Capstone project for a 12-week online course with the International Association of Crime Analysts. My topic was on how crime and intelligence analysts are using open source intelligence (OSINT) to investigate Internet crime.

1. DIGITAL BREADCRUMS:
INVESTIGATING INTERNET CRIME WITH OPEN SOURCE INTELLIGENCE
(OSINT) TOOLS & TECHNIQUES
Nicholas A. Tancredi, CCI, Q|SMIA, P2CO
International Association of Crime Analysts
Fundamentals of Crime Analysis: Essential Skills I Course Capstone Project
22 June 2020

2. Tancredi 2
Table of Contents
Hypothesis……………………………………………………………………………..3
Abstract ………………………………………………………………………………..3
Introduction…………………………………………………………………………….4
Open Source Intelligence, Social Media & Social Networks…………………………..5
Illustrating Social Media by Testimonials…………………………………………….15
Human Trafficking, Organised Crime (OC), & Social Media………………………...17
Crime Location: Dark Web & Criminal Behavior/Modis Operandi…………………..27
Child Pornography and ‘Playpen’……………………………………………………..32
Combatting Child Pornography………………………………………………………..35
Law Enforcement Model: Regional Data Sharing & Fusion Centers………………….40
Statistics, Qualitative & Quantitative Informative……………………………………..42
Conclusion……………………………………………………………………………..53
Works Cited……………………………………………………………………………57

3. Tancredi 3
HYPOTHESIS
Open source Intelligence (OSINT) is an innovative way to investigative various forms of
Internet and cybercrime, such as utilizing advanced social media searches and unique Dark Web
investigations for organized crime groups and illicit pornography sites found on the Darknet
markets.
ABSTRACT
The purpose of this paper is to examine how crime and intelligence analysts are
combatting cybercrime using open source intelligence (OSINT), mainly investigating social
media and Dark Web sites, but through an analytical perspective, shown with charts, graphics,
data from social network analysis, and data from research studies which illustrate that social
media is an effective crime fighting tool. This paper will incorporate concepts from chapter
topics from the book Exploring Crime Analysis: Readings on Essential Skills, along with
research from the Rand Corporation, academic journals, web sources, and other professional
association reports as well, such as research from the Office of Community Oriented Policing
Services, which is part of the Department of Justice. Moreover, it will look at chapters 2) Law
Enforcement Models, 3) Understanding Criminal Behavior, 4) Police Data and Crime Analysis
Data Sources, and 5) Internet Resources. It will also discuss how crime analysts are investigating
Dark Web crimes, such as child pornography, which is an ongoing issue for both crime and
intelligence analysts, as well as law enforcement officers who work tirelessly to combat some of
the deepest depths of the Dark Web. The paper also incorporates graphics and statistical
information on drug buying markets on the Dark Web as well.

4. Tancredi 4
INTRODUCTION
Crime analysts are not in the spotlight of the media; they do not get the bad press police
officers do. They don’t have to deal with divisive slurs, nor are they on the frontlines of protest
blockades, bank robberies, hostage situations, school shootings, and they certainly don’t carry a
gun and badge where they can enforce any laws; the average crime analyst is virtually
“anonymous” in the eyes of the public.”
However, a crime analyst is a vital player to their specific public safety agency, because
they are the ones mapping out high crime zones, putting together crime maps for their officers
and crime bulletins as well. They assist with missing persons cases, including child kidnappings.
They perform threat assessments, search social media sites for criminal and gang activity, they
make link analysis charts, and spend long hours at a desk when they need to, in order to keep
their community, state, or country safe from crime or terror when duty calls.
I remember watching the confirmation hearing of Mike Pompeo in January 2017 when he
was nominated to be Director of the Central Intelligence Agency (CIA). He spoke about taking a
tour in CIA Headquarters and saw an intelligence analyst falling asleep at her desk after working
eighteen hours while tracking a terrorist overseas. He called her a patriot and spoke about how he
wanted to lead people like her. Many crime analysts share the same work ethic and duty to
service. I should preface that while children are the most important stakeholder in this paper,
because of the horrendous crime that sex abuse and rape can do for a child’s physical and mental
health, and it also important for law enforcement officers to make a connection with all the
members of the community, because technology is also a great crimefighter, which community
members use daily. Edmond Burke said it best, “The only thing necessary for the triumph of evil
is for good men to do nothing” (BrainyQuote, 2020).

5. Tancredi 5
OPEN SOURCE INTELLIGENCE, SOCIAL MEDIA & SOCIAL NETWORKS
Open source intelligence, or OSINT as it will be referred to in this paper, is unclassified
publicly available information. This could include media-based information, such as social
media sites, government data and reports, academic or professional documents, including
interviews. OSINT is valuable to law enforcement because of the nature of its accessibility
(Santos and Davis, 2017, pp. 84-85).
Both law enforcement personnel and civilians can do searches on property, which
includes ownership, taxes, parcel information, business and corporation searches that includes
activity status, registered agents and officers, owners, d/b/a information, and associated
businesses. Profiles could also be designed based on information gathered through open source
channels. Moreover, geographical mapping programs such as Google Earth is also an open
source resource that is able to be used with real estate tax information to create a visual
illustration for law enforcement as well (Santos and Davis, 2017, p. 85).
One such time when Facebook was used to track down a suspect, was in November 2016
at Ohio State University in Columbus, Ohio, when an individual drove a car into a group of
people and got out of the car, only to start slashing bystanders with a knife. The attacker was shot
soon thereafter, and while law enforcement personnel was processing the scene and helping
victims, authorities diligently worked to identify the suspect (State, Local, and Federal Law
Enforcement and Homeland Security Partners, 2017, p. 8).
Authorities found a driver’s license with the name of a possible suspect, and the
information was sent to the Strategic Analysis and Information Center in Columbus, and shortly
after, an analyst at the center was able to use open source analysis to locate the suspect’s
Facebook page. The fusion center analyst identified a vital piece of evidence through open

6. Tancredi 6
source analysis, which was used to further support the identification of the subject or possible
acquaintances. The analyst disseminated the Facebook page to other fusion centers including
state and federal partners, as well as the local Federal Bureau of Investigation (FBI) Joint
Terrorism Task Force (JTTF) (State, Local, and Federal Law Enforcement and Homeland
Security Partners, 2017, p. 8).
Police departments across the United States started to realize that users of Facebook and
other social media platforms often make comments, post photographs or videos that incriminate
themselves or other people (Police Executive Research Forum, 2013, p. 11). For example, gang
members often post photos of themselves holding illegal firearms. In some cases, individuals
have “bragged” about committing serious violent crimes, apparently believing (incorrectly) that
police do not investigate social media pages or that they cannot act on the information which is
posted online (Police Executive Research Forum, 2013, p. 13).
In a LexisNexis survey, a law enforcement officer stated, “It is amazing that people still
‘brag’ about their actions on social media sites,…even their criminal actions. Last week had an
assault wherein the victim was struck with brass knuckles. The suspect denied involvement in a
face-to-face interview, but his Facebook page had his claim of hurting a kid and believe it or not,
that he dumped the [brass knuckles] in a trash can at the park. A little footwork…led to the brass
knuckles being located and [a confession] during a follow-up] interview” (Police Executive
Research Forum, 2013, p. 15).
Cybercriminals exploit the opportunities provided by the information revolution and
social media to communicate and engage in illicit underground activities, which includes fraud,
cyber stalking or predator activities, cyberbullying, hacking, blackmailing, and drug smuggling.
To combat the growing number of criminal activities, structure and content analysis of criminal

