Doctoral dissertation

Dissertation: Criminal market places in the Tor network

Juha Nurmi
How to research criminal activities in the anonymous Tor network? For example, how to estimate how much illegal drugs Finnish people bought using Silkkitie market place? What is the logic behind anonymous markets? Juha Nurmi answers to these questions in his doctoral thesis.

Every moment over two million people over the world are connected to the Tor network. The Tor Browser can be used to protect online privacy. As a result, criminals find Tor attractive and there are several illegal market places in the Tor network.

In the market places criminals use virtual currencies and anonymous nick names to protect their real identity. In 2015, Finnish people spent over two million euros to buy illegal drugs using Silkkitie market place in the Tor network.

On the other hand, now illegal activities are paradoxically more public than ever: everyone can access these onion sites and browse the product listings. The illegal trade is transparent to be followed.

First Nurmi developed a search engine to search the content published in the Tor network. This is a search engine similar to Google, but it is searching content from the onion services inside the Tor network. After this Nurmi began to use web-crawling and scraping to gather research material for his investigations. Using this data we can estimate trends, amounts of trade and analyse the market logic.

The Tor network enables a possibility to host market place websites anonymously. As a result, it is very difficult to shut these websites. Meanwhile everyone can access the websites with the Tor Browser. These market places started to arise after Bitcoin virtual currency was developed in 2009.

The dissertation demostrates how to find and extract research data from the illegal market places.

Tor is not only for criminals. It is a free security software for anyone who wants to have online privacy. At the moment, over ten thousands Finns are connected to the Tor network. They have reasons to protect their security. Nurmi estimates that Tor is relatively security against even the vast data collection capabilities of the NSA.

“Tor offers strong online anonymity. This can be used for legal and illegal purposes. People seek methods against spying and surveillance. However, criminals find the same online anonymity very useful. Luckily, online anonymity does not prevent us from gathering data about the criminal activities,” Nurmi says.

He works at Cyber Intelligence House and analyses cyber threats against companies.

The doctoral dissertation Understanding the Usage of Anonymous Onion Services will be publicly examined in the Faculty Council of the Faculty of Information Technology and Communication Sciences at Tampere University on Friday 24th of May at 12 o’clock in Tietotalo building auditorium TB109, address Korkeakoulunkatu 1. The Opponent will be Ph.D. Tobias Pulls from the Karlstad University, Sweden. The Custos will be Associate Professor Billy Brumley.

The dissertation is available on