How does the Darknet differ from the Dark Web and what risks does a lawyer face when working with it?

The word «darknet» sounds like a death sentence: it seems that anyone who has ventured there is already under suspicion. But is there really a crime lurking behind every “dark” address, and what in these horror stories is true, and what is myth?

The tip of the iceberg

At the initiative of the UNBA Committee on cybersecurity and virtual assets, a webinar titled «Truth and fiction about the Darknet: information panic or a real threat?» was held. The event was moderated by the chairman of the Committee Andriy Galych and the speaker was a director of a cybersecurity company Vitaliy Yakushev.

The speaker noted that the topic of the dark web has become overgrown with myths spread by marketers and Hollywood, and that confusion over terminology has practical implications for lawyers as well. The structure of the network is best explained by the image of an iceberg: websites and social networks indexed by search engines constitute the Surface Web —o nly a small, visible portion. There are significantly more resources beneath the surface.

This hidden part — the Deep Web — is not illegal in and of itself. This includes, for example, corporate accounting systems accessible via username and password that administrators hide from search engines, or closed interest-based forums. In contrast, the Dark Web consists of illegal platforms: discussions of cybercrimes, and the trade in prohibited substances, weapons and people.

As for the Darknet, according to V. Yakushev, it is a separate technological network with its own protocols and addressing schemes: Tor, I2P, and Freenet. «For me — web is anything related to the Internet. And net is a network — a separate technology», - the speaker explained.

The addresses of Tor sites end in .onion, meaning «onion». The name is no coincidence: traffic within the network makes at least three «hops» between nodes, and each adds a new layer of encryption. Moreover, Tor was not created for criminals, but to circumvent censorship — so that journalists and activists in China, Iran and other countries with government firewalls could publish their research.

The tools here are the same for both sides: «white hat» hackers use them to strengthen client security, while «black hat» hackers use them to break into systems. The distinction between white hat and black hat, by the way, comes from classic Westerns, where the good cowboys wore white hats and the bad ones wore black ones. «So we’re like cowboys of the virtual world», - joked V. Yakushev.

The speaker also drew attention to the difference between privacy and anonymity, which are often conflated. He compared privacy to an apartment behind a closed door: neighbors know who lives there, but they don’t know what’s happening inside. «Privacy is when people know who you are, but they don’t know what you’re doing. Anonymity, on the other hand, is the opposite: they don’t know who, but they see what they’re doing», - the speaker concluded.

The limits of acceptability

Accessing the Darknet is not a crime in and of itself, V. Yakushev emphasized. Companies that monitor such resources access them to detect requests for client hacking in a timely manner and prevent the threat. It’s a different story in countries with censorship, such as China, Iran, Russia or North Korea: there, the mere fact of accessing the Darknet means that «authorities will take an interest in the person».

Risks arise when a person actively participates in illegal activities — such as buying or selling. Even ordering a hack of a spouse’s or friend’s account «just for fun» is already a violation of the law. Citing it as an “experiment” after being detained won’t help: such actions must be documented and carried out within the bounds of procedural authority. Among other risks, the speaker cited money laundering particularly via cryptocurrency and violations of the GDPR when selling or dumping databases containing personal data.

However, even a research purpose does not guarantee immunity. «Someone finds out and says: You’re a lawyer; you must know this is illegal. Or maybe you’re not just sitting there watching, but actually doing illegal things?», - the speaker described the situation. Therefore, before undertaking such work, he advised thoroughly studying Articles 361–363 of the Criminal Code — regarding unauthorized interference and the use of malicious software.

It’s not worth collecting data «just in case» to later offer it to a client. «No, you can’t do that — only if you have contracts in place», - V. Yakushev cautioned. His practical advice for those working with the Darknet:

operate as legally as possible, in accordance with internal policies;

have a contract with the client and their consent for monitoring—otherwise, collecting information about the company could be interpreted as preparation for blackmail;

have a license for the products used for monitoring;

familiarize yourself with the laws of the country where services are provided, since sometimes even activities that seem legal at first glance may violate them.

