Co-funded by the Horizon 2020 Framework Programme of the European Union

PolicingtheDarkWeb:EthicalandLegalIssues

Deliverable4.3

UniversityofWarwickandTNO

VersionControlSheet

Title PolicingtheDarkWeb:EthicalandLegalIssues

PreparedBy KatHadjimatheou

ApprovedBy RobRowlands

VersionNumber MEDIA4SEC-D4-3-E-NOV17-DarkWebEthicsLegal

Contact K.hadjimatheou@warwick.ac.uk

RevisionHistory:

Version Date SummaryofChanges Initials ChangesMarked

1.0 14/11/17 SubmittedVersion RR No

TheresearchleadingtotheseresultshasreceivedfundingfromtheEuropeanUnion’sHorizon2020ResearchandInnovationProgramme,underGrantAgreementno700281.

ContentsExecutiveSummary............................................................................................................................................i

1. Introduction................................................................................................................................................1

1.1 MEDI@4SEC......................................................................................................................................1

1.2 WorkPackage4...............................................................................................................................1

1.3 Deliverable4.3..................................................................................................................................1

2. IntroductiontotheDarkWeb.............................................................................................................3

2.1 Case-StudyLEAoperationsontheDarkWeb.....................................................................3

3. EthicalandLegalIssueswithLEAoperationsontheDarkWeb..........................................5

3.1 Distinctionbetweenethicsandlaw........................................................................................5

3.2 Legalandpolicydiscrepanciesbetweenjurisdictions....................................................6

3.3 LEAengagementinharmfuland/orcriminalbehaviour...............................................6

3.4 Harms arising from the use of unusual and/or unorthodox disruptiontechniques......................................................................................................................................................12

3.5 Harmstolaw-enforcementofficerwelfare.......................................................................14

4. Justifying, explaining, andweighing harms and benefits of LEA operations on theDarkWeb.............................................................................................................................................................16

4.1 Legitimacy and the need for a systematic, clear, and consistent approach toharms16

4.2 JustifyingDarkWebOperations:whatarethebenefits?............................................16

5. Theroleofprivatecompanies inprovidingLEA-facingtoolsandservices forDarkWebinvestigations..........................................................................................................................................18

5.1 Overview..........................................................................................................................................18

5.2 The effect of obscure technologies on transparency, accountability and dueprocess.............................................................................................................................................................19

5.3 Tools and services using data science developed in authoritarian or human-rightsviolatingways.................................................................................................................................22

5.4 Corporate Social Responsibility/Codes of Conduct for companies doing DarkWebanalytics...............................................................................................................................................22

6. Conclusion.................................................................................................................................................24

6.1 SummarylistofRecommendations.....................................................................................24

i

ExecutiveSummary

ThisreportdiscussesethicalandlegalissuesthataroseduringaworkshoponPolicingthe Dark Web, on September 26, 2017 in The Hague, The Netherlands. The issuesdiscussed arise in relation to LEA operations targeting illegal marketplaces and CSE(childsexualexploitation)forumsontheDarkWeb;andtheroleofprivatetechnologycompaniesinsupportingsuchoperations.

WithrespecttoLEAoperations,whicharethefocusofthefirsthalfofthediscussion,thereportaddressesthefollowingtwoquestions:What,ifany,kindsofmethodsortacticsshould police be prohibited from using when tackling crime on the Dark Web?’ and‘Whatconsiderationsshouldguidepolicedecisionswithrespecttousingmethodsthatmaynotbeprohibited,butareneverthelessseriouslyharmful?’Thereportconsidersarange of relevant harms, from the re-victimisation of children, to harms to officerwelfare, to interference with the exercise of freedom of expression and associationonline. It also considers how LEAs should approach both the task of weighing thebenefits and harms of operations online and that of explaining and justifying thoseoperationstothepublic.

Key recommendations emerging from this section include that LEAs should developsupplementary,detailedguidance for authorizingandcovertofficersdoingoperationsontheDarkWebinordertoensurethattheyarecarriedoutinwaysthatarenecessaryandproportionate;thattheeffectivenessoftacticsandoperationsshouldbemonitoredsystematically by LEAs over time to create the kind of evidence base on which bestpractices could be developed- Interpol could have an important role to play infacilitating this at an international level; LEAs should be as transparent as possibleabout the outcomes of operations and how these constitute effectiveness and effortsshould be made to develop evaluation techniques that can measure the currentlyundervalueddisruptioneffectsofmethodsandoperations.

Thereportthenturnstoaconsiderationoftherisksandbenefitsthatemergefromtheincreasingly pivotal role played by private companies in LEA operations on the DarkWeb.The challengeofmaintaining transparencyandaccountability inLEAoperationsgiven the obscurity of some of the technology and the data science it rests on ishighlighted. So too is the potential impact on standards of due process for facingprosecutiononthebasisofevidenceandintelligencegatheredwiththehelpofprivatecompanies.Finally,thepotentialforself-regulationofthesectorviacodesofconductorcorporatesocialresponsibilityinitiativesisconsidered.

WerecommendthatresearchshouldbecarriedouttomapLEArelianceontheprivatesectorfortechnicaltoolsandcapabilities in investigationsonline,toassessLEAneeds,and to forecast how this is likely to develop in the future, and that outcomes of suchstudiesshouldbeusedtoplanandinvestinLEAcapabilitiesinastrategicway.AfurtherrecommendationisthatLEAsshouldmakesurethatmeansusedbyprivatecompaniesthey rely on are lawful and that the evidence collected is admissible in court- forexample,byestablishinganagreementon thewayworkcoveredbyacontractwillbecarried out. Such an agreement could cover issues such as a commitment by private

ii

companiestousetechnologicalmethodsdesignedtoensuretheintegrityoftheevidencecollected.

Inordertoensuretheirrelevance,theethicalandlegalissuesconsideredinthisreportare discussedwith reference to two recent real-life LEA operations on the darkweb:OperationBayonet,which involved the takedownby LEAs ofDarkWebmarketplacesAlphaBay and Hansa, and Task Force Argos, an Australian anti-CSE LEA unit whichinvolvedtheinfiltrationandrunningofthenotoriousDarkWebCSEforum‘Child’sPlay’.

The report closes by gathering together and listing the key recommendations thatemergefromthediscussion.

1

1. Introduction

1.1 MEDI@4SEC

MEDI@4SEC focuses upon enhancing understanding of the opportunities, challengesandethicalconsiderationofsocialmediauseforpublicsecurity:thegood,thebadandthe ugly. The good comprises using social media for problem solving, fighting crime,decreasing fear of crime and increasing the quality of life. The bad is the increase ofdigitisedcriminalityand terrorismwithnewphenomenaemerging through theuseofsocialmedia.Theuglycomprisesthegreyareaswheretrolling,cyberbullying,threats,orlive video-sharing of tactical security operations are phenomena to deal with duringincidents.Makinguseofthepossibilitiesthatsocialmediaoffer,includingsmart‘work-arounds’iskey,whilerespectingprivacy,legislation,andethics.Thischangingsituationraisesaseriesofchallengesandpossibilities forpublicsecurityplanners.MEDI@4SECwill explore this through a series of communication and dissemination activities thatengageextensivelywith a rangeof end-users tobetterunderstand theusageof socialmediaforsecurityactivities.MEDI@4SECwillseekabetterunderstandingofhowsocialmedia can, and how social media cannot be used for public security purposes andhighlight ethical, legal and data-protection-related issues and implications. Activitiescentre around six relevant themes: DIY Policing; Everyday security; Riots and massgatherings:TheDarkWeb;Trolling;andInnovativemarketsolutions.MEDI@4SECwillfeedinto,supportandinfluencechangesinpolicy-makingandpolicyimplementationinpublic security that can be used by end-users to improve their decision making. Bystructuring our understanding of the impact of social media on public securityapproaches in a user-friendly way MEDI@4SEC will provide an evidence-base androadmapforbetterpolicymaking including:bestpracticereports;acatalogueofsocialmedia technologies; recommendations for EU standards; future training options; and,ethicalawarenessraising.

1.2 WorkPackage4

TheroleofWorkPackage4(WP4)istoidentifyethicalandlegalissuesarisingfromtheuse of social media for public security and policing purposes as well as to facilitateethicsprocedureswithintheproject.Ethicsandlegalissueswillbereportedforeachofthemedworkshops.

1.3 Deliverable4.3

Thisdocumentprovidesreport identifiesanddiscussesethicaland legal issuesarisingin a workshop on Policing the DarkWeb, on September 26, 2017 in The Hague, TheNetherlands. The workshop brought together 65 international professionals withexpertise and interests in policing crime on theDarkWeb. 40 of thesewere externaldelegates; the remaining 20 were from the MEDI@4SEC consortium. The grouprepresented a diverse mix of law enforcement organisations, governments, privatecompaniesandresearchers.

2

TheworkshopwashostedbyTNOandtookplaceintheframeworkoftheinternationalCyberSecurityWeek.Thegoalwas tocreateanopensetting to sharechallenges,bestpractices and lessons learnedwhen policing crime facilitated by the darkweb and todevelopacommonvisionandactionablerecommendationsforthefuturepolicingoftheDarkWeb.AreportonandSWOTanalysisofthatworkshophasbeenproducedbyTNOandisavailableontheMEDI@4SECWebsite.

