Dark Web (UPSC Science & Tech)
UPSC guide to the dark web: Tor, deep web vs dark web, crimes, drug & weapons trade, law enforcement, and 2024-26 cyber developments.
The dark web is the tiny, intentionally hidden slice of the internet that is only reachable through anonymising networks like Tor or I2P. It hosts everything from dissident journalism to drug and weapons markets, child sexual abuse material (CSAM), stolen identity data, ransomware dashboards and cryptocurrency laundering services. For UPSC, the dark web appears under GS Paper III — Science & Technology, Internal Security with GS Paper II (Governance) overlaps.
Surface, Deep, and Dark — the three layers
| Layer | What it is | Examples |
|---|---|---|
| Surface Web | Indexed by search engines | Google, Wikipedia, news sites |
| Deep Web | Not indexed; requires login or direct URL | Banking portals, corporate intranets, paid journals, email inbox |
| Dark Web | Requires special software and cryptography | .onion, .i2p sites accessible via Tor/I2P |
The surface web is the visible internet, the deep web is the personal or paywalled internet, and the dark web is the hidden internet. The deep web dwarfs the surface web; the dark web is a fraction of both.
How the dark web works
Tor — The Onion Router
- Developed by the US Naval Research Laboratory in the mid-1990s, released open-source in 2002.
- Runs on the Tor network — thousands of volunteer-run relays globally.
- Packets are wrapped in multiple encryption layers (the "onion") and routed through three random relays.
- Each relay decrypts one layer; no single relay knows both origin and destination.
- Hidden services use .onion domains.
- Maintained by the Tor Project (non-profit).
I2P (Invisible Internet Project)
- Fully decentralised peer-to-peer anonymous network.
- Garlic routing (messages bundled and routed together).
- .i2p sites and "eepsites".
Freenet, Zeronet, GNUnet
- Other anonymising/decentralised networks with niche user bases.
Legitimate uses
- Whistleblowing — SecureDrop used by journalists (NYT, Guardian, Washington Post).
- Political dissent — Iran, China, Russia, Myanmar journalists and activists.
- Privacy-conscious users — under oppressive regimes or heavy surveillance.
- Tor Browser — circumvents censorship.
- Research — studying extremism, threat intelligence, cybercrime.
- Dark-web mirrors of news sites — BBC, DW offer Tor mirrors.
Tor is legal in most democracies including India.
Criminal uses
Illicit marketplaces
- Drug bazaars — fentanyl, methamphetamine, MDMA, cannabis.
- Weapons — firearms, 3-D printed weapons, explosives.
- Stolen data — credit cards, Aadhaar/PAN dumps, corporate leaks.
- Counterfeit documents — passports, driving licences, degrees.
- Malware and ransomware-as-a-service (RaaS) — LockBit, BlackCat, Cl0p.
- Hitman services — mostly scams.
- CSAM — the most heinous category, aggressively targeted by global law enforcement.
Evolution of darknet markets
| Market | Period | Fate |
|---|---|---|
| Silk Road (2011-13) | First major drug bazaar | Founder Ross Ulbricht arrested 2013 |
| AlphaBay (2014-17) | Largest successor | Seized Operation Bayonet 2017 |
| Hansa Market | 2015-17 | Taken over by Dutch police before shutdown |
| Empire, White House, Dream Market | 2017-21 | Exit scammed / shut down |
| Hydra (Russian) | 2015-22 | Seized by German/US law enforcement 2022 |
| Genesis Market | Till 2023 | Operation Cookie Monster |
| Nemesis Market | Till Mar 2024 | US DoJ dismantled |
| Incognito Market (2020-24) | 2020-24 | Admin "Pharoah" arrested US 2024 |
Money trail
- Bitcoin dominated early dark-web use; now Monero (privacy coin) is preferred.
- Mixers and tumblers (Tornado Cash, Samourai, Helix) obscure flows.
- FATF Travel Rule, OFAC sanctions and India's PMLA provisions (March 2023) apply.
- Chainalysis, TRM Labs, Elliptic — major blockchain forensics providers used by law enforcement.
India's legal framework
| Law / Rule | Relevance |
|---|---|
| Information Technology Act, 2000 (Sections 43, 66, 66C, 66D, 66F, 67, 67A, 67B, 70, 79) | Cybercrime, CSAM, cyber terror |
| IT Intermediary Rules 2021 | Take-down, grievance |
| Bharatiya Nyaya Sanhita (BNS) 2023 | Substantive penal code (1 July 2024) |
| Bharatiya Nagarik Suraksha Sanhita (BNSS) 2023 | Procedural code |
| Bharatiya Sakshya Adhiniyam (BSA) 2023 | Digital evidence primacy |
| PMLA (with Mar 2023 VDA SP notification) | Crypto service provider obligations |
| NDPS Act, 1985 | Narcotic drugs |
| POCSO Act, 2012 | CSAM offences |
| DPDP Act, 2023 | Personal data protection |
India's institutional response
- Indian Cyber Crime Coordination Centre (I4C, 2020) — apex coordinator; MHA.
