it.
• The process of mediation carried out by the Mafia usually reinforces the Mafia's authority in the community, whereas the VOM mediator's role is typically over after the mediation and follow-up process.
• The mutual recognition of rights that is central to the VOM is largely absent in Mafia-led mediation.
• There is limited opportunity to access legal resources during Mafia-led mediation.

Given the similarities and the differences between VOM and Mafia-style conflict resolution, the author identifies three potential risks of introducing mediation in areas where Mafia groups are present and active. Although it might not be a straightforward task, each of the risks could be mitigated to allow for VOM to be successful.

First, there is a risk of VOM to be misunderstood when, for example, it attempts to establish a dialogue between the offender and the victim through the offender admitting his/her guilt and restoring the damage suffered by the victim. This obstacle would need to be overcome by promoting the culture of restoration and restorative justice as an institution that is completely separate from the ancestral Mafia-style resolution of conflicts.

Second, the VOM's efficiency runs the risk of being limited due to lack of inputs from the parties engaged in the process. The author suggests overcoming this difficulty by implementing the VOM during the enforcement of punishment, when the offender has little to lose by participating.

Lastly, due to the fact that a lot of the crimes committed in areas where the Mafia is present tend to be of a “non-mediable” nature (e.g., tend to be of a more serious nature) there is a risk of the mediation becoming more of a judicial type. In other words, the process could start to resemble that of a trial rather than a VOM. While this difficulty might be the hardest to overcome, the author suggests that Justices of the Peace could act as mediators. Moreover, the connection between the mediation and the judiciary could be tightened, which in turn would help citizens understand that penal mediation is in fact a penal precept and a mechanism that is centered around the victim, not the offender.

Mannozzi, Grazia. (2013).”Victim-Offender Mediation in Areas Characterized by High Levels of Organized Crime” European Journal of Criminology, 0(0) 1-19. Accessed July 23, 2013 from http://euc.sagepub.com/content/10/2/187.full.pdf+html.

Locating the Source of Diffusion in Large-Scale Networks

A more efficient method has been developed to identify the source of information in a network.

In any scenario where a large-scale network is present, be it a human or social network, a network of rivers moving water, or a network of electrical signals, it is extremely important to be able to identify and locate the source of a behaviour, contaminant, or malfunctioning signal. The model presented by the authors may be used to successfully identify such sources.

The purpose of the method is to infer the original source of diffusion of infection or information from data that is gathered from “nodes” that are found inside a network. In social networks, each node is a person. The authors focused on models where a small number of nodes can be monitored; for example, in the case of a spammer that sends undesired emails online to a huge number of victims, it is close to impossible to observe all the nodes in the network.

The points of connection found inside the network are called “observer nodes;” it is from these points of connection that information is collected for analysis. For each point of connection information is required on the neighbour from which it received the information, as well as the time the information was received. What follows is a series of complex mathematical operations that are based on “maximum probability of localization” that are aimed at retrieving the source location of the information.

The successful prediction by the model of the original source from which the information diffused depends heavily on the type on network to which it is applied. The first type of network is referred to as scale-free - a network that is characterized by hubs of points of connection with a large number of links to others in the network. In this type of a network, it could be possible to accurately predict the source of diffusion 90% of the time by observing only 4% of the points of connection inside the network. However, a larger proportion of points of connection would be required for a network that is not 'scale-free,' one that is more randomly patterned. Examples of scale-free networks are terrorist conspiracies or drug trafficking networks.

In the example application of the model on data gathered during a cholera outbreak in the Kwazulu-Natal province of South Africa in 2000, the authors showed that by observing information from 20% of communities affected by the outbreak, the authors achieved an average error of less than four hops between the estimated source of infection and the first community that was affected by it. Such a small distance error could potentially aid in a quicker emergency response to an outbreak.

It could be possible to apply the proposed model in the context of an organized crime network. Outsiders could collect intelligence on a limited number of people known to be part of a larger criminal network, and the information could be analysed. If the time and the source of intelligence are properly recorded, the analyst could use the method to estimate the source of diffusion of “information” within the network, as well as the overall structure of the network. Basically, it could be determined who is directing operations and what form of organization they were dealing with, without having to undertake surveillance on everyone in the criminal network.

Another possible application of the model could be within a network whose intent is to coordinate fraudulent activity online. It would be impossible to collect intelligence on all the sources of fraudulent spam or malware that is distributed online. However, by using this model, the investigator would need to collect intelligence from only a few connecting points in the network formed by the spreading spam or malware.

There are two challenges that are identified with this method. The first is associated with the fact that it might be difficult to determine the pattern in which the diffusion occurs if an added layer of diffusion is present. Second, the choice and placement of observers in the network will ultimately affect the performance of the model. Further studies are needed to determine the effectiveness of the proposed model given the identified challenges.

