Making the virtual, virtual

(1)

Making the virtual, virtual.

An exploration of simulating cryptomarket disruptions.

Wout Singerling 11136324 9 - 6 - 2018

Supervisor: mw. dr. V.M. Dirksen 2nd_{Examiner: dhr. ir. A.M. Stolwijk} Bachelor Thesis Information Science Faculty of Science

(2)

Abstract

This research proposes a disruption model to effectively test different disruption techniques of cryptomarkets. This done by using both Social Network Analysis(SNA) and Agent Based Modeling(ABM). The combination of ABM and SNA allows for the the impact an individual has on a large network to be analysed(Lettieri et al.,2017). Criminal networks are adaptable and dynamic in nature(Bichler, Malm & Cooper, 2017; Martin, 2014; Duijn, Kashirin & Sloot, 2014). Hence, this research focuses at disrupting a criminal network by assessing the roles deemed vital for the existence of cryptomarkets, rather than looking at specific individuals. In this light, the proposed disruption technique is to disrupt the trust of buyers on

cryptomarkets. This can be done by the removal of moderators from cryptomarkets. This is efficient because moderators are responsible for the correspondence between the vendor and buyer. Through this correspondence, vendors can gain reputation and buyers can gain trust. Removing the moderator would allow for the feedback systems through which

messages can be send, could potentially become corrupted.

1. Introduction

Digital communication enables almost instant interaction among people from all over the globe. Individuals can buy, sell and trade all kinds of goods from all over the world using the internet. Although shop owners can advertise and sell their legal products almost anywhere on the planet, the same goes for criminals who wish to sell drugs. Innovative technologies, such as the Tor network, give criminals the ability to showcase and sell their illicit goods globally. These technologies prioritise privacy and allow anonymous communication(McCoy et al., 2008).

Criminal organisations can use Tor to develop and maintain an online webstore to display their products. Cryptomarkets are webshops that can only be visited anonymously on Tor, where people buy their products using crypto currencies to maintain their anonymous status(Aldridge & Décary-Hétu, 2016a). These developments in privacy-based browsing allow both the seller and buyer of illegal substances to be merely a few clicks away from each other while maintaining anonymity.

Communication through the Tor has made disrupting criminal networks increasingly difficult. Both communication and sales occur anonymously, leaving little traces for law enforcement to identify and arrest online drug dealers. Moreover, criminal networks are very adaptable when disrupted by law enforcement(Benson & Decker, 2010; Duijn, Kashirin & Sloot, 2014). Cryptomarkets are in line with this trend. The use of cryptomarkets by criminal networks strengthens their resilience and adaptability(Bakken, Moeller, & Sandberg, 2017; Aldridge, & Décary-Hétu, 2016b). The problem for law enforcement is thus to find an effective and efficient way to disrupt criminals selling drugs on cryptomarkets, without making criminal networks more resilient against police interventions.

The aim of this study is to develop a model of a cryptomarket for agent based simulation on which different disruption strategies can be tested. In order to develop a

model, previous research on the disruption of cryptomarkets is consulted. The content of this structure of this paper is as follows: Section 2 begins by defining what a criminal network is.

(4)

Section 3 defines cryptomarkets, and the significant impact cryptomarkets have in the sales and supply chain of drugs. Section 4 shows the specialisations required for cryptomarkets to exists, which will finally be adopted into the model. Then, section 5 elaborates the trust on cryptomarkets, and why trust is an important factor for both the existence of cryptomarkets, as well as the specialisations as discussed in section 4. Following, section 6 introduces AMB and why it is suitable to analyse disruption techniques for cryptomarkets. Section 7 will elaborate on SNA, and how it can be used to decide a suitable disruptions strategy for cryptomarkets. Section 8 will reflect on past attempts to disrupt cryptomarkets and why some techniques are more efficient than others. Based on the previous sections, section 9

proposes a model as well as different disruption techniques for cryptomarkets.

2. Criminal networks

Before assessing what cryptomarkets are, it is important to define criminal networks and how they operate. A criminal network is also known as a dark network. Masys(2014) describesa

dark network as _{“Groups that do their best to conceal themselves and their activities from} the authorities(i.e. terrorists, organized crime organizations).” However, research of

Gerdes(2014) goes further on the definition of dark networks and states that a network is a dark network when any form of information about an actor is lacking, disregarding the field of the network. This definition is in line with the definition of Tundis et al.(2018), which

distinguishes between a criminal organisation and criminal networks. If a criminal

organisation uses substitutionary individuals for immediate or explicit goals, it is considered a criminal network. According to the definitions of both Masys(2014) and Gerdes(2014), the essential element of a criminal network is to be hidden from law enforcement. Despite

criminal networks having a shared property of being hidden from law enforcement, a criminal network may many take on based on its characteristics.

Tundis et al.(2018) list the common structures of criminal networks. First, directed networks are hierarchical and set up by criminal networks for an explicit goal, with a clear leader in charge. Second, mesh networks consist of individuals who operate without

instructions of a clear leader and is thus decentralised. Third, transactional networks are built upon mediators within the network. These are individuals that connect subnetworks and through whom information must go to reach anyone within the network. Finally, flux networks are small merged networks that are unstable due to lack of trust.

Another important factor is the adaptability of criminal networks. Criminal networks are adaptable due to how they form themselves, as will be shown in section 8 on different types of disruption techniques. Criminal networks recruit other sub-networks for specific activities and remove those sub-networks when the activity is no longer required (Williams, 2001; Tundis et al. 2018). In extreme cases, this could involve hiring a hitman to kill a target or recruiting a hacker to perform phishing activities.

When law enforcement disrupts a criminal network, the criminal network could adapt in multiple ways, such as changing the location of their illegal activities or recruiting new individuals that are less likely to be infiltrators. Thus, a criminal network will almost never remain the same for its entire lifespan. As Tundis et al. (2018) and Williams (2001) show, individuals and other sub-networks enter and leave a criminal network depending on the goal the network has. The actors within the network may not be the same, but the specialty needed to keep the network existing could be the same. Therefore, research should not

(5)

analyse the actors involved, but the specialisations required to keep the criminal network in existence. Compared to the network behind the cryptomarket, specialisations and

technologies to keep a cryptomarket up and running are more long-lasting, as will be shown in section 4 on specialisations. The following section will elaborate on further what

cryptomarkets are.

3. Cryptomarkets

Since the development of a cryptomarket is part of the aim of the aim of this thesis, it is important to first have an idea of what a cryptomarket is. A cryptomarket is defined by Aldridge and Décary-Hétu(2016a) as an anonymous trading platform, where anyone has the ability to both sell and trade drugs. The primary function of a cryptomarket is to establish an anonymous environment where illicit goods can be sold both international and domestic.