ThisreportdrawsonthepresentationsandstructureddiscussionsthattookplaceattheMEDI@4SECworkshoptoprovideaninitialscopingofethicalandlegalissuesthatariseinthepolicingof theDarkWeb.Thereportalsoreflectsonhowthese issuesmightbeaddressed.

The issues discussed arise in relation to two broad areas of activity, namely LEAoperationson theDarkWeb, and the involvementofprivate companies in supportingtheworkofLEAsinDarkWebinvestigations.

3

2. IntroductiontotheDarkWeb

TheDarkWebreferstoa layeroftheInternet inwhichcontenthasbeenintentionallyconcealedanduserscansurfanonymously. InordertoreachtheDWandtoaccess itscontent,oneneedstoinstallacertainprogramwhosefunctionissimilartothatofawebbrowserorsearchengine.ThemostcommonlyknownprogramisTheOnionBrowser(TOR)(MEDI@4SECD1.1).ThefeaturethatdistinguishestheDarkWebfromtheopenweb is therefore encryption.While there is nothing ethically or legally dubious aboutencryption in principle, the reality is that much of the activity on the Dark Web bypeopleinliberaldemocraciesisunethicaland/orillegal.

TheDarkWebhostsavastrangeofsitesandforumsforunethicalandillegalbehaviour,from illicit markets for drugs, counterfeit goods, and contract killings to moneylaundering,extremistsitesandforumsforthesharingofchildsexualabusematerial.Alloftheseactivitiesarelegitimatetargetsofpolicing,andallaremadeeasiertoperformand more difficult to prevent and prosecute by encryption. However, it is not onlycriminals who use the dark net. Political dissidents and activists, journalists, lawenforcementandthemilitaryalsotakeadvantageofthesecurityandanonymityofferedbyencryption.

2.1 Case-StudyLEAoperationsontheDarkWeb

Inorderbothtoillustratetheissuesraisedinthefollowingsections,andtoensurethatthediscussionisrelevanttoactualpractices,webeginthissectionbyprovidingabriefoverviewoftwoselectedhistoricalLEAoperationsontheDarkWeb.Theseoperationswillserveascase-studiesthroughwhichtheethicalandlegalissuescanbeexplored.Assuch, thediscussion in the remainderof thepaperwill referback to theseoperationsregularly.

2.1.1 TaskForceArgos:FightingChildSexualExploitationontheDarkWebIn September 2017 a Norwegian newspaper, VG, ran an exclusive report about anAustraliancovertpoliceoperationagainstachildsexualabuseforumontheDarkWeb.ThisfascinatingandethicallydifficultcaseinvolvedaspecialistcovertpoliceunitintheAustralianpoliceforcetakingcontrolofandrunningaCSEforumontheDarkWebfor11 months. (Other jurisdictions have also run sites, but as far as we know for amaximumof twoweeks).During the time thepolice ran thesite, thousandsof imagesandmany videos of child abuse, including live abuse, were shared on it. The officersthemselvespostedandsharedimagesofchildabuse.

Theoperationledtoat least2veryimportantarrestsandresultedinthepolicetakingdownthesite.Explainingwhat led themtodecide towinddowntheoperation,policesaidthattheystoppedrunningit‘whenitwasn’t’worthrunning…anymore’.An in-depth article about the case can be found here:https://www.vg.no/spesial/2017/undercover-darkweb/?lang=en

4

2.1.2 OperationBayonet:ThetakedownofDarkWebmarketplacesAlphaBayandHansaInthesummerof2017Europolpublishedapressreleasedetailinghowithadsupportedtwomajor lawenforcementoperations,(ledbytheUSFederalBureauof Investigation(FBI),theUSDrugEnforcementAgency(DEA)DrugEnforcementAgency(DEA)andtheDutch National Police), to shut down the infrastructure of an underground criminaleconomyresponsibleforthetradingofover350000illicitcommoditiesincludingdrugs,rearms and cybercrime malware. In 2016, with the help of Bitdefender, an internetsecurity company advising Europol's European Cybercrime Centre (EC3), EuropolprovidedDutch authoritieswith an investigation lead into one of thesemarketplaces,calledHansa.TheDutchauthorities took covert controlofHansaunderDutch judicialauthority,whichallowedthemtomonitortheactivityofuserswithouttheirknowledge.Theyalsoshutdownasecondsite,AlphaBay,duringthesameperiod.Thisenabledthemto sweep up all the new users displaced fromAlphaBaywhowere looking for a newtradingplatform.Accordingtothepolice’sclaims,aneightfoldincreaseinthenumberofnewmembersofHansawasrecordedimmediatelyfollowingtheshutdownofAlphaBay.

The outcomes of these combined operations were, according to the Europol pressrelease:

Ø severelydisruptedcriminalenterprisesaroundtheworldØ thearrestofkeyfiguresinvolvedinonlinecriminalactivityØ huge amounts of intelligence (on ‘high-value targets’ and on the addresses of

buyers)thatwillleadtofurtherinvestigationsØ seizingofmillionsofdollarsworthofcryptocurrencies

The Europol Press Release about the case can be found here:https://www.europol.europa.eu/newsroom/news/massive-blow-to-criminal-dark-web-activities-after-globally-coordinated-operation

…These twocaseshave led toanumberofethicaland legalquestions.TowhatextentareLEAsallowedtoactivelyparticipateinorcontributetoonlineforacontainingillegalcontentor facilitating the sellingandbuyingof illegal goods?Andwhatmeans canbeused in these situations? How to balance the means against the results that can beachieved?The issueswill bediscussed in the following text along the lineofdifferenttypes of interventions by LEAs.

5

3. EthicalandLegalIssueswithLEAoperationsontheDarkWeb

In this sectionwe consider some of the ethical and legal issues arising in connectionwith LEAoperations on theDarkWeb.While each operation raises distinctive ethicalandlegal issues,somebasiccross-cutting issuesariseacrossallof them.Bothkindsofissuesarediscussedbelow.

3.1 Distinctionbetweenethicsandlaw

Theethicalandlegalissuesdiscussedherearedistinctbutrelated.Ethicsrelatestothereasonswehaveforthinkingsomethingistherightorwrongthingtodo.Lawrelatestothe rules a society has in placewithwhich people can be coerced legitimately by thestateintocomplying.Someethicalissuesarereflectedinthelaw;butethicsisbroaderthanlaw:whileillegalbehaviouristypicallyalsounethical,muchunethicalbehaviourisnotregulatedbythelaw.Forexample,ethicstellsusthatbreakingapromiseisnearlyalwayswrongful,evenif it issometimesjustifiedoverallgiventhecostsofkeepingthepromiseintheparticularcircumstances.Thus,ethicalconsiderationsalwayscomeintoplay when promise-making and promise-breaking are concerned. In contrast, legalconsiderations only arisewhen the promises in question fallwithin the narrower setthatarelegallyenforceable,sayintheformofcontracts.Ethicsisthusbroaderthanthelaw,providingperspectivesfromwhichtocriticizethelawandargueforitsreform.

Tosay thatsomething is legallypermissible is tosay that itcanbedonewithout legalconsequence.Thuslegalanalysiscantelluswhatthelawrequiresandsowhatweneedtodoifwewanttoavoidbeingprosecuted,sued,andsoon.Ethicscannotdothis.Butbecausethelawusuallyreflectssomeminimumthresholdofacceptability,thefactthatsomethingislawfuldoesnotbyitselfdemonstratethatitisdesirable-letalonemorallylaudable or an example of best practice. Ethics can offer guidance as towhatwe arepermitted to do, encouraged to do and required to do,morally speaking. Thus it canoffer advice about what kinds of things public security providers and technologydevelopers shoulddo if theywant their actions tobeboth legal andexamplesof bestpractice. Many police codes of ethics and codes of conduct include both minimumstandardsofbehaviourandmoreaspirationalprinciples.Inpractice,thereissignificantcrossoverbetweenethicsandthelaw.Forexample,PrivacybyDesign(anapproachtoprojects, including technology design, that promotes privacy and data protectioncompliancefromthestart)isanapproachthatbeganasbestpracticebutisnowbeingincorporated into EU Data Protection law.1And ethics can have a key role to play ininforming the law when, as is so often the case, the latter lags behind technologicaldevelopment.

A crossover between ethics and law also ariseswhenboth sets of principles, rules ornormssharecommonroots.The legal issuesraised inthisreportaregroundedinandmakereferencetointernational,EU,anddomesticlegalinstruments.Theethicalissuesaregroundedinthevaluesofliberaldemocraticpoliticaltheory,includinginparticular

1Seehttp://ec.europa.eu/justice/data-protection/reform/index_en.htm

6

equaltreatment,fairness,autonomyandliberty.2Becausethelegalinstrumentsreferredto in this report are those of progressive liberal democracies, the legal and ethicalconcernsdescribedbelowarecloselyrelatedandsometimesoverlap.ForthisreasonwehavepresentedthelegalandethicalissuestogetherinSection3.

