WEBVTT 1 00:00:00.120 --> 00:00:02.919 You probably think you know exactly how big the Internet is. 2 00:00:03.000 --> 00:00:04.919 Right, Oh? Absolutely, I mean we all kind of assume 3 00:00:04.919 --> 00:00:05.160 we do. 4 00:00:05.360 --> 00:00:08.800 Yeah, because you use it every single day. You check 5 00:00:08.880 --> 00:00:11.839 the news, you stream videos, you buy things on amazons, 6 00:00:11.839 --> 00:00:13.039 scroll through social media. 7 00:00:13.240 --> 00:00:15.839 It feels completely infinite, it really does. 8 00:00:16.120 --> 00:00:18.800 But the truth is the Internet you know and interact 9 00:00:18.839 --> 00:00:21.440 with it is just four percent of what is actually. 10 00:00:21.160 --> 00:00:22.800 Out there, just a tiny fraction. 11 00:00:23.039 --> 00:00:26.199 Right, You are basically staring at the bright, sunlit tip 12 00:00:26.359 --> 00:00:31.440 of this massive iceberg, completely ignoring the gigantic, invisible and 13 00:00:31.519 --> 00:00:36.200 honestly sometimes highly dangerous world lurking deep beneath the freezing water. 14 00:00:36.200 --> 00:00:39.079 And the vast majority of the Internet's sheer mass is 15 00:00:39.200 --> 00:00:40.799 permanently submerged down there. 16 00:00:40.920 --> 00:00:41.520 Exactly. 17 00:00:41.640 --> 00:00:45.600 It is hidden away, fundamentally invisible to standard search engines 18 00:00:45.600 --> 00:00:49.640 like Google, and entirely inaccessible unless you know exactly where 19 00:00:49.640 --> 00:00:51.640 to look and know how to actually get there. 20 00:00:52.240 --> 00:00:55.000 So today we are taking a deep dive into those 21 00:00:55.119 --> 00:00:58.679 hidden layers. We are drawing from this really extensive academic 22 00:00:58.719 --> 00:01:02.759 and professional guide called Dark Web Investigation, Security, Informatics, and 23 00:01:02.840 --> 00:01:04.040 Law Enforcement. 24 00:01:04.000 --> 00:01:07.439 Edited by Bubback Agar and a whole team of researchers. 25 00:01:07.560 --> 00:01:10.879 Yes, great source material and Our mission today is to 26 00:01:10.920 --> 00:01:14.439 give you an absolute shortcut being truly well informed about 27 00:01:14.439 --> 00:01:16.480 this hidden digital geography. 28 00:01:16.040 --> 00:01:18.159 Because there is so much misinformation out there. 29 00:01:18.200 --> 00:01:20.560 Oh totally. We are going to cut right through the 30 00:01:20.599 --> 00:01:23.480 Hollywood hacker myths, you know, the guys in hoodies typing 31 00:01:23.680 --> 00:01:28.840 furiously in dark neonlit rooms, to understand how the dark 32 00:01:28.879 --> 00:01:31.159 web actually functions on a technical level. 33 00:01:31.159 --> 00:01:34.159 And the surprisingly mixed bag of people who actually rely 34 00:01:34.280 --> 00:01:35.200 on it for survival. 35 00:01:35.319 --> 00:01:38.280 Yeah, plus the high stakes invisible war playing out right 36 00:01:38.319 --> 00:01:42.560 now between global law enforcement and massive criminal syndicates. 37 00:01:42.719 --> 00:01:47.200 It really is a digital space defined entirely by absolute anonymity. 38 00:01:46.599 --> 00:01:48.079 Which is wild to think about. 39 00:01:48.200 --> 00:01:51.239 It is, and that core feature is what makes it 40 00:01:51.280 --> 00:01:55.599 an incredibly powerful tool for human rights and simultaneously an 41 00:01:55.599 --> 00:01:58.480 incredibly dangerous haven for illicit activity. 42 00:01:58.599 --> 00:02:01.280 Okay, let's unpack this, because to really understand what the 43 00:02:01.359 --> 00:02:03.959 dark web is, we have to start by drawing a 44 00:02:04.040 --> 00:02:05.439 map of the Internet itself. 45 00:02:05.480 --> 00:02:07.000 That is a great place to start. 46 00:02:06.799 --> 00:02:10.479 Because people throw around the words Internet and Worldwide Web constantly, 47 00:02:10.639 --> 00:02:12.719 usually acting like they mean the exact same. 48 00:02:12.520 --> 00:02:16.240 Thing oh all the time. Yeah, But diving into the research, 49 00:02:16.479 --> 00:02:21.719 it becomes glaringly obvious that they represent two entirely different concepts. 50 00:02:22.400 --> 00:02:25.159 That distinction is really the foundational building blog for this 51 00:02:25.360 --> 00:02:31.199 entire topic. The Internet is the actual physical and logical infrastructure. 