Remaining anonymous? The offline side of darknet drug vending

Abstract

Darknet drug vending is a hybrid crime. Although many activities occur online, the delivery of drugs to buyers requires a shift from the digital to the physical realm. This transition could be considered risky for vendors; while the online side provides anonymity, the offline side may expose vendors to increased opportunity for monitoring, evidence gathering and potential enforcement. This research examines data from 80 arrest cases and 279 news reports to study these dynamics. The results, which are analysed under the framework of routine activity theory, reveal that the offline side of darknet drug vending, short of being entirely risky, actually provides some interesting criminal opportunities for vendors, as they may capitalise on the advantages of using the postal service for delivery and operating out of an enclosed base of operations for management. Remarks are made in reference to the wider implications of offline criminal opportunities for darknet drug vendors in Europe and beyond.

Keywords

Case analysis darknet drugs offline open-source data vending

Introduction

Darknet drug vending represents a significant innovation within the wider drug dealing landscape (Aldridge and Décary-Hétu, 2014). The advent of remarkable new technologies, such as cryptomarkets, encrypted communication software and online money laundering applications, has enabled drug dealers to sell their wares online (Christin, 2013; Jardine, 2021; Joyce, 2023, 2025; Martin, 2014). Fascinated by this development, researchers have focused a significant amount of attention on the online side of this crime (e.g., Bakken et al., 2018; Broséus et al., 2017; Cunliffe et al., 2017; Maddox et al., 2016; Morselli et al., 2017; Nurmi et al., 2017; Paquet-Clouston et al., 2018; van Buskirk et al., 2017; van Hout and Bingham, 2014), with the advantages – anonymity, increased efficiency and capacity for customer service – provided by these technologies being the subject of much discussion and emerging as an overarching theme (e.g., Aldridge, 2019; Bancroft et al., 2019; Childs et al., 2020; Christin, 2013; Christin and Thomas, 2019; Décary-Hétu and Giommoni, 2017; Duxbury and Haynie, 2018; Hämäläinen, 2015; Martin, 2014; van Hout and Bingham, 2014; van Wegberg and Verburgh, 2018).

While the online side is critical to darknet drug vending, it is not singular. Darknet drug vending is a hybrid crime; when the drugs are sent to buyers, the digital becomes physical. The offline side of darknet drug vending is centred around the physical handling of drugs: how they are packaged, dropped off and shipped to buyers (Aldridge and Askew, 2017; Joyce, 2023, 2025; Smith and Frank, 2020). While previous studies have touched on several aspects of this offline dimension (e.g., Aldridge and Askew, 2017; Caudevilla et al., 2016; Childs et al., 2020; Norbutas, 2018; Rhumorbarbe et al., 2016; Smith and Frank, 2020), there still remains much to uncover. While we have learned a lot about drug packing (Aldridge and Askew, 2017; Bhaskar et al., 2019; Décary-Hétu et al., 2016; Décary-Hétu and Quessy-Doré, 2017; Nurmi et al., 2017; Smith and Frank, 2020; Tzanetakis, 2018; van Hout and Bingham, 2013) dropping off (Aldridge and Askew, 2017; Bancroft, 2017; Christin, 2017; Daly and Shortis, 2024; Goonetilleke et al., 2023; Jardine, 2021; Joyce, 2023; Smith and Frank, 2020; Tzanetakis, 2018) and shipping (Aldridge and Décary-Hétu, 2016; Bancroft, 2017; Broséus et al., 2017; Christin, 2017; Christin and Thomas, 2019; Demant et al., 2018a; Norbutas, 2018; Tzanetakis, 2018; van Buskirk et al., 2016) we still know very little about the base of operations (the physical space in which the vendor carries out the offline side of their operation – e.g., the warehouse in which they manufacture and package drugs) and the in-person functioning of this crime. Even in the areas we are knowledgeable in, much of our understanding has been drawn from online data, resulting in key details which may not be available online, such as the decoy methods used by vendors, being left out. Though there have been studies that have focused on specific components of the offline domain, such as direct dealing (Childs et al., 2020), dead drops (Daly and Shortis, 2024; Goonetilleke et al., 2023) and parcel delivery (Aldridge and Askew, 2017), no single study has taken a broad overview of the offline domain of darknet drug vending – in the absence of which it is difficult to make wider theoretical assumptions about what the nature of this domain might be. Like the online environment of darknet drug vending, does the offline environment also present unique criminal opportunities? What are the advantages and disadvantages of these opportunities? How might vendors manage related risks? To what extent do country-related differences, such as between the United States and Europe, influence these risks? It is only by answering such questions that we can start to build an understanding of the offline side of darknet drug vending equal to our understanding of the online side.