Cryptomarkets are changing the environment in which drugs are sold and bought. The following differences between conventional sales of drugs and drugs on cryptomarkets shows how cryptomarkets change the drugs market. First, Cryptomarkets give criminal organisations the ability to find new markets that are otherwise out of their geographical reach(Aldridge & Décary-Hétu, 2016a). Second, sellers and buyers of drugs have the ability to anonymously communicate. That is, both have no physical contact, or do not have to be in each others physical presence to trade drugs(Martin, 2014; Bakken, Moeller & Sandberg, 2017)._{Third, The sales of drugs is done by encrypted payment methods. This allows} payments to be relatively untraceable.(Décary-Hétu & Quessy-Doré, 2017)

Besides the transformation of the sales of drugs, cryptomarkets have an impact on other parts of drug trade. That is, cryptomarkets allow for less parties involved in the supply chain for some drugs(Martin, 2014; Demant et. al., 2018). Besides the reduction of parties involved in the supply chain of drugs, Tundis et al.(2018) shows multiple motivations for criminal organisations to use online tools such as cryptomarkets.

One of which is that cryptomarkets allow for direct anonymous communication between buyers and sellers without the need to meet face-to-face and thus eliminates the threat of visibly exchanging drugs and money in public(Bakken, Moeller & Sandberg, 2017). Second, cryptomarkets allows a criminal network to work more efficiently on an international scale. Since criminal networks cooperate only if it is in the interest of both the networks, and without unnecessary risks and infringement of integrity, it is beneficial for criminal networks to seek each other out on platforms such as cryptomarkets, where relative anonymity is guaranteed(Tundis et. al., 2018).

However, the use of cryptomarket does have a limitation. Martin(2014) states that, in order for cryptomarkets to be meaningful for criminal networks, there must be a digital infrastructure in place. That is, in order for criminal organisations to use cryptomarkets as a way to sell drugs, the country in which the criminal organisation is located must have internet access, and also the potential buyers of drugs must have internet access.

Despite, the requirement of having a digital infrastructure to make use of a cryptomarket, research of Martin(2014) shows that cryptomarkets reduce the number of parties involved in the distribution and sales of drugs. On cryptomarkets, sellers and buyers can communicate directly through forum posts or satisfaction forms. The relevance forums and satisfaction forms is discussed in more detail in section 5 on trust.

(6)

For criminal networks, selling drugs through cryptomarkets means that they are less dependent on a good distribution network to sell drugs on the streets, but are more

dependent on good reputation as an online webstore(Bakken, Moeller & Sandberg, 2017). As Martin(2014) points out, the introduction and growth of cryptomarkets has created a more efficient way of selling drugs directly to a buyer reducing the need to sell drugs on the street.

Martin(2014) states that the direct communication and sales between a criminal organisation and buyers through cryptomarkets results in a less complex criminal network. I do not agree. Using cryptomarkets may require less interaction with third parties for criminal organisations to distribute drugs on a street level, but cryptomarkets bring an increasing complexity in terms of communication, shipping concealed drugs, maintaining customer satisfaction and competition.

The complexity of communication is increased because a form of specialisation is required to establish an anonymous communication. Within the criminal network, there must be an individual with the knowledge and expertise on how to set up a connection to the Tor-network. However, the complexity resides in the fact that the knowledge and expertise on setting up a connection to the Tor-network is easily obtainable. Since the software required to establish an anonymous connection is publically available, anyone gain the knowledge on how to set up a connection. This is a double edged sword for law

enforcement. Public available software allows law enforcement to understand and alter technologies used by criminals, but it enables criminal organisations to communicate securely online(Bojarski, 2015).

The shipping of drugs when purchased on a cryptomarket also increases the complexity. In fact, Aldridge and Askew(2017) state that the shipping of drugs is one of the pitfalls of cryptomarkets. If not done carefully, parcel delivery allows for the package to be traced back to the vendor. Moreover, if the drug is not concealed properly, the package could be intercepted by law enforcement. In order to prevent this, vendors use ‘stealth’ packaging to reduce the risk of the drug being detected. That is, concealing the drug inside packaging in such a way that the drugs are visually unrelated to drugs, as well as the removal of any smell of drugs(Aldridge & Askew, 2017; Décary-Hétu, Paquet-Clouston & Aldridge, 2016).

Street sales of drugs and illegal goods allows a criminal network to monitor which areas are safe to sell their drugs, for example, by knowing what the competition is or which places are relatively safe from law enforcement(Décary-Hétu, Paquet-Clouston & Aldridge, 2016). In contrast, cryptomarkets allow for anyone anywhere to make a purchase from a criminal organisation. This means that criminal organisations can no longer ensure that the person they are selling to is trustworthy(Buxton & Bingham, 2015).

Also, cryptomarkets allow for a lot more competition compared to street sales of drugs. Since cryptomarkets are publically available, anyone with an internet connection has the ability to buy drugs on a cryptomarket. Compared to conventional sales of drugs, this means that buyers have the ability analyse products and have more vendors to choose from.

Indeed, Compared to street drug dealing, vendors on cryptomarkets are competing with vendors from all over the world, and must thus gain a better expertise at selling their illicit goods(Balabanis, Reynolds, & Simintiras, 2006).

Thus, I argue that although the reduced amount of parties involved in the supply chain of drugs decreases the complexity of a criminal network, the use of cryptomarkets introduces other factors that cause more complexity. The complexity_{shifts from offline,}

(7)

real-world distribution and sales to online sales and distribution. A criminal network no longer needs to use sub-networks to distribute their drugs on a street level, but now requires

technical specialists that can maintain anonymity online, and is more proficient at appealing potential customers.

To summarize, cryptomarkets change the way drugs are being sold because drug dealers have the ability to sell virtually anywhere, can communicate with customers at any time anonymously and payment methods involve cryptocurrencies which are untraceable to individuals. Furthermore, criminal networks use cryptomarkets to sell their drugs because it removes the need to meet face-to-face, and thus reduces the risk of being exposed by law enforcement. Secondly, the anonymous communication allows for criminal networks to work more efficiently on an international scale, thus reducing the amount of parties involved in the supply chain.

The use of cryptomarkets to sell drugs is limited to individuals who have acquired the specialisation needed to set up and maintain cryptomarket communication. For a criminal network to sell their drugs on the growing cryptomarkets, some form of technological expertise and knowledge is needed(Leukfeldt, Kleemans & Stol, 2017).

4. Specialisations

Aldridge and Décary-Hétu(2016b) describe four specialisations that can operate on a cryptomarket: administrators, moderators, vendors and buyers. It is important to identify which of the specialisations are needed to maintain and create a vendor space on a

cryptomarket, since Bright et al.(2017) showed that disrupting a criminal organisation is most effective when those with a form of specialisation are removed.

First, the administrator is responsible for concealing information about users and sales and for the flow of money, which generally is in cryptocurrencies. Having users pay in cryptocurrencies is crucial for the way cryptomarkets operate. Cryptocurrencies allow people to use an anonymous bank account, where payments are encrypted and concealed from the public. Anyone can see a transaction made with cryptocurrencies, but the details about the transactions, such as what is purchased and who purchased it, is hidden. Therefore, it enables users of cryptomarkets to remain anonymous(Martin, 2014).

For criminal networks to use cryptomarkets, they either set up their own market or apply for vendor space in an existing cryptomarket. When creating its own cryptomarket, a criminal organisation needs an administrator to monitor the use of the cryptomarket. When a criminal organisation joins an existing cryptomarket, it must connect with the cryptomarket’s administrator.

