In the Name of Dark Web Justice: A Crime Script Analysis of Hacking Services and the Underground Justice System

• Author: Kyung-Shick Choi,Claire Seungeun Lee
• DOI: http://doi.org/10.1177/10439862231157520
• Published date: 01 May 2023
• Date: 01 May 2023
• Subject Matter: Articles

https://doi.org/10.1177/10439862231157520

Journal of Contemporary Criminal Justice

2023, Vol. 39(2) 201 –221

© The Author(s) 2023

Article reuse guidelines:

sagepub.com/journals-permissions

DOI: 10.1177/10439862231157520

journals.sagepub.com/home/ccj

Article

In the Name of Dark Web

Justice: A Crime Script

Analysis of Hacking Services

and the Underground Justice

System

Kyung-Shick Choi1 and Claire Seungeun Lee2

Abstract

The Dark Web serves as a key venue for peddling illegal goods and services, from

stolen possessions and drugs to illicit activities. The concurrent increase in Tor

network usage and the development of cryptocurrency has led to the creation

of major black market sites. One of the most popular illicit services offered on

the Dark Web is hacking, which includes website/social media account hacking,

Denial-of-service attacks, and custom malware. At the same time, the Dark Web

community has formed its own justice system leveraging the layer of anonymity

that exists between underground community users and the cybercrime ecosystem.

Existing studies predominantly focus on the major drug market operating on the

Dark Web, firearm sales, sexual exploitation, and money laundering. To address the

gaps in the current research as well as the relative nascency of an underground

justice system to monitor hacking services on the Dark Web, this study attempts to

broadly capture the dynamic nature of hacking services, which requires continuous

research to identify new trends and develop effective responses. The study aims to

examine the characteristics and the operations of the hacking service market and the

underground justice system on the Dark Web via an in-depth examination of Dark

Web forums with a crime script analysis vis-à-vis thematic analysis. The study defines

the crime script as that which includes pretrial, mid-trial, finalization, and exit stages.

This research sheds light on Dark Web justice courts’ procedures and the courts’

implications for shaping the future of the Dark Web.

1Boston University, MA, USA

2University of Massachusetts Lowell, USA

Corresponding Author:

Claire Seungeun Lee, School of Criminology and Justice Studies, University of Massachusetts Lowell, 113

Wilder Street, HSSB 469, Lowell, MA 01854, USA.

Email: claire_lee@uml.edu

1157520CCJXXX10.1177/10439862231157520Journal of Contemporary Criminal JusticeChoi and Lee

research-article2023

202 Journal of Contemporary Criminal Justice 39(2)

Keywords

Dark Web, hacking services, underground justice system, cybercrime ecosystem,

cryptocurrency, crime script analysis

Introduction

The Dark Web is one of the main marketplaces offering illegal goods and services, from

stolen possessions to drugs and other illicit activities. The convergence of increased Tor

network traffic and the development of cryptocurrency have helped to create major

black market sites. One of the most popular illicit services on the Dark Web is hacking,

which includes website hacking, distributed denial-of-service attack (DDoS), social

media account hacking, and custom malware. In response to this economy, the Dark

Web community has also formed its own justice system using the layer of anonymity

between the underground community users and the cybercrime ecosystem.

Even during the COVID-19 pandemic, cybercriminals have been leveraging mass

fear and panic to take advantage of many vulnerable victims through Coronavirus

phishing (Fowler, 2020), federal stimulus check scams (BBB Scam Alert, 2020), and

fake charities claiming to support coronavirus causes (DePompa, 2020). In addition,

the COVID-19 shelter-in-place order required millions of people working at home to

access corporate and government computer networks via their home Wi-Fi networks.

These conditions made online users more vulnerable than if they had been connecting

to the internet at their workplaces, which generally offer more protection.

As a result, the Internet Crime Complaint Center (IC3, 2022) received 847,376

incident reports in 2021, with estimated total losses of $6.9 billion. The monetary loss

from cryptocurrency-related cybercrime, which totaled some $246 million in 2020,

reached $1.6 billion in 2021. According to the Cyber Threat Report (Sonicwall, 2022),

governments worldwide faced a 1,885% increase in ransomware attacks. Current ran-

somware is fully capable of encrypting files on a shared network system, which can

essentially render an entire organization’s data inaccessible. Moreover, anonymous

cryptocurrency payment systems have fueled an increase in ransomware attacks such

as these that encrypt the data on a victim’s computer and network as offenders can

demand crypto payment via the Dark Web to keep their identities hidden. To gain

access to the Dark Web, users need to use a special encryption browser, such as The

Onion Relay (Tor) among others, to hide all the origination and ending destinations of

the traffic.

Signaled by these increases in cybersecurity breaches and ransomware attacks,

cybercriminals are actively selling illicit goods and services. The growing use of Dark

Web forums has offered cybercriminals more substantial opportunities for expanding

their network and forming clandestine marketplaces using crypto payment systems

without government authority intervening in transactions (Choi et al., 2022). Dark

Web markets are anonymous and essentially allow users to purchase and trade illicit

goods and services with a much lower risk of prosecution. For example, the

forum 4Chan provides illicit adult content while protecting anonymity, allowing users