Inside the dark web: How the hidden internet works

The internet is often described as an iceberg, with the visible portion representing websites that can be found through conventional search engines and a much larger hidden section containing pages and services that are not publicly indexed.

The hidden portion includes both the deep web and the dark web, which are often used interchangeably but have important differences.

What is the surface, deep and dark web?

The surface web, sometimes called the clearnet, is the part of the internet most people use every day. It consists of websites indexed by search engines such as Google and can generally be accessed through standard browsers without special authorisation, says Security.org.

The deep web refers to internet content that is not indexed by conventional search engines. It includes many ordinary and legitimate services, such as personal email accounts, medical records, subscription-based content and confidential corporate databases. Access typically requires a login or other authorisation, but users do not need specialised software.

The dark web is a small, deliberately concealed part of the deep web. It is designed to provide greater anonymity and generally requires specialised software, configurations or authorisation to access. Estimates of its size vary considerably, and the frequently cited figures for the relative sizes of the surface, deep and dark web should be treated as rough rather than precise measurements.

How does the dark web work?

The best-known system for accessing the dark web is Tor, short for The Onion Router. Tor is an open-source anonymity network that routes internet traffic through multiple relays, making it harder to determine a user's original IP address.

Tor uses layers of encryption as traffic passes through the network. The system is designed so that individual relays have limited information about the complete journey of a connection. The name "onion routing" refers to these layers of encryption.

Dark web services commonly use the .onion domain rather than familiar domains such as .com or .org. Onion addresses can consist of long strings of letters and numbers and are not generally indexed by conventional search engines.

Using the dark web can also be considerably less convenient than browsing the ordinary internet. Connections can be slow because traffic is routed through multiple relays, while websites can disappear, change addresses or become inaccessible. Search and directory services also tend to be less comprehensive than conventional search engines, making it difficult to locate reliable and current information.

Why do people use the dark web?

The dark web is strongly associated with criminal activity, but anonymity itself is not illegal and has legitimate uses.

Journalists, activists and whistleblowers can use anonymous communication systems to circumvent censorship or protect sources, particularly in countries where independent reporting or political expression is restricted.

Cybersecurity researchers, law enforcement agencies and media organisations also monitor dark web forums and services. They may look for evidence of stolen data, emerging cyber threats, criminal activity or information linked to security breaches.

Some major organisations have established onion services to provide users with an alternative way to reach their services. Facebook and The New York Times, for example, have operated dark web versions of their websites. Other legal services and communities have also existed on the network.

The broader concept of anonymous networks predates many of today's dark web marketplaces. Projects such as Freenet, released in 2000, were developed around decentralised and privacy-focused communication.

What happens on dark web marketplaces?

The anonymity offered by the dark web can also make it attractive to criminals.

Research has found substantial levels of illicit activity among dark web sites. A 2015 study found that 57% of live dark web sites examined contained illicit material, while research covering 2016 to 2019 found an increase in listings that could harm businesses.

Criminal marketplaces have offered drugs, stolen payment-card information, counterfeit currency, compromised online accounts, hacking services and, in some cases, firearms.

One of the best-known examples was Silk Road, which was launched in 2011 and shut down in 2013. Its founder, Ross Ulbricht, was sentenced to life in prison. Another major marketplace, AlphaBay, was taken down in 2017.

Stolen digital information is also traded. The Dark Web Price Index 2021, for example, listed average prices ranging from $25 to $35 for cloned credit cards with PINs, $80 for hacked Gmail accounts, $120 for stolen online banking credentials linked to an account with at least $2,000, $610 for hacked verified Coinbase accounts and $1,000 for hacked eBay accounts with strong reputations.

Prices and availability can change rapidly, however, and such figures should not be regarded as a reliable current market rate.

How are transactions conducted?

Cryptocurrencies, particularly Bitcoin, have historically been widely used in dark web transactions because they allow parties to exchange value without directly revealing their identities.

Cryptocurrency does not, however, guarantee anonymity. Transactions recorded on public blockchains can sometimes be analysed and linked to individuals or organisations through other information.

Fraud is also common. Dark web marketplaces can disappear without warning, and escrow systems designed to protect buyers and sellers can be compromised or abandoned by administrators.

What are the cybersecurity risks?

The dark web contains significant cybersecurity risks, particularly because users can encounter malicious actors and files without the safeguards associated with mainstream online platforms.

Malware distributed through underground communities can include keyloggers, botnets, remote-access trojans, ransomware and spyware. Criminal groups have also used dark web forums and marketplaces to support ransomware operations, including ransomware-as-a-service models in which developers provide malicious software to affiliates.

Phishing and other scams are widespread. Criminals can impersonate administrators, sellers or other trusted users to obtain passwords, financial information or other personal data.

For businesses, dark web activity can create additional risks. Stolen intellectual property, compromised employee credentials and corporate data may be offered for sale, while criminals can use underground services to facilitate malware attacks, distributed denial-of-service attacks and fraud.

Is accessing the dark web illegal?

Accessing the dark web or using Tor is not, by itself, evidence of criminal activity. Tor has legitimate privacy and security applications, and anonymous communication can be important for journalists, researchers and people living under censorship.

The legal position depends on what a person does after accessing these networks. Activities such as buying illegal drugs, stolen credentials or other prohibited goods remain illegal regardless of whether they take place on the dark web.

Users should also be aware that anonymity is not absolute. Investigators have developed techniques for identifying people involved in criminal activity on anonymous networks, and mistakes by users can expose their identities.

How can users reduce the risks?

People who have a legitimate reason to use the dark web should approach it cautiously.

They should avoid sharing personally identifiable information and should be wary of downloading files or following links from unknown sources. Security software and an up-to-date operating system can help reduce exposure to malicious software.

Tor's default privacy settings should not be changed without understanding the consequences, as configuration changes can potentially reveal information about a user's system or behaviour.

A VPN can provide an additional privacy layer in some circumstances, but it should not be regarded as a guarantee of anonymity or security. Users should also understand the difference between protecting network traffic and protecting themselves from malicious websites, scams or malware.

Most importantly, users should avoid illicit marketplaces and forums. The anonymity that attracts legitimate users to the dark web also attracts criminals, and there are fewer conventional safeguards for people who interact with them.

The bottom line

The dark web is not a separate internet or a synonym for online crime. It is a deliberately concealed part of the wider web that uses technologies such as Tor to make communication and browsing more private and difficult to trace.

That same privacy has legitimate applications, including protecting journalists, whistleblowers and people facing censorship. But it also creates an environment in which criminals can trade stolen data, illegal goods and cyberattack services.

For most internet users, the deep web already contains the vast majority of content they need. The dark web represents a much narrower part of the online world, where anonymity can offer important protections but also carries significant security and legal risks.