7. Tancredi 7
communities can give insight and facilitate cybercrime forensics (Iqbal, Fung, Bebbabi, Batool,
and Marrington, 2019, p. 22740).
Communication trends of the digital era, including chat servers and Instant Messaging
(IM) systems, offer a convenient operation for sharing information. Criminals exploit these
opportunities, so their illicit activities go unnoticed. The National Center for Missing and
Exploited Children reported that one out of every seven children in the United States faces
unwanted online sexual solicitations. Drug dealers use chat rooms for drug trafficking, and
terrorists and hate groups use social media to promote their ideologies (Iqbal, Fung, Bebbabi,
Batool, and Marrington, 2019, p. 22740).
Since there are limitations in existing forensic tools, the authors had made suggestions to
address these issues. For instance, crime investigators can perform a search query and see the
results in a designed visualizer. The purpose of this data mining framework is to collect
instinctive and interpretable evidence from a chat log to simplify and facilitate the investigation
progress, which is especially true in the beginning stages when there is not enough indicators for
the investigator to start with (Iqbal, Fung, Bebbabi, Batool, and Marrington, 2019, p. 22740-
22741).
The three main modules of this framework consist of: Clique Detector, Concept Miner,
and Information Visualizer. The Clique Detector identifies the cliques, (communities), in a chat
log. For this purpose, it recognizes all the entities in the given chat log. For this purpose, it first
recognizes all the mentioned entities in the given chat log. In context of investigation, the term
entity can name an individual, organization, phone number, or address. For this example, the
term entity, refers to an individual’s name (Iqbal, Fung, Bebbabi, Batool, and Marrington, 2019,
p. 22741).

8. Tancredi 8
After extracting entities, “the Clique Detector uses the co-occurrence frequencies of the
in the chat sessions and identifies the communities, called cliques” (Iqbal, Fung, Bebbabi,
Batool, and Marrington, 2019, p. 22741). Next, the Concept Miner processes a chat log of each
clique and pulls the concepts that represent the discussed topics. For this purpose, it finds vital
terms based on their frequency in the text. Each vital term is mapped to a corresponding concept
in the WordNet that is used to create a hierarchy of concepts and to represent relationships
between them. A customized version of bottom up hierarchical clustering is applied to form
groups of concepts holding strong cohesive relationships among terms. The node on the top of
the hierarchy is the main topic of the conversation (Iqbal, Fung, Bebbabi, Batool, and
Marrington, 2019, p. 22741).
Finally, the Information Visualizer illustrates the identified cliques as an interactive graph
in which the nodes represent the recognized entities, and the edges represent the identified
cliques. Additionally, the Information Visualizer also shows the keywords, summary, and
concepts of the selected clique from the graph (Iqbal, Fung, Bebbabi, Batool, and Marrington,
2019, p. 22741). An illustration of this process is shown below:

9. Tancredi 9
Moreover, the detailed architecture of this proposed framework is illustrated below in
more detail in Figure 2. It is comprised of three main components : Clique Detector, Concept
Miner, and Information Visualizer. Clique Detector detects the cliques from the chat log.
Concept Miner extracts all main concepts of the conversation from the chat sessions of each
identified clique. Information Visualizer allows the user to look through cliques and related
concepts at various levels of abstraction in an interactive interface (Iqbal, Fung, Bebbabi, Batool,
and Marrington, 2019, p. 22744).
A final framework from Iqbal, Fung, Bebbabi, Batool, and Marrington (2019), is the chat
logs of extended cliques. There are ten extracted cliques in the figure, where each has two or
three entities. All of the extracted cliques contain the central node, which represent the suspect,
and the other nodes indicated by edges are connected to the suspect. Using this visualizer, the
investigator can select a clique in order to display all vital information about it. An example of
the clique containing the entities BANG54321033, EDDYSPHARMACY8, and CHARLIE is

10. Tancredi 10
important as drug-related terms such as grass, heroin, and snow, which are found in the chat
conversation of its members. The identified entities and cliques are manually compared with the
content of the chat sessions, and the results illustrate the system has the ability to extract 80% of
cliques correctly, with some being a few false positive cases (22751).

11. Tancredi 11
To expand on the nodes framework, social media analysis is comprised of methods and
techniques to collect and analyze text, photos, video, and other material shared through social
media systems, such as Facebook and Twitter (Hollywood, Vermeer, Woods, Goodison, and
Jackson, 2018, p. 1). Social network analysis (SNA) however, is a type of data analysis that
investigates social relationships and structures as represented by networks, also called graphs.
Social media, given that it
reflects relationships
inherently, is a main source
of information for social
network analysis;
conversely, SNA is one
main type of social media
analysis (Hollywood,
Vermeer, Woods,
Goodison, and Jackson,
2018, p. 1).
Social media is important today as a communication and interaction mode for people in
general and both as a “venue” and as an enabler for specific types of crime. Law enforcement
interaction with social media and use of social media data is vitally important, given the need to
police in this technological era (Hollywood, Vermeer, Woods, Goodison, and Jackson, 2018, p.
3).

12. Tancredi 12
SNA is a type of data analysis that investigates social structures as represented by
networks, also called graphs. In these networks, each person is a “node” or “vertex,” and each
relationship between pairs of people is a link, which is known as an “edge” or “tie” (Hollywood,
Vermeer, Woods, Goodison, and Jackson, 2018, p. 3).
Criminal intelligence analysis aims at supporting investigations by performing several
functions, but most importantly, producing link charts to identify and target key actors. Law
enforcement agencies are starting to increase their use of Social Network Analysis (SNA) for
criminal intelligence, analyzing relationships among individuals based on information on
activities, events, and places derived from a host of investigative activities (Berlusconi,
Calderoni, Parolini, Verani, and Piccardi, 2016, p. 1).
SNA allows added value compared to more traditional approaches such as link analysis,
enabling in-depth assessment of the internal core of criminal intelligence groups and by
providing strategic advantages. For example, SNA can help law enforcement officers in
identifying aliases during large investigations and in the collection of evidence for prosecution.
Overall, the network analysis of criminal organizations under investigation may help identify

13. Tancredi 13
clear strategies to reach network destabilization or disruption of future criminal activity
(Berlusconi, Calderoni, Parolini, Verani, and Piccardi, 2016, p. 1).
In addition to social media and social network analysis, many law enforcement agencies
have adopted the use social media as “crime fighting tool” on their toolbelt. For example, the
Philadelphia Police Department has used Pinterest to help catch criminals; the Seattle Police
Department designed a Tweets-by-Beat service on Twitter; and the Cambridge, Massachusetts
Police Department implemented a similar service where auto-tweets mimic the police scanner to
inform residents of police happenings (Government Technology News Staff, 2013).
The infographic from Backgroundcheck.org on the next page provides even more insight
into how law enforcement uses Twitter, Facebook, and YouTube--the most used social media
networks--and what percentage of agencies at the state, local, and federal levels use the tool
(Government Technology News Staff, 2013).
Some of the statistics from the infographic state, 80% of law enforcement personnel use
social media to perform investigations, 67% believe social media helps solve crime more
quickly, 87% of time search warrants that use social media to establish probable cause hold up in
court whenever challenged, and targets also post and brag about their illegal activities which
could reference travel, hobbies, places visited, functions, appointments, their group networks,
actions, etc. (Government Technology News Staff, 2013).

14. Tancredi 14

15. Tancredi 15
ILLUSTRATING SOCIAL MEDIA DATA BY TESTIMONIALS
From a 2014 LexisNexis Social Media Use in Law Enforcement survey, it was found that
law enforcement agencies were using social media much more than they did two years prior to
anticipate criminal activity. It is was second most commonly used social media activity,
following crime investigations, and more than half (51%) listen or monitor social media activity
for possible criminal activity. Two-thirds find social media a valuable tool in anticipating future
crimes (LexisNexis, 2014, p. 8).
Additionally, law enforcement personnel are using social media tools in very unique and
effective ways in an increasing manner in order to locate criminals and evidence to
communicating directing with the residents they serve, about public safety matters. These are a
few of the creative ways law enforcement agencies have been utilizing social media (LexisNexis,
2014, p. 8):
Discover Criminal Activity and Obtain Probable Cause for a Search Warrant
“I authored a search warrant on multiple juveniles’ Facebook accounts and located
evidence showing them in the location in the commission of a hate crime burglary. Facebook
photos showed the suspects inside the residence committing the crime. It led to a total of six
suspects arrested for multiple felonies along with four outstanding burglaries and six unreported
burglaries” (LexisNexis, 2014, p. 8).
Identifying Criminals
“I was able to identify a drug dealer known only by his street name and physical
description by finding him on another dealer’s page. He was showing off his bike and you could
see the plate. Got the registration and ID’d him” (LexisNexis, 2014, p. 8).

