Introduction

From 2011 to 2 October 2013, Silk Road operated as a black market, or “cryptomarket”, primarily for drugs, on what is popularly known as the “darkweb”. The darkweb is part of the internet that cannot be reached through conventional means as it depends upon encryption techniques. This makes it possible for users to leave non-traceable communication and transactions and as such resisting law enforcements ability to track possible illicit activities. In October 2013, the DEA and FBI closed the Silk Road website and apprehended the alleged mastermind Ross Ulbricht, known online as Dread Pirate Roberts, a vocal libertarian and administrator of the Silk Road (Goldstein 2013; Greenberg 2013). Although the seizure and arrest were lauded as victories for law enforcement, the darkweb drug trade seemed unstoppable, as vendors quickly migrated to other marketplaces, and Silk Road 2, the same brand under new leadership, opened on 6 November 2013 (Soska and Christin 2015; Van Buskirk et al. 2014). This study investigates Silk Road 2 and Agora Marketplace, the two largest cryptomarkets in terms of available items in April 2014 (Digital Citizens Alliance 2014). User reviews are used as a proxy for sales to examine the demand side of the cryptomarket economy. We hypothesize, first, that cryptomarkets cater to a specific group of buyers, primarily individuals who purchase amounts intended for themselves and their social networks; and, second, that users will begin to purchase larger quantities over time.

Cryptomarkets for drugs: background

Cryptomarkets are unique, as they use highly complex and cryptographically advanced technological tools to facilitate a form of drug distribution which is qualitatively different from traditional offline drug distribution (Martin 2014b: ‘Cryptomarkets and cybercrime’). Martin (2014a: 356) defines the ideal type cryptomarket as an “online forum where goods and services are exchanged between parties who use digital encryption to conceal their identities”. Cryptomarkets may differ in terms of the goods they offer (which can range from child pornography to illicit substances to plagiarized documents). In this study we refer to cryptomarkets as markets that are similar to Silk Road in structure, functionality and product selection, which is a structure similar to eBay with a selection of goods primarily consisting of illicit substances and the absence of child pornographic content.

Three technologies are central components of the cryptomarket: Bitcoin, Tor and PGP encryption. With a few clicks, a journalist can communicate securely with a confidential source using PGP encryption, a form of public-key cryptography. A person from China can circumvent “the great firewall” and read about the situation in Tibet simply by downloading the Tor Browser Bundle. Money can be transferred worldwide between peers, e.g. migrant workers sending money to their families by using bitcoins.

Cryptomarkets are generally located on the Tor network as hidden services and are only accessible using the Tor network. This ensures that users can remain anonymous and in principle engage in untraceable online conduct. Attempts have been made to run cryptomarkets on the i2p network (namely The Marketplace and Silk Road Reloaded) but these have not gained traction in terms of size (Soska and Christin 2015). After connecting to Tor the user can anonymously browse the cryptomarkets (Barratt 2012). Communication between vendor and buyer (e.g. the recipient address) is in most cases encrypted using PGP, ensuring that it can only be read by the intended recipient. Transactions are either conducted using escrow services available on the cryptomarkets or the buyer “finalizes early” by paying for the product in advance (Martin 2014b, ‘Cryptomarkets and cybercrime’). Products are shipped through either domestic or international mail.

In this study we focus on Silk Road 2.0 due to its historical relevance, as it was the (intended) continuation of the original Silk Road, and Agora Marketplace which represents a new generation of cryptomarkets. However, we believe that the results of our research can be generalized to other cryptomarkets to a large extent, because the markets at the time represented a large fraction of the general market (Digital Citizens Alliance 2014; Soska and Christin 2015). Though the number of cryptomarkets have increased since Silk Road, there is a tendency for the economy to centralize on a few marketplaces. In the span of this study, this was particularly the case for Agora Marketplace, Silk Road 2.0 and Evolution Marketplace (Soska and Christin 2015), of which we did not study the latter. Silk Road 2.0 was seized and the alleged operator apprehended in November 2014 during Europol’s Operation Onymous. Following this Agora Marketplace and Evolution Marketplace became the largest markets (Soska and Christin 2015). In May 2015, the owners of Evolution absconded with all funds on-site (DeepDotWeb 2015a). Agora Marketplace voluntarily shut down, returning user funds in September 2015 (DeepDotWeb 2015b).

