The users of the Dark Web forums have a strong need to effectively communicate with other members while protecting their privacy. Theoretically, there is a tradeoff between online self-disclosure and privacy protection. Inspired by the seminal research of social penetration theory (Altman and Taylor, 1973) and communication privacy management theory (Petronio, 2002), as information exchanges increase, there is a higher possibility that user identities in real life could be revealed. Social interactions also play a competing role in privacy calculus (Jiang et al. 2013; Krasnova et al. 2010; Laufer and Wolfe, 1977). For example, Lewis et al. (2008) show that people’s taste for privacy is shaped by both social influence and personal motives. When the cumulative risk is larger than the future benefit, the user has to leave the community. The question pertains to how they smell the danger. We argue that there exists a prospective theoretical puzzle in explaining anonymous users’ withdrawal behaviors: which of the two factors, information intensity or network connectivity expose anonymous users? By tracking how users leave the forums on the Dark Web, we can take a close look on the mechanisms of social penetration and privacy management in a fully anonymous setting.
Prior research on the Dark Web has left notable gaps that this study aims to fill. First, the bulk of empirical investigations into the Dark Web has predominantly centered on its economic dimensions, particularly focusing on operations within Dark Web markets, as demonstrated by a range of studies (Aldridge and Decary-Hetu, 2016; Barratt and Aldridge, 2016; ElBahrawy et al. 2020; Hardy and Norgaard, 2016; Martin, 2014b; Paquet-Clouston et al. 2018). Nevertheless, there is a scarcity of studies that have approached the Dark Web from a communication standpoint. This fully anonymous environment offers a communication context markedly distinct from traditional online communities on the Internet, characterized by unique patterns of online interaction. Second, while qualitative and critical studies have explored and discussed the potential and social implications of the Dark Web technology (Bancroft and Reid, 2017; Maddox et al. 2015; Martin, 2014a; Munksgaard and Demant, 2016; Pace, 2016; Sotirakopoulos, 2018; Tzanetakis et al. 2016), very few studies have ventured into investigating online behavior with behavioral logs. Third, prevailing theories have predominantly centered on the social penetration of close relationships, but the intricacies of how individuals manage their privacy in fully anonymous social settings warrant more extensive exploration. The dynamics of how users on the Dark Web interact while remaining hidden in the shadows remain under-examined in the existing literature, offering potential theoretical contributions to the domains of anonymous communication and group socialization. Fourth, while existing theories have indeed identified various factors contributing to social penetration, such as culture, gender, motive, context, and the risk-benefit ratio, their relative importance has not been subjected to comprehensive comparative examination (Altman and Taylor, 1973; Petronio, 2002). We aim to fill these gaps and provide valuable insights into the Dark Web’s communication dynamics, user interactions, and the different aspects of factors influencing them.
This study aims to bridge these research gaps by delving into the communication dynamics of the Dark Web and exploring online behavior through behavioral logs, offering a fresh perspective on this unique digital realm. First, by conceptualizing the cryptomarket forums as anonymous online communities, the study examines the sustainability of user activities within this context. Second, through investigating patterns and mechanisms within this unique online communication environment, we aim to enhance our understanding of user online behavior and the dynamics of group socialization in anonymous online communities. Third, utilizing online behavioral data from cryptomarket forums, the study investigates how language usage and online social networks influence the long-term usage of these forums. The overall findings of this study have substantial implications for understanding group dynamics and anonymous online communities.
In the following sections, we will begin by introducing the Tor network, the Dark Web, and the cryptomarket, which serve as the research contexts for this study. Subsequently, we will provide a comprehensive review of the theoretical perspectives on technical anonymity and anonymous communication in online communities. Furthermore, we will formulate two research questions pertaining to the potential factors influencing users’ engagement in anonymous online communities. Using data collected from the digital traces of online user behavior, we will assess talkativeness, linguistic diversity, and online leadership within the online social network. Survival analysis will be employed to examine the relationships between these potential factors and user engagement in Dark Web marketplaces. Lastly, we will discuss the implications of the research findings.
