July 22, 2022
The Dark Web: An Overview
Many observers of the World Wide Web (web) have
that an individual is using Tor—but not the content) and
described it as having layers. One layer, the surface web,
have suggested that using Tor in conjunction with a virtual
contains indexed content easily accessible with a traditional
private network (VPN) can provide additional privacy
search engine such as Google. Another layer, the deep web,
because a VPN may conceal internet activity, including the
contains unindexed content that cannot be accessed with a
use of Tor.
simple Google search. Within the deep web is a segment
known as the dark web—a layer where content is
How Tor Works
intentionally concealed. The dark web may be used for
Tor works by routing users’ web traffic through other users’
legitimate purposes as well as to conceal criminal or
computers, thus connecting to internet sites indirectly rather
otherwise malicious activities. It is the exploitation of the
than directly and preventing the traffic from being traced to
dark web for illegal practices that has garnered particular
the original user. To do this, Tor creates layers (like layers
interest from law enforcement officials and policymakers.
of an onion) and routes traffic through those layers to
conceal users’ identities. To get from layer to layer, Tor
Layers of the Web
establishes relays on computers around the world through
Many consider the internet and web to be synonymous;
which information passes. Information is encrypted
they are not. The web is just one portion of the internet, and
between relays and is routed through three relays before
a medium through which information may be accessed.
reaching its destination. The final relay is called the exit
(The internet is also used for email, file transfers, and direct
relay, and the IP address of this relay is viewed as the
messaging, among other things.)
source of the Tor traffic. When using Tor software, users’
IP addresses remain hidden; as such, it appears that the
Within the web, one portion is known as the surface
connection to any given website is coming from the IP
web, comprised of content that has been indexed and is
address of a Tor exit relay.
accessible through traditional search engines such as
Google.
While data on the magnitude of the deep web and dark web
and how they relate to the surface web are unclear, data on
Another portion of the web is the deep web, which
Tor users do exist. According to metrics from the Tor
contains content that has not been indexed and thus is
Project, the mean number of daily Tor users in the United
not accessible through traditional search engines. This
States across the first six months of 2022 was 545,028—or
includes content on private intranets (internal networks
21.3% of total mean daily Tor users worldwide. The United
such as those at corporations, government agencies, or
States had the largest number of mean daily Tor users
universities), and commercial databases like Westlaw.
during this time period, followed by Germany (10.29%),
Accessing this content often requires authentication (i.e.,
Finland (5.43%), Russia (4.94%), and India (4.08).
verification of the user’s identity) and permission to
access the content.
Navigating the Dark Web
Traditional search engines often use web crawlers to access
Within the deep web is the dark web, the segment of the
websites on the surface web. Web crawlers search the web
deep web that has been intentionally hidden. It refers to
and gather websites that the search engines can then catalog
internet sites that users generally cannot access without
and index. Content on the deep web and dark web,
using special software. While the content of these sites
however, may not be caught by web crawlers (and
may be accessed using this software, publishers of these
subsequently indexed by traditional search engines) for a
sites are often concealed. Users access the dark web
number of reasons, including that it may be unstructured,
with the expectation of being able to share information
unlinked, or temporary content. As such, there are different
and/or files with little risk of detection.
mechanisms for navigating the deep web and the dark web.
Users often navigate dark web sites through directories such
Accessing and Navigating the Dark Web
as the Hidden Wiki, which organizes sites by category,
The dark web can be reached through decentralized,
similar to Wikipedia. Individuals can also search the dark
anonymized nodes on various networks including Tor
web with search engines. For instance, Ahmia searches
(short for The Onion Router) or I2P (Invisible Internet
across hidden services on the Tor network, and Kilos
Project). Tor, which was initially released as The Onion
searches markets, known as darknet markets, notorious for
Routing project in 2002, was originally created by the U.S.
serving the cybercriminal underground.
Naval Research Laboratory as a tool for anonymously
communicating online. Some privacy and security
Tor is often slower than other web browsers, in part
advocates have noted that using Tor may not be completely
because Tor traffic is routed through multiple relays and
anonymous (e.g., some internet service providers can see
there can be delays anywhere along its path. Speed can also
https://crsreports.congress.gov
The Dark Web: An Overview
be reduced when more users are simultaneously on the Tor
materials for creating a fake identity); fraud (e.g., the sale
network. However, increases in users who allow the use of
of personal information, credentials, or accounts); hacking
their computers as relays can improve the speed on Tor.
and exploits (e.g., malicious software, exploit kits, hackers
There are also tools—such as Tor2web—that may allow
for hire); exploitation (e.g., child sexual abuse material—
access to Tor-hosted content without downloading and
distinct from explicit content such as legal pornography);
installing the Tor software, but these tools do not have the
and markets with multiple types of illicit activity (those
Tor-related privacy protections.
akin to an Amazon-style site for illicit goods on the dark
web). Cryptocurrency, such as Bitcoin and Monero, is the
Anonymity and the Dark Web
common form of payment on darknet markets.