Research on cryptomarket supply and demand

The first quantitative study of Silk Road was conducted by Christin (2013), who crawled and downloaded the original Silk Road daily from February to July 2012. He was able to provide an estimated lower bound for the revenue generated on Silk Road of 1.2 million USD in monthly sales. Christin (2013) observed that most purchases were for smaller amounts, indicating personal use rather than redistribution. In 2014, Christin’s findings were supplemented by Aldridge and Décary-Hétu, who found that 31–45 % of Silk Road revenue was generated by buyers thought to be drug dealers sourcing stock. They concluded that the cryptomarkets should be understood as a “transformative” criminal innovation in drug distribution (Aldridge and Décary-Hétu 2014), and not as an eBay for drugs as argued by Barratt (2012). Aldridge and Décary-Hétu further observed that revenue had increased by more than 600 % in the course of the 15 months since Christin’s study. The largest study of the cryptomarket economy done by Soska and Christin (2015) showed a daily revenue of more than 600,000 USD in a few cryptomarkets, along with a general increase in the size of the cryptomarket economy.

A quantitative study of Silk Road 2.0 conducted in August and September 2014 concluded, among other things, that Silk Road 2.0 inflated the number of listings; that the market only offered 1834 different items; and that drugs were not the largest category in terms of sales, as they amounted to a mere 1 % of observed sales (Dolliver 2015a). The results were subsequently criticized (Aldridge and Décary-Hétu 2015; Van Buskirk et al. 2015) as they did not align with those of other researchers who had monitored cryptomarkets. A replication study has argued that the data on which this study bases its conclusions may be flawed as the results could not be replicated and that Silk Road 2.0 offered more items (12,259 at the least) in the period (Munksgaard et al. 2016). This conclusion is supported by the observations of other researchers who at no point show numbers similar to those of Dolliver (2015a) in terms of items for sale on Silk Road 2.0. and who have criticized the study (Aldridge and Décary-Hétu 2015; Van Buskirk et al. 2015), and the data upon which it is based. In the most recent and methodologically exhaustive study of the cryptomarket economy, the authors suspect that “scrapes might have been incomplete” meaning that the data collection which the study is based upon was not complete (Soska and Christin 2015: 47). We therefore disregard the conclusions reached by this study.

The nature of cryptomarkets offers vendors and buyers certain advantages. The risks of selling and purchasing drugs offline, such as violence, do not exist online. On the contrary, cryptomarkets may lead to less drug-related violence (Van Hout and Bingham 2014; Aldridge and Décary-Hétu 2014). A qualitative study based on 10 interviews with vendors on the original Silk Road showed that vending on cryptomarkets had several advantages: the security built into the system (e.g. Tor, encryption and escrow), the general conduct of business, the ability to sell goods at a higher profit, and the substantial demand. For the interviewed vendors the cryptomarkets presented advantages to traditional dealing. The vendors further noted how advertising and customer service in the form of correct grammar, photographs of the drugs for sale, reputation and stealth were significant components of successful vending on Silk Road (Van Hout and Bingham 2014).

In a single case study of user experiences, Silk Road was described as an “online sweetie shop where you can go and have a pick and mix” [388] by the interviewee (Van Hout and Bingham 2013a). The Silk Road forums also gave users information on products, vendors and harm reduction (Van Hout and Bingham 2013a). The community at least on the original Silk Road, was further characterized by users and vendors with a degree of digital literacy, since accessing the site, purchasing bitcoins and encrypting messages requires a specific skill-set (Barratt 2012; Van Hout and Bingham 2013b).

Cryptomarkets and traditional drug markets

It has been argued that the emergence of a cryptomarket for drugs could reduce some of the harmful social consequences of drug markets (Aldridge and Décary-Hétu 2014; Van Hout and Bingham 2013a). The possible reduction of these consequences is beyond the scope of this paper, but it is important to generate more knowledge of the specific distribution forms created in cryptomarkets. The technical infrastructure and design of cryptomarkets may create new conditions for drug markets, particularly at the retail end of the drug distribution chain (Aldridge and Décary-Hétu 2014; Van Hout and Bingham 2014). This distribution chain moves illicit drugs from manufacturers to exporters/importers, then to wholesalers and retailers and eventually to the consumer (Desroches 2005, 2). It is chiefly the final part of the drug distribution chain that may be affected by the invention of cryptomarkets, because while wholesale of illicit drugs may be a crime “that pays” (Desroches 2005), retailing illicit drugs rarely does because of the risks involved (ibid.). Studies of retail drug dealing show that drugs are often sold to friends and acquaintances in small quantities, for a small profit by dealers who get into dealing mainly as a consequence of their own drug use (Atkyns and Hanneman 1974; Desroches 2005, 2; Fields 1984; Johnson et al. 1985; Murphy et al. 1990). Dealers motivated by profit and who market their products to a large number of clients run an increased risk of arrest (Desroches 2005, 4). Conversely, drug dealers and traffickers on higher levels of the drug market work mainly for profit and at these levels the drug trade has much in common with legal business. As Desroches (2005), 43) puts it: “To be successful, traffickers must provide a quality product at competitive prices and maintain a reputation for reliable and trustworthy service.” Drug retailers in cryptomarkets share some of these characteristics with drug traffickers and wholesalers outside the cryptomarkets.