Second, the moderators are a step below administrators in terms of accessibility. moderators do not have as much power with respect to user information as administrators. Their primary concern is answering questions of users of the cryptomarket. Despite this seemingly being a supportive role, the moderators could significantly impact the network as a whole. Bichler, Malm and Cooper(2017) show that minor roles within a criminal network are less protected and could be more easily accessed or removed from a network.

Moreover, the contact of the moderators with the buyers and sellers is crucial for building trust for the vendor. The degree of professionalism shown by the moderators could build trust and thus yield more sales for a vendor on a cryptomarket. Another task of the moderators is to ensure that competing vendors do not create fake accounts and leave

(8)

negative feedback for each other to manipulate potential sellers on the cryptomarket(Holt et al., 2016).

Third are vendors. The vendors send an application with their seller page to the administrator of the cryptomarket and pay the administrator a fee for hosting and other maintenance work. The vendors are often opportunistic individuals who seek to profit from criminal organisations(Aldridge & Décary-Hétu, 2016). That is, most vendors on

cryptomarkets are individuals who sell and distribute small portions of various drugs. Some of which can be seen as bigger sellers that sometimes work more organised to have larger profits(_{EMCDDA and Europol, 2017).}

Fourth are the buyers of drugs on cryptomarkets. Although buyers do not seem to be a form of specialisation, their involvement on cryptomarkets are important. The most

important specialisation of a buyer is the review of a vendor. Through review posts, buyers can leave feedback for the vendor and other potential clients, which could influence the potential sales of a criminal organisation that operates on a cryptomarket. Review posts are also direct communication between the seller and buyer of drugs. As stated earlier, this is an important part for both the seller and the buyer. Not only does leaving reviews lower the risk for other vendors to purchase from a fake vendor, it allows the vendor to build credibility and trust among potential clients in a way traditional drug sales did not. Furthermore, buyers are also important because Dittus, Wright & Graham(2017) show that they drive the demand for drugs. The conception that criminal organisations determine the demand does not always hold true.

The drugs are usually sent through parcel delivery. The drugs are concealed such that delivery companies can deliver them without knowing. According to Martin(2014), this is where the criminal network depends on a legal network. Criminal networks that sell drugs on cryptomarkets depend on postal services to deliver the products. If a criminal network is unable to conceal their illicit goods, it could have major consequences for the criminal organisation and the buyer.

Finally, Aldridge and Décary-Hétu(2016) mention minor roles that are important for the existence of cryptomarkets. Internet providers are an example of a less important role. However, in line with simulating and testing disruption strategies of cryptomarkets, this could be a more significant role than it might seem. As shown later, an important aspect of the success of a cryptomarket vendor is the feedback system. Vendors on cryptomarkets place a high value on the overall involvement of the sale process. The hosting service is part of the quality. The web hosting services could offer quick browsing speed, quick buying through cryptocurrencies and an overall good quality of using the crypto market vendor space. the convenience of the website could increase trust and sales for a criminal organisation on a cryptomarket. Another minor role is the parcel delivery business that transports the

concealed drugs. As stated in section 3 on cryptomarkets, the involvement of parcel delivery businesses is a potential pitfall for vendors on cryptomarkets. When a drug is sold by a vendor, the drug is often shipped by parcel delivery, with the risk of being intercepted by law enforcement if the drugs package is not concealed properly.

Despite almost all of these specialisations being practiced in anonymity, there are multiple ways in which the anonymity can be less of an obstacle to allow these

specialisations to work in harmony with each other. The following section will elaborate on how trust is being formed amongst the specialities on cryptomarkets, and why it is important.

(9)

5. Trust

Primarily, the factor of trust is what keeps the specializations as described in section 4, to operate in harmony with each other. Trust is an important factor in criminal networks in general, since members of a network need to trust in each other when performing illegal activities(Morris & Deckro, 2013). Moreover, trust is of essence when dealing with

cryptomarkets for both the vendors and the criminal organisations that sell their drugs. Since all of the trade is anonymous, both the buyer and vendor need to have some form of

assurance that they are not dealing with law enforcement.

One of the methods for vendors in cryptomarkets to gain the trust of potential

customers is by building a credible reputation(Nurmi et al., 2016). Building a good reputation is often done through feedback systems. To illustrate why trust is an important aspect of cryptomarkets, research of Przepiorka et. al.(2017) shows that having a good reputation as a vendor results in more sales of drugs at higher prices. Thus, gaining the trust of buyers is beneficial for vendors. Another factor that can influence trust is having a form of branding on their illegal products has a positive impact on their reputation(Paquet-Clouston, 2017).

Furthermore, Tzanetakis et al.(2016) show how trust on cryptomarkets is paradoxical. Since buyers and vendors both cooperating in trading illegal goods, there is a need to be anonymous to hide from law enforcement. However, to build trust, some form of legitimation could be beneficial to ensure that a vendor is a legitimate and not an imposter or police infiltrant.

Holt, Smirnova and Hutchings(2016) show how the legitimacy of vendors can be determined on cryptomarkets. First, they show that the language used on cryptomarkets is important. Since there is specific slang being used on cryptomarkets, vendors are hard to impersonate. Second, Holt et al.(2016) show that the correspondence between vendor and seller is important. Vendors can leave an email address for contact or have set up an instant messaging chat for buyers to ask questions. Third are the payment methods. To be more trustworthy, anonymous payment methods, such as encrypted blockchain payments, can be used. Finally, the amount of time spent on a cryptomarket. This can be traced by the number of posts an individual makes on a forum or how committed a vendor is to serving customers.

Trust is thus important on cryptomarkets. Since trading on cryptomarket is

anonymous, there needs to be some form of trust that makes a buyer purchase drugs from a vendor. The trust of a vendor can be gained by a vendor when a buyer shows signs of legitimacy. The legitimacy of vendors can be established by the use of language, the inclusion of an address to a buyer to contact, using secure and anonymous payment methods and the amount of overall time a vendor spends on a cryptomarket.

The following section will elaborate on how cryptomarkets, its specialisations and trust could be simulated and modeled.

6. Agent based modelling

There are multiple ways an Agent Based Model can be made(Macal & North, 2010, 2005; Gerritsen, 2015). An agent based model is a model that consists of autonomous agents, each having the ability to make a decision based on the interaction with other agents and the environment in which they are(Bonabeau, 2002). ABM is suited for the simulation of

(10)

cryptomarket disruption because simulation allows for different disruption strategies to be tested before applying them in reality(Gerritsen, 2015). Moreover, ABM allows to analyse the impact of individual behavior has on an entire network(Birks & Elffers, 2014; Lettieri,

Altamura, Malandrino & Punzo, 2017). Further, ABM allows any object to be identified as an agent that can be instructed. This can vary from individuals, to groups, to inanimate objects, such as the vehicles used for transportation and smuggling of illicit goods(Crooks &

Heppenstall, 2012). This means that ABM allows inanimate objects of a cryptomarket, such as the server or parcel delivery business, to be included as an agent within the model. Next, agent-based simulations are decentralized, which means that there is no leader forcing actors to perform certain actions. This corresponds to cryptomarkets, since cryptomarkets are publically available for anyone to use.