- National Cybercrime Reporting Portal (cybercrime.gov.in) and helpline 1930.
- CERT-In — emergency response (MeitY).
- NCIIPC — protection of Critical Information Infrastructure.
- Defence Cyber Agency (DCA) — military cyber domain.
- State cyber cells and Cyber Forensic Labs at CFSLs/NFSU.
- Narcotics Control Bureau (NCB) — drug darknet trade.
- Enforcement Directorate (ED) — money laundering angles.
Challenges for law enforcement
| Challenge | Detail |
|---|---|
| Anonymity | Tor hides origin |
| Jurisdiction | Servers globally distributed |
| Encryption | End-to-end encrypted comms (Signal, Wickr) |
| Cryptocurrency laundering | Privacy coins, mixers |
| Agility of adversaries | Markets reconstitute rapidly |
| Skill gap | Trained cyber investigators scarce |
| International cooperation | MLATs slow |
Dark-web threat trends (2023-25)
- Ransomware professionalisation — LockBit (disrupted Feb 2024 Operation Cronos), BlackCat/ALPHV (exit-scammed Mar 2024), Cl0p (MOVEit exploitation), Play, Akira.
- Initial Access Brokers (IABs) selling network access.
- Infostealer ecosystem — RedLine, Vidar, Raccoon; logs sold cheaply.
- Synthetic identities using AI deepfakes + leaked data.
- AI-generated CSAM (new concern 2024).
- Darknet for sanctions-evasion (North Korean actors).
- Sextortion scams using AI-generated imagery.
Case studies relevant to India
- NCB darknet operations (2020-24) — seizures of LSD, MDMA from darknet-ordered parcels.
- Cyberabad Police operation "Night Crawler" (2023) — tracking sellers of stolen credentials.
- AIIMS Delhi ransomware (Nov 2022-2023) — patient records encrypted; ransom demanded.
- C-Edge Tech banking ransomware (Jul 2024) — ~300 cooperative banks briefly offline.
- Star Health data breach (Oct 2024) — customer data posted on dark web.
Prevention and response
For individuals and organisations
- Multi-factor authentication, patching, zero-trust architecture.
- Security awareness — phishing, infostealer hygiene.
- Endpoint Detection and Response (EDR).
- Dark-web monitoring — services that scan for leaked credentials.
- Incident response playbooks.
- Cybersecurity insurance.
For government
- Capacity building at I4C, CFSLs, state cyber cells.
- Crypto-transaction analytics via TRM/Chainalysis-style tools.
- International cooperation — EC3 Europol, Interpol, FBI, INTERPOL Darknet Working Group.
- Regulation of VASPs — PMLA, CARF.
- Public-private threat intelligence sharing (CERT-In cyber swachhta).
Latest developments (2024-26)
- Operation Cronos (Feb 2024) — LockBit infrastructure dismantled; affiliate arrests.
- ALPHV/BlackCat exit scam (Mar 2024) — paid-but-published leaks.
- Nemesis Market take-down (Mar 2024) — US/German cooperation.
- Incognito Market "Pharoah" arrest (May 2024) in New York.
- I4C expanded — Rs 2,000+ crore outlay; Samanvay platform.
- Indian Cybercrime helpline 1930 — over 1 crore complaints and ~Rs 3,000 crore frauds prevented (2024).
- BNSS mandates forensic investigation for offences ≥7 years imprisonment (1 July 2024).
- CARF (OECD Crypto-Asset Reporting Framework) — India to implement by 2026.
- AI Action Summit, Paris (Feb 2025) — AI-enabled cybercrime flagged.
- India Semiconductor Mission — trusted hardware for defence cyber.
- DeepTech Policy 2024 — cybersecurity startups incentivised.
- National Quantum Mission (2024) — post-quantum cryptography research to pre-empt future dark-web threats.
- Chandrayaan-4 plan and Gaganyaan progress — demands secure uplinks against cyber-intrusions.
UPSC Relevance
GS Paper III — Science & Technology / Internal Security
- Dark web, Tor, cybercrime, ransomware.
GS Paper II — Governance
- I4C, CERT-In, NCIIPC, inter-agency coordination.
GS Paper III — Economy
- Crypto crime, VASP regulation.
GS Paper IV — Ethics
- Anonymity for whistle-blowers vs abuse by criminals.
Prelims pointers — Tor (US NRL, onion routing), Silk Road, LockBit/Operation Cronos, IT Act Section 66/67, I4C, 1930 helpline, Bharatiya Nagarik Suraksha Sanhita (1 July 2024), PMLA VDA SP notification (2023).
Interview probes — encryption vs lawful interception; Tor legality; crypto-laundering policy; cybercrime capacity in states.
The dark web is neither uniformly dystopian nor a mere curiosity — it is a litmus test of how democracies balance privacy, free expression, law enforcement and international cooperation. India's response must be technically sharp, legally clear and civil-liberties aware.