A number of studies have examined the cryptomarkets using a quantitative approach (Aldridge and Décary-Hétu 2014; Christin 2013; Dolliver 2015a; Soska and Christin 2015). Findings from qualitative studies have shown that cryptomarkets offer a wide range of high-quality products (Van Hout and Bingham 2013b), and that accessing and purchasing the products requires a certain degree of digital literacy (i.e. using Tor and understanding encryption) as well as time. Because of the time that need to be spent to order the products – i.e., investing in digital skills and waiting for the shipments – we hypothesize that cryptomarkets cater to buyers who intend to resell or redistribute the products. Because buyers do not have to order very large amounts at a time, we also hypothesize that most of the buyers may be buying the products for the purpose of social drug dealing. Buying for a group can make up for the extra time spent purchasing bitcoins, tumbling them, transferring them to the marketplace, encrypting communication and purchasing the product. Since it takes just as long to order one gram of MDMA as it does to order 10 g, and the risk of the package being seized may be the same, buyers may as well order for friends. Social dealing is retail dealing (Jacques and Wright 2011) within a network of acquaintances (as opposed to strangers). On the lowest level of social dealing we find that dealers share drugs with friends and expect their friends to do likewise. This form of drug dealing has been termed “social supply” (Coomber and Turnbull 2007). At the higher end of the spectrum of social dealing the retail level begins.

Providing an objective measure of “social dealing” is not possible, so we have based our analysis on an examination of the overall distribution of observed drug purchases (in terms of number of sales and value of sales) combined with a qualitative evaluation of the most sold items. We examined both the general distribution of reviews and the most popular items in nine categories. Coupled with the increasing revenue generated by the cryptomarkets, the growing number of cryptomarkets and the widely publicized fact that drugs can be purchased relatively risk-free online, we hypothesize that larger quantities will be purchased in the cryptomarkets over time. The technological infrastructure and high security, combined with the other previously mentioned factors could, we believe, lead to traditional drug dealers recognizing the potential for a secure sourcing of drugs. Over time, some buyers may also become involved in a dealing “career” as they start to supply friends and acquaintances.

This hypothesis is based both on the requirements for accessing the markets and the availability of high-quality drugs. If users are able to easily procure high-quality substances and share them with acquaintances, they may be able to make an income as a minor-scale supplier, a social dealer.

To examine this hypothesis, we estimate a trend line using a simple linear regression for both Agora and Silk Road 2. We present our results using a simple moving average and a regression trend line based on the daily sales measured using reviews as a proxy. However, as this relies on a broad selection of substances, extrapolating from this is difficult. Soska and Christin (2015) observe that sales volumes differ within categories, and we therefore examine the development within the three largest categories in detail to determine whether the cryptomarket economy shows tendencies towards larger purchases within these categories of illicit substances.

Methods for measuring cryptomarket demand

To examine the demand for illicit drugs in the cryptomarkets we use customer reviews as a proxy for sales. This approach has been used previously to analyze cryptomarkets (Aldridge and Décary-Hétu 2014; Christin 2013; Soska and Christin 2015; Dolliver 2015a). This methodology which falls under the framework of “web-o-metrics” is defined by Björneborn and Ingwersen (2004): 1216) as “(1) Web page content analysis; (2) Web link structure analysis; (3) Web usage analysis (including log files of users’ searching and browsing behavior); (4) Web technology analysis (including search engine performance)”. This is a broad definition that draws on bibliometric and scientometric applications of online data and research into cryptomarkets commonly uses online data to download, or “mirror”, an entire website (Soska and Christin 2015; Aldridge and Décary-Hétu 2014; Dolliver 2015a). We refer to this method of data collection as “web crawling”, as it consists of “bulk downloading of web pages” (Olston and Najork 2010: 176), and, to stay within this terminology, refer to downloads of a site as “crawls”.

As shown both by previous research into cryptomarkets (Van Hout and Bingham 2014) and research into legal Internet trade (Standifird 2001) product reviews are highly important for a vendor’s success. Therefore, cryptomarkets often require users to review the products after the purchases are finalized. And since markets, vendors and buyers depend on these reviews for their success, using reviews as a proxy provides a good indicator of sales volume (for a discussion of the reliability of this measure, see Soska and Christin 2015). However, we acknowledge that vendors may purchase their own product to establish credibility thus inflating the number of perceived sales. The measure could be affected by this, and should therefore not be considered as an absolute reflection of sales volumes.