This research hypothesises that the offline side of the crime, centred on the packing, dropping off, shipping of drugs and the base of operations, presents particular criminal opportunities for vendors, with unique advantages and challenges. The aim of this research is to test this hypothesis by studying vendor conduct in criminal arrest cases (n = 80) and recorded incidents of parcel interceptions in the post (n = 279). By employing routine activity theory (RAT) and framing vendors as rational actors, drugs as the target and post office staff/customs/law enforcement agents as guardians, this article seeks to illuminate how the totality of the features of the offline side of darknet drug vending, both contextual and vendor-generated, results in significant criminal opportunities for vendors.

Literature review

Packing

Most of what we understand about the offline side of darknet drug vending relates to techniques vendors employ to avoid arrest and increase sales. Stealth methods, whereby efforts are made to conceal the presence of drugs, are commonly used to avoid detection when parcels are in transit (Aldridge and Askew, 2017; Décary-Hétu et al., 2016; Smith and Frank, 2020; Tzanetakis, 2018). These techniques may involve using moisture barrier bags to prevent scents escaping, vacuum sealing to reduce the bulkiness of the hidden drugs, and printed labels to make parcels appear professional (Aldridge and Askew, 2017; Smith and Frank, 2020). Vendors may also use other techniques, such as making smaller shipments, even multiple small shipments at a time, to reduce the risk of attention that larger packages may bring (Décary-Hétu et al., 2016). The use of stealth measures is crucial for vendors, not merely to ensure the smooth delivery of drugs, but also because buyers evaluate these methods through feedback (Décary-Hétu and Quessy-Doré, 2017; van Hout and Bingham, 2013), making stealth a reputational factor, with reputation itself being the key predictor of a vendor's success (Bhaskar et al., 2019; Nurmi et al., 2017).

Drugs are inseparable from the offline side of darknet drug vending. Although all cybercrime has an offline component (Lusthaus, 2018), the need to ship physical products makes the offline dimension particularly relevant to darknet drug vending. Drugs such as cannabis, cocaine, ecstasy-related products and LSD, appear to be favoured (Barratt et al., 2016; Caudevilla et al., 2016; Christin and Thomas, 2019; Demant et al., 2018a; Morelatoa et al., 2018; Nurmi et al., 2017; Rhumorbarbe et al., 2016; Tzanetakis, 2018; van Buskirk et al., 2016; van Hout and Bingham, 2013). Tzanetakis (2018) found that over 50% of all sales on AlphaBay consisted of stimulants, cannabis and ecstasy-related products. However, other drugs are also relevant; the same study reported that opioids constituted over 11% of all sales. Ultimately, market size allows for specialisation, with less common drugs such as new psychoactive substances, powerful opioids like fentanyl, and different prescription drugs also being readily available (Broadhurst et al., 2020; Cunliffe et al., 2019; Negri et al., 2021; Tzanetakis, 2018). A 2020 study reported that out of the 127,541 drugs listed across several markets, 13,135 were opioids (over 10%), with 1118 (almost 0.9%) being fentanyl or its analogues (Broadhurst et al., 2020). The core point here is diversity: hard and soft, common and less common; the scope of the types of drugs being shipped by darknet vendors is broad.