Tor, dark web, and cryptomarket forums
The Tor (The Onion Router) network is a special type of network that is only accessible through the Tor browser. Just like the name “The Onion Router” goes, the structure of the Tor network is analogical to an onion, which consists of a group of relays operated by volunteer individual users or non-profit organizations. The relays work as a series of virtual tunnels for connecting the information provider (sender) and user (receiver). Therefore, the traffic on the Tor network could be hidden and encrypted by multiple layers and routed between different relays multiple times. With this careful design, user identities are fully anonymized and untraceable on the Tor network. In summary, the Tor anonymity network has provided a convenient way to be extremely anonymous in some special application contexts, which to some extent becomes an important alternative ecosystem on the Internet, usually known as the Dark Web. The primary emphasis of this study will center on user behavior within the Dark Web forums, with a specific focus on the forums associated with the cryptomarket.
Many anonymous services and websites hosted on the Dark Web contain unethical content (e.g., pedophilia and child pornography) and online criminal activity (e.g., drug markets, financial fraud, illegal weapons, and espionage) (Biryukov et al. 2014; Biryukov et al. 2013; Guitton, 2013; Soska and Christin, 2015). Among them, the marketplaces have been highly prosperous since 2011, formally known as cryptomarkets (Martin, 2014b). Cryptomarket is a special type of online market hidden on the “Dark Web”. The technical basis of the Tor anonymity network has made anonymity a fundamental feature of how cryptomarkets are constructed and function as markets and as communities (Bancroft and Reid, 2017). In cryptomarkets, users are highly anonymized and well protected by the onion-routing technology behind the Tor network, which creates a very different space for communicating and trading with each other in many aspects of the communication process. Moreover, most cryptomarkets not only present and sell various products but also provide a forum for users to discuss valuable topics during the whole purchase process, such as the usage of the website, delivery of the products, and vendors’ ratings. The market-affiliated forums have provided great opportunities for researchers to analyze user behavior in anonymous online communities. With the advanced privacy-enhancing technologies employed to protect user identities, cryptomarkets have shown great potential in changing the landscape of global drug distribution networks, leading to worldwide opportunities for drug consumers and challenges for law enforcement (Nugent, 2019).
Starting from 2011, there have been several prosperous cryptomarkets, created and operated widely around the whole world through the Tor anonymity network. As one of the most popular types of services on the Tor network, in most cases, the cryptomarkets will provide affiliated forums for users to discuss the purchase process, the usage of the website, delivery of the products, vendors’ ratings, etc. Topics discussed in the forums typically center around sense-making, technical difficulties, purchase processes, logistic issues, vendor and product reviews, and cyber security issues (Hazel Kwon and Shao, 2020; Porter, 2018). As the technical design of the Tor network has made anonymity a fundamental feature of the cryptomarket forums, users are highly anonymized and well protected by the onion routing technology behind the Tor network, which creates a very different space for communicating and trading with each other in many aspects of the communication process (Bancroft and Reid, 2017). Therefore, the cryptomarket-affiliated forums have provided great opportunities for researchers to analyze users’ online behavior in a fully anonymous setting. In this study, Dark Web forums are examined as anonymous online communities.
Technical anonymity versus social anonymity in online interactions
Theoretical works in anonymous communication and organizational communication argue that there are several types and dimensions of anonymity, e.g., technical anonymity versus social anonymity, physical anonymity versus discursive anonymity, and self-anonymity versus other-anonymity (Rains and Scott, 2007; Scott, 1998; Scott et al. 2011). In the context of the Dark Web, it is especially important to clarify the technical anonymity and social anonymity provided by privacy-enhancing technologies. As previously introduced, technical anonymity is well ensured by the design of the onion routing network. However, this only provides part of the guarantees for user identity. Tor networks can’t solve all anonymity problems. Tor network only focuses on protecting the data transmission procedure. There could still be potential risks caused by inappropriate online behavior by the user of the Tor network. Although technically well protected, making no chances for third-party tracking and surveillance, every user must be vigilant and careful about their self-disclosure when using the Tor network to ensure a high level of anonymity.