52 00:02:30.560 --> 00:02:31.599 Like the cables and stuff. 53 00:02:31.840 --> 00:02:36.800 Exactly. It is the massive global network of networks. It 54 00:02:36.879 --> 00:02:40.439 consists of the physical fiber optic cables running across ocean floors, 55 00:02:40.800 --> 00:02:43.439 the satellite links, the physical servers. 56 00:02:43.039 --> 00:02:46.319 And they all communicate via Internet Protocol. 57 00:02:45.919 --> 00:02:49.159 Right IP, Yes, via IP. So think of the Internet 58 00:02:49.199 --> 00:02:51.919 as the physical roads, the bridges, and the highways of 59 00:02:51.960 --> 00:02:52.800 the digital world. 60 00:02:53.000 --> 00:02:54.080 Okay, that makes sense. 61 00:02:54.159 --> 00:02:56.199 The World Wide Web, on the other hand, was invented 62 00:02:56.199 --> 00:02:59.280 by Tim berners Lee back in nineteen eighty nine, and 63 00:02:59.319 --> 00:03:02.400 the Web is one specific way of sharing information over 64 00:03:02.439 --> 00:03:04.039 those roads using HTTP. 65 00:03:04.400 --> 00:03:06.599 So the Internet is the highway system and the world 66 00:03:06.599 --> 00:03:09.280 Wide Web is just the commercial traffic driving on those 67 00:03:09.280 --> 00:03:12.120 specific roads. Perfect way to look at it, and that 68 00:03:12.199 --> 00:03:15.960 traffic is divided into distinct layers. The very top layer 69 00:03:16.039 --> 00:03:17.039 is the surface web. 70 00:03:17.159 --> 00:03:19.479 The part we all know right this is that. 71 00:03:19.439 --> 00:03:22.039 Four percent of the iceberg sitting above the water. It 72 00:03:22.120 --> 00:03:28.840 is indexed by search engines Google, Bing, Wikipedia, Amazon, the 73 00:03:28.879 --> 00:03:31.360 blog you read this morning, that is all surface web. 74 00:03:31.599 --> 00:03:35.639 Because search engine algorithms use automated spiders to literally crawl 75 00:03:35.879 --> 00:03:37.240 from link to link. 76 00:03:37.120 --> 00:03:39.120 Logging everything they find so you can just search for 77 00:03:39.159 --> 00:03:40.280 it later exactly. 78 00:03:40.719 --> 00:03:43.360 But those spiders hit a brick wall the second they 79 00:03:43.400 --> 00:03:46.680 encounter a login screen or password prompt or a paywall, 80 00:03:46.800 --> 00:03:50.240 they just stop. They cannot crawl past those barriers, and 81 00:03:50.280 --> 00:03:53.479 that plunges you underwater into the remaining ninety six percent 82 00:03:53.520 --> 00:03:55.800 of the Internet, which we call the deep web. 83 00:03:55.800 --> 00:03:59.039 The deep web, which sounds super sketchy, but it's really not. 84 00:03:59.319 --> 00:04:01.800 No, not at all. It is massive, and it is 85 00:04:01.960 --> 00:04:04.840 entirely unindexed. But you interact with the deep web on 86 00:04:04.879 --> 00:04:05.599 a daily basis. 87 00:04:05.680 --> 00:04:09.080 Yeah, it holds your personal medical records, your online banking dashboard, 88 00:04:09.319 --> 00:04:13.879 academic databases, private corporate intranets, anything behind a password. 89 00:04:14.039 --> 00:04:17.720 The numbers on that are staggering. The research highlights a 90 00:04:17.800 --> 00:04:19.000 highly specific ratio. 91 00:04:19.399 --> 00:04:21.480 Oh right, the data sources down. 92 00:04:21.399 --> 00:04:24.120 On the deep web. There are three point four structured 93 00:04:24.160 --> 00:04:27.319 data sources for every one unstructured source. 94 00:04:27.480 --> 00:04:32.160 Meaning it isn't some chaotic wasteland. It is primarily just 95 00:04:32.360 --> 00:04:35.759 heavily organized, highly private data silos. 96 00:04:36.040 --> 00:04:36.480 Exactly. 97 00:04:36.560 --> 00:04:38.920 Wait, so if I'm picturing this right, the surface web 98 00:04:39.040 --> 00:04:42.639 is basically a public library. Anyone can walk through the 99 00:04:42.639 --> 00:04:45.839 front doors, browse the main catalog, pull a book off 100 00:04:45.879 --> 00:04:49.720 the shelf. Sure, the deep web, that massive ninety six 101 00:04:49.800 --> 00:04:53.040 percent is the secure archive down in the basement of 102 00:04:53.040 --> 00:04:54.240 that exact same. 103 00:04:54.120 --> 00:04:55.800 Library where you need special access. 104 00:04:56.040 --> 00:04:58.519 Right, you need a staff I D card or specific 105 00:04:58.600 --> 00:05:01.439 password just to view your own personal tax records. 