In terms of drug size, most sales transactions on the darknet involve quantities intended for personal use or social drug dealing (Christin and Thomas, 2019; Demant et al., 2018a), suggesting that shipped parcels are generally small. However, there is evidence that vendors may sell to other vendors (Aldridge and Décary-Hétu, 2014; Christin, 2017; Christin and Thomas, 2019) or street wholesalers (Søgaard et al., 2021) and high-level vendors tend to mail larger packages, ship drugs internationally and send them to countries with a higher risk of interception (Décary-Hétu et al., 2016). Certain drug compounds, such as opioid analogues, may be purchased in bulk, or vendors might remain in a certain weight category to dominate a given market segment (Christin and Thomas, 2019; Lamy et al., 2021). Therefore, we may interpret drug packing as something varied, with parcels containing different types and sizes of drugs depending on the vendor's business model.

Dropping off

The most apparently risky moment in the offline side of darknet drug vending is dropping off, where vendors or their employees (Joyce, 2023, 2025) leave their private base of operations and travel to the drop-off point. Here, exposure reaches its apex as the incriminating product is physically handled in public. While other delivery techniques may be observable, such as dead drops, where drug parcels are left at a specific location to be collected later by buyers (Daly and Shortis, 2024; Goonetilleke et al., 2023), it is generally accepted that drugs on the darknet are typically shipped by post (e.g., Aldridge and Askew, 2017; Bancroft, 2017; Christin, 2017; Smith and Frank, 2020; Tzanetakis, 2018). This implies that packages are deposited publicly, usually in a mailbox or at a post office. Despite their connection to the government, postal services are preferred over couriers (Jardine, 2021; Joyce, 2023, 2025), likely due to their ubiquity, cost-effectiveness and increased anonymity, as couriers often require the submission of personal information. Previous research has highlighted various techniques for approaching post offices, such as rotating mailboxes (Aldridge and Askew, 2017) and dropping-off parcels in mailboxes at night (Joyce, 2023). However, most research data on the topic has been drawn from market and forum data, leaving a significant gap in our understanding of how vendors actually interact with the post office environment during this critical aspect of the crime.

Shipping

Shipping marks an interesting turning point in the offline side of darknet drug vending; while the crime continues in the physical realm, once the drugs have been released to the postal service, they cease to be under vendor control. The places vendors ship from and ship to thus mark a relevant aspect of this offline component. It is perhaps for this reason that drugs tend to be shipped nationally rather than internationally (Norbutas, 2018; Tzanetakis, 2018). This logic may also follow through to continental effects, with the exchange of drugs between European darknet users being greater than that between European and non-European darknet users, creating geographic clustering (Norbutas, 2018).

Trends for destination and consumer countries tend to reflect those of the traditional market (Bancroft, 2017; Broséus et al., 2017), with countries such as Australia, Germany, the Netherlands, the United Kingdom and the United States featuring heavily (Bancroft, 2017; Christin, 2017; Demant et al., 2018b; Tzanetakis, 2018). This suggests that, regardless of how the drugs are sourced, the distribution of consumers of drugs by nation remains the same. The primary countries of origin for darknet drug sales are similar to those of destination. A 2016 study found that sales listings from the United States, the United Kingdom, Australia, the Netherlands and China collectively accounted for 62% of all listed drugs and 68% of all listed vendors (Van Buskirk et al., 2016). In 2019, EU-based vendors were found to make up 43% of all active vendors operating on the most popular markets (Christin and Thomas, 2019). Similar patterns are also reflected in the sale of bulk amounts of drugs, which percolate around North America, Central Europe and China (Aldridge and Décary-Hétu, 2016), giving further weight to the supposition of certain key nations as supply hubs.