ABM consists of two distinct processes, modeling and simulating(Gerritsen, 2015). Modeling consisting of the conceptualization and formalisation of a model, and simulation consists of simulating and evaluating a model.

6.1 Modeling

Conceptualisation is an important aspect of the process because here the rules of the agents and environments are determined(Gerritsen, 2015).The conceptualisation process is regarded as the general design process of the model, which can be done in four steps(Macal & North, 2005).

First, agents are being identified along with their attributes. These attributes can be either static or dynamic. That is, some some attributes can change during simulation(e.g. dynamic attributes) and other attributes do not change(e.g. static attributes). Second, the actions are defined which can influence the dynamic attributes of an agent and with which agents can interact with the environment. Often, these actions are based on past research, data that shows particular data of an agent(Macal & North, 2010). Finally, the environment in which the agents will be placed is defined.

An important dynamic attribute of an agent is memory. Agents having a memory allows them, for example, to remember which actions had a positive or negative impact on their dynamic attributes(Heppenstall et. al., 2011). An example of how an agent looks in ABM can be seen in figure 1.

(11)

According to Gerritsen(2015), the second step of the modeling part is formalisation. In this part, the conceptualisations are being defined such that the model is machine readable. This can be done in various languages, ranging from dedicated programming languages to specific modeling languages, depending on the application used to create and simulate the model(Macal & North, 2010). Further, Gerritsen(2015) shows that the formalization is generally done by two approaches, one mathematical approach and one logic-based approach. The mathematical approach allows the characteristics of an agent to be

represented by a variable and a corresponding value, while the logic-based approach allows the characteristics of agents to be represented as boolean values of true and false.

6.2 Simulation

When the conceptualisation is done, the next step is simulation. Before actually simulating, Gerritsen(2015) states that it should be clear what the aim of the simulation is. Knowing what the aim of the simulation is, helps to determine the values of agents within the network. Gerritsen(2015) further states that it is of importance to run multiple simulations with different values of agents.

Finally, the results of the model should be evaluated. Part of the evaluation could be the extent to which the results can be compared to real world scenarios. It could be that the results show values that are impossible in a real-world situation. In these cases,

Gerritsen(2015) suggests adjusting the starting values and running another simulation. This is part of the fine tuning of the simulation. In some cases, changing the starting values of the agents could be enough, however, if there are significant problems, the model might have to be redesigned entirely.

In light of this thesis, part of the evaluation could be done with SNA. Since ABM allows to analyse the effects individuals have in an entire network, SNA can be used to measure such effects (Lettieri et al.,2017).

7. Social network analysis

This section will discuss what SNA is, and how it can help disrupting cryptomarkets. Van der Hulst(2009) describes SNA as a mathematical approach to analyse patterns between nodes and relations between these nodes. Mainly, the use of SNA is to detect hidden forms of relations or network structures that are not detected at first sight. In light of this thesis,

hidden network structures could influence the way a cryptomarket could be disrupted. That is to say, SNA can beneficial for this thesis, because it can detect important figures in a

network, which might not seem important at first.

Moreover, criminal networks can be seen as networks, because they often exist of small connected groups(Benson & Decker, 2010). Criminal networks are often divided into subgroups, where each subgroup has a specific task. These subgroups have to interact in order to perform their illegal activities. Knowing how subgroups within criminal networks interact is key to understanding the structure of a criminal network, as well as knowing how a criminal network performs their illegal actions(Cantanese, De Meo & Fiumara 2016; Morselli, Gabor & Kiedrowski, 2002).

As shown in section 1, a network can be regarded as a criminal network when the goal of the network is to remain concealed from law enforcement. Since the purpose of goal

(12)

of a cryptomarket is to form an anonymous environment in which everyone can

communicate and negotiate with each other without being identified by the police, it can indeed be identified as a criminal network. Thus, SNA can be applied to discover key players or any other hidden network structures.

The identification of key players is important because research of Duijn et. al.(2014) shows that removing the key player from a criminal network is actually causing the aversive effect, namely that the network only becomes more resilient to disruption. It is thus important to determine which actors are central within the network, and if their removal causes a disruptive effect, or strengthens the network.

First, what actually is a key player? The term ‘key player’, as mentioned by

Borgatti(2003, 2006), refers to a person who is a central node within the network. That is, a node that has the most connections within a network. Borgatti(2003) also discusses the purpose of finding key players in a social network. Borgatti(2006) distinguishes between finding a key to optimally disrupt the network and finding a node with the purpose of locating the key player in a network.

Figure_{2: Examples of the different purposes for finding key players in social networks by Borgatti(2006)}

The distinction is illustrated in Figure 2. Node eleven is the central node in the network, while node four can be used to disrupt the network most efficiently. An administrator role could have the position of node eleven or node four. The administrator can access information about both vendors, buyers and other administrators on cryptomarkets, thus forming a bridge between two networks. Further, in line with Borgatti(2006), the identification of what kind of key player a role in a cryptomarket has could affect the strategy used to disrupt a cryptomarket.

Schwartz(2009) extended the research of Borgatti(2003, 2006). The research shows that the relationship between actors should be considered when identifying key players, that is, the relationship between nodes should be considered when determining the importance of a person within a network and to what extent actors on cryptomarkets are connected. To illustrate, research that uses SNA when analysing criminal networks has shown that nodes with a high betweenness centrality(e.g., a high number of links to a node) are mostly positioned in the process of transport, supply and financial skills(Malm & Bichler, 2011).

(13)

Betweenness centrality can be used to determine a key player. Being a key player is often associated with having power within a network and understanding which person could have a strategic advantage in a network(Duijn & Klerks, 2014). This strategic advantage is gained by having the fewest links between each person of the network, that is, the person with a high betweenness centrality can quickly distribute information or anything else within the network.

Research of Lettieri et al.(2017)_{on combining SNA and ABM in crime research,} shows that ABM and SNA can benefit from each other. Their research shows that the combination of the behaviour of individual agents in combination SNA can show how the individual choices of agents can have an impact on the network structure as a whole. The interaction of agents can result in changes of the network structure. That is to say, the interactions of agents within the model could cause network structures to arise within the model(Bonabeau, 2002).

SNA can thus be used for the disruption of cryptomarkets because cryptomarkets can be seen as a form of a criminal network due to its anonymous nature. Furthermore, SNA can be used to identify the key player with the purpose of disrupting a network(Borgatti, 2003; 2006). The following section will elaborate on how cryptomarkets can be disrupted.