Sometimes the values underpinning ethics and the law conflict, and ethical and legaldebatesareoftenconcernedwithfindingthebestwaytoreconcileconflictingdutiesandobligations.Within liberaldemocratic societies thequestionofwhichrights, rulesandrequirements these values give rise to is also often subject to debate. Finally, theinterpretation of the role and status of the police and the nature and source of theirauthority varies significantly between liberal democratic countries. As this suggests,shared roots and basic commitments do not preclude dilemmas and disagreementswithinbothethicsandthelaw.

3.2 Legalandpolicydiscrepanciesbetweenjurisdictions

DivergencebetweenLEAlawandpracticeindifferentcountriesillustratesalackof consensus about howmuch weight should be given to the harms of each ofthosekindsofbehaviourswhenassessingtheproportionalityofLEAmethods.Forexample, in Australia police are prohibited from physically abusing children butpermitted by law to share images of child abuse online. In a so-called ‘controlledoperation’ they get specific permission from a judge to do so.3In many otherjurisdictions,suchsharingisillegal.Insomejurisdictions,LEAsmaybepermittedtosetup sites for the sale of illicit material on the DarkWeb. In others they may only beallowedtotakeoverandhostsuchsiteswhentheyhavebeencreatedbyothers.

ThelengthoftimeforwhichLEAsarepermittedtohostsuchsitesalsoappearstodifferbetweenjurisdictions,againreflectingdifferencesinassessmentsoftheharmcausedbyfacilitation of crime. For example,while Australian police have hosted CSE sites for 6and 11 months respectively, the maximum time the FBI has hosted an illegalmarketplacewas2weeks.

There is a risk that LEA cooperation is used as ameans to transfer operations to theauspicesofLEAsinjurisdictionsthataremorepermissivewhenitcomestothetacticsand timescales of such operations. Greater harmonization between jurisdictions andLEAs operating practices is desirable so as to retain democratic accountability andlegitimacy. Europol and Interpol could have a key role to play in facilitating suchharmonization.

3.3 LEAengagementinharmfuland/orcriminalbehaviour

BothoftheDarkWebLEAoperationsoutlinedaboveinvolvepoliceengaginginactivitythatwould be considered serious criminality if undertaken by a regular citizen. DarkWeboperationsarebynomeanstheonlycontextsinwhichLEAsmayendupdeciding

2Seminalphilosophersinthisfieldinclude:JohnLocke;ImmanuelKant;JohnRawls;RonaldDworkin;J.S.Mill.3 See: https://southfront.org/australian-police-operated-one-of-largest-darkweb-child-abuse-sites-for-about-year/ .

7

toact inwaysthatwouldotherwisebeconsideredseriouscrimes.ButsuccessinDarkWeboperations seemsalmost inevitably to rest onLEAwillingness to engage in suchactivity,beitdealingdrugsorweapons,moneylaundering,hacking,orsharingimagesof child sexual abuse. LEAs are therefore likely to face dilemmas around the use ofotherwisecriminalandoftenveryharmfulmethodswithincreasingfrequency,asillegalactivityontheDarkWebcontinuestogrowapace.

Engaging in criminal activities by LEAs is not always legally permitted. Goingundercover to infiltrate in a network of criminals is a common method to gainknowledge about the criminals in order to arrest them. But this might involveparticipating in criminal activities as well. What is allowed and what is not alloweddepends on the situations an agent gets involved in and always requires a legal andethicalconsideration.IntheNetherlands,infiltrationisallowed,butentrapmentisnot.4Incaseanactionisaformofentrapment,theresultisthatanillegalactiontakesplacebyacitizen,whichwouldnothaveoccurredifthepolicedidnotsetthetrap.Legally,thisimpliesthattherewasnointentofthecitizentocommitthecrime,soincaseofacourtcasethesentencewillbelowerorabsent.Clearly,theboundariesbetweenengagementandentrapmentgetblurredtoacertainextent.Thedistinctionasexplainedduringtheworkshop lies between maintaining a marketplace and actively creating a newmarketplace by a LEA. Nevertheless, even maintenance requires action and includesfacilitating the offering of illegal goods or content. Creating amarketplacewith illegalwould seem a form of entrapment, including the legal implicationsmentioned above.Moreover,thetypeofgoodsmaybringadifference.Offeringdrugsorweaponswithoutdeliveringthemcanbeallowed,whileofferingchildabuseimagesmaynotbe,sincetheofferingmay includeprovidingorspreading the images instantly.5Basically,providingorspreadingimagesofchildsexualabuseisillegalassuch.

LEAsconsideringusingotherwisecriminal tacticsareconstrained indoingsobybothmoral and legal principles. Not only do they need to demonstrate that the harm theycauseisproportionatetotheharmsprevented,buttheymustalsohaveregardtomoraland legal prohibitions on the use of certain methods. Two questions therefore arise:‘What, ifany,kindsofmethodsortacticsshouldpolicebeprohibitedfromusingwhen tackling crime on the DarkWeb?’ and ‘What considerations should guidepolicedecisionswithrespecttousingmethodsthatmaynotbeprohibited,butareneverthelessseriouslyharmful?’Wenowdiscussthesetwoquestionsindetail.

3.3.1 Prohibitedmethods-entrapmentandviolationsoffundamentalhumanrightsThere are certain methods police are legally prohibited from using, whatever thepotentialbenefitstocriminaljustice.Twocategoriesofprohibitedmethodsarerelevanthere.

4 See the Tallon case from the Dutch Supreme Court (Hoge Raad): Tallon-arrest, HR 4 december 1979, NJ 1980, 356. 5 See: https://darkwebnews.com/dark-web/german-zit-operatives-infiltrate-dark-web-catch-users/ .

8

Entrapment

The first is entrapment. The moral prohibition on entrapment is essentially aprohibitionongivingsomeoneanexceptionaloruniqueopportunitytocommitacrimeandtherebyhavinganessential role in turning themintoacriminal.Therationale forsuchaprohibition is that theroleofpolice ina liberaldemocracy is topreventcrime-not to provide people with the temptation to commit it. Moreover, for the legalqualification of a criminal act, intent is often a requirement. If a situation is createdwhere the opportunity to commit a crime is presented in such away that it ismoredifficult for the criminal to step aside than to continue, the intention might be lessrationalandtherewithdifficulttoproveincourt.UndertheECHR,theCourt’sapproachtowhetherentrapmentwasatstakeornotiscurrentlyofanobjectivenature.TheCourtholdsitirrelevantwhetherthetargethadhadalatentcriminalintent(whetherhehadbeenpredisposed)beforetheagents’intervention;therelevantelementwaswhetherhehadstartedactinguponhislatentcriminalintentbeforetheintervention.Thereisthusno difference for entrapment purposes between the creation of a criminal intent thathadpreviouslybeenabsentandtheexposureofalatentpre-existingcriminalintent.6

Until now, Dark Web operations running illicit marketplaces and forums have notcrossed the line into entrapmentbecause theyhaveonly involved the continuationofexisting sites, not the creation of new or unique ones. This is likely what Jon Rouse,DetectiveInspectorontheChild’sPlayoperationintendedwhenheinsistedthathisunit‘willnevercreateaforumforchildsexoffenders’.

Thedistinctionbetweencreatingandmaintainingawebsiteonwhichseriouscriminalactivity takes place can be compared to offline situations. For example, it is knownpracticeforpolicewhobecomeawareofanimpendingdrugsdealtogoundercoverandpretendtobethedealerorbuyerinordertoarrestsomeone.Theofferandthedealarenotcreated,butrathermaintainedandtheninterruptedbythepolice.Nevertheless,theline appears thinner in the case ofmaintaining a platform for child sexual content orother typesof illicitdigitalcontent,whendoingsomeansthe illegalmaterial is in factsharedordelivered.Thiscontrastswith theexampleofadrugsdeal,where thedrugsitself is not actually ever delivered to a genuine buyer. Maintaining platforms withinstantlyavailabledigitalcontentofanillegalnatureimpliesthattheillegalproductsarenotonlydeliveredbutreceivedaswell.

EvenwhenLEAoperationsontheDarkWebusemethodsthatfallshortofentrapment,these may still raise important and related ethical issues such as the facilitation orencouragementofcrime.Thesearediscussedinmoredetailbelow.

Violationsoffundamentalhumanrights

In most liberal democracies, there are certain things police are not permitted to do,whatever the harm they are trying to prevent. These prohibited methods includetorture,rape,childabuse,andassassinations.Oneofthemoralreasonsforprohibiting

6 D. Vitkauskas & G. Dikov (2012). Protecting the Right to a fair trial under the European Convention on Human Rights. Council of Europe human rights handbooks; Strasbourg 2012. At p. 59, under reference to the Ramanauskas case.

9

suchactionsisthattheactofcarryingthemoutcompromisesthemoralcharacteroftheactor inquestion. Inotherwords,even ifoneonlycarriesout torture inorder tosavemanylives,indoingsoonestillbecomesatorturer.Whenitcomestoactionscarriedoutby LEAs, it is not just the moral character of the individual police officer that is inquestion; it is also themoral characterof theentirepolitical community,because inademocracypoliceofficersact inthenameofandwiththepoliticalauthorizationofthepublic.Somemightarguethatademocraticstatecannotcontinuetoclaimlegitimatelytobefoundedonrespectforthedignityandequalityofhumanbeingsifitcompromisesitsmoralintegritywithactsthatviolatesuchprinciples.