Technically, it is always possible to infer user identity from their social interactions and group socialization process with other people (Al Jawaheri et al. 2020; Biryukov et al. 2013). On the normal websites on the World Wide Web such as social networking sites, the group socialization process naturally occurs everywhere and never stops. Assisted by rapidly developed Web technologies, people can now share various types of content, e.g., text, photo, voice, video, etc. with others in a short time at almost any place. The enormous data about social interactions exposed on social media has already provided enough information for user identification and personality prediction, even without directly tracking users’ IP addresses (Kosinski et al. 2013; Stachl et al. 2020). This could make a huge impact on Dark Web users. Any casual leak of personal information may lead to vital consequences, especially for some controversial or illegal activities. For example, the founder of Silk Road, Ross Ulbricht, got caught and arrested by law enforcement only because he had once accidentally exposed his personal email address on the Dark Web. Therefore, the Dark Web users are consistently faced with a social dilemma between self-disclosure (social interactions) and privacy protection (social anonymity) during the entire group socialization in anonymous online communities.
Much like conventional counterparts such as Reddit, which have attracted the attention of researchers across various disciplines in recent years (Medvedev et al. 2019; Parmentier and Cohen, 2019; Seering et al. 2019), the cryptomarket forums primarily serve as platforms for discussion and social interaction, enabling individuals with shared interests or opinions to engage over the Internet, all without face-to-face contact. Notably, Dark Web forums exhibit significant differences from mainstream online platforms like Reddit. Firstly, Dark Web users typically have limited real-life or offline social connections, leading to natural disconnection and separation among its users, unlike popular social networking sites such as Facebook and Twitter, which heavily rely on offline social relationships. Moreover, Dark Web access requires sophisticated technology and carries a high entry threshold, challenging ordinary users. Consequently, Dark Web users tend to be more motivated and active compared to users on mainstream social media platforms. The elevated entry requirements attract individuals with specific needs for a high degree of anonymity, often driven by economic incentives, which may be illegal or unethical. Lastly, although the Dark Web is perceived as an environment conducive to anonymous online interactions, achieving technical anonymity does not ensure complete social and perceived anonymity, as cautioned by the theory of anonymous communication. Users must exercise care in their online self-disclosure to prevent inadvertent disclosure or inference of private information during online social interactions.
In summary, the Dark Web forums differ from common online forums in terms of social connections, user motivation, and the need for anonymity. Understanding these distinctions is crucial for comprehending the dynamics of Dark Web communities and the unique challenges associated with online interactions in this context. Just like all communities, the first step for every user of anonymous online communities is to join the group. Then the new members need to learn the group norms through social interactions and communication with each other. Theoretically, the whole group socialization process can be categorized into five phases (Levine and Moreland, 1994; Moreland and Levine, 1982), namely investigation (entry), socialization, maintenance (acceptance), resocialization (divergence), and remembrance (exit). A successful socialization process could lead to good acceptance of the newcomers into the group, while a failed socialization process will just result in divergence of the group and the worst case is that the group member exit from the group. In this sophisticated process, the most important outcome and consequence is exit behavior, which completely ends all the social interactions between the group members.
User engagement in anonymous online communities
From the perspective of media use, one of the most important research questions is how and why users use and continuously use online communities as a media platform to communicate with others. As anonymity is an important affordance of computer-mediated communication, which could lead to substantial implications and consequences (Bancroft and Reid, 2017; Scott and Rains, 2020; Scott et al. 2011; Woo, 2006), this study pays special attention to the use and sustainable use of online communities in a fully anonymous setting, i.e., the anonymous online communities. Therefore, the exit behavior (or user sustainability in contrast way) on the Tor network is a focal variable in this study.
There has been a large body of research on continuance behavior in information systems. Bhattacherjee (2001) claims that users’ continuance intention is determined by their satisfaction with the IS (information system) use and the perceived usefulness of continued IS use. Limayem and Cheung (2008) expanded Bhattacherjee’s IS continuance model by adding a moderating effect (IS habit) to IS continuance intention and IS continued usage. Bhaskar et al. (2019) decomposed the perceived usefulness into the perceived quality and perceived usability. In the context of open-source software (OSS) development, Wu et al. (2007) find that developers’ feelings of satisfaction and their intentions to continue with OSS development were influenced by both helping behavior and economic incentives. Jin et al. (2010) find that users’ continuance intention to participate in an online community is determined by both satisfaction and affective commitment.
