With the advent of the dark web, criminals can conduct their activities in ways that are difficult for law enforcement to discover, monitor, and investigate. This report describes the findings of an expert workshop of federal, state, and local law enforcement practitioners and researchers who explored how law enforcement agencies should conduct criminal investigations while dealing with evidence on the dark web.

Read Online

Identifying Law Enforcement Needs for Conducting Criminal Investigations Involving Evidence on the Dark Web

by Sean E. Goodison, Dulani Woods, Jeremy D. Barnum, Adam R. Kemerer, Brian A. Jackson

Full Document

FormatFile SizeNotes
PDF file 1.2 MB

Use Adobe Acrobat Reader version 10 or higher for the best experience.

Research Questions

  1. What challenges do law enforcement agencies face when dealing with evidence of criminal activity on the dark web?
  2. What are the high-priority needs associated with dealing with evidence on the dark web?

As more activities of daily life move online, criminals and criminal activity have followed. With the advent of the dark web, criminals can conduct their activities in ways that are difficult for law enforcement to discover, monitor, and investigate. The dark web provides anonymity and encryption, which significantly complicates the process of identifying suspects and collecting evidence. To better understand these challenges, the RAND Corporation and the Police Executive Research Forum (PERF), on behalf of the National Institute of Justice (NIJ), convened a workshop to bring together a diverse group of practitioners and researchers to identify the highest-priority problems and potential solutions related to evidence on the dark web. The focus was on developing an actionable research and development agenda that will enhance law enforcement's ability to understand and investigate illicit activity on the dark web. Workshop participants identified 46 potential solutions, or needs, which include improving training for law enforcement officers, sharing information across jurisdictions, and investigating the gaps and shortcomings in current laws related to searching packages.

Key Findings

Improving training and information sharing will likely have the greatest impact

  • Increased investment is needed in training at all levels, from the most-junior to the most-senior officers. The junior levels need to know what everyday artifacts might be relevant to an investigation and the senior levels need to ensure that the necessary skills and knowledge are included in officer and investigator training curricula.
  • Investment in efforts aimed at improving information sharing is needed across agencies, both within the United States and across international borders.

There is a lack of knowledge about what the dark web is and how criminals leverage it

  • Investigating officers often overlook physical artifacts that are indicative of dark web activities when collecting evidence during a criminal investigation. These artifacts might include notes that identify cryptocurrency wallets, encryption keys, or dark web addresses.
  • The anonymity and encryption associated with dark web activities make it much more difficult for investigators to prove that a crime has been committed.

Recommendations

  • Invest in training at all levels, from the most-junior to the most-senior officers.
  • Invest in improving information sharing across agencies, both within the United States and internationally.
  • Examine the benefits of investing further in established cross-organization structures that are designed to facilitate cooperation and information sharing.
  • Encourage standards organizations to develop new testing standards for forensic tools that are employed to collect evidence on computers that have been running dark web software.
  • Conduct research into modernizing laws associated with inspecting packages transmitted via the U.S. mail and similar services.
  • Conduct research into the increasingly interconnected nature of crime and criminals to ensure that law enforcement is able to focus on both the highly visible tip of the iceberg (i.e., traditional crime) and the less visible — but extremely important — portion of the iceberg (i.e., electronic crime) that has the potential to affect the health and welfare of populations both near and far.

Research conducted by

The research described in this report was prepared for the National Institute of Justice (NIJ) and conducted by the Justice Policy Program within RAND Social and Economic Well-Being.

This report is part of the RAND Corporation Research report series. RAND reports present research findings and objective analysis that address the challenges facing the public and private sectors. All RAND reports undergo rigorous peer review to ensure high standards for research quality and objectivity.

Permission is given to duplicate this electronic document for personal use only, as long as it is unaltered and complete. Copies may not be duplicated for commercial purposes. Unauthorized posting of RAND PDFs to a non-RAND Web site is prohibited. RAND PDFs are protected under copyright law. For information on reprint and linking permissions, please visit the RAND Permissions page.

The RAND Corporation is a nonprofit institution that helps improve policy and decisionmaking through research and analysis. RAND's publications do not necessarily reflect the opinions of its research clients and sponsors.