text: The mysterious corner of the Internet known as the Dark Web is designed to defy all attempts to identify its inhabitants. But one group of researchers has attempted to shed new light on what those users are doing under the cover of anonymity. Their findings indicate that an overwhelming majority of their traffic is driven by the Dark Web’s darkest activity: the sexual abuse of children. 
   
   At the Chaos Computer Congress in Hamburg, Germany today, University of Portsmouth computer science researcher Gareth Owen will present the results of a six-month probe of the web’s collection of Tor hidden services, which include the stealthy websites that make up the largest chunk of the Dark Web. The study paints an ugly portrait of that Internet underground: drug forums and contraband markets are the largest single category of sites hidden under Tor’s protection, but traffic to them is dwarfed by visits to child abuse sites. More than four out of five Tor hidden services site visits were to online destinations with pedophilia materials, according to Owen’s study. That’s over five times as many as any of the other categories of content that he and his researchers found in their Dark Web survey, such as gambling, bitcoin-related sites or anonymous whistle-blowing. 
   
   The researchers’ disturbing statistics could raise doubts among even the staunchest defenders of the Dark Web as a haven for privacy. “Before we did this study, it was certainly my view that the dark net is a good thing,” says Owen. “But it’s hampering the rights of children and creating a place where pedophiles can act with impunity.” 
   
   >“Before we did this study, it was certainly my view that the dark net is a good thing.” 
   
   Precisely measuring anything on the Dark Web isn't easy, and the study's findings leave some room for dispute. The creators of Tor known as the Tor Project responded to a request for comment from WIRED with a list of alternative factors that could have skewed its results. Law enforcement and anti-abuse groups patrol pedophilia Dark Web sites to measure and track them, for instance, which can count as a "visit." In some cases, hackers may have launched denial of service attacks against the sites with the aim of taking them offline with a flood of fraudulent visits. Unstable sites that frequently go offline might generate more visit counts. And sites visited through the tool Tor2Web, which is designed to make Tor hidden services more accessible to non-anonymous users, would be underrepresented. All those factors might artificially inflate the number of visits to child abuse sites measured by the University of Portsmouth researchers.1 
   
   "We do not know the cause of the high hit count [to child abuse sites] and cannot say with any certainty that it corresponds with humans," Owen admitted in a response to the Tor Project shared with WIRED, adding that "caution is advised" when drawing conclusions about the study's results. 
   
   Tor executive director Roger Dingledine followed up in a statement to WIRED pointing out that Tor hidden services represent only 2 percent of total traffic over Tor's anonymizing network. He defended Tor hidden services' privacy features. "There are important uses for hidden services, such as when human rights activists use them to access Facebook or to blog anonymously," he wrote, referring to Facebook's launch of its own hidden service in October. "These uses for hidden services are new and have great potential." 
   
   Here's how the Portsmouth University study worked: From March until September of this year, the research group ran 40 “relay” computers in the Tor network, the collection of thousands of volunteer machines that bounce users’ encrypted traffic through hops around the world to obscure its origin and destination. These relays allowed them to assemble an unprecedented collection of data about the total number of Tor hidden services online—about 45,000 at any given time—and how much traffic flowed to them. They then used a custom web-crawling program to visit each of the sites they'd found and classify them by content. 
   
   The researchers found that a majority of Tor hidden service traffic—the traffic to the 40 most visited sites, in fact—were actually communications from “botnet” computers infected with malware seeking instructions from a hacker-controlled server running Tor. Most of those malware control servers were offline, remnants of defunct malware schemes like the Skynet botnet whose alleged operator was arrested last year. 
   
   But take out that automated malware traffic, and 83 percent of the remaining visits to Tor hidden service websites sought sites that Owen’s team classified as related to child abuse. Most of the sites were so explicit as to include the prefix “pedo” in their name. (Owen asked that WIRED not name the sites for fear of driving more visitors to them.) The researchers’ automated web crawler downloaded only text, not pictures, to avoid any illegal possession of child pornographic images or video. “It came as a huge shock to us,” Owen says of his findings. “I don’t think anyone imagined it was on this scale.” 
   
