Tokyo, Denver, Helsinki, Lisbon or the Professor? A Framework for Understanding Cybercriminal Roles in Darknet Markets

There is comparatively little information about the roles and the separation of these roles within financially-motivated cybercrime online. As Darknet Markets (DNMs) are online fora, roles can often be conflated with membership or user types within such fora, e.g., administrator, new user, etc. The insights presented in this paper are grounded in a Conversation Analysis of underground forum threads in combination with Social Network Analysis of the relationships between actors in these fora and an automated analysis of the thematic scope of their communications using NLP techniques. This results in a more nuanced understanding of roles, and the power relationships between roles, as they emerge through and are defined by linguistic interactions. Based on this mixed methods approach, we developed a dynamic typology of three key roles within DNMs that goes beyond a basic supply-demand logic: entrepreneurs, influencers and gatekeepers. A closer analysis of these roles can contribute to a better understanding of emerging trends in a forum and allow for the identification and prioritisation of high-risk targets.