106 00:05:01.519 --> 00:05:02.680 That is a great analogy. 107 00:05:02.800 --> 00:05:04.480 But then we get to the dark web, and the 108 00:05:04.560 --> 00:05:07.360 dark web is like a secret vault hidden behind a 109 00:05:07.399 --> 00:05:10.319 fake bookshelf in that basement. I love that you need 110 00:05:10.399 --> 00:05:14.800 a highly specific encrypted physical key justifying the door, let 111 00:05:14.839 --> 00:05:16.000 alone actually open it. 112 00:05:16.120 --> 00:05:19.000 What's fascinating here is that the technology used to build 113 00:05:19.000 --> 00:05:24.519 that secret vault wasn't created by rogue hackers or criminal syndicates. 114 00:05:24.040 --> 00:05:25.560 Which is what everyone assumes. 115 00:05:25.879 --> 00:05:28.639 Oh absolutely, but it was actually developed in the mid 116 00:05:28.720 --> 00:05:32.120 nineteen nineties by the United States Naval Research Laboratory. 117 00:05:32.360 --> 00:05:33.839 The US military built it. 118 00:05:34.040 --> 00:05:41.120 Yes, the military's original goal was to anonymize TCP based applications. 119 00:05:40.519 --> 00:05:43.680 And to clarify that for everyone. TCP is essentially the 120 00:05:43.720 --> 00:05:48.639 fundamental language computers used to establish a reliable connection and exchange. 121 00:05:48.279 --> 00:05:51.240 Data, kind of like the postal service tracking system for 122 00:05:51.319 --> 00:05:51.800 the Internet. 123 00:05:51.959 --> 00:05:54.439 Right, So the Navy needed a way to mask that 124 00:05:54.560 --> 00:05:59.600 tracking to protect field operatives, intelligence gathering, and spies operating 125 00:05:59.639 --> 00:06:00.720 over seat Exactly. 126 00:06:00.800 --> 00:06:03.639 It was entirely built by the government to protect its own. 127 00:06:03.480 --> 00:06:07.360 People, which brings us to the actual architecture of that anonymity. 128 00:06:07.680 --> 00:06:10.600 Because knowing that a hidden volt exists is one thing, right, 129 00:06:10.879 --> 00:06:14.000 But how do people actually get inside without leaving a 130 00:06:14.079 --> 00:06:17.480 massive trail of digital breadcrumbs for anyone to follow. 131 00:06:17.600 --> 00:06:20.399 Well, you cannot just open up standard browsers like Chrome 132 00:06:20.519 --> 00:06:22.839 or Safari and stumble into the dark web. 133 00:06:22.959 --> 00:06:23.959 No, that won't work at all. 134 00:06:24.079 --> 00:06:28.000 Users rely on highly specialized overlay networks, and the most 135 00:06:28.000 --> 00:06:28.959 famous of these is. 136 00:06:28.920 --> 00:06:31.120 TOR, which sanse for the Onion router. 137 00:06:31.480 --> 00:06:36.079 Yes, the Onion router. Tour takes your Internet data and 138 00:06:36.240 --> 00:06:39.720 encapsulates it in multiple complex layers of encryption. 139 00:06:39.720 --> 00:06:42.959 Literally mimicking the layers of an onion precisely. But how 140 00:06:42.959 --> 00:06:45.160 does that actually mask your identity? I mean, if I 141 00:06:45.240 --> 00:06:47.000 send a message, it still has to get from my 142 00:06:47.040 --> 00:06:49.040 computer to its destination somehow. 143 00:06:49.439 --> 00:06:51.839 That is where the volunteer node system comes into play. 144 00:06:52.399 --> 00:06:55.480 When you connect using TOR, your traffic isn't taking a 145 00:06:55.480 --> 00:06:56.079 direct route. 146 00:06:56.120 --> 00:06:58.639 It bounces around right exactly. 147 00:06:58.240 --> 00:07:02.040 It is bounced haphazardly through a decentralized network of volunteer 148 00:07:02.120 --> 00:07:04.519 computers called nodes all over the. 149 00:07:04.439 --> 00:07:06.360 World, just random people's computers. 150 00:07:06.439 --> 00:07:08.920 Yep, you hit an entry node also called a guard node, 151 00:07:09.040 --> 00:07:11.120 then you bounce to a middle node, and finally you 152 00:07:11.160 --> 00:07:12.360 hit an exit node, and. 153 00:07:12.240 --> 00:07:14.720 That exit node is what sends your request out to 154 00:07:14.759 --> 00:07:15.920 its final destination. 155 00:07:16.120 --> 00:07:19.519 Yes, but here is the genius of the Onion design. 156 00:07:20.360 --> 00:07:24.319 Each node only possesses the cryptographic key to peel off 157 00:07:24.399 --> 00:07:26.000 one single layer of encryption. 