   Despite their popularity on the Tor network, child abuse sites represent only about 2 percent of Tor hidden service websites—just a small number of pedophilia sites account for the majority of Dark Web http traffic, according to the study. Drug-related sites and markets like the now-defunct Silk Road 2, Agora or Evolution represented a total of about 24 percent of the sites measured in the study, by contrast. But visits to those sites accounted for only about 5 percent of site requests on the Tor network, by the researchers’ count. Whistleblower sites like SecureDrop and Globaleaks, which allow anonymous users to upload sensitive documents to news organizations, accounted for 5 percent of Tor hidden service sites, but less than a tenth of a percent of site visits. 
   
   The study also found that the vast majority of Tor hidden services persist online for only a matter of days or weeks. Less than one in six of the hidden services that was online when Owen's study began remained online at the end of it. Since the study only attempted to classify sites by content at the end of its six month probe, Tor director Roger Dingledine points out that it could over-represent child abuse sites that remained online longer than other types of sites. "[The study] could either show a lot of people visiting abuse-related hidden services, or it could simply show that abuse-related hidden services are more long-lived than others," he writes. "We can't tell from the data." 
   
   The Study Raises the Question: How Dark Is The Dark Web? 
   
   Other defenders of the Tor network’s importance as an alternative to the public, privacy-threatened Web will no doubt bristle at Owen’s findings. But even aside from the Tor Project's arguments about why the study's findings may be skewed, its results don’t necessarily suggest that Tor is overwhelmingly used for child abuse. What they may instead show is that Tor users who seek child abuse materials use Tor much more often and visit sites much more frequently than those seeking to buy drugs or leak sensitive documents to a journalist. 
   
   Nonetheless, the study raises new questions about the darkest subcultures of the Dark Web and law enforcement’s response to them. In November, the FBI and Europol staged a massive bust of Tor hidden services that included dozens of drug and money laundering sites, including three of the six most popular anonymous online drug markets. The takedowns occurred after Owen’s study concluded, so he doesn’t know which of the pedophilia sites he measured may have been caught in that dragnet. None of the site takedowns trumpeted in the FBI and Europol press releases mentioned pedophilia sites, nor did an analysis of the seizures by security researcher Nik Cubrilovic later that month. 
   
   >“It came as a huge shock to us. I don’t think anyone imagined it was on this scale.” 
   
   In his Chaos Computer Congress talk, Owen also plans to present methods that could be used to block access to certain Tor hidden services. A certain number of carefully configured Tor relays, he says, could be used to alter the "distributed hash table" that acts as a directory for Tor hidden services. That method could block access to a child abuse hidden service, for instance, though Owen says it would require 18 new relays to be added to the Tor network to block any single site. And he was careful to note that he's merely introducing the possibility of that controversial blocking measure, not actually suggesting it. One of Tor's central purposes, after all, is to evade censorship, not enable it. 
   
   The study could nonetheless lead to difficult questions for the Tor support community. And it could also dramatically shift the larger public conversation around the Dark Web. Law enforcement officials and politicians including New York Senator Chuck Schumer have railed against the use of Tor to enable online drug sales on a mass scale, with little mention of child abuse. Owen's study is a reminder that criminal content is hiding in the shadows of the Internet that make drug sales look harmless by comparison—and whose consumers may be more active than anyone imagined. 
   
   1Updated 12/30/2014 5:25 EST to add more of the Tor Project's explanations of possible inaccuracies in the study's count of visits to child abuse sites. ||||| Image copyright Thinkstock Image caption The study sought to find out which hidden Tor sites got the most traffic 
   
   Most traffic to sites hidden on the Tor network go to those dealing in images of child sexual abuse a study suggests. 
   
   The six-month study sought to catalogue hidden services on the so-called "dark net" and work out which were the most popular. 
   
   It found lots of sites peddling illegal drugs but the most popular were those involved with abuse. 
   
   However, the researcher behind the study said it was hard to conclude that people were behind all the visits. 
   