8. Types of disruption

In this section, multiple disruption techniques are being discussed, and why some disruption techniques are more suitable for the disruption of cryptomarkets than others. Besides the element of being hidden from law enforcement as described in section 1,_{another important} factor is the adaptability of criminal networks. Research has shown that criminal networks can recover effectively from short term disruptions and that this makes them even more resilient to future disruptions(Bichler, Malm & Cooper, 2017; Martin, 2014; Duijn, Kashirin & Sloot, 2014). Criminal networks recover from disruption because they have the ability to replace the removed actors within the network(Williams, 2001; Tundis et al. 2018). More over, when an actor is removed, criminal networks adjust themselves so that they are less likely to be disrupted in the future(Duijn, Kashirin & Sloot, 2014). To have a smaller chance of being disrupted is defined as network resilience. Ayling(2009) defines resilience as the combination of two concepts. The first concept is the ability for criminal networks to simply take in the disruption without any consequence. The second concept is the ability to readjust the network after the disruption has been made. This could for example be the replacement of actors within the network that are removed by law enforcement. Resilience is thus the ability to occlude the disruption, and the ability to readjust according to the disruption.

Similar to criminal networks, cryptomarkets recover from disruption fairly easily. Attempts have been made to shut down cryptomarkets by large international cooperation of law enforcement institutions, such as Europol(Décary-Hétu, & Giommoni, 2017). These attempts of law enforcement to reduce the sales of drugs on cryptomarkets have been relatively successful in terms of temporarily shutting down the sales of drugs through cryptomarkets, but not effective in terms of removing cryptomarkets from operation as a whole. The most well-known attempt is the so called ‘Operation Onymous’, which involved the takedown of multiple large cryptomarkets, such as Silk Road. However, similar to disruption of conventional drugs trade, the disruption was only effective for a short time(Décary-Hétu & Giommoni, 2017).

(14)

Long term disruption is needed to disrupt criminal networks effectively. This because, criminal networks recover from short term disruptions(e.g., removing an actor of a network by arrest) and, when criminal networks are disrupted, they are less vulnerable to short term disruptions in the future(Duijn, Kashirin & Sloot, 2014).

Long term disruptions can be done based on the traces vendors leave behind, despite the fact that contemporary technologies used for selling and buying drugs on cryptomarkets allow for vendors and buyers to remain anonymous. As discussed in section 5, trust is an important factor in cryptomarkets and is based on feedback mechanisms on cryptomarkets. One of the most important traces that both vendors and sellers leave behind are interaction through reviews. For example, the language used by vendors and buyers can be analysed by using natural language processing algorithms that can detect and link the writing to a certain culture or geographical location(Hannah, De Nooy & De Nooy, 2009). However, leaving traces behind on cryptomarkets are necessary for vendors to gain a good reputation, as discussed in section 5.

Figure 3:_{Example of a user profile on a dark web market(http://darkweb.reviews/rsclub-market-review/).}

Décary-Hétu and Giommoni's(2017) finding is in line with that of Van Buskirk(2017), who shows that the number of vendors on cryptomarkets did not change after Operation

(15)

Onymous. Décary-Hétu and Giommoni(2017) suggest that to study the effects of different disruption techniques of cryptomarkets, alternative angles are needed other than police raids that shut down cryptomarkets permanently.

First, research of Bichler et. al.(2017) shows that drug trade networks, can be disrupted best by targeting individuals with a high centrality(e.g. the most central node in a network) and who have a form of specialisation vital to the network. When specifically disrupting cryptomarkets, research of Duxbury & Haynie(2018) suggest focusing on the removal of active vendors, which have the least amount of links to other actors within the network. Finally, research of Aldridge et. al.(2018) suggest that manipulating the market is a good disruption technique. When the market is being manipulated, the overall trust amongst buyers and sellers is being reduced.

It is thus more suitable to disrupt criminal networks in such a way that the overall trust is being removed on cryptomarkets. According to Aldridge et al.(2018), this can be done by market manipulation and according to Duxbury & Haynie, this can be done by removing active vendors with little links to other actors within the network. However,

Paquet-Clouston(2017) shows when an active vendor is removed from a cryptomarkets by law enforcement intervention, a new vendor will quickly take its place. Vendors are quickly replaced by the environment, since the distribution of vendor of cryptomarkets follows the ‘90, 9, 1 percent’ rule(Van Mierlo, 2014), where 90 percent of the vendors are observing, and 1 percent is actively trading drugs(Paquet-Clouston, 2017).

9. Suggestion for simulation

In this section, the model is proposed, as well as multiple disruption strategies for disrupting cryptomarkets. First, section 7 on Agent Based Modelling, shows that simulation consists of two parts, the modeling and simulating. The first step, modeling, consists of two parts, conceptualisation and formalisation.

9.1 Conceptualisation

The conceptualisation step can be seen as the general design process of the model, where the actors are being determined, and are given a set of actions an agent can perform, as well as a set of rules which determines their behavior(Gerritsen, 2015).

Identification of agents

First, the identification of agents on cryptomarkets is done in section 2 on the specialisations on cryptomarkets based on the research of Aldridge & Décary-Hétu(2016b). Besides those agents, the other inanimate objects are of importance to the environment, namely the server on which the cryptomarket is hosted, the parcel delivery which ships the drugs, and the feedback system through which the agents communicate with each other. These inanimate object can be put into the model as agents. Accordingly, the following agents are identified in this thesis:

● Vendor:_{The goal of the vendor is to make as much profit as possible. In order to} successfully do so, a vendor must have a good reputation to win over the trust of potential buyers. This can be done by selling drugs with little risk of being intercepted

(16)

by law enforcement, but also by replying to questions, and the amount of time spend on a cryptomarket.

● Buyers:_{The goal of a buyer is to purchase drugs with as little risk of being detected} by law enforcement as possible.

● Administrators:_{The goal of an administrator is to moderate the flow of money and} moderate if the vendors are behaving to the rules. Thus, moderators receive the payment from a buyer, and send the payment to the vendor.

● Moderators:_{The goal of a moderator is to make sure the feedback system is not} being compromised by imposters.

● Parcel Delivery:_{Primarily, the parcel delivery is responsible for making sure the} package send by the vendor is being delivered to the destined buyer.

● Server: _{The server can be either online or offline. Only the administrator can perform} the action of turning the server offline.

● Feedback system:_{The goal of the feedback system is to support interaction}

amongst members on cryptomarkets. Though the feedback system, questions can be asked and feedback is given.

Attributes of agents

As described in section 6, after the identification of agents, an agent gets assigned static and dynamic attributes. In this model, there are two general static attributes an agent can have: name and location

The location of an agent is of importance because Broséus et al.(2017) show a difference in parcel delivery quality. That is, in some countries, law enforcement invested more in interception of parcel packaging, which increases the risk of the package not being delivered. If the package is not delivered, the vendor risks getting a negative review, and so a decline in trustworthiness(Tzanetakis et. al., 2016). Moreover, when a vendor needs to ship internationally, there is an increased risk of the package being intercepted compared to domestic shipping(Tzanetakis et. al., 2016). Furthermore, some drugs are sold from specific countries. Broséus et. al.(2017) shows that, for example the sale of cocaine and MDMA on cryptomarkets is generally restricted to vendors located in the Netherlands. Thus, the location of the agent is of importance to determine the risk of being detected by law enforcement.

The name of the agent is of importance too. Although many users on cryptomarket use an alias to hide their identity, the frequency with which a vendor uses the same alias when communicating with a vendor is an indication that the vendor is indeed legitimate(as described in section 5 on the trust on cryptomarkets).