Data collection and extraction

The data collection from Silk Road 2.0 and Agora Marketplace was originally conducted using a simple web crawler, DrugBot, programmed in R using the packages RCurl, an interface for the libcurl library, stringr and XML (Lang and the CRAN Team 2015a; Lang and the CRAN team 2015b; Wickham 2015). Data was collected from February 28th to June 2nd 2014, and a total of six crawls were conducted. To expand the dataset further we were granted pre-publication access to Gwern Branwen’s et al. (2015) collection of crawls, collected using wget, from both marketplaces since their inception. As such, the dataset consists of crawls from February 28th 2014 to April 2015.

The crawler operates by first visiting the front page of the marketplace and downloading the HTML source, after which the crawler follows hyperlinks extracted from the HTML according to a set of rules (e.g. not downloading images, only downloading relevant pages). The process is repeated until the site has been crawled completely and every intended page has been downloaded and stored. The dataset extracted from the crawls by Branwen is not as thorough as those collected by our crawler. DrugBot, our custom crawler, attempts to download pages again if the server responds with a “404 – Page not found”, which will frequently happen as markets tend to go offline for one reason or another (e.g. DDoS, high-volume traffic, maintenance). Branwen used wget and did not attempt to download pages if they presented an error, as our crawler did. As such the data from Branwens crawls is not fully exhaustive. However, given that crawls are frequent, typically weekly, and Branwen has downloaded millions of pages of interest (reviews and products) in total, this should not be considered as a methodological shortcoming, since the questions we seek to answer do not require complete datasets.Footnote 1

Information on pages (e.g. reviews, product descriptions and prices) was extracted using a combination of XPath and regular expressions. Every observed item for sale was added to a database with the price set as the lowest observed price in all the conducted crawls. This measure is opposed to that used by Christin and Soska (2015), who set prices using a more complex heuristic. Our motivation for this is partly pragmatic, as items may be listed at exorbitant prices if the vendor is out of product, thus ensuring that buyers do not order the product, leading us to a higher number of items and reviews priced correctly in the dataset, as well as our emphasis on purchase price. Prices were converted to USD using the daily weighted average exchange rate on BitStamp. Silk Road 2.0 reviews were extracted from pages presenting items for sale and the vendor profiles. For Agora the pages containing feedback on items were used.

As vendors individually choose which categories to list their items in, relying simply on the categorization presented by the marketplace will skew the data. For example, a substance like bk-MDMA will be found in both the categories of research chemicals and ecstasy, and Adderall will be found in both the categories of Stimulants and Prescription Drugs (Dolliver 2015a). The categorizations we apply are inspired by the qualitative coding in previous studies (Aldridge and Décary-Hétu 2014; Dolliver 2015a), the UNODC categorization of illicit substances (UNODC 2003) but is based on those presented by the marketplaces which are generally similar. Qualitative coding has the strengths discussed above, but is highly time-consuming. It is also worth noting that this coding does not identify: a) whether a product is contaminated (e.g. speed sold as ecstasy), b) that a large part of prescription medication (in particular benzodiazepines) are made from sourced ingredients pressed into pills, and c) that the categories are broad and contain differing substances. We further discarded items that were categorized by marketplaces as steroids or that frequently appeared in the category (e.g. Clomid). Table 1 shows our categorizations identifying nine broad genres of illicit substances offered on the markets studied.

Table 1 Categorizations of items
Full size table

Vendors on Silk Road 2 and Agora could list custom orders. This allows the vendor to, for example, sell a different quantity, offer a discount or sell larger amounts. Not all custom orders have a description from which it can be deduced whether the item is a drug. We chose to include every custom order that was not explicitly described as a non-drug item (e.g. weapons, credit card information, eBooks or steroids). Reviews were extracted from both vendor and item pages in the marketplaces. The review contains text, an indicator of recentness in days and a rating. By subtracting the “[T] days since”, indicating the recentness of a review, we estimated the date on which the review was written.

Reliability and validity

Following discussions about the reliability and validity of results in cryptomarket research (Munksgaard et al. 2016; Van Buskirk et al. 2015; Aldridge and Décary-Hétu 2015; Dolliver 2015b), we acknowledge some shortcomings in the reliability of our data and the validity of our measurements. However, as our study does not focus on the overall sales volume, but on purchase sizes, we consider our dataset as large samples. To answer the questions posed, a complete database of all sales is not necessary. The shortcomings of our data are primarily due to: a) the incomplete crawls conducted by Branwen and b) possible duplicated reviews and the “crude” removal of these.