On the Dark Web, Christin (2013) has analyzed the survivability of both users and products on the market of Silk Road 1 and found that about half of the sellers leave the site within 100 days of initial appearance; around a fifth of the sellers stay for less than three weeks. Most of the sellers will disappear within roughly three months since their arrival. Only a core of 112 sellers has been online throughout their whole observation interval. Similar findings were replicated on another 16 cryptomarkets from 2013 to 2015, including Silk Road, Agora, and Evolution (Soska and Christin, 2015) and also OpenBazaar (Arps and Christin, 2020). All the empirical observations indicate that vendors usually hold low stocks and operate primarily in the retail space, with small product quantities, low sales volumes, and a short lifetime in the cryptomarkets. These previous works have already paid attention to survival analysis on the cryptomarket ecosystems but are majorly limited to the analysis of products and vendors. Also, most of the work stops at describing the estimated Kaplan-Meier curve (the K-M curve), which only depicts the decaying process of user and vendor lifetime without further explorations on the potential explanations.
As most of the data collected on the cryptomarket forums are user behavior logs in the form of text on the webpage, it is necessary to develop various methods and strategies to characterize users’ behavior according to the content they produced (Bagozzi and Dholakia, 2002; Chen and Liu, 2021). Previous studies have claimed that both language use and online social networks on the Dark Web demonstrate different patterns from the normal platforms on the Internet. For example, Choshen et al. (2019) find that the text related to legal and illegal activities on the Dark Web is different from each other in terms of not only word use but also shallow syntactic structure (represented through POS tags). Further, Zamani et al. (2019) examined the differences in the structure and dynamics of networks in both dark and public web forums. They find that the degree distribution in public forums is much more homogeneous than in Dark Web forums and even “semi-dark forums” (e.g., 8chan). Therefore, both language use and online social network characteristics should be considered when trying to understand user behavior in anonymous online communities.
Linguistic diversity and talkativeness
Language use can be used to reflect and infer many characteristics of the users, from the psychological process, e.g., affective processes and perceptual processes, to social processes, e.g., social concern and social support (Tausczik and Pennebaker, 2010). Among the psychological meanings of language use, Batikas and Kretschmer (2018) found that negative emotion is highly correlated to exit behavior in the Agora market. In other words, entrepreneurs with a high share of negative feedback are much more likely to exit the market. This finding is consistent with another work by Bhaskar et al. (2019), who also find that sellers with poor ratings are significantly more likely to exit. The finding is further confirmed across several different cryptomarkets, including Silk Road 2.0, Agora, Evolution, and Nucleus. All the previous findings suggest that online illegal markets function in a similar way to legal markets—the economic performance is significantly harmed by negative ratings. Since negative ratings and comments under the vendor profiles in the anonymous online communities play essential roles in the group socialization process, we give special focus on the user sentiment when exploring the factors that explain the user survivability from textual features. Therefore, we propose the following research question:
RQ1: What is the relationship between the user’s language use and exit behavior in anonymous online communities?
Online leadership in social network
Social network plays important roles in shaping markets, either online or offline (White, 1981). Previous studies on cryptomarkets show that buyers tend to exit the market instead of retaliation against sellers after negative experiences in social interactions with others (Norbutas et al. 2020). In many different types of online communities, social rewards such as enjoyment and reputation are important predictors of continuous engagement (Nov et al. 2010; Zhang et al. 2020). Also, social support (e.g., emotional support and informational support) gained from the online social network on the online communities could further motivate the user to keep staying in the online group, especially for health-related communities (Wang et al. 2017; Wang et al. 2012). From the perspectives of online influence and leadership, the more central position a user occupies in the network, the more likely he/she would become the leader and have more influence in the community, which could further enhance the commitment to the group (Huffaker, 2010; Johnson et al. 2015). Based on all the considerations, we propose the second research question:
RQ2: What is the relationship between the user’s position in online social networks and exit behavior in anonymous online communities?