Besides the static attributes, an agent gets assigned dynamic attributes. These are attributes that can change during the simulation(Macal & North, 2010). The dynamic attribute of a vendor is its reputation. The reputation of a vendor can change when a vendor answers few questions, or when the drugs are not delivered to the customer.

The dynamic ability of a buyer is trust. The level of trust of a buyer determines if a buyer is actually making a purchase. Trust can be influenced by the reputation of vendors, but also by the delivery of the drugs package. If the package is intercepted, a buyer will leave negative feedback, and the trust will be reduced, as explained earlier.

Last, both the vendor and buyer have a dynamic ability related to the drugs bought and sold. As stated previously, the drug a vendor can sell is depending on the country in

(17)

which it resides. Moreover, Aldridge & Askew(2017) show that the familiarity a buyer has with a product could influence the trust of a buyer. If a buyer has had successful purchases of a specific drug in the past, and suddenly not receives a package, the trust of a buyer can decrease.

Actions of agents

When the identification of the agents and its attributes are being determined, the actions for the agents can be defined for the model. First, the actions of the buyers are set. Buyers can decide to buy drugs from a vendor, ask a question and leave feedback.

The actions for vendors are set. First, a vendor must become an actual vendor on the cryptomarket. This is done by applying to an administrator. Once accepted, the reputation of the vendor increases.

Following, the actions for administrators are set. As shown in section 4,

administrators have the ability to accept vendors, as well as reject vendors. Furthermore, administrators support the transactions of cryptocurrencies between vendors and buyers, and so can perform the actions of receiving payment as well as sending payment. Fourth, the actions for moderators are set. The primary objective of a moderator is to ensure that the feedback system will not be compromised of infiltration, or impostering vendors. Hence, the actions a moderator can perform are solely for the purpose of moderating the feedback system. Namely; removing a question and answering a question.

Rules of agents

When the attributes and actions are set, the rules can be determined. That is, the motivation of an agent to perform an action. The rules for buyers are based on the research of

Décary-Hétu & Quessy-Doré on consumer loyalty on cryptomarkets. this thesis shows that there are multiple factors that determine from which vendor a buyer decides to buy drugs from. There are external factors such as the amount of vendors selling a drug, and the reputation of a vendor. Then there are internal factors, such as the buyers knowledge about a drug. The knowledge a buyer has about a certain drug can be indicated by the amount of times a buyer bought the same drug, which can be included in the memory of an agent.

The rules of vendors are mostly based on the risk and reputation of a vendor. Nurmi et. al.(2017) shows that vendors with a bad reputation are more likely so sell internationally, with a greater risk of being detected by law enforcement. Ultimately, the goal of a vendor is to make as much sales as possible, provided that the risk of being detected by law

enforcement is as little as possible. Hence, a vendor could decide to first build a reputation on a cryptomarket by answering questions before selling drugs.

As shown previously, the goal of an administrator is to accommodate the transaction of cryptocurrencies between buyers and vendors as well as making sure new vendors are not infiltrants or imposters. Accepting or rejecting can be done based off the reputation of the vendor. This is inline with the rules for a moderator, who can answer questions, or remove questions based on the reputation of a vendor.

The attributes and actions of the agents can be seen in figure 3. After the agents with their corresponding attributes and actions are determined, the environment in which these agents behave is determined.

(18)

Figure 3: Agents with their attributes and actions.

Environment

As shown in section 6 on agent based modelling, the environment of the model is of importance. The environment is the space in which the different agents can interact with each other. In this thesis, the environment is the cryptomarket itself, including the server and the delivery service. The cryptomarket is the platform where all the actors communicate and come together to buy, sell and moderate. Despite, the parcel delivery not being part of the cryptomarket itself, it is vital for the existence of a cryptomarket. Hence, it is an important part of the environment which allows for the traded drugs to be received and shipped.

There is one agent that can influence the environment entirely, namely the server. The server is an agent within the environment, since it is an inanimate object vital for cryptomarkets. Administrators have access to the server on which the cryptomarket is hosted and so have the power to shut down the environment entirely.

Other inanimate objects represented as agents are the the feedback system and parcel delivery. The feedback system is an agent within the environment that other agents can interact with. The interaction between the agents occurs on the feedback system, hence it is an important object within the environment. Furthermore, the drugs are shipped by the parcel delivery businesses. The parcel delivery business can interact with both the vendors when a drug is sold.

Figure 4 shows the inanimate objects part of the environment with which agents can interact.

(19)

Figure 4: _{Inanimate objects represented as agents with their attributes and actions for the model.}

Now that the environment and the agents with their attributes and actions are set, they can all be put together in a model. Figure 5 shows an overview of how the model eventually looks like with all the agents and some possible interactions among them.

Implementation of disruption.

An important factor of the cryptomarket is the resilience it offers. As defined earlier, resilience is the ability of criminal networks to adapt to the changes made within the network(Ayling, 2009; Duijn, Kashirin & Sloot, 2014). The implementation of different

disruption techniques when simulating could show how resilient a cryptomarket is. There are multiple ways in which a criminal network can be disrupted.

As shown in section 6 on key players in networks, Borgatti(2003) made the distinction between finding the keyplayer with the purpose of disrupting a network, and finding a

keyplayer with the purpose of finding the most central actor within the network. Furthermore, as shown in section 8 on the different disruption strategies, there are disruption strategies suggested specifically for cryptomarkets.

The first disruption method is that of Bichler et. al.(2017), which suggest removing the agent that has a speciality vital to network. However, as research of Duijn et al.(2014) shows that the removal of an agent vital to a network would not disrupt the network, but makes the network more resilient to future disruption. Furthermore, as stated in section 8 on types of disruption, removing the administrator from a cryptomarket did not cause the cryptomarket to dissolve(Décary-Hétu, & Giommoni, 2017). Thus, removing a vital specialisation is not recommended as a disruption strategy.

The second method is the method of Duxbury & Haynie(2018), who propose that the most active vendor, with the least amount of relationships to other agents within the network should be removed. Within the simulation this can be done by using SNA. Using a

measurement such as betweenness centrality can calculate which vendors have the most buyers. This can be done based off the amount of sales a vendor has completed. Out of vendors with the most buyers as customers, the vendor with the least amount of connections to other agents within the network can be removed after a number of iterations. However, removed vendors are quickly replaced on cryptomarkets(Paquet-Clouston, 2017).

(20)

The third method is that suggested by Aldridge et. al.(2018), which is a form of market manipulation to disrupt cryptomarkets. However, this is difficult to do, because mimicking a vendor has proven to be difficult(Smirnova & Hutchings, 2016).

However, these disruption strategies do not target one of the most vital parts of the cryptomarket, namely the feedback system. Since the feedback system is key for vendors to distinguish themselves from other vendors and give buyers the opportunity to select a vendor, I propose a disruption strategy where the feedback system is disrupted. This can be done by removing the moderator of a cryptomarket. Since the moderator is tasked with making sure the feedback system is not compromised of law enforcement infiltrants, or fake vendors, removing a moderator would give already existing threats the opportunity to evolve themselves. Once the moderator is removed from a network, negative reviews and fake vendors are difficult to remove or verify.

