X Close

Organised Crime Research Network

Home

A UCL-based research network on preventing and controlling organised crime

Menu

Review: Open Source Intelligence and Organised Crime seminar

Philip T Doherty1 February 2017

IMG_3912

On Tuesday the 24th of January, we were privileged to welcome Michael Endsor, from King’s College London, to conduct a seminar addressing the factors associated with open source intelligence and the subject of ‘Organised Crime’. Michael is a research associate of the ‘International Centre for Security Analysis’, and eluded to the abundance of information available through social media for the collection, analysis and processing of intelligence.

The boom of social media in the last decade has spread internationally, with the example of Facebook reaching 1.79 billion users at the end of 2016. Michael explained that social media can be used as a ‘database bank’ for the collection of information on various sources, and can positively enable law enforcement agencies to develop social networks within organisations. Furthermore, with the ever growing population of online users, law enforcement can use open source intelligence (OSINT) to better their understanding of the spatial mapping of the demand for illicit products, and their consequent supply chains.

The patterning of identifying criminal activity is observed differently within each of the media sites. However, similarities occur as a trending ‘hashtag’, where the user tags a post with a specific code, enabling other interested users to interact and create online networks. Popular tags include ‘#junkiesofiggg, #dope, #ilovedope, etc.’ Michael’s primary focus within the seminar was ‘Instagram’, as patterns are observable in imaging as well as text. He described the characteristics of certain images, where an individual enjoys flaunting their wealth through designer products, and large sums of cash; while others directly display the illicit product they are trying to sell.

Instagram has tried to block certain hashtags from trending and existing altogether, however this has not seen a reduction in criminal activity, as extra letters have been added to the tag in order to avoid the security protocols. The most popular form of criminal activity on social media is the distribution of drugs.

The advantage to law enforcement is the insight into names/coding of products, the packaging of certain drugs, the regions of distribution (due to geolocation tagging on images), the individuals involved in such a transaction, and the observation of proliferating online networks. Through the analysis of tags, shares and direct messaging (DM), law enforcement are able to trace products back to the distributer are consequently spark an investigation for an arrest. This can also lead to the research into open source hotspot mapping (both temporal and spatial) for specific use of illicit produce and the supply demand markets of these.

 
IMG_3923

Michael’s research paper ‘A structural Analysis of Social Media Networks: A Reference Guide for Analysts & Policymakers’ is a brilliant example of how intelligence can be gathered from public, and even private accounts, of social media.


The views expressed in this blog post are the authors own and do not necessarily represent the views of UCL, the Department of Security and Crime Science or the UCL Organised Crime Research Network.

Interested in researching online criminal markets? Here is 1.6 TB of data

Patricio Estevez-Soto20 July 2016

It is not news that much organised crime activity has moved to the web. However, an article in this week’s edition of The Economist (“Shedding light on the dark web“, July 16 2016), provides an enlightened analysis on how the drug trade has moved from the street to online markets facilitated by anonymising technology such as Bitcoin and Tor.

The article focuses on how the market infrastructure provided by “Dark Net Markets” (DNM)—such as an escrow service, information sharing between buyers and sellers, dispute resolution mechanisms, etc.—has transformed business practices of these “organised criminals”, making them look more like Amazon and less like Al Capone.

While the article is an interesting read, what made it all the more interesting is the data it uses. As the article states:

The secretive nature of dark-web markets makes them difficult to study. But last year a researcher using the pseudonym Gwern Branwen cast some light on them. Roughly once a week between December 2013 and July 2015, programmes he had written crawled 90-odd cryptomarkets, archiving a snapshot of each page. (The Economist, July 16 2016)

Naturally, this data is a treasure trove for anyone interested in studying these criminal markets, and luckily for the research community, it is publicly available at Gwern Branwen’s Black-market archives. Branwen’s description is enticing (my emphasis):

Dark Net Markets (DNM) are online markets typically hosted as Tor hidden services providing escrow services between buyers & sellers transacting in Bitcoin or other cryptocoins, usually for drugs or other illegal/regulated goods; the most famous DNM was Silk Road 1, which pioneered the business model in 2011. From 2013-2015, I scraped/mirrored on a weekly or daily basis all existing English-language DNMs as part of my research into their usagelifetimes/characteristics, & legal riskiness; these scrapes covered vendor pages, feedback, images, etc. In addition, I made or obtained copies of as many other datasets & documents related to the DNMs as I could. This uniquely comprehensive collection is now publicly released as a 50GB (~1.6TB) collection covering 89 DNMs & 37+ related forums, representing <4,438 mirrors, and is available for any research. (Branwen, July 14 2016)

Some of this data has already been used in articles and posts, yet there is still a lot of potential for researchers from an organised crime and/or cybercrime perspectives. Branwen lists some possible uses, yet I am sure researchers that specialise in this field can think of many more.


 

The views expressed in this blog post are the author’s own and do not necessarily represent the views of UCL, the Department of Security and Crime Science or the UCL Organised Crime Research Network.