Although data is gathered automatically, the method and process are susceptible to errors (Munksgaard et al. 2016). The web crawler adheres to a set of rules which in conjunction with the method leads to issues regarding the data collection and the construction of a dataset for analysis. The particular nature of the cryptomarkets also presents problems. The need for anonymity and secrecy when it comes to business operations and operational security for vendors and buyers, as well as the need to avoid profiling by law enforcement, means that marketplaces, vendors and buyers will take steps to obfuscate their practice and protect their anonymity. Agora presented only a limited number of reviews on each item page, and older reviews seemed to be either purged or unavailable, as opposed to Silk Road 2.0, where the reviews were available dating back months, with a link to the reviewed items if they were still for sale. During the process of data extraction from Agora, a peculiar pattern of seemingly identical reviews on different dates was observed. The suspected duplicate reviews, identified by their similar characteristics (rating, review text and product) rather than their dates were removed from the dataset. For Silk Road 2.0, we removed suspected duplicate reviews based on their identical review texts and the product in question. In both cases, we kept only the first observation of the duplicated values. This “crude” approach likely also removes reviews which are not duplicated, but as we are not concerned with the overall size of the cryptomarket economy this does not present a methodological problem.

Results

Cryptomarket demand

Between 28 November 2014 and 23 April 2015, we observed a total of 51,344 unique items sold that we categorized as drugs and 793,825 reviews of these, indicating sales. Approximately 66 million USD in sales was observed on Silk Road 2.0 and 61 million USD on Agora. Given our use of partial crawls, the crude removal of duplicated values and our setting of prices as the lowest observed, the actual numbers in both cases can be considered to be higher.

The largest purchases observed were two custom orders on Agora at 87,256 USD each. The majority of the observed reviews were of items in the category of Cannabis (238,914 reviews) which was further responsible for 28.51 % of the revenue generated.

We hypothesize that cryptomarkets cater to a specific group of buyers, primarily individuals who purchase amounts intended for themselves and their social networks. Buying for a group can make up for the extra time spent purchasing bitcoins, transferring them to the marketplace, encrypting communication and purchasing the product. Buyers may as well order for friends and acquaintances. First because it takes just as long to order one gram of MDMA as it does to order 10 g. Secondly because the risk is much the same given that trading illicit drugs on the darkweb until now has been extremely difficult for law enforcement agencies to penetrate. As “personal use” and “social dealing” are relative terms as regards both quantity and value, we examined both the general distribution of reviews and the most popular items in the eight categories (Table 2).

Table 2 Revenue and sales within coded categories
Full size table

Graph 1 shows the distribution of sales on both Silk Road 2 and Agora on a scale from 0 to 1000 USD in intervals of 50 USD. A number of reviews are not included in the graph, as the items cost more than 1000 USD. A total of 16,688 reviews for items over 1000 USD were observed, amounting to 2.1 % of the observed 793,825 reviews. The distribution of the value of reviewed items can be further inspected by reviewing the items sold. As our database contains more than 51,344 unique items sold, it is not possible to evaluate every single item. Instead we examined the bestselling item in each category in intervals of 0–100 USD, 101–200 USD and 201–300 USD, the intervals within which 89.6 % of the observed reviews fall.

Graph 1
figure 1

Distribution of sales in intervals of 50 USD

Full size image

Table 3 shows the most popular items in the different categories in intervals of 0–100, 101–200 and 201–300 USD. While it is evident that the quantities differ, 20 doses of LSD, an ounce of cannabis or 0.5 g of heroin, found in the price range of 201–300 USD, could be for social supply and personal use. The most popular items are in quantities that are either suited for one person’s use or a small supply for acquaintances, for example 1 g of cocaine, an ounce or less of cannabis, or a heroin stamp bag. The overview thus indicates that items priced at 300 USD or less are bought with personal use or social dealing in mind. The exceptions to this are found in the category Research Chemicals and NPS, where we find 900 Nbome-blotters and 14 g of mephedrone as well as the 100 g of speed paste in the category of Stimulants. These amounts we deem too large to just be intended for social supply or personal use and thus to be indicative of redistribution.

Table 3 Most popular items in 9 categories
Full size table

89.6 % of the sales we observed were of items valued at 300 USD or less. While most sales fall within the lower price ranges, large quantities are still being purchased on the cryptomarkets. 10.4 % of sales are above 300 USD and 2.1 % of these are above 1000 USD. The 2.1 % of sales above 1000 USD constitute 31 % of the revenue generated. The majority of sales, however, do fall within low price ranges.

Changes in cryptomarket demand

Our second hypothesis is that the quantities purchased on the cryptomarkets will grow larger as dealers recognize the potential for sourcing drugs using the cryptomarkets. Due to the suspected obfuscation of review dates on Agora and the different nature of the two markets, we have analyzed the markets separately. To investigate whether the demand for larger quantities is growing, we measure the development of demand by using a simple linear regression model for both markets, with price as the dependent variable and time as the predictive variable, to construct a simple trend line. Graphs 2 and 3 show a seven-day moving average of the value of purchased items and a trend line based on the observed sales.