16. Tancredi 16
Public Safety Awareness
“We use a dedicated Facebook page and Nixle to alert our citizens about what is going on in
[Town]. We put out advisories, warnings and details of crime. We also use Facebook for public
service announcements” (LexisNexis, 2014, p. 8).
The following graphics illustrate the increase in social media use in law enforcement
agencies from 2012 to 2014.

17. Tancredi 17
HUMAN TRAFFICKING, ORGANISED CRIME (OC), & SOCIAL MEDIA
There was a study done in the United Kingdom, called ePOOLICE (early Pursuit against
Organised crime using environmental scanning, the Law and IntelligenCE systems). The goal of
this study was to develop a prototype environmental scanning system, integrating a number of
promising and mature technical components which would precisely filter information from open-
sources, such as the web and social media, to find information that may constitute work-signals
of OC. One of the main issues is set out to answer was the extent to which OC crime threats
could be found in the early stages of the initial threat, prior to their development into larger and
more complex criminal systems, through the automated collection and analysis of data from
various open sources (Andrews, Brewster, and Day, 2018, pp. 1-2).
Social Media Intelligence (SOCMINT), provides the opportunity for insights into events
and groups, enhancing situational awareness, and enabling the identification of criminal intent,
provided that it is performed in a manner that it appropriately respects human privacy rights.
Reports and case studies have both examined the use of SOCMINT within public safety
agencies, and the reception they received from it. One such event was the use of social media by
the Boston Police Department after the 2013 Marathon bombings, and the success that came
from it (Andrews, Brewster, and Day, 2018, p. 2).The United Nations Office on Drugs and

18. Tancredi 18
Crime (UNODC) have defined,
using the UN Palermo protocol as
the basis, or what they call, the three
constituent ‘elements’ of trafficking,
these being the ‘act,’ ‘means,’ and
‘purpose,’ which is seen in Figure 1
it (Andrews, Brewster, and Day,
2018, p. 3).
First, the ‘act’ refers to what is done, and can include context such as whether and how
the victim has been recruited, transported or harbored. The question of how this is being done is
shown by the ‘means,’ which seeks to make the case whether the force is being used as the basis
of manipulation, which could include kidnapping, abduction or the exploitation of
vulnerabilities, or more subtle methods, which could be through fraud, imposing financial
dependents or coercion (Andrews, Brewster, and Day, 2018, p. 3).
The final element, the ‘purpose,’ creates the reason why the act and means are taking
place, or more simply, the form of exploitation behind the act and means be it forced labor,
sexual exploitation and prostitution, organ harvesting or domestic servitude (Andrews, Brewster,
and Day, 2018, p. 3). These are also crimes that are committed anonymously through the Dark
Web as well.
The above definitions and category design provide an ideal illustration of a classification
of human trafficking that can be used to form the basis of an approach to automatically find and
extract valuable data from open sources. This classification in actuality forms part of a bigger

19. Tancredi 19
model, made up of a broader range of OC threats, that includes the cultivation and distribution of
illegal narcotics (Andrews, Brewster, and Day, 2018, p. 3). Figure 2 illustrates this below:

20. Tancredi 20
Using sexual exploitation as an example, indicators include things such as the appearance
that persons are under the specific control of another, that the individual(s) appear to not own or
own very little clothing, or rely on their employer for basic amenities, transport and
accommodation and more. The taxonomy excerpt included in Figure 3 illustrates at a high level
how a taxonomy node focused on attributes which could show how an individual is vulnerable,
or could be a victim of trafficking or exploitation, may contain specific rules created to identify
text which suggests they could have subjects to violence, as one example of a weak signal
(Andrews, Brewster, and Day, 2018, pp. 5-6).
In order to search for certain keywords, analysts have the ability to take a single tweet
which may contain multiple locations and entities associated with it. As the Twitter examples
illustrate, these relationships are done on a ‘per sentence’ basis. Figure 4 provides a visual of
how this is done in practice (Andrews, Brewster, and Day, 2018, p. 6).

21. Tancredi 21
In order to scan social media sites, analysts have the ability to implement content
extraction and categorization models, which is an integrated pipeline that facilitates the crawling
of social media that is put in place. This process operates and allows for the seamless collection,
restructuring, processing, filtering and output of the data in preparation for further review. The
stages of data preparation and processing pipeline is illustrated below in Figure 6 (Andrews,
Brewster, and Day, 2018, p. 7).
By utilizing a data set created from 29,096 tweets as information sources obtained by
scanning for tweets which contained tweets with weak signals of OC; formal content was created
by scaling the extracted and structured data as seen in Figure 7 (Andrews, Brewster, and Day,
2018, p. 11).

22. Tancredi 22
By using minimal support of 80 tweets, the content was mined for OC threat concepts using
modification of the open-source In-close concept miner (Andrews, Brewster, and Day, 2018, p.
11). Pictured in the tree, is the head node, which is the concept that contains all the tweets from
concepts that satisfy the minimum support (5512 tweets) and each of the branches is a location
and another is an organized crime (Andrews, Brewster, and Day, 2018, pp. 11-12).
The example illustrates that every OC is Human Trafficking crime, as this was the type of
OC being scanned for by the system. The number inside each node is basically a concept
identification number assigned by the concept miner. The number outside the node, below the
list of attributes, is the object count (the number of tweets contained in the concept) and with
each case this is above the baseline support threshold of 80. For instance, the concept 53, has the
attributes authorlocation-Atlanta and Crime-HumanTrafficking, and has 185 objects (tweets).
Essentially, within the data there are 185 tweets that contain the author location Atlanta and
contain a weak signal of Human Trafficking. With this strong level of corroboration, a police
analyst would be alerted to investigate this further, and a possible next step in the investigation is

23. Tancredi 23
automated by formal concept analysis (FCA) in the form of a ‘drill-down’ to the OC concept’s
sub-concepts (Andrews, Brewster, and Day, 2018, pp. 11-12). See Figure 8 below to get an
illustrative view of this concept.

24. Tancredi 24
The processes and components described in Figure 9 were enacted as part of the
European ePOOLICE project.
The components of the Organised Crime Taxonomy and entity extraction created by the authors
were designed in the system to provide data readily to be consumed by various analytic
components, one of which was the FCA OC threat corroboration component described above.
The user interface was created in close collaboration with end-users from Law Enforcement
Agencies, which use a map-based approach (Andrews, Brewster, and Day, 2018, p. 13).
The system allows a police analyst to select region and type of OC to scan for and then
acquire such Internet sources as Tweets, which match those criteria. Data that is structured
automatically becomes extracted from the sources, which allows analysts to carry out a host of
analyst tasks and illustrate the results in an appropriate visual piece (Andrews, Brewster, and
Day, 2018, p. 13).
The final part of this research I will discuss is the OC tracking from three maps shown
below. The map in Figure 10 illustrates the OC concepts described in Figure 9. A host of icons
are utilized by the system to show types of OC and the one example in this study is for Human
Trafficking. Analysts then have the ability to click an OC concept icon to display its information

25. Tancredi 25
(essentially this is the attributes and objects of the concept) and drill down to its sub-concepts
(Andrews, Brewster, and Day, 2018, p. 13).
Figure 11 illustrates the ‘Atlanta’ OC concepts with its associated information, including
its attributes (crime:humantrafficking and location: atlanta) including its objects (tweets), listed
as URLs that would allow the analyst to trace back the original sources (Andrews, Brewster, and
Day, 2018, p. 13).

