Coordinated Bust of Dark-Web Dealers Yields 150 Arrests in U.S., Europe

“Since the onset of the Covid-19 pandemic, more people have turned to the darknet than ever before to buy drugs,” Deputy Attorney General Lisa Monaco said Tuesday in detailing the results of the 10-month investigation. “Already was a billion-dollar illicit drug industry. But darknet drug revenue has surpassed pre-pandemic levels, with much of the sales occurring on social-media platforms.”

The darknet is a network of websites that uses anonymity software to hide users’ locations. Users on darknet forums use cryptocurrency to pay for illegal goods such as drugs, or services such as malware for cyberattacks, making it difficult for investigators to track them down.

Authorities gathered evidence from previous international cybercrime cases, including an operation that took down the DarkMarket marketplace in January. At that time, German authorities arrested the marketplace’s alleged main operators after they entered the country from Denmark. German police seized servers in Ukraine and Moldova that were used to run the marketplace.

Most of the arrests announced Tuesday took place in the U.S. and Germany, authorities said, noting that a number of investigations were still under way. The Justice Department is working with authorities in other countries to extradite people to the U.S., Ms. Monaco said.

“With such operations based on information sharing, trust between partners and international coordination, we are sending a strong message to these criminals on the dark web,” said Jean-Philippe Lecouffe, the deputy executive director of Europol, the European Union’s law-enforcement agency. “No one is beyond the reach of law, even on the dark web.”

Drugs seized as part of the probe included 152.1 kilograms of amphetamine and smaller amounts of cocaine, opioids and prescription painkillers. Authorities said they were especially disturbed by the sale of counterfeit pills laced with the potentially deadly synthetic opioid fentanyl. Investigators discovered darknet vendors running labs at home to create the fake tablets resembling prescription painkillers, Ms. Monaco said.

Joint investigations among authorities in different countries can take a long time as police need legal agreements to share evidence across borders and cybercrime investigators often piece together data from a variety of sources to identify people who use software to hide their locations, said Steven J. Murdoch, a professor of security engineering at University College London.

“It’s unlikely one breakthrough will give you everything you want, it’s a matter of pulling the thread,” he said.

Similar techniques to identify those who buy and sell illegal items on the darknet could also help police find affiliates of cybercrime groups that sell ransomware on darknet forums, said Brian Honan, executive director of BH Consulting, a Dublin-based firm that advises companies, including after ransomware attacks. Many victims don’t report ransomware attacks to police, preventing authorities from gathering data that could help to identify perpetrators.

“If those pieces aren’t being shared so they can be put together, they won’t be able to identify who’s behind this,” he said.