By Nicolas Christin.
“Silk Road anonymous marketplace was shut down on the end of September 2013. The FBI have arrested a man they believe to be the mastermind behind the biggest online illegal drug website that have ever existed and the site has been shut down. The site was apparently only shut down due to the arrest and not because of the system security. It is believed the mastermind known as Dread Pirate Roberts slipped up while posting programming questions on forums not being anonymous. I am not going to name the accused because i believe in “innocent until proven guilty” but you can find names and photos on the net easily. He is being charged with drug charges and possibly murder for hire charges among others. If you try to visit the silk road you will see this screen.”
Introduction.
“More brazen than anything else by light-years” is how U.S. Senator Charles Schumer characterized Silk Road [5], an online anonymous marketplace. While a bit of a hyperbole, this sentiment is characteristic of a certain nervousness among political leaders when it comes to anonymous networks. The relativelyrecent development of usable interfaces to anonymous networks, such as the “Tor browser bundle,” has indeed made it extremely easy for anybody to browse the Internet anonymously, regardless of their technical background.
In turn, anonymous online markets have emerged, making it quite difficult for law enforcement to identify buyers and sellers. As a result, these anonymous online markets very often specialize in “black market” goods, such as pornography, weapons or narcotics. Silk Road is one such anonymous online market. It is not the only one – others, such as Black Market Reloaded [3], the Armory [1], or the General Store [7] are or have been offering similar services – but it gained fame after an article posted on Gawker [10], which resulted in it being noticed by congressional leaders, who demanded prompt action be taken.
It is also reportedly very large, with estimates mentioned in the Silk Road online forum [6] ranging between 30,000 and 150,000 active customers. The site has a professional, if minimalist, look, and appears to offer a variety of goods (e.g., books, digital goods, digital currency…), but seems to have a clear focus on drugs. Not only do most items listed appear to be controlled substances, but the screenshot also shows the site advertising a sale campaign for April 20 – also known as “Pot day” due to the North American slang for cannabis (four-twenty).
In this paper, we try to provide a scientific characterization of the Silk Road marketplace, by gathering a 2 set of controlled measurements over roughly six months (February 3, 2012 – July 24, 2012), and analyzing them. Specifically, we offer the following contributions. We devise a (simple) collection methodology to obtain publicly available Silk Road market data.
We use the data collected to characterize the items being sold on Silk Road and the seller population. We describe how items sold and seller population have evolved over time. Using (mandatory) buyer feedback reports as a proxy for sales, we characterize sales volumes over our measurement interval. We provide an estimate of the daily dollar amount of sales conducted on Silk Road, and use this estimate to infer the amount collected in commission by Silk Road operators.
While we cannot estimate the number of buyers with the dataset we collect, we show that Silk Road is a relatively significant market, with a few hundred sellers, and monthly total revenue of about USD 1.2 million. We also show that Silk Road appears to be growing over time, albeit not at the exponential rate that is claimed in forums [6].
The rest of this paper is structured as follows. We start by describing how Silk Road operates in Section 2. We then explain how we gather our measurements in Section 3. We report on our measurements analysis in Section 4, before turning to economic implications in Section 5. We discuss our findings, reflect on possible intervention policies, and ethical considerations in Section 6, outline related work in Section 7,and conclude in Section 8.
2 Silk Road overview
Silk Road is an online anonymous marketplace that started its operations in February 2011 [6]. Silk Roadis not, itself, a shop. Instead, it provides infrastructure for sellers and buyers to conduct transactions in an online environment. In this respect, Silk Road is more similar to Craigslist, eBay or the Amazon Marketplace than to Amazon.com. The major difference between Silk Road and these other marketplaces is that Silk Road focuses on ensuring, as much as possible, anonymity of both sellers and buyers. In this section, we summarize the major features of Silk Road through a description of the steps involved in a typical transaction: accessing Silk Road, making a purchase, and getting the goods delivered.
