This study aims to make recommendations about how the Internet can be more thoroughly cleaned of Child Sexual Abuse Material (CSAM), focusing on the Dutch government policies. In the past years, several organizations, including the European Commission, called out the Netherlands for the role Dutch companies have in the hosting of CSAM. According to INHOPE, the CSAM hotline umbrella organization, the Netherlands is responsible for 20\% of the hosted CSAM worldwide and 79\% within the EU. For this study, a mixed-methods approach is chosen. A mixed-methods approach combines a qualitative and a quantitative method. The qualitative analysis is used to reveal relevant stakeholders, their positions, how they participate in the policymaking process, how they evaluate the government policies, and what they believe are the most significant improvements to the system. The quantitative results map information flows and processing times of the Dutch CSAM NTD mechanism. Combining the qualitative and quantitative research has revealed several pitfalls. Firstly, much CSAM remains unfound. Secondly, hotlines have a very important but also insecure position in the government policies. Further, are direct incentives for the sector more than moral duty are missing and the organizational degree of the sector is low. Also, the set norms and policies of the government and self-regulation are not accounting for the high diversity of the sector. There is a lack of financial resources. Finally, several stakeholders question the adequacy of law enforcement in regard to CSAM. Consequently, recommendations in three areas are made: (1) expanding and strengthen the current policies, (2) enhancing the collaboration between the stakeholders and their own position and (3) introducing new policy initiatives.

To provide insight into factors that play a role for DT in the humanitarian sector, a combination of literature and expert interviews was used to identify relevant criteria for the humanitarian sector. In accordance with prevailing literature, these factors have been categorised in people, process and technology factors. People factors include leadership, human resources, culture, organisational structure. Process factors were: alignment operations & IT, long term commitment Management, long term commitment network, long term commitment donor, crisis response, Legal issues. Finally, technology factors included both data and digital. The identified critical DT factors were translated into an assessment framework making use of the CMMi Maturity Model approach. For each factor and maturity level combination, there is an explanation of what a humanitarian organisation has to comply with, before advancing to the next level. This ensures that national societies can generate an overview where they currently are and what steps to take to advance. To adequately deal with the barriers and increase practical applicability of the framework, separate barrier-overcoming-strategies have been formulated.

Cybercrime thrives and online anonymous markets, or darknet markets, play an important role in the cybercriminal ecosystem. Vendors active on darknet markets invest in security mechanisms to compromise the availability or usefulness of evidence to Law Enforcement Agencies. Therefore, difficulties arise in linking identities or machines to cybercrimes facilitated by darknet markets. As a result, many cybercrime investigations are ineffective. This thesis consists of an exploratory case study based on the full administration of the Hansa Market. The Hansa Market (2015-2017) was infiltrated and eventually taken over and shut down by the Dutch Police. The data used in this thesis originates from the server that hosted the market and is made available by the Dutch National High Tech Crime Unit (NHTCU) and the Fiscal Information and Investigation Service (FIOD). This data is used to answer the research question: “Which factors influence the security behaviour of darknet market vendors active on Hansa Market?”. To answer this question, vendors that are similar regarding a) their experience, b) the activity on other markets, c) the amount of physical items sold, e.g. drugs and d) the amount of digital items sold, e.g. stolen credit card information, are clustered into five `vendor types' using Latent Profile Analysis. It is researched whether these clusters of vendors differ in terms of the following security behaviours observed: a) authentication related security practices (password strength, password uniqueness and two-factor authentication usage), b) encryption of communication, in the form of PGP-adoption and PGP-key strengths used, c) the linkability of a vendors' pseudonym through PGP-key matching and d) a vendors' choice of Online Financial Service Providers within the bitcoin ecosystem, measured by querying a service that provides contextual information on bitcoin transactions and addresses. The findings indicate that approximately causal relationships may be inferred between on the one hand vendor types, that represent a combination of business success in terms of physical and digital sales, experience and activity on other markets and on the other hand security behaviour. Vendors offering digital items tend to behave less securely than vendors selling large amounts of drugs. This thesis explains the observed (differences in) suboptimal security behaviours by arguing that vendors on Hansa Market conduct subjective risk assessments. This implies that the probability of being targeted by LEA and the value of the vendors' assets that are at stake (e.g. informational assets containing incriminating evidence or `years of freedom') are of influence on security behaviour. Lastly, recommendations to Law Enforcement Agencies include to exploit the subjectiveness in cybercriminals' risk assessments and to consider focusing on vendors transacting digital items. Academics are recommended to extend this research by investigating cybercriminal security behaviours through improved measurement methodologies in larger and more recent datasets.

Background: A lot of scientists have tried to shed light on dark web markets. They did this by scraping these marketplaces over a period of time and describe what they were seeing. However, the methods used to measure these markets were never validated before. Research goal: This research will identify and validate the methods that are used in the literature to measure darknet marketplaces. Methods: To validate these methods, a novel dataset is used, namely the confiscated backend of a market. This dataset is cleaned and used to analyze the accuracy of these proxies on. Results: It is found that the number of transactions, revenue, and market share can be estimated with a high amount of explained variance. The predictions are precise enough to find prominent vendors on the market. The designed method of calculating the illegally obtained profits of a darknet vendor is easy to understand and could be used by law enforcement agencies. Finally, it is found that some vendors register to a market early as a strategy to ensure their business continuity.

The thesis reconstructed and analysed transaction-level data of a particular darknet market. Moreover, the thesis reveals what kind of vendors are active on this darknet market, based on their characteristics. Finally, this research identified what the relative importance is of different vendor characteristics for vendor performance on darknet markets.

Dit rapport is geschreven in het kader van de tweede fase van het vak ’Bachelor-eindproject’ van de bacheloropleiding Technische Bestuurskunde aan de Technische Universiteit Delft. Het rapport is geschreven naar aanleiding van het issue-paper dat ik voor de eerste fase van dit project geschreven heb over het bestrijden van financiële, economische en fiscale fraude met een cybercomponent. Het onderzoek betreft het ontwerp van een methode om de betrokkenheid van een land bij de handel op online anonieme markten in kaart te brengen op productniveau. Deze methode is ontworpen aan de hand van het proces voor Data Mining en maakt voor de analyse gebruik van machine learning technieken en methodes voor content-based geo-location estimation ontworpen voor social media platformen zoals Twitter. De toepasbaarheid en het resultaat van de methode is in de praktijk getest door de toepassing van de methode op de casus van de FIOD.