Terrorists use the Dark Web to hide

Elizabeth Weise

USATODAY

SAN FRANCISCO — Terrorists are increasingly using the hidden parts of the Internet to avoid surveillance, relying on the open web for recruiting but then moving to encryption and the Dark Web for more nefarious interactions, experts said in interviews Monday.

This is one reason United Kingdom Home Secretary Amber Rudd said Sunday that government agencies need access to such encrypted services to protect the public, reigniting a more than 20-year debate over the competing needs of security and privacy.

“We need to make sure that organizations like WhatsApp — and there are plenty of others like that — don’t provide a secret place for terrorists to communicate with each other,” she said on the BBC.

WhatsApp: What you need to know about the popular messaging app

London terror suspect Khalid Masood sent a WhatsApp message to an unknown person just before Sunday's attack that killed four people and injured dozens. The message’s contents — and its intended recipient — can't be accessed by police because the popular, Facebook-owned messaging service encoded them.

It is the burgeoning of these secret, unaccessible corners of the Internet that worries law enforcement agencies, which have been talking for several years about the dangers posed by criminals and terrorists who can now "go dark" by using strong encryption.

"That is a shadow falling across our work," he said. The darkness is spreading through the whole room, FBI Director James Comey said last week at a security conference at the University of Texas at Austin.

Privacy advocates and online pragmatists believe it's impossible to provide access just to law enforcement without endangering the privacy of the public and making their data more vulnerable to criminals.

“The minute you have a mechanism in place to overcome the encryption, that opens it up for any hacker to get at it, which becomes a major issue,” said Joel Reidenberg, a cybersecurity and privacy law professor at Fordham Law School.

A surprising amount of what terrorist groups such as ISIS do happens on the open web. It's the communication that leads to violent acts that is often inaccessible.

“Like any organization that has a message and an outreach objective, they use multimedia formats and a wide variety of spaces. They have printed magazines, websites and Twitter feeds,” said Kate Coyer. She leads research at a center for research in violent online political extremism at the University of Central Europe in Budapest, Hungary.

This can range from beautifully designed magazines with articles on how to use cars as weapons to Twitter accounts that proselytize the glories of jihad, said Rabbi Abraham Cooper, head of the Wiesenthal Center's Digital Terrorism and Hate project in Los Angeles.

When they find a likely recruit, they increase the interactions, then when the discussions become more pointed “they absolutely will look for encrypted chat groups so they can have those conversations privately,” Cooper said.

In the last 18 months, the Wiesenthal Center has seen a new mantra on the part of terrorist groups and those who recruit to terrorist ideologies. “They say, ‘just as you wouldn’t go forward without your Koran, you should not communicate with anybody without being encrypted,’” Cooper said.

“Mere ‘fans' prefer more mainstream outlets to spread news, propaganda, videos etc. They often chatter among each other on best practices and spreading of how-to manuals. Once someone gets serious about taking action on their rhetoric, the conversations go private,” said Veryan Khan, editorial director at the Terrorism Research and Analysis Consortium, a private firm that collects information on terrorism.

Even deeper and harder to get at is what's know as the Dark Web, the hidden portion of the Internet that’s only available through specialized browsers. It’s not really a single entity but instead thousands of sites, most encrypted and all available only to those with information about how to find them and how to access them.

“It’s a place where all sorts of illicit activities can happen. It’s the sort of place where you would go if you wanted to buy weapons,” said Herb Lin, a senior research scholar for cyber policy at the Hoover Institution at Stanford University.

The dark web also plays a key role in terrorists' overall communication strategy.

“One of the things they do is they train each other on how to run all the traffic on their Android mobile phones through the dark web so all their Internet and voice traffic is sent through encrypted channels and so unreadable by law enforcement,” said Aaron Brantly, a professor of cyber studies at the U.S. Military Academy.

The debate over the threat encryption poses to government-intelligence gathering efforts is not new. It dates back to the 1990s when the National Security Agency proposed requiring that all new telephones and digital devices include what was known as the Clipper chip, which would have given the government back door access to encrypted communications.

That attempt and others going forward have all been thwarted by U.S. courts upholding the right to privacy.

The legal situation in the United Kingdom is different because the U.K. does not have a First Amendment but does have the Regulation of Investigative Powers Act, passed last year, which gives the executive branch there very broad powers to issue surveillance orders without having to go through the courts to get a warrant as would be required in the United States, Reidenberg said.

UK security services get broad online surveillance powers

Even if law enforcement were able to gain access to keys to unlock encrypted message, it’s not clear how long it would help, said Khan of the Terrorism Research and Analysis Consortium.

Al-Qaeda and ISIS supporters are highly adaptive and once a new communication tool becomes less secure they simply move on. “It is my opinion that closing one area simply makes them harder for us to monitor potential new threats,” she said.

Featured Weekly Ad