(21)

Figure 5: Overview of the cryptomarket model.

9.2 Formalisation

When the conceptualisation is done, the model can be formalized. As stated in section 6 on ABM, this can be done by either a mathematical approach, or logic-based

approach(Gerritsen, 2015). In the proposed model, the mathematical approach is more convenient to use. This because the agents are given different values such as trust, reputation and risk. Moreover, part of the model is the chance of a package being intercepted by law enforcement, which is best represented as a numerical value.

Further, the SNA is a mathematical approach to analysing patterns in networks. Methods such as betweenness centrality, to find key players within a network, depend on numerical values. Thus the mathematical approach to formalisation is best suited.

9.3 Simulation

Before simulating it is important what kind of disruption is being tested and what kinds of values agents get assigned. The starting values of all agents could be set on the same value, or different values could be given individually to agents. Furthermore, the amount of agents could be set, too. For example, when a specific cryptomarket wants to be simulated, data on the number of vendors and buyers could give an indication on the number of agents simulated within the model.

9.4 Evaluation

The final part of the simulation is the evaluation, in which will be reflected on the results of the simulation. Ultimately, the goal of the simulation is to evaluate how well a certain

disruption technique performs. SNA can not only be used as a disruption technique itself, but it can also evaluate how well the cryptomarket has been disrupted.

However, As Gerritsen(2015) shows, multiple values should be tested. In the

proposed simulation, there are multiple values that should be tested. In this model, there are various values that can be set to different thresholds, such as the chance of a package being intercepted by law enforcement, or the amount of reputation a vendor gains after a

completed purchase.

Furthermore, different disruption techniques can be compared and reflected upon. After multiple simulations are done, SNA can determine which disruption technique was most successful in dismantling the network. This can be calculated based on the numbers of connected agents when the simulation is done.

10. Conclusion

The aim of this research was to develop a model of a cryptomarket for agent based simulation on which different disruption strategies can be tested. This is done by first defining a cryptomarket and the specialisations required for cryptomarkets to operate. A cryptomarket is an online open market in which anyone has the ability to anonymously

(22)

communicate and trade goods and services(Aldridge and Décary-Hétu, 2016a). What

distinguishes cryptomarkets from street dealing, is the ability for users to interact directly and globally with drugs vendors(_{Décary-Hétu, Paquet-Clouston, & Aldridge, 2016). Moreover,} users on of a cryptomarkets can give feedback and rating to a vendor, allowing buyers to make a drugs purchase based off the reputation of a vendor(Nurmi et. al., 2017).

Studying which specialisations are required for a cryptomarket to exist is more effective, because a criminal network will almost never retain the same structure for the entirety of its lifetime. Hence, this thesis identified the specialisations of cryptomarkets. Furthermore, the disruption techniques are based on the specialisations on a cryptomarket, rather than specific individuals.

For this research, an agent based model was build which consists of the agents, their characteristics (i.e., attributes and actions), and the environment. The agents are the

specialisations within a cryptomarket, namely: administrators, moderators, vendors and buyers. Moreover, ABM allows for inanimate objects to be included as agents in the model. Thus, parcel delivery, server and feedback system can be regarded as specialisations and so be transformed into agents. In this model, the environment is the cryptomarkets including the parcel delivery service. Despite parcel delivery services not being part of a cryptomarket, it is a vital service on which a crypto market depends on.

The disruption strategies proposed in this research is the removal of the moderators. The removal of a moderator could give already existing threads to a cryptomarket(e.g. fake vendors and law enforcement infiltrants) free play.

11. Limitations

One limitation that this thesis has is that an agent can have multiple roles. That is, a vendor could also purchase drugs from another vendor, of a moderator could also purchase drugs from a certain vendor. This is limiting the research, because the interaction between actors is of impact for the network structure. For example, different sub-networks could emerge from certain interaction between groups of agents, which could affect the disruption of the cryptomarket.

Another limitation is the illicit goods sold. Cryptomarkets are indeed used to sell drugs, but often other illegal products and services are offered. As a consequence, a vendor with a lot of knowledge about other illicit trades can have a better reputation. Though, this thesis is limited to the sale of drugs on cryptomarkets. Moreover, in this model, vendors have an unlimited supply of drugs. That is, a single vendor could potentially provide every buyer with the drugs they wish to buy. In a real world scenario, this would be impossible.

Further, there are multiple cryptomarkets operating simultaneously. The disruption of a single cryptomarket could thus influence multiple cryptomarkets. Since this thesis is limited to a single cryptomarket, creating an environment in which multiple cryptomarkets can be simulated could yield different results for disruption techniques.

Also, the formalization of a model is finalized when the model is translated to a machine readable language. As shown in section 6.2 on simulation, there are different applications and languages which can translate a model into a machine readable language. This thesis did not include such a translation, due to the wide variety and choice one has for translating. The language or application used to formalize a model could be a case of personal preference.

(23)

Finally, Gerritsen(2015) states that a model is a representation of a real world scenario. Thus, it is difficult to exactly replicate how agents behave in a real world scenario. There are many different human factors that influence the actions of humans, which is difficult to generalize in a model.

Further research could thus focus on expanding the proposed model in this thesis so that is will be closer to reality. This could be done first by researching how different

cryptomarkets influence each other. Second, further research could focus on the supply of vendors on cryptomarkets. Aldridge,& Dé cary-Hé tu, (2016b) show that the vendors are mostly entrepreneurs who sell drugs bought from criminal organisations. Disrupting the relationship between these organisations and vendors could be effective.

(24)

12. References

Aldridge, J., & Askew, R. (2017). Delivery dilemmas: How drug cryptomarket users identify and seek to reduce their risk of detection by law enforcement. International Journal of Drug Policy, 41, 101-109. Aldridge, J., & Dé cary-Hé tu, D. (2016b). Cryptomarkets and the future of illicit drug markets. In EMCDDA (Ed.), Internet and drug markets, EMCDDA insights (pp. 23–30). Luxembourg: Publications Office of the European Union.

Aldridge, J., & Décary-Hétu, D. (2016a). Hidden wholesale: The drug diffusing capacity of online drug cryptomarkets. International Journal of Drug Policy, 35, 7-15.

Bakken, S. A., Moeller, K., & Sandberg, S. (2017). Coordination problems in cryptomarkets: Changes in cooperation, competition and valuation. European Journal of Criminology, 1477370817749177. Balabanis, G., Reynolds, N., & Simintiras, A. (2006). Bases of e-store loyalty: Perceived switching barriers and satisfaction. Journal of Business Research, 59(2), 214-224.

Benson, J. S., & Decker, S. H. (2010). The organizational structure of international drug smuggling. Journal of Criminal Justice, 38(2), 130-138.

Birks, D., & Elffers, H. (2014). Agent-based assessments of criminological theory. In Encyclopedia of Criminology and Criminal Justice (pp. 19-32). New York: Springer.

Bonabeau, E. (2002). Agent-based modelling: Methods and techniques for simulating human systems. Proceedings of the National Academy of Sciences of the United States of America (PNAS), 99 (3), 7280–7287.

