Deep Web Marketplaces

Over the past couple of weeks, I’ve been frequenting the deep web marketplaces most famously used for buying drugs online with Bitcoin.

I wanted to see if there was anything we could learn about how these illicit marketplaces work that could be applied to improve the legal marketplaces we invest in at USV.

As part of my research, I purchased an item on Evolution (no, not drugs – a pair of furry boots) in an effort to understand the dynamics of these marketplaces, from trust and safety to flow of funds. This is what I learned in the process.

Privacy

• Deep web marketplaces can only be accessed using Tor, a decentralized computer network that anonymizes traffic such that it’s harder to trace an individual user through their IP address. If you’d like to learn more about Tor and how it works, this is a good introduction.

• Most if not all marketplaces force you to sign up before browsing the listings. The sign up process involves picking a username and password, and an account PIN number. You’re also expected to remember a mnemonic private key for your account, which is not stored on the marketplace’s servers.

• Most sellers (particularly drug dealers) require all communications to be encrypted with PGP. Most marketplaces have a PGP key field at the profile setup level.

• Some marketplaces automatically delete all order information from their servers 30 days after an order has been “finalized” by the user.

• No e-mails are used, only Bitmessage (decentralized) or the marketplace’s messaging system (encrypted and periodically deleted).

Products

• Lots of drugs. The drugs category is 10x larger than all others. You’ll find anything from Valium to cocaine and LSD.

• You’ll also find digital content, stolen credit card and user/password lists, hacking services (mostly DDoS), counterfeit goods (fashion, jewelry, etc.), lab equipment, electronics (I was tempted to buy a pocket-sized EMP pulse generator), high-end spy gear, forged documents (driver’s licenses, passports), counterfeit currency, weapons and more.

Brand and Reputation

• Brand and reputation means everything to sellers. Buyers guide themselves via eBay-style reviews of the sellers.
• This is particularly important in an environment where there is no real identity shared between any of the participants. By contrast, I may not know who an eBay seller is but I take comfort in knowing that eBay does.

• Most sellers have 95%+ positive ratings. Some sellers have been involved in over 10,000 transactions.

• Many sellers have a presence across multiple deep web marketplaces, and oftentimes point to their profiles on different platforms as a way to further establish credibility.

• The community moderates sellers beyond the eBay-style reviews. A lot of marketplaces have separate community forums where users review sellers and products.

• A quick way for new sellers to establish credibility is to get reviewed by these community members.

• These forums often have established members, to whom sellers frequently send review samples.

• Sellers oftentimes link to these reviews as social proof, which are often rich in detail about the quality of the product (with pictures!), the seller, the packaging (good/bad stealth), speed, etc.

Flow of funds

• You are given a bitcoin public key on to which you must deposit funds before making a purchase.

• You’d buy bitcoin at an exchange, and use a mixing/tumbling service to anonymize them for a small fee. The need for these services in illegal transactions is interesting, since Bitcoin is frequently antagonized for its anonymity.

• You are expected to trust the marketplace with holding your funds. Some users keep a balance on their account, while others only make a deposit when they intend to make a purchase.

• Funds show up in your account once the transaction has been confirmed in the blockchain multiple times.

• Once funds are in your account, checkout is familiar and straightforward.

Escrow

• Escrow is provided by the marketplace operator and it is paramount to their business model.

• Sometimes you’ll find two service tiers: standard escrow (admins are the judges) or multisig escrow.

• To finance this service (and make a profit), marketplaces charge a small fee.

• Some sellers are very well established and have stellar reputations. This affords them the privilege of skipping escrow.

• Oftentimes, sellers will give you a discount (up to 20%) if you skip escrow or finalize early for the benefit of getting paid upfront.

• You have some number of days (15-30) to finalize the order (at which point the funds are transferred to the seller) or dispute it, at which point the staff gets involved.

Shipping

• This was not really relevant for my purposes, so I’m not entirely sure how shipping works for drugs. But I did some reading and wanted to share the most creative (emphasis on creative) method for anonymously receiving a package:

• One user put down the address of his local post office as a shipping address instead of his home. As a recipient, instead of his name he submitted “Holder of Federal Reserve Note number #NNNNN”, #NNNNN being the serial number of a dollar bill in his possession. Apparently he went to the post office holding the bill, correctly identifying himself as the holder of that federal reserve note, and was given the package (which I can only assume contained drugs).

Network effects

• There are no data network effects in the platform. In fact, deep web marketplace operators want to hold on to as little data as possible, as the opposite increases their exposure to prosecution.

• The network effects are in the seller’s reputation across many different forums, marketplaces, and websites (including “clear” web services like Reddit).

• Brand and product drive defensibility. Because the popular sellers are present in all major marketplaces, users mostly make decisions based on product. When new users ask for recommendations, they are oftentimes sent to a particular marketplace because of its ease of use.

Lessons learned

• A seller’s brand and reputation are extremely important in a system where the intermediary (the marketplace) does not guarantee trust and safety.

• This is largely decentralized in deep web marketplaces, as vendors make sure their brand is spread across multiple websites and forums.

• Marketplaces come and go (or get seized by the FBI) but sellers need maintain their reputation.

• Marketplaces can extract value where they incur costs. Because Bitcoin transactions are a commodity, high take rates and complex fee structures are unsustainable business models. This leads marketplaces to become very thin layers between supply and demand, which commands much smaller transaction fees – as low as 2% – to finance the small set of crucial services (enforcing contracts).

• The network regulates itself with relatively little involvement from its administrator (if networks are like governments, this is similar to a very small libertarian one).

• Peer to peer commerce, with no intermediary, can work: it depends on the reputation of the supplier and the size of the discount.

There’s a lot to learn from these platforms as we continue to think about how the Blockchain and other new technologies might impact traditional business models. For example, marketplaces with cost structures that command high take rates are vulnerable to Bitcoin-driven business models with very low or non-existent transaction fees. It could be that what drives adoption of unbundled services is competition by lowering costs.

I’m also wondering how applications could build network effects while defaulting to decentralized open data through the Blockchain Application Stack. While deep web marketplaces don’t fit this model, periodically purging the database has similar implications to giving up control of your user’s information by using decentralized data stores. Perhaps the answer is to have the best product and user experience.

This brings about a very interesting set of questions for both entrepreneurs and investors.

How do you monetize a decentralized network? Is it SAAS on top of the network?

How can you build build network effects while relinquishing control of the data? Do you compete on product and user experience? Is that defensible?

We have some ideas, but no definitive answers.