Graph 2
figure 2

Trends in purchase sizes on Silk Road 2.0

Full size image
Graph 3
figure 3

Trends in purchase sizes on Agora Marketplace

Full size image

The linear regression trend line of purchases on Silk Road 2.0 shows a significant decline (p < 2.2e-16) in the average value of purchases with a coefficient of −0.1550 USD per day. In March and April we observed a steep rise in the average size of purchases, which we lack explanations for. In February of 2014 Silk Road 2.0 was allegedly the victim of a hack, after which the site operated without escrow services until its seizure. Given that a number of days is to be expected to pass between the purchase and review of an item, this increase in purchase sizes may be indicative of larger purchase sizes that were sold while the escrow system was still in existence and only reviewed afterwards. It is also possible that after the theft buyers and vendors simply chose to conduct large deals off-site rather than on-site, while smaller purchases continued to be conducted on-site.

As with Silk Road 2.0, Agora Marketplace showed a tendency towards smaller purchase sizes over time. We found a significant (p = 8.637e-05) negative coefficient (−0.02316756), attesting to a decline in the size of purchases on Agora Marketplace as well.

We further examined trends in the three largest categories, Ecstasy, Cannabis and Stimulants, which account for 69 % of the total revenue. Only in the case of Cannabis did we find a significant tendency (p = 4.359e-05) towards larger purchases, whereas Ecstasy (p = 3.257e-06) and Stimulants (p < 2.2e-16) both showed a significant tendency towards smaller purchases (Graph 4).

Graph 4
figure 4

Trends in purchase size in three largest categories

Full size image

Discussion

We further estimated the daily average sales volume on the markets as 264,982 USD on Silk Road 2 and 98,653 USD on Agora. Aggregating this number by 365 days yields 132.7 million USD, a very rough estimate of a lower bound for a yearly revenue on Agora and Silk Road 2. However, given the proliferation of new cryptomarkets, the general trend towards larger revenues (Aldridge and Décary-Hétu 2014) and the obfuscation of sales dates on Agora, we believe this number may be significantly higher.

By way of comparison, in 2003 the UNODC estimated that the size of the global illicit drug market was 13 billion USD at production level, 94 billion USD at wholesale level and 322 billion USD at retail level (UNODC 2005: 127). However, the UNODC’s estimations have been challenged by researchers as being too high (Kilmer and Pacula 2009; Reuter 2009b). Kilmer and Pacula (2009) do not give a total estimate for all drugs globally, because the uncertainty would be too great across countries, drugs and prices. But they do make an estimate of the size of the global cannabis market, which is considerably lower than the UNODC’s estimate. Kilmer and Pacula’s best estimate of the size of the global cannabis market in 2005 was 70 billion EUR, while the UNODC’s estimate for 2003 was 130 billion EUR. The difference is largely due to different assumptions about average use and average price. Of the estimated lower bound of 132.7 million USD revenue on Agora and Silk Road 2, the sale of cannabis would constitute 29.5 million USD.

In total we found 105 million USD in sales on Silk Road 2.0 and Agora Marketplace in 2014. Soska and Christin (2015) observed that the cryptomarkets reached a daily revenue >600.000 USD in 2014. Our results and those of Soska and Christin (2015), suggests that in comparison to both the global market for drugs and the global cannabis market the cryptomarkets only make up a small proportion of these. While the revenue is increasing rapidly, the markets are still very small in a global context. The first quantitative study of Silk Road concluded that the demand was primarily for items for personal use, such as a few grams of cannabis (Christin 2013: 12). However, recent research has concluded that the main revenue comes from bulk sales to vendors (Aldridge and Décary-Hétu 2014). While these are differing conclusions as to the type of demand, our results support both interpretations of the data. The majority of purchases are for smaller amounts, such as single grams of cocaine or heroin stamps, and it is likely that they are intended for social dealing or personal use. However, the most revenue is generated from larger quantities. These observations are not conflicting: the majority of purchases are of smaller quantities suited for personal use and social dealing, while the real revenue is generated in the upper price ranges. These observations correspond with existing research into illicit drug markets, which has found that the biggest profits are made in the upper levels of the drug market (Reuter 2009a: i).

We hypothesized that the quantities purchased on the cryptomarkets would grow significantly in the course of our study. This hypothesis was tested by fitting a simple linear regression model to the sales observed. The model showed a significant decline in terms of purchase values for both Silk Road 2.0 and Agora Marketplace. In broad terms the data do not suggest a tendency towards larger purchases. However, in the category of cannabis where most revenue was generated we observed a significant tendency towards larger purchases.