3.3.2 Potentiallypermissiblebutcontroversialmethods:necessityandproportionalityButwhile there is a consensus around themoral and legal prohibitionon committingcertain kinds of harms, like selling dangerous drugs or weapons, or abusing a child,there is legal andmoraldivergenceon the issueofwhetherpolice should facilitateorencourage such harms, or even just to stand by and allow them to occur wheninterventionmighthavebeenpossible.

Bothmorality and the law generally reflect ourmoral intuitions that there is adescendingscalewhichstatesroughlythatdirectlyinflictingaparticularharmisworse than facilitating it, which in turn is worse than encouraging it, which isworse, inturn, thanmerelyallowingit tooccurwhenonehadanopportunitytointervenetostopit.

WhenpolicerunDarkWebforumssuchasHansaorChild’sPlay,theyengageinallofthesekindsofwrongsorharms.Forexample,goingundercoverasapaedophilemightinvolvebehaviourthatdirectlyharmschildrenbysharingimagesoftheirabusewithpaedophiles;encouragesabusebyeggingothersonintheirsharingofimages;normalizesabusebybefriendingotherpaedophilesandmakingthemfeelcomfortableabouttheiracts;andpermitsabusetohappenbystandingbyandwitnessingit–liveonlineinsomecases-insteadofinterveningtopreventit.Theseaspectsofcovertpolicingareoftenoverlookedinpublicdiscussionandscholarlyanalysis,bothofwhichfocusonthepotentialimpactoflaw-enforcementactivityonthoseindividualswhoarerightlyorwronglysuspectedofcrime.

Instrictlylegalterms,suchLEAactivitymaydirectlyinfringeuponthehumanrighttobodilyintegrity(respectforthehumanbody).Evenscreenshotsorpreviewsinthumbnailsmayqualifyassuchunderthelaw.

Whenitcomestojustifyingtheuseofsuchmethods,LEAsinallEUcountriesrelyon a framework based on the moral and legal principles of necessity andproportionality.Theseprinciplesstate,roughlyspeaking,thatLEAsshouldusetheleastharmfuland intrusivemeansnecessarytoachievetheircriminal justiceaims,andthatanyharmsandintrusionsthuscausedshouldbeproportionatetothoseaims.

Intheremainderof thissection,weprovidesomeindicationof thekindofharmsthatmight occur in the context of Dark Web operations and how LEAs might begin toincorporate them into proportionality and necessity assessments as well as intoguidanceandfutureplanning.

10

3.3.3 Doingharm:re-victimisingvulnerablepeopleand/orusingthemasameanstothepursuitofcriminaljusticeends

SomemethodsusedbyLEAsinoperationsontheDarkWebinvolvethere-victimisationof people who have been the victims of crime. This related in particular to policesharingofimagesofabuse,beitchildabuse,torturebyterrorists,orsomeotherkindofabuse.Sharingofsuchimagesandvideosinvolvesviolatingsomeone’sbasicrightsandinterests,not for theirownprotection,but for the sakeof someother criminal justiceaim. In other words, they involve using someone as a means to an end, rather thanrespectingthemasanindividualwithbasicrightsthatshouldneverbeviolated.Thisisperhapswhat onemother – interviewed for the Norwegian newspaper report on theChild’sPlayoperation-meantwhenshesaidshe felt thatpoliceposingaspaedophilesusedherdaughter ‘asbait’withwhich to catch criminalswhen they shared imagesofherabusewithotherpaedophileswhileundercover.

Onepotentiallineofjustificationforsuchre-victimisationmightclaimthatthesharingofimagesofabusemaybepermissibleprovidedthatitisminimized,andthatitisjustifiedintermsofprotectingother,similarlyvulnerableindividuals,fromthesamekindsofabusesinthefuture.ThisislikelywhatJonRouse,aDet.InspectorwithTaskforceArgosmeantwhenheinsistedthatArgosisa‘victim-centredunitnotanoffender-centredunit’.7Accordingtothisviewpoint,thefactthatthewrongdonetotheindividualisdonepreciselytoprotectotherslikethemmakesitlessdamagingtothedignityofthevictim,andthereforelessdifficulttojustifythanitwouldbeifitweredonemerelytocatchcriminals.

IfLEAsconsideringusingthistacticaretorelyonthisjustificationforre-victimisingabusedchildren,thentheyshouldensurethattheaimoftheoperationisexplicitlydefinedintermsoftheprotectionofvictimsandthatitssuccessismeasuredwithreferenceprimarilytovictimprotectionratherthanarrests.(Oftenthelatterwilltracktheformer,butitmaynotalwaysdoso,forexampleifonememberofachildsexualexploitationgangisarrestedthismaynotreducetheexploitationofthechildrentargetedbythatgangsignificantly).Theyshouldalsospelloutinguidancetoofficerstheconditionsunderwhichsuchactionsarepermissible,toensurethatre-victimisationisproperlylimited.Andtheyshoulddevelopapolicyonconsultingand/orcompensatingvictimswhoseimagesaresharedand,whereappropriate,theirfamilies.AslawyerJamesMarshstatedinrelationtotheChild’sPlayoperation:‘Ifvictimscouldbeconsultedalongtheway,itwouldgivethemasenseofcontrol.Controlisexactlywhattheyweredeprivedofduringtheassaults’.

Fromalegalperspective,re-victimisationasameanstoprotectother(potential)victimsimpliesthataratherexplicitchoicehastobemadetoprioritizepreventionandprotectionabovecatchingcriminals.However,catchingcriminalsandstoppingcriminalactivitywillusuallybethetriggertoengageinre-victimisation.Withregardstoproportionalityandnecessity,therefore,aproperassessmentwillalwaysbeneeded,includingcontinuouslymonitoringandassessingtheactionsofLEAsalongtheway.Thedifficultyisthatitmaybehardtodecidetohaltorrollbackonactivitiesinvolvingre-

7 Speaking in a video on YouTube https://www.youtube.com/watch?v=5CJKeQnnoW8).

11

victimisationifthereappearstobeisanincreasingchancetocatchoneormorecriminalsbehindanetwork.GuidelinesandstandardsforperformingthesekindsofassessmentscouldbeaveryvaluableandhelpfultoolforLEAsinthesecomplexsituations.Theguidelinesmayincludebasicprinciplesandguidanceonhowtoweighinterestsandhowtomakelegalandethicalconsiderationsinspecificcases.

3.3.4 Encouraging,facilitating,andnormalizingharmWhile there exists a well-developed body of domestic law on entrapment in mostjurisdictions, legalandmoralnormsare less clearwhen it comes toactivities thatarerelatedto,butfallshortofentrapment,likeencouragingorfacilitatingcrime. RunningHansaandChild’sPlaysites,asLEAsdidinourtwocase-studyoperations,involvedthefacilitationofcrime,becausethesitesweredesignedandestablishedwithapurposeofenablingpeopletoexchangeillicitmaterials.Whilethepolicetakeoverofthesesitesdidnotcreatenewopportunitiestocommitcrimes,itdidenablethoseintentoncommittingcrimestodoso.Asaresult,somecriminalityoccurredontheLEA’swatch,whichwouldnot have occurred if theyhad simply closeddown the site. This kind of facilitation ofcrime can be justified by the aims of the operation,whichmight reasonably bemoreambitiousthanmerelytakingdownasite-asthatwouldmostlikelymerelydelaysuchcriminalityuntilitcanfindanewsitetowhichtomigrate.

Encouraging crime is more likely to occur when operations entail officers goingundercover and adopting identities in ways that involve making friendships orcollaboratingwithcriminals.Thisisprobablymoretypicalofcounter-terrorismoranti-paedophileoperationsthanwithoperationstodisruptdarkmarketssuchasHansa.Forexample, the Child’s Play operation involved officers making ‘friends’ with otherpaedophiles, expressing approval of and ‘liking’ images or videos of abuse, andpotentially encouraging them to continue to post images. When asked how his unitjustified these activities, Jon Rouse, one of the leading officers in Taskforce Argos,repliedthat‘abusersareabusers’andthat‘peoplewhohaveadesiretoabusechildrenwillabusechildrennomatterwhat’.Thisresponseseems toindicateanassertionthatpolice actions cannot turn someone into an offender who was not already going tobecomeone.Butwhilethismightbetruewhenappliedtotheimpactofactionstakenbyan individualundercoverofficer, it isprobablyalso true thatsomepaedophileswouldnothavebecomecontactoffenderswereitnotfortheexistenceofsitessuchasChild’sPlay,whereabuseisnormalizedandencouraged.WhenLEAactivitycontributestothiscumulativekindofencouragement,thisshouldbeacknowledgedandtakenintoaccountinanyassessmentoftheharmscausedbythosetactics.

3.3.5 AllowingharmSimilarpointscanbemadeinrelationtothefactthatLEAoperationsontheDarkWeboften involve police having direct knowledge and/or witnessing the occurrence ofseriouscrimesbutnottakingopportunitiestointervenetopreventthem.Hereagainarange of relevant considerations come into play and these should be worked into acoherentapproachtoweighingtheharmofsuchomissions.Suchconsiderationsinclude,for example, the seriousness of the crime; its imminence; the reliability of theintelligence or evidence of its occurrence; the likelihood of success of any policy

12

interventiontostopit;andthepotentialeffectofsuchinterventiononthebroaderaimsoftheoperation.