26. Tancredi 26
The sub-concepts are shown as icons below the original concept and Figure. 12 illustrates
the additional information displayed when one of these sub-concepts is clicked on–in this case,
the attribute drug: amphetamine. The 10 sources that contain a reference to amphetamine are
listed and at this point the analyst could decide to look at some of these and clicking on a URL
will take the analyst to the original source. Above the lists of attributes and sources is a list of
categories that are referred to in one or more of the sources on the OC concept, but not in all of
them. Thus, they give the analyst additional information of interest but without an indication of
their level of corroboration (Andrews, Brewster, and Day, 2018, p. 13).

27. Tancredi 27
CRIME LOCATION: DARK WEB & CRIMINAL BEHAVIOR/MODIS OPERANDI
In addition to OSINT information that is found through the surface web (or what is found
through a Google, Bing, or Yahoo search), there is information that is not indexed on the Surface
web, which is known as the Deep Web. This includes many large data sets and databases which
are much larger than the Surface web that many normally use, or that require a password (Mills,
2017, p. 87). This illustration is shown below.

28. Tancredi 28
The Dark Web is a very small piece of the Deep Web that is purposely hidden from view
and among other things, is used for criminal activities. Analysts will find a large array of tools
and resources on the Surface Web at their disposal but being familiar with the Deep and Dark
Web will be valuable in conducting research and criminal investigations (Mills, 2017, p. 87).
While the Dark Web can be used for some legitimate purposes such as investigative journalism
and peaceful anti-government activists who are opposing government, where such activity could
lead to imprisonment and execution, criminals are highly attracted to the Dark Web because of
the anonymity it provides where criminals engage in a variety of crimes, such as drug dealing,
prostitution, fraud, weapons trafficking and murder-for-hire (Mills, 2017, p. 102).

29. Tancredi 29
In order to access these sites, one must use an anonymizer such as The Onion Router
(TOR), which can be freely downloaded and installed on any computer. It uses a series of
networks run by volunteers to send information through the Internet in small packets that are
encrypted, which are nearly impossible to trace. The packets of information travel about in
application layers similar to that of layers of an onion, which is what makes TOR anonymous.
Advanced searches might be necessary to find what the analyst is looking for. This could be a
Dark Web user with virtual currencies such as Bitcoin to conduct illegal transactions. Bitcoin
and other virtual currencies allow money to be moved anonymously without banks or
government regulation, which is why it is perfect for criminals (Mills, 2017, p. 102).
This is illustrated below (Routley, 2017):

30. Tancredi 30
Another component of the Tor browser is the ability to host unindexed websites on the
Darknet. These hidden services appear on .onion urls, as opposed to the more familiar .com or
.ca. Tor’s browser can be used to either access anonymous surface web browsing, or access Dark
Web sites hosted throughout the onion network (Jardine, 2018, p. 2827). In 2016, the Tor
network had an average of about 2 million daily users. These users are not necessarily 2 million
unique individuals, as those who connect to a Tor node, disconnect and then connect again
would be counted as two unique users. Moreover, Tor’s 2 million daily users are certainly not
evenly divided in terms of how they actually use Tor’s Dark technology (Jardine, 2018, p. 2828).
Uncharted Software created a visualization of data flow in the Tor network where they
place each relay on a world map and illustrate traffic exchanged relays as animated dots (Tor |
Metrics, 2018). The graphic; “TorFlow” is shown below. This interactive data flow paints a clear
picture of all Tor nodes around the globe, and the interactive tools allow the user to see the
change of Tor users and nodes over time.

31. Tancredi 31
The often-criminal nature of Dark Web sites cluster in pretty normal ways with various
measurement exercises. In 2013, one look at over 8,000 .onion addresses for example, found that
pornography (17%) and drugs (15%) made up a significant plurality of sites (Jardine, 2018, p.
2830). While drug sites make up a large part of illegal Dark Web sites, around 2% of illegal sites
are dedicated to the collection and dissemination of child abuse imagery and received over 80%
of all the recorded site visits. Even when accounting for activity of bots, law enforcement and
returning users, leads to the conclusion that child abuse content is the most popular type of
content on the Tor Dark Web (Jardine, 2018, p. 2830).
This leads us into the Modis Operandi (M.O.) of a criminal, which is a Latin term which
means the “method of operation.” When it comes to criminal behavior, it refers to the method
used by the offender to successfully commit the offense. These methods should not be confused
with motivation or why the offender committed the crime. In a series, the M.O. can over time,
typically as a result of offenders learning what does and does not work in gaining access to and
victimize a target that offender desires (Alston and Gallager, 2017, p. 50).
It is important to catalog these behaviors for link analysis, where decisions are made as to
whether given crime are part of a type of series. This is especially important for crimes that
happen close together in chronological order. Identifying the M.O. helps to gain insight into the
type of the offender (Alston and Gallager, 2017, p. 50).
An M.O. will include any activities carried out to gain access to maintain control of a
victim’s activities that assist him or her in the commission of a crime, to prevent his or
identification, and those that help him or her flee the scene of the crime afterward. Studies
suggest that at an M.O. will change or evolve over time as offenders learn from experience and

32. Tancredi 32
develop preferences. As a result, crime analysts should draw attention to M.O. generalities rather
than specifics of crimes (Alston and Gallager, 2017, p. 50).
CHILD PORNOGRAPHY & ‘PLAYPEN’
Child pornographic content is shared among offenders who in turn share the content
online, which causes lifelong harm to the victims and even further trauma into adulthood
(Requiao da Cunha, MacCarron, Passold, Walmocyr dos Santos Jr., Oliveira, and Gleeson, 2020,
p. 1). The National Center for Missing and Exploited Children and Association of Sites
Advocating Child Protection’s white paper, state child pornography is one of the fastest growing
online businesses, with a revenue of about $3 billion USD. The issue is, nothing is really known
about the networked structure of these rings that share and view children being abused. Even less
is known about the real impacts of law enforcement interactions on Dark Web criminal
networks, mostly because of the lack of comprehensive data, which causes deep gaps in the
literature of criminal networks (Requiao da Cunha, MacCarron, Passold, Walmocyr dos Santos
Jr., Oliveira, and Gleeson, 2020, p. 1).
In August 2015, a new Dark Web site appeared called “Playpen.” The focus of Playpen
was the “advertisement and distribution of child pornography,” and the site allowed users to post
images (Altvater, 2017, p. 22). There were almost 60,000 accounts registered in its first month
and nearly 215,000 accounts by 2016, and the site also hosted 117,000 posts with 11,000 visitors
per week, and much of the content included “some of the most extreme child abuse imagery one
could imagine” (Altvater, 2017, p. 22).
The FBI described Playpen as “the largest remaining known child pornography hidden
service in the world” (Altvater, 2017, p. 22). It was in the later part of February 2015 when the

33. Tancredi 33
FBI seized the server running Playpen from a web host in Lenoir, North Carolina. Although, the
FBI did not immediately shut the site down. Instead, they operated the site from its own servers
in Virginia from February 20th to March 4th. While the FBI was in control of the site during the
time, law enforcement officers had the ability to deploy a network investigative technique (NIT)
to identify, and later prosecute, users of the site (Altvater, 2017, p. 22).
The ongoing investigation of the ‘Playpen’ child pornography website and its members
led to its takedown in 2015 and produced results that are a global ongoing effort (FBI, 2017).
These are ‘Playpen’ by the numbers:
The graphic below from the article The Dark Side of the Internet, depicts what a “Dark
Market” site looks like when it is seized by law enforcement agencies. The pornographic content
on the Dark Web was some of the most distressing material. The websites dedicated to providing
links to videos that depicted rape, bestiality and pedophilia were abundant. One such post at
supposedly a non-affiliated content-sharing website offered a link to a video of a 12-year-old girl