158 00:07:26.560 --> 00:07:29.720 Oh wow, so no single computer in the chain has 159 00:07:29.759 --> 00:07:32.680 the full picture exactly. The entry node knows who you are, 160 00:07:32.720 --> 00:07:34.839 but has no idea what data you are sending or 161 00:07:34.839 --> 00:07:38.360 where it's actually going. And the exit node knows what 162 00:07:38.399 --> 00:07:40.839 the data is and where it's going, but has absolutely 163 00:07:40.879 --> 00:07:42.560 no idea who originally sent it. 164 00:07:42.720 --> 00:07:46.519 Precisely the mechanism. Yeah, the chain of custody is completely shattered. 165 00:07:46.560 --> 00:07:48.240 That is incredibly clever, it is. 166 00:07:48.800 --> 00:07:50.920 And if you are trying to visit a hidden service 167 00:07:51.000 --> 00:07:54.600 hosted entirely inside the Tour network, you aren't typing in 168 00:07:54.639 --> 00:07:56.120 a standard dot com address. 169 00:07:56.279 --> 00:07:58.480 Oh no, that looks super weird, very weird. 170 00:07:58.720 --> 00:08:02.360 You have to type a complete letely randomized sixteen character 171 00:08:02.519 --> 00:08:05.279 alphanomeric string that ends in dot onion. 172 00:08:05.720 --> 00:08:07.920 Wait, I have to push back on this volunteer node 173 00:08:07.920 --> 00:08:10.720 system for a second. Sure, if tor relies on the 174 00:08:10.720 --> 00:08:15.000 computers of random volunteers to bounce this heavily encrypted traffic around, 175 00:08:15.519 --> 00:08:18.879 isn't it incredibly dangerous to be that exit node? Ah? Yes, 176 00:08:18.920 --> 00:08:21.680 because that is the specific machine where the traffic finally 177 00:08:21.759 --> 00:08:24.319 leaves the encrypted network and enters the open internet. 178 00:08:24.399 --> 00:08:27.199 Right, you have hit on one of the most significant 179 00:08:27.279 --> 00:08:30.480 vulnerabilities for the people supporting the network. It is a 180 00:08:30.680 --> 00:08:33.720 massive legal risk to run an exit node. I can 181 00:08:33.799 --> 00:08:37.120 imagine because if a user leverages Tour to commit a crime, 182 00:08:37.159 --> 00:08:41.679 say they hack into a financial institution or purchase illegal contraband, 183 00:08:42.320 --> 00:08:45.080 the IP address that shows up on the bank's security 184 00:08:45.159 --> 00:08:47.879 log or law enforcement's radar is not the. 185 00:08:47.840 --> 00:08:49.639 Criminals, it's the volunteers. 186 00:08:49.799 --> 00:08:53.720 Yes, the trail ends abruptly at the IP address of 187 00:08:53.759 --> 00:08:56.960 the volunteer running that exit node. Oh man, So when 188 00:08:57.000 --> 00:09:00.240 global law enforcement starts knocking on doors, the volunteer here's 189 00:09:00.279 --> 00:09:01.320 the first person they visit. 190 00:09:01.519 --> 00:09:05.440 That is terrifying for anyone just trying to support digital privacy. 191 00:09:05.759 --> 00:09:06.399 It really is. 192 00:09:06.679 --> 00:09:09.799 But Tour isn't the only infrastructure down there. The guide 193 00:09:09.919 --> 00:09:13.840 also dives heavily into alternatives like ITWOP and free net, 194 00:09:14.159 --> 00:09:17.320 which take this paranoia to an entirely different level. 195 00:09:17.399 --> 00:09:21.519 Oh definitely. ITWOP stands for the Invisible Internet Project, and 196 00:09:21.600 --> 00:09:25.840 instead of onion routing, it utilizes a concept called garlic routing. 197 00:09:25.679 --> 00:09:27.840 Which sounds like we're just running through the produce syle. 198 00:09:27.919 --> 00:09:29.799 But what does that actually mean mechanically? 199 00:09:30.360 --> 00:09:32.480 Well, the metaphor actually makes perfect sense once you look 200 00:09:32.480 --> 00:09:36.159 at the architecture. Okay, how so in garlic routing, multiple 201 00:09:36.200 --> 00:09:40.200 messages from different users are bundled tightly together like individual 202 00:09:40.240 --> 00:09:43.000 clothes in a single bulb of garlic. Oh icy, So 203 00:09:43.039 --> 00:09:46.720 if anyone intercepts the traffic, it is functionally impossible to 204 00:09:46.759 --> 00:09:50.120 isolate a single message or determine its origin, because they're 205 00:09:50.159 --> 00:09:53.639 all moving as one massive encrypted cluster. 206 00:09:53.799 --> 00:09:54.679 That is brilliant. 