These results suggest that in spite of higher revenue and increased public exposure, cryptomarkets do not show signs of becoming distribution hubs for larger quantities. Buyers purchase products in differing quantities and amounts, but we did not observe a tendency towards larger sales in the span of our study. The fact that most purchases are not indicative of redistribution apart from social dealing and that we observed no significant growth in purchase sizes could suggest that the market is not changing drastically in terms of purchasing patterns.

The significant decrease of the average purchase price on Silk Road 2.0 may be explained by the absence of escrow services on Silk Road 2.0 following an alleged theft in February. Without escrow it is necessary to place trust in the vendor rather than the technology and marketplace. The lack of escrow may therefore lead to unwillingness to purchase larger quantities. However, although Agora operated with escrow we did not observe a tendency towards larger purchases there either. Another explanation for this development could be that larger purchases are made outside of the cryptomarkets to increase anonymity and save on commissions, though this would mean they would have to be conducted outside escrow as well.

The evidence presented in this study shows that drug purchases on Silk Road 2.0 and Agora largely follow a pattern that is well known in the “normal” face-to-face market. We see a large percentage of purchases for personal use and/or social dealing and a smaller number of deals made with the intention of resale for profits. However, the business-to-business dealing on the cryptomarkets generates most of the revenue. Thus drug buyers on cryptomarkets follow some of the same patterns as in the “normal” drug market and do not act as if cryptomarkets are decriminalized.

Ethical considerations

Our methodology and field presented us with particular ethical considerations. These are not necessarily representative of the broader spectrum of webcrawling and methodologies for gathering and analyzing the vast amounts of data available online, though they do provide examples of the complexity of the methodology. Much online research is conducted using APIs offered by companies and sites such as Facebook, Google and Twitter. An API will often have terms of use which the researcher must abide by. While no formal standard for crawler behavior exists, we believe a balanced approach to crawling websites, especially on the darkweb, is vital. Previous quantitative research of Silk Road has considered the implications of the methodology, though researchers have still conducted fast crawls (Aldridge and Décary-Hétu 2014; Christin 2013). It is our opinion that using too much bandwidth poses a risk for further research, as marketplace owners may take steps to block researchers. Furthermore, large crawls put additional pressure on the Tor network. Large-scale use of the Tor network for research purposes can make the network slower for regular users, who can include people browsing sites blocked by their governments, such as Twitter. Tor is notoriously slow, hidden services are even slower, and extensive crawls use a significant amount of bandwidth from both the Tor network and the website. In order to maximize the amount of data gathered while minimizing any obstruction of business, our custom crawler operated at different speeds adjusted by the time spent downloading the page. The crawler, so to speak, takes “a step back” if the marketplace is busy in order not to disturb business. This can also be a valid strategy in order to encounter measures taken by the webpage administrators to prevent their pages to be crawled (Aldridge and Décary-Hétu 2015).

Because the web crawler downloads every page on the marketplace, it does not behave as a normal user, and thus can as pointed out by Aldridge and Décary-Hétu (2015) potentially arouse the suspicion of the administrators of the markets. It could resemble a law enforcement operation, or a hacker probing for security weaknesses or gathering data for account phishing.Footnote 2 If too many page requests are sent, the crawler’s behavior may also resemble a denial-of-service attack and take up too much bandwidth from “legitimate” use of the marketplace. In order to identify ourselves, we sent a string of text as the user agent for every page request, identifying the crawler and its purpose, along with the means of securely communicating with us. A public PGP key was created to allow for encrypted communication between us and the owners of the marketplace, using either the internal messaging system or a safe-mail.net account in case they wished to contact us. Instructions for communicating securely with us were given via the user agent. No owners or administrators contacted us, though we are certain that they were aware of us. Other quantitative studies of cryptomarkets have either not addressed whether the researchers should identify themselves to the marketplace administrators (Aldridge and Décary-Hétu 2014) or an anonymous approach has been used (Christin 2013; Dolliver 2015a).

Despite employing a newer methodology, our ethical choices are grounded in the traditional ethical concerns of criminology and social science in general. Our practice of identifying ourselves and seeking a type of consent from the administrators is different from traditional approaches, but given the field of study it is not possible to ascertain informed consent from all users. The data remains public and is already anonymized, and the markets are likely monitored by law enforcement, so in this respect our study does not endanger the population.