34. Tancredi 34
who was being raped by four boys at school (Moore and Rid, 2016, p. 23). Other examples
include a service that sold online video access to the vendor’s own family members: “My two
stepsisters … will be pleased to show you their little secrets. Well, they are rather forced to show
them, but at least that’s what they are used to” (Moore and Rid, 2016, p. 23).
Many communities geared
towards discussing and sharing
illegitimate fetishes were readily
available and were already active.
Under the shroud of anonymity, a host
of users appeared to look for
justification of their desires, providing
words of support and comfort for one
another in solidarity against what was
seen as society’s unjust discrimination
against non-mainstream sexual
practices, such as the desire for child pornographic material. Over the Dark Web, users
exchanged experiences and preferences, and traded content as well (Moore and Rid, 2016, p. 23).
A notable example from a website called Pedo List, included a commenter who freely
stated that he would ‘Trade child porn. Have pics of my daughter’ (Moore and Rid, 2016, p. 23).
There is no fear of retribution or prosecution on these sites, or at least it has not happened yet on
any of these communities, because users continue to feel comfortable enough to share personal
stories about their tendencies that would be forbidden outside the shroud of anonymity (Moore
and Rid, 2016, p. 23).

35. Tancredi 35
COMBATTING CHILD PORNOGRAPHY
To combat child pornography and child abuse imagery online, law enforcement agencies
are enlisting the help of carefully chosen group of technology savvy volunteers, because the
resources of law enforcement agencies may either be stretched significantly to donate to multiple
investigations (Acar, 2018, p. 206). By offering their time and expertise, a group of highly
enthusiastic crowd of volunteers had stepped up in the fight against child abuse on the Internet.
When compared with the anonymous communities of well-known online environments, specially
tailored and vetted crowds for particular purposes could be organized (Acar, 2018, p. 212).
Currently, there are many OSINT tools that volunteers have at their disposal, which
ranges from simple Google searches to expensive sets of software. Although, the appropriateness
and effectiveness of any given toolkit could change over time since they depend on the current
legal and technical circumstances (Acar, 2018, p. 215). For example, a popular OSINT
application can become quickly outdated due to new legislation that restricts the acquisition of
personal data online or the emergence of advanced techniques for capturing open sources.
Although, a law enforcement agency (LEA) must create a specifically designed OSINT toolkit
for volunteers and also update it to new versions as finer tools emerge, or related legal
amendments occur (Acar, 2018, p. 215).
Some of the essential features of crowdsourcing, including submission of OSINT reports,
distribution of task assignments and training modules for members could be integrated into a
user-friendly application. Volunteers could also make contact with administrators,
representatives of the registry office and legal advisors through the same interface, which could
also serve as an entry point for the OSINT toolkit (Acar, 2018, p. 215).

36. Tancredi 36
Volunteers also have access to secure database information, which prevents the misuse of
secure classified information. The interface has the ability to scan each user’s computer before it
assigns their particular task, where no visible connection to the related information has been
identified as a result of the scan (Acar, 2018, p. 216).
Figure 2 shows an example of the fusion of OSINT and non-OSINT data, made up of
OSINT reports that can be crosschecked through classified government databases in order to
compliment, confirm or negate the contributions of the crowd. When the process is automated,
this fusion not only strengthens the admissibility of OSINT reports but also saves time for LEAs,
by shortening the duration of the total inquiry period necessary for all reports (Acar, 2018, p.
216).

37. Tancredi 37
There are two major advantages of big data analysis for the active LEAs: fast and
efficient analysis of related information within a case and exploration of previously unknown
connections to cases that seem unconnected. 1) Since thousands, at least, of emails and
nicknames can be associated with a particular case, manual review of OSINT reports by active
LEAs would be very tasking, even with the proposed model. Moreover, due to the
overabundance of digital information, a vital link for the conviction of a suspect within a
particular case could be overlooked quite easily during manual examination. Therefore, such an
outcome contradicts the main objectives of building the above theoretical model, which could
include saving time on criminal investigations and making sure a very thorough inspection of
digital evidence has been performed (Acar, 2018, pp. 216-217).
Among other things, big data analysis of OSINT reports of a particular case visualizes the
connections between pieces of related information, so the acceleration of the evaluation process
could be carried out by active LEAs. Thus, such an analysis can effortlessly provide a complete
transcript of the communications of a suspect both in chronological and geographical order by
one click (Acar, 2018, p. 217).
Last but not least, whitelist and blacklist of e-mails and nicknames such as the consumer
support emails of well-known online environments and known aliases of wanted criminals can
be defined beforehand to increase the speed and maximize the benefits of big data analysis. By
doing this, a blacklist could be highlighted by the system, and a whitelist could be ignored and
not sent to the volunteers for subsequent assignments (Acar, 2018, p. 217).
Looking back to Operation Pacifier, the mass child pornography investigation on the
Dark Web, the FBI was successful in locating the Playpen server and gained control of it.
Although, the FBI still did not have the ability to find out the locations of individuals who were

38. Tancredi 38
posting or consuming child pornography through the Tor browser. The FBI had to find out the
Playpen IP users’ addresses, so the FBI employed a hacking method that was authorized by the
court, which was referred to as a Network Investigative Technique (NIT) (Altvater, 2017, p. 23).
An NIT is made up of four main pieces: 1) a generator, 2) an exploit, 3) a payload, and a
logging server. A generator runs on the “hidden service,” such as Playpen, and produces a unique
identification (ID) number that is associated with each user of the dark web site. The generator
then transmits that unique ID, along with the exploit and payload, to each user’s own computer.
Once on a user’s computer, the exploit takes control of the Tor browser; such as hacking, and
deploys the payload (Altvater, 2017, p. 23).
Next, the payload searches a user’s computer for those materials authorized in a search
warrant. Pertinent information would likely include an individual’s username, the unique
identifying number of the computer’s network card (MAC address), including the name of the
computer. After finding this information, the payload sends it to the logging service and creates a
record of the computer that the user utilized to access the Dark Web site. The process also allows
the payload to capture the public IP address of the user’s computer. The logging service records
all of the data sent from the payload on a separate computer at the FBI (Altvater, 2017, p. 23).
The FBI then has the ability to use the IP address to serve a subpoena on an internet
service provider, which will provide the government with a user’s name and physical address.
With strong probable cause that the user accessed illegal content, the FBI then obtains a search
warrant for the user’s computer. By seizing the computer, the government is able to prove that
the same computer with that NIT accessed that particular Dark Web site (Altvater, 2017, p. 23).
When it comes to investigating and mining Dark Web sites, investigators are using a
mining tool called Memex, and they are also using it to combat human trafficking on various

39. Tancredi 39
illicit .onion sites as well. Memex was developed at the Defense Advanced Research Projects
Agency (DARPA), with the help of Program Manager Chris White, who came up with a way to
make it easier to find human traffickers on Dark Web marketplaces (Altvater, 2017, p. 26).
White, had experience designing tools for mining big data and visualizing the results
while supporting the military in Afghanistan. White later used his experience to lead a project at
DARPA aimed at building a suite of search-engine tools that would allow users, such as law
enforcement personnel, to find, interact with, and understand data available on the surface web,
deep web, and dark web. White and his team called the suite applications Memex, which was
combination of “memory” and “index” (Altvater, 2017, p. 26).
In 2014, the DARPA team started testing Memex with law enforcement, and continued to
introduce the platform to district attorney’s offices, law enforcement, and non-governmental
organizations (NGOs). The New York Police Department (NYPD) and Manhattan District
Attorney’s Office’s (DANY) Human Trafficking Response Unit launched Memex. Today,
DANY uses Memex in every human trafficking case, and investigators screened 4,752 possible
cases for the first few months of 2016 (Altvater, 2017, p. 28).
According to Manhattan District Attorney Cyrus Vance who described his office’s use of
Memex, “We cannot rely on traumatized victims alone to testify in these complex cases. When
sex traffickers create online ads for their victims’ sexual services, they leave a digital footprint
that leads us to their criminal activity. Because those ads are frequently removed or intentionally
hidden on the ‘dark web,’ it puts them beyond the reach of typical search engines, and therefore,
beyond the reach of law enforcement. With technology like Memex, we are better to serve
trafficking victims and build strong cases against their traffickers” (Altvater, 2017, p. 28).