Base of operations

Little is known about the base of operations used by darknet drug vendors. While previous studies have referenced the management of the darknet drug vending business (Caulkins et al., 2019; Joyce, 2023, 2025) as contained within a particular space – a normative conclusion – no work has substantially examined how said space functions. Presumptions could be drawn from closed market dealing, as those dealers work from private settings (Curtis and Wendel, 2000; Parker, 2000), and thereby avoid the violence, and threat thereof, associated with open markets (Parker, 2000; Potter, 2009; Taylor and Potter, 2013). Equally, we might look to social media dealing, where drugs are marketed through social media platforms like Telegram, WhatsApp and Snapchat, and deals are then latterly made in person – evidencing a hybrid quality (Korshøj and Søgaard, 2024; Moyle et al., 2019). Yet in both cases, parallels are far from perfect. Closed market dealing is often driven by convenience and friendship more than significant financial gain (Parker, 2000; Sandberg, 2012), distancing it from the enterprise-focused profiteering of the darknet (Caulkins et al., 2019; Joyce, 2023, 2025). Although social media dealing relates to cryptomarket dynamics in the online domain, particularly in the use of advertising (Bakken et al., 2023; Demant et al., 2019; Moyle et al., 2019) and market-related dynamics (Childs et al., 2020; Demant et al., 2019; Moeller et al., 2021), research shows that in the offline domain, social media dealing retains many aspects of traditional market drug selling (Bancroft, 2023; Søgaard et al., 2019). Drugs tend to be sourced from offline channels, territorial competition remains at least partially relevant, and employees are recruited in a manner that appears broadly fluid and ad hoc (Korshøj and Søgaard, 2024). As such, it may be that these works are not entirely informative of darknet drug dealing, where the use of post to reach customers may draw a certain line between the offline dynamics of darknet vending and those of other drug dealing iterations.

Theoretical framework

Routine Activity Theory (RAT)

The Routine Activity Theory (RAT) frames crime as a convergence of a motivated offender and a suitable target, in a particular place, in the absence of a capable guardian (Cohen and Felson, 1979; Eck, 1994). Initially conceived in relation to criminal opportunity and patterns of routine victimisation, RAT has evolved over time, and has been widely applied in criminology, from examining patterns of homicide (Messner and Tardiff, 1985) to studying fear of cybercrime (Cook et al., 2023). Criminologists have frequently adopted the original conceptual framework to modern contexts, where targets can range from drugs (Jacques and Wright, 2011; Systema and Piza, 2018) to pirated media (Petrescu et al., 2018), and guardians can include surveillance technology (Hollis-Peel et al., 2011) to anti-virus software (Choi, 2008).

Despite its flexibility, the applicability of RAT to cybercrime remains debated amongst criminologists (Leukfeldt and Yar, 2016; Yar, 2005), with arguments over the nature of cybercrime as a place, the fixed quality of criminal motivation, and the implications of the shift in criminal activities from the digital to the physical being hotly contested (Capeller, 2001; Grabosky, 2001; Leukfeldt and Yar, 2016; Wall, 2007/10; Yar, 2005). There is still no clear consensus on the degree to which RAT can and should be applied to cybercrimes, not merely because of the nature of the virtual space, but also because of the lack of convergence across space and time (Leukfeldt and Yar, 2016; Yar, 2005). Nonetheless, criminologists continue to use RAT to frame studies on cybercrime (e.g., Bossler and Holt, 2009; Choi, 2008; Leukfeldt, 2014; Marcum et al., 2010), albeit with varied results (Leukfeldt and Yar, 2016). A potential middle ground might be found by focusing on the offline side of cybercrime (Lusthaus, 2018), where the applicability of traditional criminological theories like RAT should be clear. This approach may allow for the partial conceptualisation of cybercriminal activity, especially for hybrid crimes that involve both online and offline elements.