207 00:09:54.919 --> 00:09:59.960 Furthermore, ITOP creates separate one way inbound and outbound tunnels 208 00:10:00.080 --> 00:10:00.840 for data. 209 00:10:00.679 --> 00:10:02.000 To make it even harder to track. 210 00:10:02.120 --> 00:10:04.759 Exactly, to make it incredibly difficult for an adversary to 211 00:10:04.840 --> 00:10:09.919 run traffic analysis. Those tunnels expire and completely rebuild themselves every. 212 00:10:09.720 --> 00:10:12.559 Ten minutes, oh every ten minutes, and then you have 213 00:10:12.679 --> 00:10:15.279 free net, which operates on a completely different philosophy. 214 00:10:15.399 --> 00:10:17.240 Yes, free net is entirely different. 215 00:10:17.360 --> 00:10:20.759 It is a decentralized peer to peer network. Like to 216 00:10:20.840 --> 00:10:23.679 even use free net, you are required to donate a 217 00:10:23.720 --> 00:10:26.679 portion of your own computer's hard drive space and your 218 00:10:26.720 --> 00:10:28.320 personal bandwidth right to. 219 00:10:28.279 --> 00:10:30.360 Store encrypted fragments of other people's files. 220 00:10:30.399 --> 00:10:32.759 There are no central servers to take down. The users 221 00:10:32.799 --> 00:10:33.960 literally are the servers. 222 00:10:34.200 --> 00:10:36.440 And we have to look closely at a major update 223 00:10:36.559 --> 00:10:39.840 mentioned in the research regarding free net version point seven 224 00:10:39.879 --> 00:10:40.639 point five. 225 00:10:40.639 --> 00:10:41.879 Right, the darknet mode. 226 00:10:42.039 --> 00:10:44.840 Yes, that update introduced darknet. 227 00:10:44.399 --> 00:10:48.120 Mode, which basically allows users to configure their connection so 228 00:10:48.159 --> 00:10:51.720 they only connect to the nodes of highly trusted friends. Exactly, 229 00:10:51.799 --> 00:10:56.120 you're literally building an invite only, underground private network. It 230 00:10:56.240 --> 00:11:00.879 is entirely isolated from strangers, making it virtually penetrable from 231 00:11:00.919 --> 00:11:01.679 the outside. 232 00:11:02.039 --> 00:11:05.559 The architecture across all these networks is explicitly designed to 233 00:11:05.559 --> 00:11:10.440 make tracking mathematically impossible, and the technology itself, the onion layers, 234 00:11:11.080 --> 00:11:14.559 the garlic bundling, the peer to peer storage, is completely neutral. 235 00:11:14.960 --> 00:11:17.559 It's just mas and code which forces us to look 236 00:11:17.559 --> 00:11:21.399 at a really complicated reality. If the technology is entirely neutral. 237 00:11:21.440 --> 00:11:25.159 Who is actually utilizing these invisible networks on a daily basis? 238 00:11:25.360 --> 00:11:28.440 That specific question is the subject of intense debate among 239 00:11:28.559 --> 00:11:30.159 security researchers. 240 00:11:29.679 --> 00:11:31.960 Because it's not all bad guys, not at all. 241 00:11:32.559 --> 00:11:36.000 The data highlights a fascinating split in how we analyze 242 00:11:36.039 --> 00:11:39.639 the dark web. When researchers deploy machine learning algorithms to 243 00:11:39.679 --> 00:11:43.720 automatically scan and classify dark websites, the algorithms suggest a 244 00:11:43.799 --> 00:11:48.000 ratio of about fifty two percent legal content to forty 245 00:11:48.039 --> 00:11:49.759 eight percent illegal content. 246 00:11:49.919 --> 00:11:52.480 Wait, how is that possible? Almost an even. 247 00:11:52.279 --> 00:11:54.360 Split according to the automated scans. 248 00:11:54.440 --> 00:11:57.360 Yes, how can a computer algorithm and a human researcher 249 00:11:57.399 --> 00:12:00.080 look at the exact same dark web landscape and come 250 00:12:00.159 --> 00:12:02.720 up with numbers that contradict each other? What is the 251 00:12:02.759 --> 00:12:04.320 machine actually missing there? 252 00:12:04.679 --> 00:12:07.519 It really comes down to nuance. An algorithm is often 253 00:12:07.559 --> 00:12:11.440 just looking at raw traffic volume, active domains, or counting pages. 254 00:12:11.600 --> 00:12:13.639 It's just crunching numbers exactly. 255 00:12:13.960 --> 00:12:17.720 But when researchers conduct manual classifications, meaning human beings actually 256 00:12:17.759 --> 00:12:20.600 looking at the context, the intent, and the offerings of 257 00:12:20.639 --> 00:12:23.039 the sites, the numbers flip dramatically. 