40. Tancredi 40
In addition to the above methods and law enforcement agencies, there are other
organizations that are taking down child porn sites on the Dark Web. For instance, in October
2011, the “hacktivist” collective known as Anonymous, through its Operation Darknet, crashed
a website hosting service called Freedom Hosting, where they operated on the Tor network, and
was reportedly home to more than forty child pornography websites (Finklea, 2017, p. 6).
Among the forty websites, was Lolita City, which was cited as one of the largest child
pornographic sites with over 100GB of data. Anonymous had “matched the digital fingerprints of
links on [Lolita City] to Freedom Hosting” and then launched a Distributed Denial of Service
(DDoS) attack against the site. In addition, through Operation Darknet, Anonymous leaked the
user database, which included username, membership time, and the number of images uploaded–
for over 1,500 Lolita City members (Finklea, 2017, pp. 6-7).
Moreover, in February 2017, hackers that had an affiliation to Anonymous took down
Freedom Hosting II–a website hosting provider on the dark web that was stood up after the
original site was shut down in 2013. Hackers claimed that over half the content on Freedom
Hosting was related to child pornography. Website data was also dumped, which could also
identify users of these sites. Moreover, security researchers estimated that Freedom Hosting II
stored 1,500-2,000 hidden services (roughly 15-20% of their estimated number of active sites)
(Finklea, 2017, pp. 6-7).
LAW ENFORCEMENT MODEL: REGIONAL DATA SHARING & FUSION CENTERS
Regional data sharing is not a concept new for law enforcement agencies, but it has
become a bigger priority in later years. As opposed to countries with centralized law
enforcement agencies, where data is shared among regions by default, the decentralized and

41. Tancredi 41
disjointed nature of U.S. law enforcement requirement needs local and state agencies to take it
upon themselves to proactively share with others (Jones and Gwinn, 2017, p. 41). This is where
fusion centers have aided in secure communication information sharing.
After the terrorist attacks on the World Trade Centers and Pentagon on September 11th,
2001, the federal government became much more involved in data sharing. Fusion centers were
defined and developed at the federal and state levels, with the mission to prevent repeating the
mistakes made prior to and during that time in 2001 (Jones and Gwinn, 2017, p. 41).
A fusion center can be best described as a large task force, but more specifically, it is a
collection of two or more law enforcement agencies working together and sharing threat-related
information to interdict very detailed criminal and/or terrorist activity. Overall, a fusion center is
made up of personnel from local, state, tribal, and federal agencies. The projects and operations
that take place at fusion centers require personnel with specific security clearance levels in order
to access both classified and unclassified information, which includes other sources of
confidential information as well (Jones and Gwinn, 2017, pp. 41-42).
In certain cases when it relates to the classified nature of fusion center operations and
strategic locations around the United States, the role of crime analysis in fusion centers is limited
in many ways. Crime analysts who have the opportunity to work in a fusion center must attain a
certain level of security clearance for purposes of obtaining access to both classified and
unclassified systems. They must also be highly skilled and work well with others. Since fusion
centers are inclusive of personnel from a host of agencies, analysts need to be cognizant of the
roles and responsibilities of each agency, and the sensitivity of information sources for
disseminated products. Overall, it is vital for data to be timely and accurate, and shared
appropriately (Jones and Gwinn, 2017, p. 42). However, it is not difficult to get a crime analyst a

42. Tancredi 42
security clearance for a fusion center; some crime analyst positions even require a security
clearance for certain Homeland Security related roles, such as fusion center analysts, or public
safety intelligence analysts. The Texas Department of Public Safety often posts crime analyst
roles for their fusion centers, where a secret clearance is listed in the job description.
Additionally, it is essential for intelligence and public safety purposes during any large
event, for intelligence divisions to employ the use of social media for live view feeds that can
provide real-time information to the operations center. During a large event, a fusion center may
be opened, and individuals with the proper training can be pulled from other intelligence units to
analyze online traffic to commanding officers on the street to keep them informed of intelligence
situations through updates on their smartphones and some also follow selected websites and
feeds as well (Police Executive Research Forum, 2013, p. 15).
STATISTICS, QUALITATIVE & QUANTITATIVE ANALYSIS
I found an excellent array of graphics and data for the use of social media within law
enforcement agencies, and how various law enforcement agencies around the country are using it
as a tool to help them deter and solve crime. I have displayed these facts in the body of this paper
and will display them below as well. When illustrating statistics for child exploitation and Dark
Web cases, Europol wrote and designed a report titled a 2018 Internet Organised Crime Threat
Assessment (IOCTA).
Online child sexual exploitation (CSE) continues to be the most disturbing part of
cybercrime. Compared to that of child sexual abuse, which existed before the creation of the
Internet, the online dimension of this crime has enabled offenders to interact with each other
online and obtain child sexual exploitation material (CSEM) in volumes that could not be

43. Tancredi 43
imagined over ten years ago. The growing number of increasingly younger children with access
to Internet devices and social media allows offenders to reach out to children in ways that are
extremely impossible to do without an online environment. This trend has considerable
implications for the modi operandi in the online sexual exploitation of children (Europol, 2018,
p. 30).
The 2014 LexisNexis Social Media Use in Law Enforcement Survey
The 2014 LexisNexis Law Enforcement Social
Media survey centered around how best to
leverage social media as a tool to communicate
information about emergencies, and includes
these findings:

44. Tancredi 44
73% believe using social media helps solve
crime faster, which is up 6% from the 2012
LexisNexis survey. This of course, is much higher
today [2020], which has since been used as an
emergency communication tool during and after
the June 2016 Pulse Nightclub shooting in
Orlando, during and after Hurricane Harvey in
Houston in August 2017, and during and after the
Las Vegas strip shooting in October 2017.
More than a third (34%) now notify the of
crimes through social media, which is up from 11% from 2012. These two-way public
communications alert the public with urgent, real-time information and inform them to be on the
lookout for certain criminal suspects, what cars they drive, including other identifying details
(LexisNexis, 2014, p. 3). Law enforcement personnel have increased their outreach with the
public through social media for help in solving crime, with 29% soliciting crime tips. Law
enforcement agencies also use it to alert the public about emergencies (34%), to establish
positive community and public relations (30%) and to communicate about traffic issues (27%)
(LexisNexis, 2014, p. 3).

45. Tancredi 45

46. Tancredi 46
The majority of law enforcement professionals are predominately self-taught in using
social media for investigations and secondarily seek out colleagues. Formal training had a slight
decrease, with larger decreases in learning from colleagues and using information in community
sites, which includes the media or online (LexisNexis, 2014, p. 7).

47. Tancredi 47
Dark Web Graphics and Statistics
As shown from the 2018 United Nations Office on Drugs and Crime ‘World Drug Report
2018,’ “62 percent of active listings on a selection of darknet marketplaces were drug-related –
48 percent coming under the illicit drugs category” (Armstrong, 2018).
Tor Statistics
Tor is the most popular and well known of its kind, and it has gained world-wide use
from 750,000 Internet users on a daily basis. This is about the size of a small country; half-way
between the Internet populations of Luxembourg and Estonia. Over fifty percent of Tor users
live in Europe, which is also the region with the highest penetration, as the service is used by an
average of 80 per 100,000 Internet users in European countries (Oxford Internet Institute, 2020).

48. Tancredi 48
Italy for example, accounts for 76,000 Tor users a day, which is about one fifth of the
entire European daily Tor user base. Italy is second only to the United States in terms of average
number of users, as over 126,000 people access the Internet through Tor from the United States
every day. The service is popular throughout the whole European region, with a high penetration
in Moldova, as well as less populous states; about a hundred Internet users connect to Tor daily
from each of San Marino, Monaco, Andorra, and Liechtenstein, despite the minor Internet
populations in their countries (Oxford Internet Institute, 2020).
When examining the data of Tor users as a percentage of the large Internet population,
the Middle East and North Africa has the second highest rate of usage, with an average of over
60 per 100,000 Internet users that use the service. Tor is very popular is Israel, which makes up
for more Tor users than India, while having less than 4% of its Internet users. Iran is another
country where Tor is very popular, which accounts for the largest number of Tor users outside
Europe and the United States and makes up for 50% more users than the United Kingdom,
despite only one third of the population on the Internet (Oxford Internet Institute, 2020).
The geography of Tor illustrates how much individuals seek anonymity on the Internet.
As more governments try to control and censor the online activities of their citizens, users face a
choice to either perform their connected activities in ways that abide by government policies or
use anonymity to bring about a freer and more open Internet (Oxford Internet Institute, 2020).
The below cartogram illustrates daily Tor users per 100,000 Internet users:

49. Tancredi 49
Example from Europol - Grams Website
The Grams website launched in April 2014 and was one of the first search engines for
Tor-based darknet markets, designed to resemble and work in a similar way to surface web
search engines. Since the Grams website launched, it has been upgraded many times to improve
the functionally and user
experience. Features have
been added to promote
certain keyword or key
phrase searches, to allow a
bitcoin tumbling/mixing
service, and also provide
easy access to darknet

50. Tancredi 50
markets through redirection and a network for publishers and advertisers. Grams could also be
useful as a point of departure for general research on darknet markets, as it is familiar and
convenient, has a user-friendly interface, and potentially makes the darknet more accessible
(Europol, 2017, p. 21).
Mass Arrests for Child Pornography & Operation UMBRELLA
In 2017, Facebook made a report to the National Center for Missing and Exploited
Children (NCMEC) of videos that depicted a Danish and girl, both 15, who were engaged in
sexual activity. The case was then sent to Denmark via Europol. Over 1,000 people had
distributed the videos to one or more people through Facebook. On January 15, 2018 Danish
Police announced operation UMBRELLA to the public where over 1,000 people (mostly young
people) were charged for the distribution of child pornography according to the Danish Penal
code (Europol, 2018, 32).

51. Tancredi 51
Online Child Sexual Exploitation Material Statistics
One of the most important threats in the online distribution of CSEM is the continuous
increase in the Darknet. Although most CSEM is still found on the surface web, some of the
more extreme content can only be accessed by such hidden services such as the Tor Browser. In
2017 the Internet Watch Foundation (IWF), a UK-based non-profit organization working to
lower the amount of CSEM online, saw a 57% increase in domain names hosting CSEM and an
86% increase in the use of hidden websites. CSEM that is initially shared on the Darknet tends to
eventually find its way to the surface web (Europol, 2018, p. 32).

52. Tancredi 52
This graphic from The Economist, titled Shedding light on the dark web, discusses the
many crimes, especially drug crimes committed on the Dark Web, and the statistics of those
crimes committed as well.

53. Tancredi 53
CONCLUSION
This paper discussed an array of ways that crime and intelligence analysts, including law
enforcement personnel, are investigating and combatting Internet crime using open source
intelligence (OSINT) tools and techniques, which includes child pornography sites on the Dark
Web as well. This paper examined both social media and social network analysis (SNA), and
how SNA is used to connect various criminal networks.
One of the best tools for analysts discussed in this paper has been SNA, because of the
way it “connects the dots.” By design, SNA has connected various criminal organizations, and
allows the analyst to use an array of different tools in the software to group members of these
groups together, how they are connected, who they are, what level they are connected through,
and allows the analyst to use keywording for each group member as well.
It discussed software and a study in the United Kingdom, called ePOOLICE (early
Pursuit against Organised Crime using environmental scanning, the Law and IntelligenCE
systems), which is used to track organized crime, which in this case, was human trafficking. This
tool primarily scanned and examined social media sites, in the case for this paper, were human
trafficking posts to Twitter.
This paper looked at the Tor Browser and how it is used to access the Dark Web, and the
illicit crimes, especially child pornography, which were committed through a host of Dark Web
sites, such as Playpen and Lolita City. It discussed how law enforcement agencies are enlisting
the aid of tech savvy volunteers who were able to interdict cybercriminals who are involved in
the creation and utilization of child porn web sites.
The research presented in this paper illustrates that technology has allowed crime and
intelligence analysts, as well as law enforcement officers, the opportunity to provide more

54. Tancredi 54
accurate results and better information when it comes to combatting and investigating Internet
crimes. It has allowed analysts to “connect the dots,” and will be a timelier way of navigating
through electronic investigations, but along the journey of writing this paper, it has allowed me
to grow as an individual for a future role in a crime analyst or criminal intelligence position.
As I was doing the research for this capstone, such as basic and advanced information on
the Tor Browser, anonymous Internet searches, open source intelligence (OSINT), forensic
analysis software, social media and social network analysis, as well as Dark Web crimes, I took
and completed the Certified Cryptocurrency Investigator (CCI) credential from Blockchain
Intelligence Group, which is a certification program that trains the student on the basics of
cryptocurrency and blockchain, how they works, how criminals use cryptocurrency to commit
crimes and go undetected on the Tor network, the three layers of Internet, the illicit drug buying
markets on the Dark Web, and much more.

55. Tancredi 55
If there is anything that I took away from the extensive research I have done for this
capstone project and from the CCI training I took, is that there is much more that I have to learn.
This is not only true on a technical aspect, but on a social aspect as well. When looking at this
from a stakeholder’s position, nothing bothers the public more than a crime against children,
especially when criminals are able to hide behind the “cloak of online anonymity.”
OSINT is a balance of a strong technical skill set and sharp attention to detail, with all the
“noise” that exists on the three layers of the Internet in this era of overstimulation. Just as social
media and smartphones have changed the process of public safety communication, especially
with the accessibility such as the Tor Browser, social media sites, and various OSINT sources
freely available to the public. This cannot be more true than the recent upset in Minneapolis and
riots and protests in major cities around the country over a man who was killed by a police
officer who put his knee on a man’s neck while he was handcuffed, with two other officers
already restraining him.
Criminals, similar in ways to the four police officers that were recorded in Minneapolis,
have a harder time hiding their crimes, because of the work of expert technical analysts and
White-Hat hackers. In the paper, I spoke about various law enforcement agencies using
volunteers to work certain cybercrime and child exploitation cases. With the current mass riots in
our country, law enforcement agencies may have to start turning to volunteers again, because law
enforcement agencies are more than likely time constricted on developing and sharing
intelligence dissemination for officers, troopers, fusion centers, and interagency coordination
assistance.
When I was working on my undergraduate degree at Barry University in South Florida, I
had classes with a lot of police officers and deputies, because we were all in the Public

56. Tancredi 56
Administration program. I learned much from them, and know not all cops are bad or out to
arrest everyone. Although, when I worked as a security officer at a mall and seaport in South
Florida, most of the officers that worked on shift, did not want anything to do with security
officers. What does this have to do with OSINT? A lot! Look at how fast the Minneapolis Police
Department caught bad press over the last week.
Word spread quickly across the Internet, and in an age of contention between police and
citizens, online media wars are never a good thing. Overall, every member of the public is
stakeholder who has contact with the police, because social media and Dark Web sites are
unforgiving, and once the crimes and misdeeds of others spread online, there is no way of taking
them back. I found this video of a brief interview with a TX DPS Trooper a while ago, and it
represents what real policing is supposed to be.
Industry Analyst at Altimeter Group Susan Etlinger said it best, “Cyberattacks, doxing,
and trolling will continue, while social platforms, security experts, ethicists, and others will
wrangle over the best ways to balance security and privacy, freedom of speech, and user
protections” (Pew Research Center, 2017). Moreover, a rare quote from Napoleon Bonaparte
states, “Crime is as contagious as the pest; you can’t commit it without having to pay for it.”
How true the social media era made that for criminals!