   Drug traffic 
   
   Tor, or The Onion Router, is an anonymising system that lets people use the web without revealing who they are or which country they are in. The anonymity offered by the network has encouraged many people to set up hidden .onion sites that offer content, services and goods that it is illegal to sell openly. 
   
   Carried out by Dr Gareth Owen from the University of Portsmouth, the study set up servers to join the Tor network and catalogued hidden services found on it. The system was also able to visit the sites to download HTML content so they could be categorised and to track how many visits each one received. 
   
   Traffic to hidden services on Tor represents about 1.5% of all the data passing across the network on any given day. 
   
   Over the six months of the study, Dr Owen and his colleagues saw about 80,000 hidden sites on Tor. 
   
   "Most of the hidden services we only saw once. They do not tend to exist for a very long time," he said during a speech at the 31st Chaos Communications Congress in Hanover, where he presented his findings. 
   
   The top 40 hidden services were involved with controlling botnets - networks of home computers compromised by malicious programs. Many of these botnets have been shut down which has left their client computers fruitlessly polling Tor seeking the now dormant command systems. 
   
   The study found that the biggest number of hidden services were dedicated to selling illegal drugs. Also in the top five were underground markets, fraud sites, mail services and those dealing in the virtual currency Bitcoin. 
   
   Image copyright SPL Image caption Hidden sites peddling illegal drugs are also popular on Tor 
   
   Although the number of sites dealing in images of abuse on Tor is small, traffic to them dwarfs that going to other sites, said Dr Owen. 
   
   About 75% of the traffic observed in the study ended up at abuse sites, said Dr Owen. 
   
   "When we found this out we were stunned," he said. "This is not what we expected at all." 
   
   Despite the findings, Dr Owen cautioned against drawing too many conclusions since he did not know which visits were done by people and which by machines. 
   
   "It's not as quite as straightforward as it looks," he said. "It might look like there are lots of people visiting these sites but it is difficult to conclude that from this information." 
   
   "What proportion are people and which are something else? We simply don't know." he said, adding that "crawlers" run by law enforcement and other agencies that police abuse sites could be responsible for the steady stream of traffic. 
   
   Roger Dingledine, one of the original developers of Tor, also said the methodology of the study - which only scanned long-lived sites to see what content they offered - made it hard to draw conclusions about what people did on the network. 
   
   "Without knowing how many sites disappeared before he got around to looking at them, it's impossible to know what percentage of fetches went to abuse sites," he said. 
   
   "There are important uses for hidden services, such as when human rights activists use them to access Facebook or to blog anonymously," he added. 
   
   "These uses for hidden services are new and have great potential."
target: – Between March and September of last year, four out of five visits to a major part of the Dark Web—the anonymous corner of the Internet—were to sites exhibiting the sexual abuse of children, says a new study picked up by Wired. These sites account for only 2% of the Dark Web, but got five times more traffic (or about 83%) than other sites, like those selling drugs, offering gambling, or providing a haven for whistleblowers. "Before we did this study, it was certainly my view that the dark net is a good thing. But it’s … creating a place where pedophiles can act with impunity," says UK computer science researcher Gareth Owen. The websites studied are part of Tor hidden services—which allows users to surf the web anonymously, BBC explains—and they occupy the biggest chunk of the Dark Web. Owen used relay computers and a web-crawling program to collect his data. Tor executives point out the results could be distorted, and Owen acknowledges that "caution is advised" when assessing them. "We do not know the cause of the high hit count (to child abuse sites) and cannot say with any certainty that it corresponds with humans," he says. It's possible the traffic could be caused by law enforcement groups conducting investigations or hackers flooding the sites with fake visits. And then there's the positive justification for an anonymous web. "There are important uses for hidden services, such as when human rights activists use them to access Facebook or to blog anonymously," says Tor's executive director. Still, law enforcement and politicians are expected to push for a crackdown because of the study, and Owen says there may be ways to block child abuse sites. (A chunk of the Dark Web was shut down in November.)