Accessing Silk Road. Suppose that Bob (B), a prospective buyer, wants to access the Silk Road marketplace (SR). Bob will first need to install a Tor client on his machine, or use a web proxy to the Tor network (e.g. http://tor2web.org) as Silk Road runs only as a Tor hidden service [11]. That is, instead of having a DNS name mapping to a known IP address, Silk Road uses a URL based on the pseudo-top level domain. onion, that can only be resolved through Tor. At a high level, when Bob’s client attempts to contact the Silk Road server URL (http://silkroadvb5piz3r.onion at the time of this writing), Tor nodes set up a rendez-vous point inside the Tor network so that the client and server can communicate with each other while maintaining their IP addresses unknown from observers and from each other.
Once connected to the Silk Road website, Bob will need to create an account. The process is simple and merely involves registering a user name, password, withdrawal PIN, and answering a CAPTCHA. After this registration, Bob is presented with the Silk Road front page (see Figure 1) from where he can access all of Silk Road’s public listings.
Public and stealth listings. Silk Road places relatively few restrictions on the types of goods sellers can offer. From the Silk Road sellers’ guide [5], “Do not list anything who’s (sic) purpose is to harm or defraud, such as stolen items or info, stolen credit cards, counterfeit currency, personal info, assassinations, and weapons of any kind. Do not list anything related to pedophilia.”
Conspicuously absent from the list of prohibited items are prescription drugs and narcotics, as well as adult pornography and fake identification documents (e.g., counterfeit driver’s licenses). Weapons and ammunition used to be allowed until March 4, 2012, when they were transferred to a sister site called The Armory [1], which operated with an infrastructure similar to that of Silk Road. Interestingly, the Armory closed in August 2012 reportedly due to a lack of business [6].
Not all of the Silk Road listings are public. Silk Road supports stealth listings, which are not linked from the rest of Silk Road, and are thus only accessible by buyers who have been given their URL. Stealth listings are frequently used for custom listings directed at specific customers, and established through out-of-band mechanisms (e.g., private messaging between seller and buyer). Sellers may further operate in stealth mode,meaning that their seller page and all the pages of the items they have for sale are not linked from other Silk Road pages.
While Silk Road is open to anybody, stealth mode allows sellers with an established customer base to operate their business as invitation-only. Making a purchase. After having perused the items available for sale on Silk Road, Bob decides to make a purchase from Sarah (S), a seller. While Tor ensures communication anonymity, Silk Road needs to also preserve payment anonymity.
To that effect, Silk Road only supports Bitcoin (BTC, [30]) as a trading currency. Bitcoin is a peer-to-peer, distributed payment system that offers its participants to engage in verifiable transactions without the need for a central third-party. Bob thus needs to first procure Bitcoins, which he can do from the many online exchanges such as Mt.Gox [4]. Once Bob has Bitcoins, and decides to purchase the item from Sarah, instead of paying Sarah directly, Bob places the corresponding amount in escrow with Silk Road. Effectively, B pays SR, not S.
The escrow mechanism allows the market operator to accurately compute their commission fees, and to resolve disputes between sellers and buyers. Silk Road mandates all sellers and buyers use the escrow system. Failure to do so is punishable by expulsion from the marketplace [5].
Finalizing. Once the purchase has been made, Sarah must ship it to Bob. Thus, Sarah needs a physical address where to send the item. To preserve anonymity, Silk Road recommends to use delivery addresses that are distinct from the buyer’s residence. For instance, Bob could have the item delivered at Patsy’s house, or to a post-office box. Once Sarah has marked the item as shipped, Bob’s delivery address is erased from all records. Once the item reaches its destination, Bob finalizes the purchase, that is, he tells Silk Road to release the funds held in escrow to Sarah (i.e., SR now pays S), and leaves feedback about Sarah. Finalizing is mandatory: if Bob forgets to do so, Silk Road will automatically finalize pending orders after a set amount of time.
Sellers with more than 35 successful transactions and who have been active for over a month are allowed to ask their buyers to finalize early; that is, to release payment and leave feedback before they actually receive the item. Due to the potential for abuse, Silk Road discourages finalizing early in general, and prohibits it for new sellers.
Finally, Silk Road enhances transaction anonymity by providing “tumbler” services that consist of inserting several dummy, single-use intermediaries between a payer and a payee. That is, instead of having a payment correspond to a simple transaction chain B → SR → S, the payment goes through a longer chainB → I1 → . . . → In → S where (I1, . . . In) are one-time-use intermediaries.