Eight out of ten are fakes

What is actually being sold on darknet markets? According to unofficial data cited by the speaker, about 80% of sales on the Darknet are scams. The scheme is simple: attackers manage to download, say, 10 records from a company’s database, but sell the «database» for 100,000. The rest are generated or taken from other, previously stolen databases. The buyer is given a few genuine records to verify — and then pays for the fake.

As an example, the speaker cited a recent attack on the ATB website, where the attackers demanded a ransom within two hours. «The hack did occur, but there is no reliable data on how extensive it was», - noted V. Yakushev.

The samples released, he said, did not appear to be evidence: there is a suspicion that this is a database stolen some time ago, «enriched» with fake data. A similar situation occurred with the alleged «Reserve+» breach: the citizens’ data in the leaked file was real but most likely came from military registration and enlistment offices’ databases. The goal of such leaks is blackmail or reputational damage.

However, real leaks are also dangerous: hackers often post password databases that they were unable to monetize on the Darknet for free. «Passwords are a pain because so many people use the same passwords everywhere», - the speaker noted. In his experience, during simulated hacking attacks, up to 30% of passwords turn out to be reused, so the test can sometimes be completed in a few hours. «A cybersecurity system is like a coconut: the perimeter is protected, but the inside is soft», - the speaker explained.

He emphasized to the lawyers that data from the Darknet may not be admissible as evidence in court — it must first be validated. Furthermore, due to encryption, VPNs, and cryptocurrency mixers, it is extremely difficult to attribute an action — that is, to prove that a specific person actually committed the act. As an example, the speaker cited a Japanese case where a hacker used a virus to take control of other people’s computers and planted evidence against their owners—resulting in the arrest of innocent people. The real perpetrator was eventually tracked down thanks to a cat.

«If a hacker’s skill level exceeds that of law enforcement specialists, then, most likely, they won’t be able to catch him», - the speaker concluded, comparing the situation to the rivalry between Sherlock Holmes and Moriarty.

Who guards the nodes

The speaker named Silk Road as the most famous marketplace, with a turnover of hundreds of millions of dollars. Its founder was sentenced to two life terms plus 40 years — in the USA, sentences for each crime are cumulative — but was later pardoned by President Donald Trump. Next came AlphaBay, Hansa, and Hydra. Law enforcement agencies, upon gaining access to such platforms, typically do not shut them down immediately but instead gather information for a certain period of time.

According to V. Yakushev’s observations, such markets last an average of a couple of years: they are either shut down by law enforcement or the owners disappear on their own, taking users’ deposits with them — a so-called exit scam. Closed forums have their own trust system: registration based on recommendations from two participants (guarantors), arbitration, and reputation. «To prove you’re a bad hacker, you have to get a bad reputation», - the speaker explained.

Is Tor truly anonymous? Monitoring only the entry node or only the exit node does not allow one to determine where a user has been. But if both are monitored, analytical tools can determine this with a 70–80% probability based on the times of entry and exit. One webinar participant noted that there are only about 9,000 Tor nodes in the public registry. According to the speaker, if a significant portion of them is controlled by intelligence agencies, that is enough to deanonymize a specific individual when necessary.

The story of ANOM — a supposedly ultra-secure communication system purchased by drug and arms dealers proves that this is not just a conspiracy theory. In reality, it was controlled by the FBI, and ultimately, hundreds of users were arrested simultaneously. Hence V. Yakushev’s advice: the anonymization technology must be under your own control. Even an open-source messenger does not guarantee that the verified version is actually running on the server: «After all, no one gives you access to these servers».

In closing, the speaker emphasized that both Tor and closed forums exist for more than just malicious purposes. «It’s like a kitchen knife: you can use it to prepare food, or you can use it to injure people», - the speaker concluded.