258 00:12:23.120 --> 00:12:23.720 Wow. 259 00:12:23.960 --> 00:12:26.919 Manual classification suggests that up to sixty eight percent of 260 00:12:26.960 --> 00:12:29.559 the dark web contains highly illegal material. 261 00:12:29.639 --> 00:12:32.200 Here's where it gets really interesting, because you have to 262 00:12:32.240 --> 00:12:34.559 look at the dark web like an unlit city street. 263 00:12:34.679 --> 00:12:36.720 Oh, I like that analogy, right, The. 264 00:12:36.679 --> 00:12:39.960 Street itself is just geography. The darkness is just an 265 00:12:40.039 --> 00:12:43.480 environmental condition exactly. A human rights activist or a dissident 266 00:12:43.879 --> 00:12:47.720 can use that darkness to safely escape an oppressive authoritarian 267 00:12:47.759 --> 00:12:51.679 regime that literally wants them dead. But a criminal can 268 00:12:51.799 --> 00:12:54.519 use the exact same darkness to stand on the corner 269 00:12:54.519 --> 00:12:57.320 and sell illicit goods without ever being seen by a 270 00:12:57.360 --> 00:12:58.279 passing patrol car. 271 00:12:58.559 --> 00:13:01.440 If we connect this to the big picture, we are 272 00:13:01.480 --> 00:13:05.039 looking at the ultimate double edged sword of digital privacy. 273 00:13:05.120 --> 00:13:09.120 It really is the exact same cryptographic anonymity that protects 274 00:13:09.120 --> 00:13:12.480 the innocent serves as the ultimate shield for the guilty. Yeah. 275 00:13:13.120 --> 00:13:15.399 On the non criminal side of the street, you have 276 00:13:15.519 --> 00:13:20.879 journalists actively avoiding state censorship. Organizations like Reporters Without Borders 277 00:13:21.440 --> 00:13:26.240 specifically recommend using tour to bypass authoritarian firewalls. 278 00:13:25.679 --> 00:13:27.480 Because it's a literal life saver for them. 279 00:13:27.600 --> 00:13:31.080 Yes, you have whistleblowers trying to safely leak evidence of 280 00:13:31.120 --> 00:13:34.799 corporate or government corruption. You even have major corporate IT 281 00:13:35.080 --> 00:13:38.679 security teams down there silently monitoring the darknet to see 282 00:13:38.679 --> 00:13:41.799 if their own company's proprietary assets have been compromised. 283 00:13:42.000 --> 00:13:46.000 But sharing that exact same digital street are cyber criminal 284 00:13:46.039 --> 00:13:50.639 syndicates selling narcotics, illegal weapons, and malicious software. It's a 285 00:13:50.639 --> 00:13:55.559 busy street very you have activists launching coordinated attacks and 286 00:13:55.679 --> 00:14:00.559 state sponsored actors engaging in high level political cyber espionage. 287 00:14:00.240 --> 00:14:05.360 And the transition from physical contraband to digital goods is 288 00:14:05.519 --> 00:14:08.480 crucial to understanding the modern underground. 289 00:14:08.559 --> 00:14:11.120 People always think it's just drugs and weapons, right. 290 00:14:11.200 --> 00:14:14.200 We often visualize the dark web as a shadowy marketplace 291 00:14:14.240 --> 00:14:17.799 for illegal drugs, But a staggering portion of this underground 292 00:14:17.799 --> 00:14:20.600 economy runs entirely on data, and. 293 00:14:20.559 --> 00:14:23.320 More specifically, it runs on your data exactly. We have 294 00:14:23.399 --> 00:14:25.840 to talk about the sheer scale of that underground data 295 00:14:25.919 --> 00:14:28.759 economy because it is difficult to wrap your head around. 296 00:14:29.120 --> 00:14:31.679 If you want to understand the magnitude of this, just 297 00:14:31.679 --> 00:14:34.840 look at the twenty thirteen Yahoo hack detailed in the research. 298 00:14:34.960 --> 00:14:38.159 That event was a true watershed moment for cybersecurity. 299 00:14:38.279 --> 00:14:39.159 It was massive. 300 00:14:39.279 --> 00:14:42.759 Five hundred million user accounts were fully compromised, half a billion, 301 00:14:42.879 --> 00:14:45.799 half a billion. We are talking about full names, primary 302 00:14:45.799 --> 00:14:49.120 email addresses, passwords, and security questions. 303 00:14:48.679 --> 00:14:49.159 All of it. 304 00:14:49.480 --> 00:14:53.480 And that entire massive database was packaged and put up 305 00:14:53.519 --> 00:14:55.879 for auction on the dark web, fetching up to three 306 00:14:55.960 --> 00:14:56.919 hundred thousand dollars. 