Suitable target

Targets have been flexibly conceptualised. Initially conceived as victimised persons, targets expanded across time to include goods and services (Felson and Clarke, 1998), before encompassing value in general. This conceptual elasticity has allowed for the application of RAT to drug dealing offences (e.g., Eck, 1994; Jacques and Wright, 2011; Systema and Piza, 2018), where the target may be the drugs themselves. This broader approach has been in part assisted by the conceptualisation of a suitable target as a composite of four key elements: value, inertia, visibility and accessibility (VIVA) (Cohen and Felson, 1979; Felson and Clarke, 1998). In relation to drug dealing, the value of drugs lies in the profits they generate for vendors; they are the critical, definitional component around which all other aspects of the crime revolve. The inertia of drugs makes them easy to target – unlike human victims, drugs are immobile objects – but their mobility, the delivery to buyers, is vital for the seller's success. The visibility of drugs is critical: if they become visible to a capable guardian, dealers risk arrest and punishment. As such, they must be kept hidden and sold in a manner that avoids detection (Fader, 2016). Finally, the accessibility of drugs plays a key role in determining what drugs dealers will sell and in what quantities. For the purposes of this research, by analysing drugs as the target of darknet drug vending, we can home in on the interaction between drugs and criminal opportunity – how valued, inert (mobile), visible and accessible they are made through the offline component of the crime.

Rational offender

Although inclusive of the offender in its paradigm, RAT diverges from dispositional theories that focus on the motivations of offenders and instead emphasises crime as opportunity, where the context shapes the offender (Miro, 2014). In light of this, RAT aligns closely with Rational Choice Theory (Felson and Clarke, 1998; Jacques and Wright, 2011), where offenders are framed as committing crimes based on a cost-benefit analysis, weighing potential hazards against potential rewards (Cornish and Clarke, 1986). The rational drug seller takes measures, on the one hand, to avoid the risk of arrest (Fader, 2016), and on the other, to maximise profits. Darknet drug vendors, using the internet to conduct transactions and deploying encrypted software to conceal their identities, are somewhat cushioned by darknet anonymity (Christin, 2013; Décary-Hétu and Quessy-Doré, 2017; Martin, 2014). However, when the crime shifts from the digital to the physical realm, they may become more vulnerable as they can no longer rely on such protection (Aldridge and Askew, 2017; Smith and Frank, 2020). By examining darknet drug vendors as rational actors, this study seeks to further our understanding of how vendors reduce the risks associated with the specific opportunity context of the offline domain.

Capable guardian

Rather than being a positive quantity, the guardian component of RAT focuses on the variable's absence or incapacity. Similar to the conceptualisation of targets, the notion of guardians has evolved over time: early work focused on those in a position to protect targets (guardians), later expanding to include those who could influence potential offenders (handlers), and finally encompassing those who, due to their particular employment role (managers), are in a position to detect and/or deter crime (Eck, 1994; Eck and Weisburd, 2015). This third category is particularly relevant for darknet drug vending: since the drugs are transacted through the postal system, postal and customs employees, in addition to standard law enforcement, have a unique capacity to interrupt the passage of drugs between vendor and buyer. The structure of the postal system, its rules and processes, are thus critical to the success-risk nexus associated with darknet drug vending; it is within this framework that the measures taken by the postal employees to intercept parcels and the methods used by vendors to ensure safe delivery collide. Through conceptualising postal, customs and law enforcement agents as capable guardians, we may be able to better understand the challenges that vendors face in the offline side of darknet drug vending, and how different enforcement practises across different regions, such as in the United States and Europe, may impact their behaviour.

Data and methodology

Arrest cases

To investigate the offline activities of darknet drug vendors, this study analysed arrest case files obtained from Pacermonitor, a publicly accessible online repository in the United States. Pacermonitor was chosen for its accessibility and extensive coverage of American vendors, who represent a significant portion of darknet operations (Bancroft, 2017; Tzanetakis, 2018). The platform offers public access to case files, which are often redacted or confidential in many European jurisdictions where most non-American vendors operate. Additional information, particularly regarding vendor profiles, was garnered from the US Department of Justice website. While this approach introduced a bias towards American vendors, the dataset was not exclusively American. Some vendors had been extradited or were arrested there, and the sample also included French and Dutch offenders.

The data collection process involved conducting systematic key word searches on Pacermonitor and downloading cases that met the key words criteria. For a case to be included in the study, it had to fulfil the following requirements:

Relevance: each case was assessed to ensure its relevance by verifying the charges made in the given case and cross referencing information from websites and media sources pertaining to darknet cases.