Generally speaking, allowing harm to occur is not as objectionable morally as eitherdirectly inflicting it, or encouraging or facilitating it. Nevertheless, it is important toclarifyapolicywithrespecttoallowingharm,becausethestakescanbeveryhigh.Forexample, in theChild’s Play operation, police officerswitnessed child abuse occurringlive online and did not act to prevent it. One can speculate that they also alloweddangerous drugs and even lethal weapons to be traded on Hansa while they wererunning the site. People may well have died as a result of the trade of such things.Allowingsuchharmsmightbejustifiableifthealternativeofdirectinterventionwouldserveonlytodisplacethespecificincidentandwouldlikelyriskunderminingthelargeroperation.ButitisnotclearwhethertheLEAsinvolvedinthetwooperationsoutlinedaboveattemptedeithertopredictortoretrospectivelyassesstheharmcausedbythesecriminalacts,orboth.Suchassessmentsareimportantbothforthosemakingdecisionsabout whether to extend authorisations for certain covert activities and for futurestrategyandplanning,whichshouldbeinformedbyevidenceandknowledgegatheredfromhistoricaloperations.

There is a risk that LEAs carrying out long-term, high-stakes operations become soinvested in theoperation that theyarewilling toallowveryseriousandveryharmfulcrimestooccurifthatappearsnecessarytothesuccessoftheoperation.Forexample,intheChild’sPlaycase,thepolicewerefollowingandwatchingthetwokeyadministratorsof thesite for3daysbeforetheyarrestedthem.Duringthistime, thecriminalsmet inperson,checkedintoahotel,thenwenttogethertoahousewheretheyrapeda4year-old child. The policewerewatching the housewhen the abuse occurred. It is unclearfromwhat thepolicehave saidwhydid theynot intervene toarrest these individualsbeforetheyvisitedthehouse.Itisalsounclearif(andifsothenwhy)theydidnotcheckwhetherachildwaslivingattheaddresstheyvisitedorwhetherthepersonregisteredtothataddresshadaccesstochildren.Thecriminalswereeventuallyprosecutedfortherapeofthat4-yearoldratherthanfortheirroleinadministeringtheDarkWebsite.Thisraises thequestionwhether theLEAsdecidednot to intervene earlier but to take therisk that their targetswould abuse a child, in order tohelp secure aprosecution, andwhetherdoingsoiseverjustified.SuchquestionscannotbeaddressedunlessLEAsareclearerwiththepublicaboutthewayinwhichtheymakedecisions.

3.4 Harms arising from the use of unusual and/or unorthodox disruptiontechniques

CertainfeaturesoftheDarkWeb,inparticularthedifficultyoftracingactivitiesbacktoidentifiablepeopleandlocations,andtheinternationallydistributednatureofcriminalactivity, make it difficult to apply traditional LEA approaches. As a result, activitiesdesignedtodisruptillicitactivitybytakingadvantageofanonymityandthefragilebasisoftrustontheDarkWebhavebecomemoreattractivetoLEAs.Thesemightinclude:

13

• spreadingmisinformation,fakenews,andrumourtofuelmistakenbeliefsaboutpolice activities online and to reduce trust between e.g. buyers and sellers ofillicitproducts.

• using technological means, such as DDS techniques which overwhelm outletsandforcethemtoclose,inordertodisruptthesupplychainonline

• using ‘honey pot’ techniques, such as using automatic tools to pretend to bevendors and “sell” drugs, so that users get scammed and don’t return to themarket.

• advertising LEA’s own successes to show that they operate confidently on theDark Web, which would reduce trust in encryption. For example, the Dutchnational police have created a dark web site that lists Dark Web vendors bypseudonym,includingthoseunderinvestigation,thosewhoare"identified,"and15whohavealreadybeenarrestedincurrentandpastinvestigations."WetracepeoplewhoareactiveatDarkMarketsandofferillicitgoodsorservices,"thesitereads."Areyouoneofthem?Thenyouhaveourattention."8

Suchtacticsmightbeeffective indeterringcrimeontheDarkWeb,howevertheymayalsohavenegativeimplications,whicharenowconsideredbelow.

3.4.1 Theriskofcriminalizinginnocuousbehaviourand/orunderminingtheexerciseofvaluablefreedomsfacilitatedbytheDarkWeb

NotallactivityontheDarkWebissuspect.SomecitizensusetheDarkWebastheydotheopenweb.Forexample,ethnographicresearchononeparticularDarkWebsite-theDark Web Social Network- in 2014, describes a politically libertarian but innocuouswebsite,usedbypeoplewhoseeitasameansofbeingfreefromthekindofcorporateandgovernmentsurveillancetheyfindobjectionableontheopenweb.Asthatresearchreports, the Dark Web Social Network’s ‘about’ page describes it as “a safe andmoderated environment for the productive exchange of information.”9Notably, thatresearch also found that the Dark Web Social Network discouraged child sexualexploitationimagesandpoliceditselfrelativelysuccessfully.Similarprocessesofmoralpolicing on the Dark Web were also reported in more recent research based oninterviewswithadministratorsofDarkWebsearchengines.10And techcommentatorsandresearchersroutinelypredictthatmoreandmoreeverydayandinnocuous‘surfaceweb’ activity will migrate to the DarkWeb as people becomemore concerned abouttheirprivacyandlesstolerantofcorporatemonitoringoftheirbehaviourformarketingpurposes.11Privacyandcensorshipconcernsalsoareemergingassignificantpredictors

8 Greenberg in Wired Magazine, 2017, https://www.wired.com/story/alphabay-hansa-takedown-dark-web-trap/ 9 Gehl, Robert. (2016a) ‘Power/freedom on the dark web: A digital ethnography of the Dark Web Social Network’. New Media & Society, 18(7) 10 Gehl, Robert, (2016) ‘Is the Dark Web legit? The case of Dark Web search engines.’ Selected Papers of AoIR 2016: The 17th Annual Conference of the Association of Internet Researchers Berlin, Germany / 5-8 October 2016 11 Bartlett, Jamie, ‘Hoe the mysterious dark bet is going mainstream’ TED talk, available at: https://www.ted.com/talks/jamie_bartlett_how_the_mysterious_dark_net_is_going_mainstream

14

of reduced opposition to the Dark Web,12as a reported surge of Dark Web usagefollowingtheEdwardSnowdenrevelationsappearstoconfirm.13

FormanyusingtheDarkWeb,theiractivitiesarenotonlyinnocuousbutalsoconstitutethe exercise of valuable freedoms. Chief amongst these are the freedom to expresspolitical views or sexual preferences without fear of persecution by authoritarianregimesandthefreedomtoexchangeinformationwithoutmanipulationormonitoringbyprofit-seekingcompanies.SomeDarkWebusersconsidertheterm‘darknet’or‘DarkWeb’ itselfamedia fabricationtodrawattentionaway fromthe legitimate, innocuous,andevenlife-savinguseoftheDarkWebandtowardsthecriminal.Some,likeEdwardSnowdenand JulianAssange, seegovernment-sponsoredattempts to crackanonymityontheDarkWebasanattackonfreedoms,especiallyprivacy.14

An LEA approach to the Dark Web that treated all activity there as suspect in anundifferentiated, blanket manner would risk undermining the exercise of thesefreedoms. For example, attempting to crack encryption and expose the identities ofindividuals interacting anonymously on the Dark Web might not only expose thoseparticularindividualstoharmsfromauthoritariangovernments,butalsounderminethetrustthatisvitaltotheeffectivefunctionoftheDarkWebasaspacesafefrompoliticalpersecution.For this reason,LEAs in liberaldemocratic jurisdictionsshouldas faras possible adopt a targeted approach to policing the Dark Web, focusing onexposing,disruptingandprosecutingcriminalswhilerefrainingfrominterferingwithinnocuousactivitiesandtheexerciseofpoliticalfreedoms.

3.5 Harmstolaw-enforcementofficerwelfare

Untilnowwehave focusedon theharmsofLEADarkWeboperationsonvictims.Butsuchoperationsalsohaveahighcostfortheindividualofficerscarryingthemout.Atthebeginning of this Sectionwe noted that certainmethods are out of bounds in liberaldemocracies,partlybecauseoftheimpactonthemoralcharacterofthosecarryingthemout. Reports of covert operations on the Dark Web certainly demonstrate that theindividualofficersinvolvedstruggletomaintaintheirmoralidentity, ifnottheirmoralcompass.ThisisillustratedbythewordsofoneAustralianofficerwhowentundercoverasthepersonrunninganonlinechildsexualabuseforum:‘It’sasifyouforceyourselftohaveasplitpersonality,andyoudownload thisotherperson intoapartofyourbrainandhandoverthatpartofyourbraintohim.It’shard.Yougiveapartofyourselfthejob,andthatpartbecomesa friendof thoseyou’re investigating.Whenweweredonewithoneofourrecentoperations,itfeltlikeIhadlockedupallmyfriends’.This describes a professional hazard that has serious implications for the welfare ofcovert officers, towards whom LEAs have a duty of care. But it is also an issue ofpreservingvaluableexpertiseandskillswithinLEAs:officerswhohavebreakdownsorwho can no longer perceive the distinction between morally acceptable and

12 Jardine Eric. (2017) ‘Privacy, censorship, data breaches and Internet freedom: The drivers of support and opposition to Dark Web technologies’. New Media and Society. Online First. October 4, 2017 13 Gehl, 2016a (as above). 14 1 http://www.rollingstone.com/politics/news/the-battle-for-the-dark-net-20151022. Retrieved 11-10-2016. 2

15

unacceptabletacticscanbecomeariskratherthananassettocovertunits.LEAsshouldput in place strategic and long-term provision of psychological, moral, andprofessionalsupport forofficers involved inoperations thatbring themclose todisturbing activities such as torture and child abuse.