307 00:14:57.000 --> 00:15:00.000 That is insane. And it isn't just massive tech platforms 308 00:15:00.080 --> 00:15:03.639 taking the hit. The healthcare IT industry is an incredibly 309 00:15:03.720 --> 00:15:04.600 lucrative target. 310 00:15:04.759 --> 00:15:05.480 Oh absolutely. 311 00:15:05.840 --> 00:15:08.639 Let's look at the twenty sixteen case involving a company 312 00:15:08.679 --> 00:15:12.840 called pilot Phish Technology, Right. I remember that one cybercriminals 313 00:15:12.840 --> 00:15:16.120 managed to steal their proprietary source code, along with a 314 00:15:16.200 --> 00:15:19.759 massive list of employee user names, and dump the entire 315 00:15:19.879 --> 00:15:23.440 package for sale on a dark web market called alphabet. 316 00:15:23.080 --> 00:15:27.080 And healthcare data is significantly more valuable than a standard. 317 00:15:26.759 --> 00:15:31.320 Credit card number because it is rich in permanent personal identifiers. 318 00:15:31.519 --> 00:15:33.320 I mean, you can cancel a credit card, but you 319 00:15:33.399 --> 00:15:35.879 cannot cancel your medical history exactly. 320 00:15:36.440 --> 00:15:39.759 This makes patients highly vulnerable to targeted spearfishing. 321 00:15:39.840 --> 00:15:40.080 Right. 322 00:15:40.200 --> 00:15:42.960 Instead of throwing a wide generic net of spam emails 323 00:15:43.000 --> 00:15:46.759 hoping someone randomly clicks, criminals use that stolen medical data 324 00:15:46.799 --> 00:15:48.960 to throw a highly targeted spear and make it look 325 00:15:49.000 --> 00:15:54.919 real it's very real baycraft emails referencing a patient's specific 326 00:15:55.039 --> 00:15:59.600 doctor or a specific medical condition, making the extortion or 327 00:15:59.600 --> 00:16:01.720 the fake billing look completely legitimate. 328 00:16:01.840 --> 00:16:04.840 But what is truly alarming is how these criminal syndicates 329 00:16:04.919 --> 00:16:06.919 actually acquire this data in the first place. 330 00:16:07.159 --> 00:16:08.799 It's not always what you'd expect. 331 00:16:08.960 --> 00:16:12.240 No, it isn't always some brilliant external hacker breaking through 332 00:16:12.279 --> 00:16:16.639 a firewall. The researchers detail a rapidly growing trend known 333 00:16:16.720 --> 00:16:18.679 as the insider threat. 334 00:16:18.519 --> 00:16:22.879 Which is terrifying for businesses. Organizations spend millions of dollars 335 00:16:22.879 --> 00:16:26.679 building perimeter defenses, but criminals on the dark web bypass 336 00:16:26.799 --> 00:16:30.480 all of it by actively recruiting disgruntled corporate employees. It 337 00:16:30.600 --> 00:16:34.320 just bribed them essentially. Yes, they use these anonymous forums 338 00:16:34.320 --> 00:16:38.639 to offer massive payouts in untraceable cryptocurrency. Wow. All the 339 00:16:38.639 --> 00:16:41.360 employee has to do is quietly hand over their legitimate 340 00:16:41.399 --> 00:16:45.519 logging credentials or smuggle confidential data out on a flash drive. 341 00:16:45.759 --> 00:16:47.799 So the threat walks right through the front door because 342 00:16:47.840 --> 00:16:50.759 it is using an authorized password. And speaking of bypassing 343 00:16:50.799 --> 00:16:56.399 the rules. The analysis of activists, particularly the decentralized group Anonymous, 344 00:16:56.480 --> 00:16:58.200 presents a fascinating contradiction. 345 00:16:58.399 --> 00:16:59.720 They are a very complex group. 346 00:17:00.879 --> 00:17:04.640 On one hand, Anonymous ran a campaign called Operation Darknet 347 00:17:04.839 --> 00:17:09.880 where they acted as digital vigilantes. They actively tracked down, unmasked, 348 00:17:10.119 --> 00:17:13.160 and destroyed illegal child abuse sites on the dark web, 349 00:17:13.440 --> 00:17:16.039 effectively policing the worst elements of that space. 350 00:17:16.279 --> 00:17:21.039 But simultaneously, members of that same overarching collective created something 351 00:17:21.079 --> 00:17:22.920 called onion irc. 352 00:17:22.759 --> 00:17:25.599 Which is a dark web chat forum that essentially operates 353 00:17:25.640 --> 00:17:28.319 as an illegal underground hacking academy. 