With the advent of the dark web, criminals can conduct their activities in ways that are difficult for law enforcement to discover, monitor, and investigate. This report describes the findings of an expert workshop of federal, state, and local law enforcement practitioners and researchers who explored how law enforcement agencies should conduct criminal investigations while dealing with evidence on the dark web.

Read Online

Identifying Law Enforcement Needs for Conducting Criminal Investigations Involving Evidence on the Dark Web

by Sean E. Goodison, Dulani Woods, Jeremy D. Barnum, Adam R. Kemerer, Brian A. Jackson

Download eBook for Free

FormatFile SizeNotes
PDF file 1.2 MB

Use Adobe Acrobat Reader version 10 or higher for the best experience.

Research Questions

  1. What challenges do law enforcement agencies face when dealing with evidence of criminal activity on the dark web?
  2. What are the high-priority needs associated with dealing with evidence on the dark web?

As more activities of daily life move online, criminals and criminal activity have followed. With the advent of the dark web, criminals can conduct their activities in ways that are difficult for law enforcement to discover, monitor, and investigate. The dark web provides anonymity and encryption, which significantly complicates the process of identifying suspects and collecting evidence. To better understand these challenges, the RAND Corporation and the Police Executive Research Forum (PERF), on behalf of the National Institute of Justice (NIJ), convened a workshop to bring together a diverse group of practitioners and researchers to identify the highest-priority problems and potential solutions related to evidence on the dark web. The focus was on developing an actionable research and development agenda that will enhance law enforcement's ability to understand and investigate illicit activity on the dark web. Workshop participants identified 46 potential solutions, or needs, which include improving training for law enforcement officers, sharing information across jurisdictions, and investigating the gaps and shortcomings in current laws related to searching packages.

Key Findings

Improving training and information sharing will likely have the greatest impact

  • Increased investment is needed in training at all levels, from the most-junior to the most-senior officers. The junior levels need to know what everyday artifacts might be relevant to an investigation and the senior levels need to ensure that the necessary skills and knowledge are included in officer and investigator training curricula.
  • Investment in efforts aimed at improving information sharing is needed across agencies, both within the United States and across international borders.

There is a lack of knowledge about what the dark web is and how criminals leverage it

  • Investigating officers often overlook physical artifacts that are indicative of dark web activities when collecting evidence during a criminal investigation. These artifacts might include notes that identify cryptocurrency wallets, encryption keys, or dark web addresses.
  • The anonymity and encryption associated with dark web activities make it much more difficult for investigators to prove that a crime has been committed.

Recommendations

  • Invest in training at all levels, from the most-junior to the most-senior officers.
  • Invest in improving information sharing across agencies, both within the United States and internationally.
  • Examine the benefits of investing further in established cross-organization structures that are designed to facilitate cooperation and information sharing.
  • Encourage standards organizations to develop new testing standards for forensic tools that are employed to collect evidence on computers that have been running dark web software.
  • Conduct research into modernizing laws associated with inspecting packages transmitted via the U.S. mail and similar services.
  • Conduct research into the increasingly interconnected nature of crime and criminals to ensure that law enforcement is able to focus on both the highly visible tip of the iceberg (i.e., traditional crime) and the less visible — but extremely important — portion of the iceberg (i.e., electronic crime) that has the potential to affect the health and welfare of populations both near and far.

Research conducted by

The research described in this report was prepared for the National Institute of Justice (NIJ) and conducted by the Justice Policy Program within RAND Social and Economic Well-Being.

This report is part of the RAND Corporation Research report series. RAND reports present research findings and objective analysis that address the challenges facing the public and private sectors. All RAND reports undergo rigorous peer review to ensure high standards for research quality and objectivity.

This document and trademark(s) contained herein are protected by law. This representation of RAND intellectual property is provided for noncommercial use only. Unauthorized posting of this publication online is prohibited; linking directly to this product page is encouraged. Permission is required from RAND to reproduce, or reuse in another form, any of its research documents for commercial purposes. For information on reprint and reuse permissions, please visit www.rand.org/pubs/permissions.

The RAND Corporation is a nonprofit institution that helps improve policy and decisionmaking through research and analysis. RAND's publications do not necessarily reflect the opinions of its research clients and sponsors.