16

4. Justifying, explaining, and weighing harms and benefits of LEAoperationsontheDarkWeb

Theprevious sectiondiscussed thekindofharms that are inflictedbyoroccur in thecontextofLEAoperationsontheDarkWeb.ThissectionfocusesontheapproachLEAscanandshouldtaketoweighing,explaining,andjustifyingsuchharms,giventheaimsofpolicingandthelegallimitsonpoliceaction.

4.1 Legitimacyandtheneedforasystematic,clear,andconsistentapproachtoharms

Onlybydevelopingasystematic,clearandconsistentapproachtonavigatingtheharmsofDarkWebpolicingmethods canLEAsbegin to respond to the inevitably increasingrounds of criticism their operations receive. For an example of such criticism,we canconsider the followingquote fromCarissaByrneHessick, aprofessorof lawand legalexpert in this field, who reacted to reports of the Australian police’s hosting andtakedownofChild’sPlaythus:

“Itsounds likethepolicetellonestoryabouthowdamagingthe imagesarewhenothersshare them, and another storywhen the police share them. That’s a kind of hypocrisy Ireallydon’tlike.Butthisshedslightontheargumentthatanyandallsharingofsuchanimageisabuse.Ifthepolicesaythey’reonlysharingimagesthathavebeensharedbefore,itmeansthepolicedonotthinkallsharingisharmful.”15

Thiscriticism isunfair. Itassumeswrongly thatLEAshavenoground forarguing thatthere is a moral (and that there should be a legal) difference between the harm ofsharingofimagesforalimitedtimeinordertoprotectothervictimsandthesharingofimagesinordertoachieveaccesstootherimages,satisfyabusiveurges,andfuelfurtherabuse. But doing harm in order to avert further, more serious harm is in principlejustifiable whereas doing harm in order to satisfy one’s desires is not. LEA clarityaroundtheuseofcontroversialmethodisessentialiftheinevitablydifficultoperationsinthisareaaretoretainlegitimacyandpublicsupport.

4.2 JustifyingDarkWebOperations:whatarethebenefits?

As the previous paragraph suggests, public acceptance of LEAmethods in DarkWeboperations depends on such methods being clearly and consistently justified by theLEAsusingthem.Thisincludesspellingoutthebenefitsthatsuchtacticsaredeployedtoachieve. But sometimes those benefits are poorly defined. A review of official andjournalistic reportsof theDarkWeboperationsdescribedabove reveals that theyarejustifiedintermsof:victimsidentified;arrestsandconvictions;andabusers‘identified’.Whilethesearealllegitimateaimsoflawenforcementoperations,theyleaveoutcrimesavertedordisrupted,anddeterrence.Theseshouldbeincludedamongsttheoutcomes

15 VG article

17

by which success is measured. In other words, efforts should be made to developevaluationtechniquesthatcanmeasurethevalueofdeterrenceanddisruption.

More importantly, the positive outcomes of Dark Web operations are described bypoliceinverybroadandgeneralterms.Itisdesirablethattheoutcomesaremeasurableandabletobemonitored,notonlysothatthebenefitsoftheoperationcanbeproperlyunderstood and then balanced against the harms, but also so that a body of evidenceabout thevalueof theseoperationsand the tacticsusedduring themcanbeamassed.Thismeans, amongst other things, creatingmeasurements that are finer-grained thansimply numbers of individuals arrested. For example, an operation that results in theconvictionof5small-timedrugdealers is lesssuccessfulthanonewhichresults intheconvictionofasingle,veryseriousandprolificrepeatoffender.Countingtheseverityofthe sentences, e.g. number of years of imprisonment, would better track the harmsaverted.

LEAsshouldthinkcarefullyandsystematicallyaboutthenatureofandtheweightthatshould be given to the harms of the different kinds of methods they use whenundertakingoperationson theDarkWeb,andhowtheycanbe justified.LEAsshoulddevelopguidanceforauthorizingandcovertofficersdoingoperationsontheDarkWebinordertoensurethattheyarecarriedoutinwaysthatarecompatiblewithrespectforhumanrightsandwiththeethicalcodesthatgovernpolicinginmanyjurisdictions. The effectiveness of tactics and operations should be monitoredover time to create the kind of evidence base onwhich best practices could bedeveloped.Inthisrespect,itwouldbedesirabletoformaninternationalevidence-baseand bank of tactics in order to enable the diffusion of best practices amongst forcesacrossjurisdictions.Interpolcouldhaveanimportantroletoplayinanysuchinitiative,and indeed it appears that they have already begun to be proactive in this area,developing INTERPOL investment in technologies for cybercrime. However, as thefollowing section explains, much of the technology used by LEAs to support theiroperationsontheDarkWebareprovidedbyprivatecompanies,andthisraisesasetofdistinctethicalandlegalissues,towhichwenowturn.

18

5. The role of private companies in providing LEA-facing tools andservicesforDarkWebinvestigations

5.1 Overview

Private companies are playing an increasingly pivotal role in LEA operations on theDarkWeb.Forexample,theinvestigationleadwhichenabledDutchauthoritiestotargettheHansamarketplacewasidentifiedwiththehelpofBitdefender,aninternetsecuritycompany advising Europol's European Cybercrime Centre (EC3). Private techcompanies have the data, expertise, and tools to support investigations to achieveoutcomesthatwouldbebeyondthecapabilitiesofLEAsworkingalone.TheyaremakingasignificantcontributiontolawenforcementontheDarkWeb.Whilethiscontributioniscertainlywelcome,thereisariskthatitisaccompaniedbyanincreasinghoardingofcapabilitieswithintheprivatesector,creatingariskthatLEAsbecomeoverlyreliantonthe services of companies in ways that have implications for accountability,transparency,therighttoafairtrialandtaxpayervalueformoney.

OnewayinwhichtheserisksmayariseisifcertaincompaniesbecomeindispensabletoLEAworkthroughtheconstructionofdatabasesthatcannotbereplicatedbyLEAs.Forexample,onecompany thatpresentedat theMEDI@4SECworkshopon theDarkWebreportedthat ithadamassedandstoredBitcoinmetadataoveraperiodofyears.Thiscompany therefore has a de facto monopoly on the market for this data, which isincreasinglyusefulasitcanrevealinformationthatcanhelptoexposetheidentitiesofindividualsortotrackaccountsontheDarkWeb.

Anecdotally, participants in the MEDI@4SEC workshop on the Dark Web expressedconcern that companies are charging huge sums for information that would be veryuseful to police investigations, making investigations unduly expensive. The concernwas also expressed that LEAs find it very difficult to recruit people from thesecompanies, because they cannot compete in terms of attractive salary packages. Inaddition, it was noted that LEA procurement procedures are long and burdensome,making it difficult for LEAs to respond in a timelymanner to operational challenges.Finally, the concernwas expressed that LEAsmaymake poor procurement decisions,buying tools that are very expensive but which may become obsolete quite quickly,givenhowfasttechnologydevelopsinthisfield.

At the same time, it was reported that opportunities exist for LEAs to get externaltechnical expertiseandassistancewithouthigh costs. Forexample, a smallnumberofprivateentitiesprovideinformationtoLEAsforfree,orworkwiththemonaprobonobasis. In addition, the role of the VG newspaper in identifying the Child’s Play servershows further that tech-savvy investigative journalismcouldplayan importantrole inassistingpolice.DigilanteorwhitehathackergroupscouldalsobeengagedbyLEAstoassistinoperationsthattargetcommonenemies,suchaschildsexoffendersontheDarkWeb. For instance, in 2014 Intangir, the pseudonym for a hacker who acts as a self-styledpatrolmanoftheDarkWeb,deletedallthechildsexualabuse-relatedlinksfroma

19

popularsitecalledHiddenWiki.16Or theycouldprovideuseful insight into techniquesusefultoinvestigators-forexample,citizenjournalistgroupBellingcatprovideanopensourcetutorialontheirwebsiteonhowtodoinvestigationsonBitcointransactions.17

Yet even if these alternative routes to gaining valuable expertise, skills, and tools arelikely to be fruitful, they are unlikely to significantly reduce the reliance by LEAs onprivatecompanies.ThisisaproblemnotonlybecauseitmaydriveupthecostsofLEAoperationsontheDarkWeb,butalsobecauseprivatecompaniesactoutofself-interestin an area of activity that has an impact on the public interest, aswe now discuss inmoredetail.18Ourobservationsbelowsupporttheconclusionthatresearchshouldbecarried out to map LEA reliance on the private sector for technical tools andcapabilitiesininvestigationsonline,toassessLEAneeds,andtoforecasthowthisislikelytodevelopinthefuture.TheoutcomesofsuchstudiesshouldbeusedtoinvestinLEAcapabilitiesinastrategicway.