Considerations of the consequences of fieldwork are common concerns in criminology as well as social science. Utilizing new methodologies and relying on automated tools does not absolve researchers from the need to reflect on the ethical issues inherent in the research. While online localities are not equivalent to traditional fields of research, it is possible to draw on traditional considerations in criminological and social science research, for example those expressed in the Code of Ethics of the British Society of Criminology (2015) and the American Sociological Association (2008). We hope that our approach will ensure that in future marketplace owners do not consider researchers as adversaries due to the effects of our fieldwork and will continue to allow us to research these particular new markets. We are grateful that neither the administrators of Silk Road 2.0 nor Agora Marketplace chose to block our crawls.

Further research

This study focused on broad trends on the markets and within categories. Our method for setting the price of an item, as the lowest price observed, may underestimate or skew the results. It is further possible that demographic trends in the user base affect both demand and supply patterns on cryptomarkets. In particular, we note, that prices in Australia are much higher than those outside. Further research may well use the information on where products are shipped from, and where they may be shipped to.

This study is one of the few quantitative studies of the cryptomarkets. While previous studies have garnered both academic interest and popular fascination, research quickly comes to seem outdated as the revenue grows and the popularity of the cryptomarkets increase. Little is known about the demographics of the people who use cryptomarkets, especially from a quantitative point of view, and the available data, apart from reviews and listings, is sparse. The 2013 Global Drug Survey did gather data on the users using cryptomarkets (Barratt et al. 2014), but the fact that most participants were experienced users makes it difficult to generalize the results. However, the results are promising, and further quantitative and qualitative research based on them will contribute to examining the cryptomarkets’ demand.

Cryptomarket databases would present a treasure trove of highly relevant data for research. In the context of social drug dealing, it could be hypothesized that some users may become drug dealers as they realize the potential in providing friends and acquaintances with high-quality drugs. This tendency has been observed in previous criminological research of social drug dealing (Järvinen and Ravn 2011). As identified by EMCDDA (2015) social media platforms and apps are becoming more widespread used in drug dealing and as such provide outlets for drugs accessed from cryptomarkets. As such it may be relevant to follow if and how new careers of drug dealing may be a consequence of such changes in (and uses of) technologies. Marketplace databases could be used to examine buyers’ careers and provide an insight into whether cryptomarkets affect drug-dealing careers, a subject that is difficult to study quantitatively, if not impossible, by using the publicly available data used until now.

This study relies on qualitative studies of cryptomarkets and their users and vendors, and the importance of this research is evident throughout this study. However, as the cryptomarkets change and grow, further research and monitoring is needed. Studies of the user base and the vendors operating on the cryptomarkets can contribute to a deeper understanding of whether and how the cryptomarkets are changing traditional criminal scripts. Furthermore, it is vital to understand the appeal of the cryptomarkets, especially with regard to the buyers. To understand the motivations for using the cryptomarkets, it is necessary to examine how buyers conceptualize the risks associated with their use of the markets.

Conclusion

Our analysis showed that the observed demand, measured in terms of reviews, is primarily for quantities intended for personal use or social drug dealing. The majority of reviews fall within the lower price ranges, although a significant part of the revenue is generated in price ranges that suggest business-to-business dealing, i.e. drugs intended for redistribution. 2.1 % of the reviews are for products above 1000 USD, trades that make up 31 % of the generated revenue. 89.6 % of the trades is for products below 300 USD. Cannabis, stimulants and ecstasy make up the vast majority of drugs traded, being responsible for 69 % of the revenue generated.

Furthermore, our results indicated that the cryptomarkets did not show a tendency towards larger purchases. This suggests that the cryptomarkets do not show signs of changing in terms of the quantities purchased. Examining the three largest categories, Cannabis, Stimulants and Ecstasy, we found that there was only a significant tendency towards larger purchases in the category of Cannabis. The results suggest that the cryptomarkets resemble traditional drug markets in terms of the distribution of sales and revenues. However, beyond the finding that the cryptomarkets did not in general evolve towards larger purchases, and as such redistribution, we still need research that addresses how the cryptomarket impact the wider drug markets. Lavorgna (2014) finds that there may be differences in the crime scripts for internet-mediated drug trafficking between synthetic drugs (in our case Ecstasy and part of the stimulant category) and natural occurring and semi synthetic (in our case Cannabis and some parts of the stimulant category). Lavorgna (2014) pays special attention to the stages within the drug trafficking and points towards that the communicative strategies and informational opportunities may be related differently to different forms of criminal behaviours. The cryptomarkets have very well developed online discussion forums which could be studied in order to gain further knowledge on the supply and redistribution activities that is quantified within this paper.

This study has established and further developed a methodology for monitoring the cryptomarkets for drug trades. Methodologically we have contributed to the field by emphasizing that research into cryptomarkets should engage with and evaluate data qualitatively as regards the categorization of items. In terms of ethical challenges, we have further argued that research into cryptomarkets should draw on the ethical considerations faced in traditional criminological research.