Overall, the authors demonstrate that it is possible to identify the source of diffusion in large networks with only a few observers, both in a reliable and cost-effective way.

Pinto, Pedo C., Thiran, Patrick, Vetterli, Martin “Locating the Source of Diffusion in Large-Scale Networks” Physical Review Letters, 10(6) (2012). Accessed on August 6, 2013 from http://prl.aps.org/abstract/PRL/v109/i6/e068702.

Drug Market Disruption and Violence

Disrupting established marijuana markets with increased law enforcement can lead to more violence.

In Copenhagen, Denmark, cannabis products were sold fairly openly for about 30 years in the Christiania neighborhood. In 2004, Copenhagen's police changed its policy of cannabis trade tolerance in the area and cracked down on Christiania's cannabis sellers, making 75 arrests of individuals perceived to be sellers and runners. A heavy police presence was maintained in the area for a period of one year after the crackdown.

The 2004 crackdown disrupted a well-established, syndicalist, cannabis market in Copenhagen and, arguably, forced drug sellers to meet their customers in other areas of the city. Once the police reduced the heavy presence in Christiania, violence, including fatal shootings, erupted. The number of homicides and attempted homicides in the area during the 5-year period after the crackdown surpassed any 5-year period in the previous 20 years in all of Denmark. The authors hypothesize that the crackdown on the well-established cannabis market area in Christiania contributed to increases in violence due to new groups fighting over the lucrative drug territory.

The authors created a database from publically available newspaper articles that described shootings associated with the cannabis market in Denmark between 2000 and 2010. The authors used a method called a 'fixed effects regression model' to build a causal link between the intensified law enforcement and the violence that followed. (This method is appropriate for use when a researcher wants to build a causal link but cannot account for the effects of unobserved variables.)

Results of the regression analysis indicate that increased drug law enforcement (measured through the number of charges for drug law violations) predicts the violence in the year following the charges (measured through the charges for homicide, attempted homicide, and grievous bodily hard).  In an attempt to demonstrate that the causal link is not actually the opposite, the authors reversed their analysis to predict whether the violence would cause the increased drug law enforcement. The results of the latter analysis demonstrate that the causal link cannot be reversed, meaning that increased drug law enforcement was a predictor for violence in the year following increased enforcement.

The research presented in this paper demonstrates that in places where a drug market is stable and monopolistic, a sudden increase in drug law enforcement can lead to increased violence. Increased enforcement disrupts the established market structures, its equilibrium and hierarchy; this, in turn, will increase competition among drug groups for access to territory and customers. Violence and conflict are both a means and a result of increased competition.

Moeller, Kim, and Hesse, Morten. (2013).”Drug Market Disruption and Violence: Cannabis Markets in Copenhagen” European Journal of Criminology, 0(0) 1-16. Accessed on September 18, 2013 from http://euc.sagepub.com/content/early/2013/01/10/1477370812467568.

Quebec's Synthetic Drug Market

There are many small producers and distributors of synthetic drugs in Quebec. Price differentials are equally related to marketing, quality and dealer-consumer relations.

The purpose of this study was to examine the structural attributes of Quebec's synthetic drug market by merging two techniques, drug composition and economic analyses, and using information derived from 365 seized synthetic drug mixtures. The drug composition analysis examined the drug's chemical and physical profile to make inferences about the structure of the drug market, while the economic analysis looked at the price factors for the same market.

The drug composition analysis used synthetic drug seizure information, the chemical composition (the number of, and concentration of, different substances present in the tablet), and its physical properties (colour and logo) to make inferences about the market's features. This assumes that each manufacturer has its own signature, based on the 'recipe' used, and that the drugs produced by that manufacturer carry the same profile and can be identified from analysis of its chemical and physical characteristics.

The economic analysis examined illicit drug prices, which provided information about the internal dynamics of the illicit market, revealing production costs, behavioural trends, market structure, consumer trends, demand and supply and other factors involved in the final settling of prices.

The study provided an overview of the market by applying a descriptive network analysis using the drug composition data. This identified links between the drugs sharing the same characteristics and some detail of the market structure. A cluster analysis was then conducted to statistically model these features and identify the optimal number and nature of clusters for all seized synthetic drugs to define market features. Finally, the price data was analyzed.

The study analyzed data from 365 seized synthetic drug mixtures as part of a project commissioned by the Health Canada in response to the rising consumption of synthetic drugs. In partnership with the Quebec provincial and municipal police forces, seizures samples were taken for a period between 2007 and 2008.