5.2 Theeffectofobscure technologieson transparency,accountabilityanddueprocess

5.2.1 TransparencyandaccountabilityTransparencyandaccountabilityofLEAactivityisvitalforitsdemocraticauthorization,bothdirectlyby formalmechanismsofoversight,and indirectlyby thepublic.Secrecyaroundtechnologicalmethodsusedtosupportsuchoperationsraisesofthequestionofwhetherandhowelectedofficials,nationalauditbodies,policeoversightagencies,andjournalistswill be able to scrutinize thework of LEAS to ensure that criminal justicedecisions are being made fairly. And techniques and algorithms used by privatecompaniesmaywellkeptsecret.Thisraisespotential challenges for transparencyandaccountabilityofLEAoperationsthatrelyonsuchtechniques.Thisisarealproblem,notonly a hypothetical one: at the time of writing journalists in the USA are pursuinglitigation against the Chicago Police Dept. to force it to reveal algorithms it uses todeterminewho is high-risk enough to beplacedon a predictivepolicing gun violence‘heatlist’.19Theneedforsuchrevelationwasgivenfurtherimpetusbya2016studybytheRandCorporation,whichfoundthatbeingontheheatlistwasnotinfactpredictiveof future involvement in gun crime, as the Chicago PoliceDept. claimed itwas.20Thisproblem is likely to becomemore relevant in the future as cooperation with privatecompaniesbecomes increasinglynecessary forLEAs tobeable toproperly investigatecriminalactivityontheDarkWeb. 16 See the report here: https://motherboard.vice.com/en_us/article/539ggq/a-hacker-scrubbed-child-porn-links-from-the-dark-webs-most-popular-site 17 https://www.bellingcat.com/resources/2017/09/15/follow-bitcoin-python-blockexplorer-webhose-io/ 18 For an excellent in-depth analysis of some of these issues, see Joh, Elizabeth (2017) ‘The Undue influence of surveillance technology companies on policing’. New York University Law Review, 92. 19 See article in Shadow Proof, 7th June 2017, ‘Journalists sue Chicago Police for Records on Heat List Used for Predictive Policing’, https://shadowproof.com/2017/06/07/journalists-sue-chicago-police-records-heat-list-used-predictive-policing/ 20Saunders, Hunt and Hollywood, Predictions put into practice: a quasi-experimental evaluation of Chicago’s predictive policing pilot’ Journal of Experimental Criminology 12(3). https://link.springer.com/article/10.1007/s11292-016-9272-0

20

A second way in which the involvement of private companies in supporting LEAoperations on the DarkWebmight undermine transparency and accountability is byusing complex andobscure algorithms.Understanding theworkingsof the algorithmsmay be difficult for LEAs. But if the basis on which LEA resources are allocated andcriminaljusticedecisionsaremadeisobscure,thenitisdifficultforLEAsthemselvestobesurethattheyactfairlyandinthepublicinterest,anditisevenharderforrelevantexternal bodies and institutions to exercise effective democratic oversight. This issuearisesnotonlywhenresourcesofprivatecompaniesareusedupfronttoindicatetargetgroups,butalsowhenthereiscooperationbetweenLEAsandprivatecompaniesduringanoperation.

5.2.2 DueprocessAfter investigations have takenplace by LEAs in cooperationwith private companies,criminalshavetobetakentocourt.Inthesecases,itisrequiredboththattheevidencecollectedandthatthewaytheevidencehasbeencollectedbecometransparent.Inlightof due process and the right to a fair trial in which a suspect can properly defendhimself,therecanbenosecretsregardingtheevidence.Moreover,theevidenceneedstohavebeenobtained lawfully.Unlawfullyobtainedevidenceneeds tobeexcluded fromthe trial and cannot be allowed to count as evidence to come to a conviction. Dueprocessissuesarisewhentechnologyusedtogatherevidenceisnotmadetransparentand when it is made transparent to the relevant legal parties but is too technicallycomplexforthemtounderstandandevaluatesufficientlywell.

Theadmissibilityincourtofdigitalevidencehasbeenasubjectofdebateforsometime.Thedifficulty judges face inunderstandingdigital evidence isaproblem.So too is theneedtoprovethatevidenceis‘real’andhasnotbeendigitallymanipulated.Theseissuesare precisely what canmake it difficult to consider the evidence as ‘convincing for ajudge’.Theessenceofalawtrialisthatthejudgehastobeconvincedofthefactthatasuspecthascommittedacrimeinordertocometoaconviction.Thejudgeweighsalltherelevantevidenceathandandthencomestoadecisionofwhetherheorsheconsiderstheevidencetobeconvincing.Difficulties inweighingtheevidencearise inrelationtoDarkWebactivitiesinparticular,becauseofthetechnicalcomplexities.

In collaborations with private companies opportunities may arise to obtain more orothertypesofevidencethanLEAscouldbeallowedbylawtocollectontheirownortoperform certain actions or activities that may not be performed by LEAs. In thissituation, cooperation with private companies can be used as a means to extend themethods available for LEAs during their investigations, potentially beyond the legallimitationsorcompetencesthatapplytoLEAs.Legalboundariesoncompetencesshouldbekeptinmindcarefully.

However,withregardstoadmissibilityofevidencesomelegalguidanceisavailable.ThecaselawoftheECHRacknowledgesthatthenational legislatorisbetterplacedtodealwiththe(substantive)lawofevidence.Sonationaldifferencescanarise.However,itispossibletofindsomeclaritywithrespecttotherequirementsforproceduralfairnessof

21

atrial.ThecaseofKhanv.UK21maybeinvokedasaleadingcaseinthismatter.Inthiscase,thepolicehadinstalledlisteningdevicesintheprivatepropertyofKhan,withouthisknowledge.Thetapesrecordedwereobtainedinbreachofarticle8ECHR(righttoprivate and family life), but the court had taken considerable account of thisunlawfulness and the lack of regulations providing Khan with remedies. A breach ofarticle 8 was upheld, but the evidence was admissible, since the court had properlyconsideredallevidenceandtakenaccountoftheunlawfulnessoftherecordingsaspartof theevidence. It follows fromthisdecisionthat theprovisionsofarticle6ECHR, therequirementofafairtrial,concerncriminalproceedingsintheirentiretyandcannotbelimitedtoasingleitemofevidence.So,ifapieceofevidencehasbeenobtainedbyusingunlawful means, this does not automatically undermine due process, providing adefendant is given the opportunity to question the significance and legality of theevidence and its source, and whether it was falsified before a court.22The legality ofevidence may depend on the extent to which a LEA has had a hand in instructing aprivateparty toobtain the evidence if thishappened in anunlawfulmanner. If a LEAknowsthatobtainingevidenceinacertainwayisunlawfulbutneverthelessinstructsaprivate party to obtain the evidence in this way, the evidence will be unlawfullyobtained and can be excluded from the trial. However, if a private party collectsevidence on its own initiative,which can be in an unlawfulmanner, and delivers theevidencetoaLEA,theevidencemaybelawfullyobtainedbytheLEAandcanassuchbeincludedinthetrial.

Inadditiontotheproblemofdeterminingwhetherevidenceisadmissible,thereisalsoapotentialchallengearoundguaranteeingthetransparencyoftheprocessofthetrial.So,allevidencethatisusedtocometoajudgementneedstobeavailabletoallparties.Thisdoesnotnecessarilyincludethemethodsforobtainingtheevidence.However,whenitconcernsdigitalevidenceaboutbehaviourofasuspectontheDarkWeb,themethodsofobtainingevidencemaybe implicitlypartof theevidence itself.Toseehowthis is thecase, it’s useful to consider the use of algorithms to identify suspects. Technologiesrelying on algorithms can be used to give guidance to LEAs on where to search forsuspects or illegal activity. However, this profiling technology cannot be evidence initself, as it only indicates potential suspects. It can be the starting point forinvestigations, but still then the illegal activity needs to be identified, recorded, andproven in relation to a suspect before a conviction can take place. In any case,whenthere are indications based on profiling that a specific activity or person should beinvestigated,theLEAhastobeabletoexplaintoajudgewhytheindicationwasindeedsufficient to start usingmeans for investigation. The reason is that the use of specificinvestigatorymeansneedstobejustified.Otherwise,theinvestigationscanbedeclaredtobebasedonarbitrariness.

Inpractice,LEAsmaybeprovidedwithintelligencebyprivatecompanies,butLEAsdonotdisclose this in courtbecausedoingsowould jeopardize the relationshipwith the

21 12 May 2000 (Application No 35394/97). 22 A. Roosendaal & N. Purtova (2009). Whether a Photograph Taken for Google’s Street View can be used as Evidence in a Criminal Process: A Case Note. Digital Evidence and Electronic Signature Law Review, vol 6, p. 187-190.

