Tip of the iceberg: beneath the ‘surface web’

Charlie Abrahams, senior vice president at brand protection company MarkMonitor, explains what can be done to prevent brand infringements on the dark side of the web.

In 2013, the FBI took down the illegal online marketplace Silk Road, bringing awareness of the criminal underground of the internet to the forefront of society.

Most people can now say that they have heard of the ‘deep web’, but not everyone understands what it is or how concerned they should be about the risks, especially brand owners looking to protect their reputations online.

The deep web comprises un-indexed webpages, dynamic content pages and otherwise gated information inaccessible via regular browsers or search engines.

By contrast, the surface web is what we would consider “regular” webpages. The surface web makes up only 4% of the internet—the other 96% is considered part of the deep web.

The deep web hosts a wide range of information—from academic resources, to subscription information, to conference proceedings. While much of its content consists of normal, day-to-day materials including corporate intranets and social media sites, it is also where un-indexed sites reside, selling grey market or counterfeit goods, phishing for user credentials, disseminating malware and engaging in other criminal activity.

Whether via spam, advertisements or cybersquatting domains, it is easy for consumers to stumble upon these sites unknowingly.

Although it can be difficult to identify criminal actors in the deep web, the so-called ‘dark net’ is where anonymity reigns.

The dark net is a small subset of the deep web, and can be accessed only via a Tor browser. Originally developed in the mid-1990s by the US Naval Research Laboratory to protect intelligence communication, today approximately 2.5 million users access Tor on a daily basis.

While the anonymity of the Tor network offers protection to those looking for privacy online, it is also appealing to criminals who are looking to profit while remaining unknown. Downloading Tor is relatively easy and it’s no surprise that people are accessing the dark net to visit marketplaces where counterfeit, pirated and illicit goods are sold.

Like Silk Road, there are many anonymous online marketplaces including Abraxas, Agora Marketplace and Nucleus where criminals are allegedly able to sell their wares.

“Policing the deep web adds an extra layer of difficulty to intellectual property protection as offenders are actively seeking to evade detection.” 

To further solidify the anonymity of these marketplaces, goods are typically bought using Bitcoin, a nearly untraceable digital currency. Bitcoins are appealing to criminals because not only are they not linked to personally identifying information such as names and addresses, they are not controlled by any one central authority, can be sent anywhere and arrive within minutes, and are non-reversible. Once Bitcoins are sent there is no getting them back. 

It’s important for a brand owner to know how its name is being represented on both the deep web and the dark net.

Just as important as enforcing against abuse and brand-jacking on the surface web, policing the deep web adds an extra layer of difficulty to intellectual property protection as offenders are actively seeking to evade detection.

To identify abuse, brand owners must understand their level of risk. Financial institutions should be monitoring for account information and companies with counterfeiting issues should determine if these marketplaces provide a means of mass distribution. Others should determine whether they need regular monitoring. All should track abuse over time.

The good news is that for abuse occurring in much of the deep web, standard enforcement and anti-counterfeiting strategies can be utilised. For most organisations, the threats and how to mitigate them on the dark net are still evolving. It is essential for companies to understand the importance of detection. By determining whether they need some sort of regular monitoring, companies will be better able to understand their risk and what steps should be taken to diminish them. 

Cybercriminals are continuously evolving their strategies and targets. In order to protect reputations and credibility, it’s important that brands explore all avenues for abuse and be aware of threats to their IP in all realms of the web.

Understanding the difference between the deep web and the dark net, as well as implementing a strong enforcement programme, will help you to deter criminals looking to take advantage of the opportunity to engage in illicit activity and cause damage to your brand.

Charlie Abrahams is senior vice president at brand protection company MarkMonitor. He can be contacted at: charlie.abrahams@markmonitor.com