Borgatti S. P. (2003) The key player problem. In: Breiger R., Carley K., & Pattison P. (eds). Dynamic social network modeling and analysis: workshop summary and papers. National Academy of Sciences Press, Washington, D.C.

Borgatti, S. P. (2006). Identifying sets of key players in a social network. Computational & Mathematical Organization Theory, 12(1), 21-34.

Bright, D., Greenhill, C., Britz, T., Ritter, A., & Morselli, C. (2017). Criminal network vulnerabilities and adaptations. Global Crime, 18(4), 424-441.

Broséus, J., Rhumorbarbe, D., Morelato, M., Staehli, L., & Rossy, Q. (2017). A geographical analysis of trafficking on a popular darknet market. Forensic science international, 277, 88-102.

Buxton, J., & Bingham, T. (2015). The rise and challenge of dark net drug markets. Policy Brief, 7. Catanese, S., De Meo, P., & Fiumara, G. (2016). Resilience in criminal networks. Atti della Accademia Peloritana dei Pericolanti-Classe di Scienze Fisiche, Matematiche e Naturali, 94(2), 1.

Crooks, A. T., & Heppenstall, A. J. (2012). Introduction to agent-based modeling. In Agent-based models of geographical systems (pp. 85-105). Springer, Dordrecht.

(25)

Décary-Hétu, D., & Giommoni, L. (2017). Do police crackdowns disrupt drug cryptomarkets? A longitudinal analysis of the effects of Operation Onymous. Crime, Law and Social Change, 67(1), 55-75.

Décary-Hétu, D., Paquet-Clouston, M., & Aldridge, J. (2016). Going international? Risk taking by cryptomarket drug vendors. International Journal of Drug Policy, 35, 69-76.

Décary-Hétu, D., & Quessy-Doré, O. (2017). Are repeat buyers in cryptomarkets loyal customers? Repeat business between dyads of cryptomarket vendors and users. American Behavioral Scientist, 61(11), 1341-1357.

Demant, J., Aldridge, J., Décary-Hétu, D., & Munksgaard, R. (2018). Going local on a global platform: A critical analysis of the transformative potential of cryptomarkets for organized illicit drug crime. International Criminal Justice Review, 1057567718769719.

Dittus, M., Wright, J., & Graham, M. (2017). Platform Criminalism: The'Last-Mile'Geography of the Darknet Market Supply Chain. arXiv preprint arXiv:1712.10068.

Duijn, P. A., Kashirin, V., & Sloot, P. M. (2014). The relative ineffectiveness of criminal network disruption. Scientific reports, 4, 423.

Gerdes, L. M. (2014). MAPPing dark networks: A data transformation method to study clandestine organizations 1. Network Science, 2(2), 213-253.

Gerritsen, C. (2015). Agent-based modeling as a research tool for criminological research. Crime science, 4(1), 2.

Hanna, B., De Nooy, J., & De Nooy, J. (2009). Learning language and culture via public Internet discussion forums. Springer.

Heppenstall, A. J., Crooks, A. T., See, L. M., & Batty, M. (Eds.). (2011). Agent-based models of geographical systems. Springer Science & Business Media.

Lettieri, N., Altamura, A., Malandrino, D., & Punzo, V. (2017, September). Agents Shaping Networks Shaping Agents: Integrating Social Network Analysis and Agent-Based Modeling in Computational Crime Research. In Portuguese Conference on Artificial Intelligence (pp. 15-27). Springer, Cham. Leukfeldt, E. R., Kleemans, E. R., & Stol, W. P. (2017). Origin, growth and criminal capabilities of cybercriminal networks. An international empirical analysis. Crime, Law and Social Change, 67(1), 39-53.

Macal, C. M., & North, M. J. (2010). Tutorial on agent-based modeling and simulation. Journal of simulation, 4(3), 151-162.

Macal, C. M., & North, M. J. (2005, December). Tutorial on agent-based modeling and simulation. In

Simulation conference, 2005 proceedings of the winter (pp. 14-pp). IEEE.

Malleson, N., Heppenstall, A., & See, L. (2010). Crime reduction through simulation: An agent-based model of burglary. Computers, environment and urban systems, 34(3), 236-250.

(26)

Martin, J. (2014). Lost on the Silk Road: Online drug distribution and the ‘cryptomarket’. _{Criminology &}

Criminal Justice_{, 14(3), 351-367.}

Masys, A. J. (Ed.). (2014). Networks and network analysis for defence and security. Springer Science & Business Media.

McCoy, D., Bauer, K., Grunwald, D., Kohno, T., & Sicker, D. (2008, July). Shining light in dark places: Understanding the Tor network. In _{International Symposium on Privacy Enhancing Technologies}

Symposium_{(pp. 63-76). Springer, Berlin, Heidelberg.}

Morris, J. F., & Deckro, R. F. (2013). SNA data difficulties with dark networks. Behavioral Sciences of Terrorism and Political Aggression, 5(2), 70-93.

Morselli, C., Gabor, T., & Kiedrowski, J. (2000). The factors that shape organized crime. Public Safety Canada.

Nurmi, J., Kaskela, T., Perälä, J., & Oksanen, A. (2017). Seller’s reputation and capacity on the illicit drug markets: 11-month study on the Finnish version of the Silk Road. Drug & Alcohol Dependence,

178, 201-207.

Paquet-Clouston, M. C. (2017). Are Cryptomarkets the Future of Drug Dealing? Assessing the Structure of the Drug Market Hosted on Cryptomarkets.

Przepiorka, W., Norbutas, L., & Corten, R. (2017). Order without law: Reputation promotes cooperation in a cryptomarket for illegal drugs. European Sociological Review, 33(6), 752-764. Schwartz, D. M., & Rouselle, T. D. (2009). Using social network analysis to target criminal networks. Trends in Organized Crime, 12(2), 188-207.

Tundis, A., Huber, F., Jäger, B., Daubert, J., Vasilomanolakis, E., & Mühlhäuser, M. (2018). Challenges and available solutions against organized cyber-crime and terrorist networks. WIT

Transactions on The Built Environment, 174, 429-441

Tzanetakis, M., Kamphausen, G., Werse, B., & von Laufenberg, R. (2016). The transparency paradox. Building trust, resolving disputes and optimising logistics on conventional and online drugs markets. International Journal of Drug Policy, 35, 58-68.

Valvi, A. C., & Fragkos, K. C. (2012). Critical review of the e-loyalty literature: a purchase-centred framework. Electronic Commerce Research, 12(3), 331-378.

Van Buskirk, J., Bruno, R., Dobbins, T., Breen, C., Burns, L., Naicker, S., & Roxburgh, A. (2017). The recovery of online drug markets following law enforcement and other disruptions. Drug & Alcohol Dependence, 173, 159-162.

Van der Hulst, R. C. (2009). Introduction to Social Network Analysis (SNA) as an investigative tool. Trends in Organized Crime, 12(2), 101-121.

Van Mierlo, T. (2014). The 1% rule in four digital health social networks: an observational study.

(27)

Williams, P. (2001). Transnational criminal networks. _{Networks and netwars: the future of terror,}

Making the virtual, virtual