Accessibility: only fully accessible cases were included. Cases which were redacted or lacked detailed documents outlining the facts of the cases were excluded from the study.

In total, 89 cases were initially identified, and 80 of these met the criteria for inclusion in the research. The cases spanned from 2013 to 2021, with the average date of conviction being 2018. The data was largely drawn from criminal complaints, which ranged from 9 to 44 pages in length.

To proceed with the analysis, the cases were first read through in detail to determine the type of information available and to develop a structured approach for the analysis. A schema was then created to facilitate the understanding of the data drawn from the recorded cases. This schema focused on three specific factors: packing (including stealth used and the types of drugs sold), dropping off (including activities in and around post offices and mailboxes) and shipping (including places of origin and destination). Additional quotes were drawn out of the data to provide examples and support the analysis. These were marked as example cases, by their number, and by the country to which they are relevant (e.g., EC1 – United States). Once this information was collected, it was then analysed in the context of RAT.

Open-source reports

To examine the nature of drug parcels and their interception, data was drawn from open sources through the Nexis^® Metabase, which consists of more than 85,000 online sources from over 200 countries in over 90 languages. However, for the purposes of this research, the timespan was limited to the advent of the cryptomarkets in 2011, following a 10-year range, up until 2021. The identification of potentially relevant news reports was based on a query consisting of a combination of key words that refer to four basic elements of the phenomenon of interest. The final query, developed through a process of trial and error, included these four interconnected elements and their associated key words:

Drugs [drug OR cannabis OR weed OR marijuana OR cocaine OR coke OR amphetamine OR methamphetamine OR crystal OR mdma OR narcotic OR pills OR lsd OR fentanyl OR ketamine OR heroin OR ecstasy OR khat OR xanax OR pcp OR dmt OR oxycodone].

Darknet [darknet OR darkweb OR cryptomarket].

Means of distribution [mail OR post OR courier].

Enforcement [seized OR seizure OR arrested OR accused OR charged OR intercept OR intercepted OR raid OR raided].

This final query was used to extract 2556 news reports published in English between the years 2011 and 2021. The extracted dataset was cleaned through a combination of text analytics and manual content analysis. These included:

Duplicates: reports that have the same text body. To remove duplicates, the text of each report was transformed into a list of words that was further used to measure the similarity between news reports as a ratio. The higher this ratio, the more similar the news reports were; when the ratio took the maximum value of one, the two reports were identical. Reports presenting 100% similarity to other report(s) were removed from the sample.

Reports with similar information: reports referring to the same interception or case, but which were reported by a different journalist with different wording.

Off-topic reports: reports which were extracted by the query, but which did not contain relevant information.

On-topic reports with insufficient information: reports which were extracted by the query and did contain some relevant information, but not enough to be included as a data source in the sample.

Concurrently, reports were manually classified as either positive (containing relevant information) or negative (not containing relevant information); positive reports were those which were deemed to be non-duplicate, dissimilar, on-topic and containing sufficient information of physical world incidents. The resulting sample of positive records included 279 news reports in English covering the time period of 2011 and 2021. In terms of type of incidents, three main categories of positive reports emerged:

Reports about the interception of a single parcel at a post office or postal centre (e.g., a report of the discovery of a specific drug at a specific post office in Sri Lanka).

Reports about the interception of parcels at post offices or postal centres in general (e.g., a report about specific postal centre in Ireland, where over the past month a certain amount of cannabis had been seized across a certain number of packages).

Reports about the specific arrest, trial or conviction of a darknet drug vendor who was known to smuggle drugs by post (e.g., a report on the trial of a specific vendor, where the type of drug he sold and the area he mailed the drugs from are mentioned).

From these 279 reports, 505 unique incidents of postal interception were identified. The data provided about these incidents was then processed and assessed to identify specific information about said incidents, such as drugs and countries involved, decoys and stealth methods used and means of discovery, among others. In doing so, natural language processing techniques were implemented to generate variables related to different entity types, including geolocations such as countries, regions, counties and cities, and weights and values of seized drugs. