Policing the Onion Router (Tor) crypto-markets on the dark web: An analysis of South African investigatory powers

• Citation: (2023) 36 SACJ 406
• DOI: https://doi.org/10.47348/SACJ/v36/i3a3
• Published date: 13 March 2024
• Pages: 406-433
• Author: Reddy, E.
• Date: 13 March 2024

Policing the Onion Router (Tor)

crypto-markets on the dark web:

An analysis of South African

investigatory powers

EVESHNIE REDDY*

ABSTRACT

Emerging nancia l technology (ntech), such as cryptoc urrencies and

privacy-enhanc ing technology (pets) such as the Onion Router (Tor),

enable varying levels of anonymit y or pseudonymity base d on underlying

encryption algorit hms. These technologie s are increasingly exploited by

cybercrim inals for nefarious pur poses on the dark web. Thi s has resulted

in the so-ca lled tor crypto -markets that facilit ate ‘digital organised cr ime.’

Thus, albeit not inherent ly criminogen ic, encryption const itutes a barrier

to crimina l investigation. This ar ticle discusses t wo specic methods t hat

police use to investigate and prosecute c riminals operating on the da rk web,

through the use of hack ing tools in the context of: (1) online undercover

cybersur veillance operations; and (2) remote search and seiz ure. These

methods differ i n both scope and complexity and , importantly, bear

distinct legal, tech nical, and ethica l consequences that have yet to confront

South Africa n courts. As a resu lt, these methods, in t he context of dark

web investigations, have not previously been considered i n South Africa n

literature, but have received signi cant analysis in the Un ited States, the

Netherlands, and Austra lia. These method s will be disc ussed in the context

of South Africa n investigatory powers in order to deter mine whether there

is a legal basis for its operation.

1 Introduction and background

Encryption technology is vital for safeguarding data, upholding the

right to privacy, and promoting cybersecurity. Modern encryption

technologies, as necessitated by the global reliance on computers,

utilise what is known as ‘encryption or cryptographic algorithms’

to encode clear-text data into cipher-text. T his ensures that only

* BCrim (Hons) (UKZN) M Tech (Unisa); Senior L ecturer, Depar tment of Criminology

and Securit y Science, School of Cri minal Justic e, Unisa. This a rticle forms pa rt

of research under taken towards the author ’s PhD study. I would like to thank

the anonymous reviewers for t heir construc tive and insightf ul comments and

suggestions.

https://doi.org/10.47348/SACJ/v36/i3a3

406406

(2023) 36 SACJ 406

© Juta and Company (Pty) Ltd

the intended recipient can access, read, or understand the data.1 In

computer science, this is embodied in the principles of condentiality,

integrity and availabilit y of information (CIA triad). The CIA triad is

essential for the proper functioning of information-communication

technologies (ICTs) and the global digital economy at large.2

Emerging nancial technology (ntech),3 such as cryptocurrencies4

and privacy-enhancing technology (PETS),5 such as the Onion Router

(Tor), enable varying levels of anonymity or pseudonymit y6 based

on underlying encryption algorithm s. Tor remains the most popular

one of many specialised encryption technologies7 that enables access

to the outermost layer of the internet known as the ‘dark web’8 or

‘dark net’. In contrast to the surface web, the dark web is a part of

the internet that is not indexed by search engines such as Google.

Tor was developed decades ago by the Center for High Assurance

Computer Systems (CHACS) of the United States Naval Laboratory to

allow intelligence agencies to communicate anonymously.9 Since 2006,

Tor has been available to the public as a free download via the Tor

Project, a non-prot organisation.10 Tor is thus a legitimate technology

1 E Reddy and VA Lawack ‘An overview of t he regulatory developments regardi ng the

use of cryptoc urrencies in South Afric a’ (2019) 31 SA Merc L J 5; W Schulz and J van

Hoboken Human Rights an d Encryption (2016) 1 0.

2 See S Sam onas and D Coss ‘T he CIA strikes b ack: Redening con dentialit y,

integrity and ava ilability in security ’ (2014) 10 J Info System Security 21 -45.

3 The ter m, ‘ntech’, broadly refers to the use of technology in  nancial applications.

On ntech, see VA Lawack and AC Puja ‘Intr oduction: Sett ing the scene for the

discourse on nte ch law and regulation i n Africa’ in VA Lawack (ed) Fintech Law

and Regulation: An African Perspe ctive (2023) 5-9.

4 Als o referred to as ‘cryp to assets’. See Intergovernme ntal Fintech Working Group

‘Position paper on cry pto assets’ (2021). On cr yptocurrencies, see Redd y and Lawack

op cit (n2) 9-10.

5 On PETS, s ee K Seamons ‘Privac y-enhancing technologies’ in BP K nijnenburg et al

(eds ) Moder n Socio-Technical Perspectives on Priva cy (2021) 165, 149-170. See also

MS Olivier ‘A layered architect ure for privacy-en hancing technolog ies’ (2003) 31

SAfr Computer J 54.

6 See A Pt zmann and M Han sen ‘A terminology for tal king about privac y by

data mini mization: anonym ity, unlinkabi lity, undetectabi lity, unobservabil ity,

pseudonymity, and identit y management’ (2010), available at https://dud.inf.

tu-dresden.de/literatur/Anon_Terminology_v0.34.pdf, accessed 2 December 2021.

7 See ‘10 best da rk / deep web browsers for anonymit y’ SOCRadar, 20 May 2020,

available at https://socradar.io/10-best-dark-deep-web-browsers-for-anonymity/,

accessed on 23 November 2023; E Redd y and A Minnaa r ‘Cryptocu rrency: A tool

and target for cyber crime’ (2018) 31 Acta Criminologica 71 at 75.

8 Thi s article uses the term ‘dark web’.

9 D Kaval lieros et al ‘Underst anding the dark web’ i n B Akhgar (eds) Dark Web

Investigation (2021) 3 at 8-9; RW Gehl The Da rk Web: Legitimacy of Fre enet, Tor,

and I2P (2018).

10 The Tor Project ‘Histor y’ (2023), available at https://ww w.torpr oject.org, accessed

31March 2022.

Policing the Onion Router (Tor) crypto-markets on the dark web:

An analysis of South African investigatory powers 407

https://doi.org/10.47348/SACJ/v36/i3a3

© Juta and Company (Pty) Ltd