These drugs were chemically analyzed by Health Canada, which extracted and classified the synthetic drugs based on their chemical composition (active substance and cutting agents) and physical features (colour and logo).  Among the tablets, there were four key active substances: (1) MDMA (3,4-methylenedioxy-N-methylamphetamine) also known as ecstasy, (2) MDA (3,4-methylene dioxy-amphetamine), (3) methamphetamine and (4) amphetamine, both of which are known as speed or crystal meth. There were forty adulterants, cutting agents and by-products of chemical reactions. These tablets were marked with more than 122 logos and 12 colours. All of the synthetic drugs were seized in nine different areas across the province, reflecting both small remote areas as well as large urban centres. Additional data on the context and details of the seizure regarding the branding of the product being sold and its retail price were obtained from law enforcement investigative files.

Since the data did not include the percentage of each chemical ingredient, the analysis applied both a network and cluster analysis. These complementary statistical methods organized the drugs into groups with shared properties. The network analysis gave a detailed view of the drugs' compositions and physical attributes. This permitted linking each feature of a tablet, whether chemical or physical, with the rest of the tablets in the sample. The cluster analysis validated the relationships identified by the network analysis.

Eighty different chemical compositions were identified. Each tablet had a different combination of the active substance(s) or cutting agent(s). The highest number of seized tablets contained methamphetamine and caffeine (n=100), comprising 27.4% of the sample. Others included MDMA (n=18), MDA (n=19), and methamphetamine (n=27). There was a range of different logos and colours. The most common symbol of a 'star' and 'on star' accounted for 3.8% (n=14) of the sample. The drugs were one of twelve different colours, the most prevalent being white (n=224), with 122 different logos. A drug's logo and colour rarely indicated its chemical composition, and tablets with the same appearance frequently represented two different drug mixtures.

The relationships identified in the network analysis were modeled using a two-step cluster analysis. In the first step, the chemicals were regrouped according to quality, based on the drug's level of purity, whether the tablet only contained active ingredients (i.e., MDMA, MDA, methamphetamine or amphetamine), or whether its purity was diluted with cutting agents. This produced three groups, Grade A (highest quality drugs, consisting only of active ingredient, n=71), Grade B (medium quality drugs, consisting of one active ingredient and one or more cutting agents, n=227), and Grade C (lowest quality drugs, composed solely of cutting agents, n=57).

In the second step, the drug's quality (Grade A, Grade B and Grade C drugs), colour (white, blue, yellow, mauve, orange, pink and green), and logos were identified. Using the physical and chemical variables, the optimal number of clusters was determined and compared with findings from the network analysis. Four distinct clusters emerged, which permitted assessment of the logos and colours that were most likely to be associated with drugs of different quality.

An Analysis of Variance was then used to determine the level of impact of the market variable (whether the drug was sold as ecstasy or speed) and the price. It was conducted on all samples to identify the price factors at the provincial level. The drug price factors in Montreal (n=108) were compared with the rest of Quebec (n=153). In the rest of Quebec, there was a difference between prices for both the cluster variable and how the drug was sold (e.g., as ecstasy or speed). These variables accounted for 10% of the price variation. The relationship between the dealers and clients also influenced price variation. The dealers accommodated their users by presenting drugs based on affordability. Similarly, in Montreal, there was a difference in drug prices based on whether it was sold as ecstasy or speed, and on dealer-client relations. These factors explained 14.3% of the price variation. Consistent with the province, a tablet of ecstasy sold for $11.17 and speed for about two dollars less ($9.36). For comparative purposes, the analysis was also done for the area outside of Montreal. The prices were influenced by quality of the drug, which explained 10.1% of price variation for the region.

Findings from the drug composition analysis indicate that the Quebec synthetic drug market is likely to be composed of a large number of small manufacturers and distributors, also indicating a competitive market. The economic analysis provided complementary information, finding that both differential marketing and dealer-consumer relations influenced price variations, depending on the region.

Ouellet, Marie and Carlo Morselli. (2013) “Precursors and Prices: Structuring the Quebec Synthetic Drug Market.” (pending review at the Journal of Drug Issues).

For more information on organized crime research at Public Safety Canada, please contact the Organized Crime Research Unit at ps.organizedcrimeresearch-recherchesurlecrimeorganise.sp@canada.ca.

Organized Crime Highlights is produced for Public Safety Canada and the National Coordinating Committee on Organized Crime (NCC). The NCC and its Regional/Provincial Coordinating Committees work at different levels towards a common purpose: creating a link between law enforcement agencies and public policy makers to combat organized crime. Organized Crime Highlights supports NCC research objectives by highlighting topical, evidence-based information found in scholarly organized crime articles. The summaries herein reflect interpretations of the report authors' findings and do not necessarily reflect those of the Department of Public Safety Canada or the National Coordinating Committee on Organized Crime.

Date modified:

2022-07-27