Study Claims 80% of Tor Traffic Related to Child Abuse

More than 80 percent of ‘dark net’ traffic is to sites hosting child-abuse content, according to a University of Portsmouth study of Tor ‘hidden services’ websites but some researchers have pointed out possible skewed results in the findings.

The study’s findings were revealed at the recent Chaos Computer Congress in Hamburg. Using Tor’s technology to hide their addresses from search for a period of six-months, researcher Dr Gareth Owen analyzed traffic to dark web sites to understand the kind of sites that were the most popular.

Wired reported on the conclusion that sites with child abuse material only account for two percent of the sites on the dark net, but for 83 percent of visits. This means child abuse sites are browsed five times as often as other sites with other types of content examined during the study relating to drugs, bitcoin, whistle blowing, and gambling.

“When we found this out we were stunned,” the researcher admitted. “This is not what we expected at all.”

“Before we did this study, it was certainly my view that the dark net is a good thing. But it’s hampering the rights of children and creating a place where paedophiles can act with impunity.”

Some dark net sites, such as the now closed Silk Road 2.0 that are accessed through encrypted browsers like Tor, try to impose measures to curb child abuse content.

Owen stated in his report that crawlers set up by law enforcement agencies may be responsible for a steady stream of visits to such websites as part of their investigations.

“What proportion are people and which are something else? We simply don’t know.”

The study also found that these sites tend not to stay up for very long. It was reported that a number of Tor websites exist only for days or weeks before disappearing. Less than one-in-six of the 80,000 websites monitored during the search stayed online for the six-month period.


How Tor Responded

Nick Matthewson, researcher, director and chief architect of Tor, explained in a blog post that the study might have observed a disproportionate number of hidden services directory requests.

He wrote:

“Basically, a Tor client makes a hidden service directory request the first time it visits a hidden service that it has not been to in a while. If you spend hours at one hidden service, you make about one hidden service directory request. But if you spend one second each at 100 hidden services, you make about 100 requests. Therefore, obsessive users who visit many sites in a session account for many more of the requests that this study measures than users who visit a smaller number of sites with equal frequency.”

He further stated that data collected by the researchers could reveal more about the surfing habits of a particular group of Tor users, rather than the reality of the network’s traffic.

In November 2014, project director for Tor Andrew Lewman went over possible ways that more than 400 hidden services on dozens of servers were located by law enforcement in the Operation Onymous phase. Some of the servers were indeed related to criminal activity, such as Silk Road 2.0, but others were not – and these were acting as infrastructure for Tor’s anonymity network.

It was also revealed in 2013 that a sudden Tor network overload could be associated with a large botnet. Coinciding with the uptick in Tor users, the botnet switches to Tor as a method of communication with its C&C (command and control) channel. Tens of thousands of botnet requests within a limited amount of dark web networks can aggravate traffic.