22

company.ThisillustratesthatthereisacertainkindofdependenceofLEAsonprivatecompanies, since these companiesmight have bettermeans and knowledge to gatherspecific intelligence. However, keeping this a secret in court might infringe upon therighttoafairtrialifasuspectisnotabletoassesstheoriginsofevidence.ThereisariskofLEAs trying tohide theircollaborationswithprivatecompanies,whichmight implythatthereisaneedto‘buildastory’oftheevidenceandhowitwasobtainedandwhyacertaininvestigationwasstarted.Allthis,todefendproactivelyagainstarbitrariness.

5.3 Toolsandservicesusingdatasciencedeveloped inauthoritarianorhuman-rightsviolatingways

Asindicated,LEAsareboundbylawtouseonlycertainpermittedmeanstopursueaninvestigation.Theuseorapplicationofdatasciencetechnologiesispermissibleaslongasthesefallwithinthescopeofmeansandcompetencesallowed,oftenbynationallaws.The question arises whether EU LEAs should be buying or contracting to use suchservicesifthesciencebehindthemhasbeendevelopedbyusingdatainwaysthatwouldbeillegalinEUjurisdictions.Aclearanswertothisquestionisdifficulttogive.First, itmaybedifficult toanLEAtoknowabout theexactwayaservicehasbeendeveloped.Basically,theservicesdonotcomewithadescriptionoftheexactmeansofdevelopmentandtheexacttechnologiesordatabasesusedtobuildacertainstandardoftechniques,knowledge,orprofiles.Second,itmaybepossibletofindoutaboutthewayaservicehasbeendeveloped,butthisdoesnotautomaticallyalsoprovideinformationaboutwhetherthewayitisappliedinpracticeorworksinitsdeploymentislegalornot.

Inanycase,LEAscanonlyusetheservicesprovidedbyprivatepartiesinwaysthatarein linewiththeir legalcompetences.Somemeansfalloutsidethe legalcompetencesofLEAs.For instance, if aprivate company ishackinga computeroranetworkbyusingillegalhackingsoftware,thisisawayofobtainingevidenceoratleastgainingaccesstoanetworkthatfallsoutsidethescopeofthelegalcompetencesofLEAs.

5.4 CorporateSocialResponsibility/CodesofConductforcompaniesdoingDarkWebanalytics

In order to give somemore guidanceonprivate companies offering services forDarkWeb analytics or research, the development of a Code of Conduct may be desirable.Giventhefactthatthereisastrongfocusonillegalactivitiesandfindingorobstructingthese, clear rulesora setofbasicprinciples canbehelpful in creatinganaccountablepractice.Thesharingofbestpracticescanbeusefulaswell.

Withregardtotheprinciples,inspirationcanbefoundinseveralhumanrightslaws.Forinstance,therequirementsfordueprocessasdiscussedabovecangivesomeguidanceon transparency that is needed for legal admissibility of evidence or investigationtechniques and technologies. A parallel can be drawn with the basic principles forinformation security, often referred to as the CIA-principles. CIA stands forConfidentiality, Integrity, and Availability. So, information collected in the course ofinvestigations should be protected properly against leakage or unlawful access, theintegrityofthedataneedstobeensured,e.g.byusingtimestampsofdigitalsignatures,

23

andthedataneedtobekeptavailableandshouldnotbelostorgetoutofsight.Besides,lawsonprivacyanddataprotectioncanbeused to formulateprinciples.For instance,theprincipleofprivacybydesign(ordataprotectionbydesignaslaiddowninArticle25of theGDPR)canbeusedasaway toprotect the rightsof individuals thatbehavelawfully on the Dark Web. The principle entails that in the development of tools orservices, the protection of privacy is embedded. This can be done by implementingtechniques to secure the data, by anonymizing or pseudonymizing the data whenpossible,andbymeansofcontractsandworkinginstructions.Ingeneral,themeasurestakencanbeofatechnicalororganizationalnature.23Theaimofprivacybydesignistooprotectthefundamentalrightsofpersonswhosedataisbeingprocessed.Thesepersonscanbesuspects,butalsootherpersonswhosedataisbeingprocessedinthecourseofinvestigations, simply becausemore data is collected than from the suspect only. Theapplicationofprivacybydesignseemsalogicalstep,sincethereasonforusingtheDarkWeb for non-criminal activities can often be found in privacy considerations ofindividualusers.Butprivacybydesign canalsohelp toprotect the rightsof suspects,because it supports the creation of requirements on how to secure data and how toensureintegrityofthedatacollected.Dataintegrityandqualityofdataareaspectsthatshouldbetakenaccountforbytheorganisationsresponsibleforthepersonaldatabeingprocessed.So,LEAshavearesponsibilitytoensurethatthedataandinformationtheycollectandprocessisofhighquality.

23 For an overview of measures that can be taken and their origins in the GDPR, see, for instance, this framework: https://www.privacycompany.eu/factsheets/#%2Ffiles%2FPrivacy%2520by%2520Design%2520Framework%2520-%2520English.pdf .

24

6. Conclusion

6.1 SummarylistofRecommendations

Thisreporthashighlightedanddiscussedsomeoftheethicalandlegalchallengesposedby the policing of the Dark Web. The discussion aims to be responsive to currentpracticesandrelevanttokeyactorsinthefield,principallyLEAsandprivateactorsthatcontributetopolicingontheDarkWeb.Thoughtechnologiesandpracticesinthisareachangeanddevelopfast,thereporthasattemptedtofocusonissueswhoserelevanceislikely topersist in at least thenear future.As far aspossible, discussionof issueshasbeenfollowedupbyconcreterecommendationsforfutureaction,directedtokeyactorsinthefield.

The role of national LEAs/police professional bodies in drafting guidance, developingbestpracticeandsecuringuptakeisvital.ButinternationalinstitutionssuchasEuropolandInterpolalsoplayanimportantroleindisseminatingbestpractice.Industryshouldbe the proactive generators of self-regulation and good practice, not only the passiveparticipantsofstate-ledgovernance.

Anumberofrecommendationshaveemergedfromthediscussioninthisreport.Theseare directed to LEAs, companies, and to those defining research agendas in this field.Theseareextractedfromthetextandreproducedbelow.

• LEAs should adopt a targeted approach to policing theDarkWeb, focusing onexposing,disruptingandprosecutingcriminalswhilerefrainingfrominterferingwithinnocuousactivitiesandtheexerciseofpoliticalfreedoms.

• LEAs should put in place strategic and long-term provision of psychological,moral, and professional support for officers involved in operations that bringthemclosetodisturbingactivitiessuchastortureandchildabuse.

• If in the course of operations LEAs share images or videos of abuse, torture,assassinationsorsimilarlyrights-violatingactionstheyshoulddevelopapolicyon consulting and/or compensating victimswhose images are shared and/or,whereappropriate,theirfamilies.

• LEAs should develop supplementary, detailed guidance for authorizing andcovertofficersdoingoperationson theDarkWeb inorder to ensure that theyarecarriedout inways thatarenecessaryandproportionate.Guidanceshouldspecifyconsiderationstotakeintoaccount,including:theharmre-victimisationandhowtocompensateormitigateit;harmsthatarerelatedtobutfallshortofentrapment, such as encouraging, facilitating, and normalizing serious crime;harms to thewelfare of officers; and the harm that is donewhen LEAs allowcrimestooccurthatcouldhavebeenpreventedbyLEAintervention.

• Theeffectivenessof tacticsandoperationsshouldbemonitoredsystematicallybyLEAsover time tocreate thekindofevidencebaseonwhichbestpracticescould be developed. In this respect, it would be desirable to form aninternationalevidence-baseandbankoftactics inordertoenablethediffusion

25

of best practices amongst forces across jurisdictions. Interpol could have animportantroletoplayinanysuchinitiative.

• LEAsshouldbeastransparentaspossibleabouttheoutcomesofoperationsandhow these constitute effectiveness. With respect to existing, well-publicisedoperations,theforcesinquestionhavereleasedrathervaguestatementsaboutnumbers of arrests. But counting the severity of the sentences instead, e.g.number of years of imprisonment,would better track the harms averted thanlisting the number of individuals arrested or convicted. And efforts should bemade to develop evaluation techniques that can measure the currentlyundervalueddisruptioneffectsofmethodsandoperations.

• Research should be carried out tomap LEA reliance on the private sector fortechnicaltoolsandcapabilitiesininvestigationsonline,toassessLEAneeds,andto forecast how this is likely to develop in the future. The outcomes of suchstudiesshouldbeusedtoplanandinvestinLEAcapabilitiesinastrategicway.

• LEAsshouldmakesurethatmeansusedbyprivatecompaniestheyrelyonarelawful and that the evidence collected is admissible in court- for example, byestablishinganagreementonthewayworkcoveredbyacontractwillbecarriedout. Such an agreement could cover issues such as a commitment by privatecompaniestousetechnologicalmethodsdesignedtoensuretheintegrityoftheevidencecollected.

• Private companies offering particular services or tools for Dark Webinvestigationsshoulddevelop,publishandabidebyCodesofConducttodevelopresponsibleandaccountablepractice.