57. Tancredi 57
WORKS CITED
Acar, K.V. “OSINT by Crowdsourcing: A Theoretical Model for Online Child Abuse
Investigations.” International Journal of Cyber Criminology. 12(1), 2018 January-June
2018, pp. 206-229. DOI: 10.5281/zenodo.1467897.
Alston, J.D. and Kathleen M. Gallagher. “Understanding Criminal Behavior.” Exploring Crime
Analysis: Readings on Essential Skills, Edited by Kathleen Gallagher, Julie Wartell,
Samantha Gwinn, Greg Jones, and Greg Stewart, 3rd Ed. Scotts Valley, CA, CreateSpace,
2017, p. 50.
Altvater, B.J. “Combatting Crime on the Dark Web.” The Prosecutor. 2017 December. pp. 1-10.
Andrews, S., Ben Brewster, and Tony Day. “Organised crime and social media: a system for
detecting, corroborating and visualizing weak signals of organized crime online.” Security
Informatics. 7(3), 2018, pp. 1-21. http://doi.org/10.1186/s13388-0032-8.
Armstrong, M. “Drugs Dominate the Darknet.” Statista. 27 June. 2018.
https://www.statista.com/chart/14464/drugs-dominate-the-darknet/.
Berlusconi, G., Francesco Calderoni, Nicola Parolini, Marco Verani, and Carlo Piccardi. “Link
Prediction in Criminal Networks: A Tool for Criminal Intelligence Analysis.” PLOS ONE.
11(4), 22 April 2016, pp. 1-21. DOI: 10:1371/journal.pone.0154244.

58. Tancredi 58
BrainyQuote. Edmund Burke Quotes.
https://www.brainyquote.com/quotes/edmund_burke_377528. 2020. Web. 9 April. 2020.
Europol. “Drugs and the darknet: Perspectives for enforcement, research and policy.” Europol.
pp. 1-90. https://www.europol.europa.eu/publications-documents/drugs-and-darknet-
perspectives-for-enforcement-research-and-policy.
Europol. “Internet Organised Crime Threat Assessment.” Europol. 2018, pp. 1-72.
https://www.europol.europa.eu/internet-organised-crime-threat-assessment-2018.
FBI. “’Playpen’ Creator Sentenced to 30 Years.” FBI. 5 May. 2017.
https://www.fbi.gov/news/stories/playpen-creator-sentenced-to-30-years.
Finklea, K. “Dark Web.” Congressional Research Service. 10 March. 2017, pp. 1-19.
https://fas.org/sgp/crs/misc/R44101.pdf.
Government Technology News Staff. “Solving Crime with Social Media (Infographic).
Government Technology. 12 March. 2013. https://www.govtech.com/public-safety/Solving-
Crime-with-Social-Media-Infographic.html.
Hollywood, J.S., Michael J., D. Vermeer, Dulani Woods, Sean E. Goodison, and Brian A.
Jackson. “Using Social Media and Social Network Analysis in Law Enforcement.” RAND
Corporation, 2018, pp. 1-28. https://www.rand.org/pubs/research_reports/RR2301.html.

59. Tancredi 59
Iqbal, F., Benjamin C.M. Fung, (Senior Member, IEEE), Mourad Debbabi, Rabia Batool, and
Andrew Marrington. “Wordnet-Based Criminal Networks Mining for Cybercrime
Investigation”. IEEE Access. 7, 2019, pp. 22740-22755. DOI:
10.1109/ACCESS.2019.2891694.
Jardin, E. “Privacy, censorship, data breaches and Internet freedom: The drivers of support and
opposition to Dark Web technologies.” New Media and Society. 20(8), 2018, pp. 2824-2843.
DOI: 10.1177/1461444817733134.
Jones, G. and Samantha Gwinn. “Police Data and Crime Analysis Data Sources.” Exploring
Crime Analysis: Readings on Essential Skills, Edited by Kathleen Gallagher, Julie Wartell,
Samantha Gwinn, Greg Jones, and Greg Stewart, 3rd Ed. Scotts Valley, CA, CreateSpace,
2017, pp. 41-42.
LexisNexis. “Social Media Use in Law Enforcement: Crime prevention and investigative
activities continue to drive usage.” 2014 November, pp. 1-8.
https://centerforimprovinginvestigations.org/wp-content/uploads/2018/11/2014-social-
media-use-in-law-enforcement-pdf.pdf.
Mills, G. “Police Data and Crime Analysis Data Sources.” Exploring Crime Analysis: Readings
on Essential Skills, Edited by Kathleen Gallagher, Julie Wartell, Samantha Gwinn, Greg
Jones, and Greg Stewart, 3rd Ed. Scotts Valley, CA, CreateSpace, 2017, pp. 87,102.

60. Tancredi 60
Moore, D. and Thomas Rid. “Cryptopolitik and the Darknet.” Survival. 58(1), 2016 February-
March, pp.7-38. DOI: 10.1080/00396338.2016.1142085.
Oxford Internet Institute. “The Anonymous Internet.” University of Oxford. 2020.
http://geography.oii.ox.ac.uk/the-anonymous-internet/.
Pew Research Center. “Shareable quotes from experts on the future of online public discourse.”
Pew Research Center. 2017 March. 29.
https://www.pewresearch.org/internet/2017/03/29/shareable-quotes-from-experts-on-the-
future-of-online-public-discourse/.
Police Executive Research Forum. “Social Media and Tactical Considerations for Law
Enforcement.” Office of Community Oriented Policing Services, U.S. Department of Justice,
2013, pp. 1-60. https://it.ojp.gov/CAT/Resource/158.
Requiao da Cunha, B., Padraig MacCarron, Jean Fernando Passold, Luiz Walmocyr dos Santos
Jr., Kleber A. Oliveira, and James P. Gleeson. “Assessing police topological efficiency in a
major sting operation on the dark web.” Scientific Reports, 10(73), 2020, pp. 1-10.
http://doi.org/10.1038/s41598-019-56704-4.
Routley, N. “The Dark Side of the Internet.” Visual Capitalist. 8 July. 2017.
https://www.visualcapitalist.com/dark-web/.

61. Tancredi 61
Santos, Rachel B and Cheryl Davis. “Police Data and Crime Analysis Data Sources.” Exploring
Crime Analysis: Readings on Essential Skills, Edited by Kathleen Gallagher, Julie Wartell,
Samantha Gwinn, Greg Jones, and Greg Stewart, 3rd Ed. Scotts Valley, CA, CreateSpace,
2017, pp. 84-85.
State, Local, and Federal Law Enforcement and Homeland Security Partners. Real-Time and
Open Source Analysis (ROSA) Resource Guide. July 2017, pp. 1-52.
https://it.ojp.gov/GIST/1200/Real-Time-and-Open-Source-Analysis--ROSA--Resource-
Guide.
The Economist. “Shedding light on the dark web.” The Economist. 16 July. 2016.
https://www.economist.com/international/2016/07/16/shedding-light-on-the-dark-web.
Tor | Metrics. “Traffic.” The Tor Project. 2018. https://metrics.torproject.org/uncharted-data-
flow.html.