Collection methodology
We next turn to describing how we collected measurements of the Silk Road marketplace. We first briefly explain our crawling mechanism, before outlining some of the challenges we faced with data collection. We then discuss in detail the data that we gathered.
3.1 Crawling mechanism
We registered an account on Silk Road in November 2011, and started with a few test crawls. We immediately noticed that Silk Road relies on authentication cookies that can be reused for up to a week without having to re-authenticate through the login prompt of the website. Provided we can manually refresh the authentication cookie at least once per week, this allows us to bypass the CAPTCHA mechanism and automate our crawls.
We conducted a near-comprehensive crawl of the site on November 29, 2011,1 using HTTrack [34]. Specifically, we crawled all “item,” “user” (i.e., seller) and “category” webpages. The complete crawl completed in about 48 hours and corresponded to approximately 244 MB of data, including 124 MB of images.
Starting on February 3, 2012, and until July 24, 2012, we attempted to perform daily crawls of the website. We noticed that early in 2012, Silk Road had moved to inlining images as base64 tags in each webpage. This considerably slowed down crawls. Using an incremental mode, that is, ignoring pages that had not changed from one crawl to the next, each of these crawls ran, on average, for about 14 hours.
The fastest crawl completed in slightly over 3 hours; the slowest took almost 30 hours, which resulted in the following daily crawl to be canceled. To avoid confusion between the time a crawl started, and the time a specific page was visited, we recorded separate timestamps upon each visit to a given page.
3.2 Challenges
Kanich et al. [15] emphasize the importance of ensuring that the target of a measurement experiment is not aware of the measurement being conducted. Otherwise, the measurement target could modify their behavior, which would taint the measurements. We thus waited for a few days after the November crawl to see if the full crawl had been noticed. Perusing the Silk Road forums [6], we found no mention of the operators noticing us; our account was still valid and no one contacted us to inquire about our browsing activities.
We concluded that we either had not been detected, or that the operators did not view our activities as threatening. We spent some additional effort making our measurements as difficult to detect as possible. Since all Silk Road traffic is anonymized over Tor, there is no risk that our IP address could be blacklisted. However, an identical Tor circuit (on our side) could be repeatedly used if our crawler keeps the same socket open; this in turn could reveal our activities if the Silk Road operators monitor the list of Tor circuits they are running, and realize that a fixed Tor rendez-vous point is constantly being used.
We addressed this potential issue by ensuring that all circuits, including active circuits, are periodically discarded and new circuits are built. To further (slightly) obfuscate our activities, instead of always starting at the same time, we started each crawl at a random time between 10pm and 1am UTC. Despite all of these precautions, we had to discard some of our data. On March 7, 2012 a number of changes were implemented to Silk Road to prevent profiling of the site [6].
Whether this was due to Silk Road operators noticing our crawls or to other activity is unclear. URL structure changed: item and users, instead of being referenced by a linearly increasing numeric identifier, became unique hashes. Fortunately, these hashes initially simply consisted of a substring of the MD5 hash of the numeric identifier, making All dates and times are expressed in Universal Time Coordinates (UTC).
Each item page contains seller, price, and shipping information, as well as buyer feedback on the item. it easy to map them to the original identifiers.2 More problematically, feedback data, which is crucial to estimating the volume of sales became aggregated and feedback timestamps disappeared. That is, instead of having, for an item G sold by S a list of n feedback messages corresponding to n purchases of G along with the associated timestamps, Silk Road switched to presenting a list of 20 feedback messages, undated, across all the items sold by S. In other words, feedback data became completely useless.
Thankfully, due to very strong pushback from buyers who argued that per-item feedback was necessary to have confi- dence in purchases [6], Silk Road operators reverted to timestamped, per-item feedback on March 12, 2012. Nevertheless, we had to discard all feedback data collected between March 7, 2012 and March 12, 2012. Finally, in several instances, Silk Road went down for maintenance, or authentication was unsuccessful (e.g., because we had not refreshed the authentication cookie in time), leading to a few sporadic days of missing data.
The largest gaps are two eight-day gaps between April 10, 2012 and April 17, 2012 due to an accidental suspension of the collection infrastructure; and between July 12, 2012 and July 19,2012, due to an accidental deletion of the authentication cookie.
To read more about this report please go to: http://cryptome.org/2013/10/silk-road-travel.pdf