Anonymity on the dark web is not guaranteed. While tools
such as Tor aim to anonymize content and activity,
Investigations and the Dark Web
researchers, security experts, hackers, law enforcement, and
Just as criminals can leverage the anonymity of the dark
other officials are constantly developing means by which
web, so too can law enforcement. They can use it to
certain hidden services or individuals could be identified, or
conduct online surveillance and sting operations and to
deanonymized. For instance, law enforcement uses network
maintain anonymous tip lines. Federal investigations of
investigative techniques, their term for specially designed
dark web cases are often multiagency initiatives. For
malware engineered to take advantage of a specific
instance, the Joint Criminal and Opioid Darknet
technology vulnerability and bypass anonymity protections.
Enforcement (JCODE) team is a Department of Justice
(DOJ) initiative, led by the Federal Bureau of Investigation
Reasons for Anonymizing Online Activity
(FBI), which coordinates federal investigations focused on
A number of reasons have been cited for why individuals
dismantling online sales of illicit drugs—particularly
might use services such as Tor to anonymize online
opioids—and other illicit goods. In April 2022, the JCODE
activity. Anonymizing services have been used for legal
team supported and helped coordinate the multiagency
and illegal activities ranging from keeping sensitive
investigation and seizure of the Hydra Market, which DOJ
communications private to selling illicit contraband.
described as “the world’s largest and longest-running
darknet market.” Hydra enabled users, largely in Russian-
Individuals around the world may use internet-based
speaking countries, to trade in illicit goods and services
anonymizing services to maintain free speech, privacy, and
such as illicit drugs, stolen financial information, and
anonymity. For instance, they may use them as anti-
fraudulent identification documents. Reportedly, Hydra
censorship tools to reach and share blocked content or to
accounted for about 80% of darknet market-related
conduct political activism online as part of dissident
cryptocurrency transactions in 2021, and had amassed about
movements. Individuals may use Tor and similar services to
$5.2 billion since 2015.
seek out forums for discussing private issues such as
victimization or physical or mental illnesses, and businesses
Researchers have helped identify areas in which law
may use them to protect their projects from spies and others
enforcement can improve dark web investigations. DOJ’s
who may try to gain a competitive advantage. Journalists
National Institute of Justice, through the RAND
may also rely on anonymizing services to communicate
Corporation and Police Executive Research Forum,
with dissidents or whistleblowers who may want to conceal
sponsored an expert’s workshop to identify law
their identity or share leaked documents.
enforcement’s high-priority needs with respect to dark web
investigations. Recommendations included enhancing
Anonymizing services and the dark web may also be used
training for investigators to spot dark web evidence,
for nefarious activity. Just as criminal activity can occur
improving information sharing between agencies,
through the surface web, it occurs on the deep web and dark
examining new structures for cross-agency cooperation,
web. A range of malicious actors, from criminals to
developing new standards for collecting dark web evidence,
terrorists to state-sponsored spies, leverage cyberspace. The
modernizing laws regarding inspections of mail and
web can serve as a forum for conversation, coordination,
overseas packages, and increasing research on the
and action, and malicious actors may rely on the dark web
relationship between traditional crime and less-visible
to help carry out their activities with reduced risk of
crime facilitated by the dark web.
detection.
Concluding Observations
Much of the illicit activity on the dark web occurs on
Policymakers may question how best to contend with
darknet markets, where administrators provide a forum for
evolving technology, such as the challenges of attribution in
buyers and sellers to communicate and leverage
an anonymous environment, to effectively combat
transactions. In some arenas, such as illicit drug sales,
malicious actors who exploit cyberspace, including the dark
vendors rely on reviews from buyers to build their brand
web. Congress may look to recommendations from
and customer base just like they do on the surface web.
researchers and law enforcement as it debates whether or
Researchers have examined the types of malicious activity
how to bolster knowledge regarding criminal activity online
facilitated through darknet markets, and they have
and support law enforcement’s dark web investigations.
identified some of the major market categories to include
illicit drugs (e.g., marijuana, cocaine, methamphetamine,
For more information, see CRS Report R44101, Dark Web.
heroin, fentanyl, other illicit opioids); pharmaceuticals (e.g.,
prescription medication, recalled drugs, unregulated
Kristin Finklea, Specialist in Domestic Security
supplements); falsified documents and counterfeits (e.g.,
IF12172
https://crsreports.congress.gov
The Dark Web: An Overview
Disclaimer
This document was prepared by the Congressional Research Service (CRS). CRS serves as nonpartisan shared staff to
congressional committees and Members of Congress. It operates solely at the behest of and under the direction of Congress.
Information in a CRS Report should not be relied upon for purposes other than public understanding of information that has
been provided by CRS to Members of Congress in connection with CRS’s institutional role. CRS Reports, as a work of the
United States Government, are not subject to copyright protection in the United States. Any CRS Report may be
reproduced and distributed in its entirety without permission from CRS. However, as a CRS Report may include
copyrighted images or material from a third party, you may need to obtain the permission of the copyright holder if you
wish to copy or otherwise use copyrighted material.
https://crsreports.congress.gov | IF12172 · VERSION 1 · NEW