354 00:17:28.519 --> 00:17:29.640 It is wild, it is. 355 00:17:30.039 --> 00:17:33.359 They utilize the encrypted space to teach new recruits advanced 356 00:17:33.359 --> 00:17:36.480 hacking tactics, share malware, and coordinate attacks. 357 00:17:36.519 --> 00:17:38.599 So they are enforcing a moral code on the dark 358 00:17:38.640 --> 00:17:42.200 web while simultaneously running a school for cyber warfare in 359 00:17:42.240 --> 00:17:43.440 the exact same environment. 360 00:17:43.519 --> 00:17:44.920 The hypocrisy is staggering. 361 00:17:45.039 --> 00:17:48.519 Well, it perfectly illustrates how incredibly complex the ecosystem is 362 00:17:49.039 --> 00:17:52.799 in this underground economy. Data is the ultimate currency and 363 00:17:52.880 --> 00:17:56.440 true power belongs to whoever can control, manipulate, or expose it. 364 00:17:56.920 --> 00:18:01.160 This is exactly why modern corporations and government agencies can 365 00:18:01.200 --> 00:18:04.599 no longer just build tall firewalls and hope the threat 366 00:18:04.640 --> 00:18:05.279 stays outside. 367 00:18:05.359 --> 00:18:06.440 We have to go on the offensive. 368 00:18:06.599 --> 00:18:09.799 Yes, they are increasingly forced to deploy their own IT 369 00:18:10.160 --> 00:18:14.559 security teams directly into the dark web to proactively search 370 00:18:14.599 --> 00:18:18.799 for stolen assets and monitor the chatter of criminal syndicates. 371 00:18:19.759 --> 00:18:22.319 So what does this all mean? How does global law 372 00:18:22.400 --> 00:18:26.240 enforcement deal with this? It's like trying to squeeze a balloony. 373 00:18:26.240 --> 00:18:31.240 He squeeze the surface web tightly with regulations, takedowns, and monitoring, 374 00:18:31.720 --> 00:18:34.880 and the criminality doesn't disappear at all. It just inflates 375 00:18:34.920 --> 00:18:38.000 the balloon further down in the unindexed, encrypted dark web. 376 00:18:38.160 --> 00:18:41.720 Exactly how do authorities win that game without destroying the 377 00:18:41.799 --> 00:18:45.440 anonymity network that dissidents and journalists rely on to survive. 378 00:18:45.839 --> 00:18:48.839 That is the defining policing dilemma of the digital age. 379 00:18:49.640 --> 00:18:52.880 The balloon analogy is incredibly accurate, particularly when you look 380 00:18:52.880 --> 00:18:56.680 at the adaptation of terrorist organizations following the tragic November 381 00:18:56.720 --> 00:19:00.720 twenty fifteen Paris attacks. Law enforcement and vision anti groups 382 00:19:00.759 --> 00:19:05.920 like Anonymous aggressively took down surface level websites associated with ISIS. 383 00:19:05.480 --> 00:19:09.720 But the groups simply shifted their digital infrastructure heavily into 384 00:19:09.799 --> 00:19:14.279 the darknet. Yes, the documentation points to a specific propaganda 385 00:19:14.319 --> 00:19:18.759 website called isdarat. When authorities continuously remove the site from 386 00:19:18.759 --> 00:19:23.359 the surface web, the organization simply launched a dark web mirror. 387 00:19:23.039 --> 00:19:26.079 Of it, and to ensure their followers could actually find 388 00:19:26.079 --> 00:19:30.000 that hidden location, they leveraged the heavily encrypted messaging app 389 00:19:30.039 --> 00:19:32.880 Telegram to broadcast the new Dota Onion. 390 00:19:32.640 --> 00:19:34.319 Link, which is very smart. Honestly. 391 00:19:34.440 --> 00:19:37.519 According to the captured data, that single message was viewed 392 00:19:37.519 --> 00:19:40.799 by seven six hundred and twenty nine users. Wow. They 393 00:19:40.839 --> 00:19:43.799 executed a seamless transition of their audience from the visible 394 00:19:43.839 --> 00:19:45.640 web right into the dark neck. 395 00:19:45.720 --> 00:19:48.920 They don't just move, though, they actively educate their supporters 396 00:19:48.960 --> 00:19:51.559 on how to use these complex tools. They do like 397 00:19:51.640 --> 00:19:54.160 Al Qaida went as far as distributing a manual titled 398 00:19:54.160 --> 00:19:55.640 Tour Browser Security. 399 00:19:55.279 --> 00:19:57.240 Guidelines, a literal instruction manual. 400 00:19:57.559 --> 00:20:00.599 Yeah. The goal was to teach their sympathizers the technical 401 00:20:00.599 --> 00:20:03.960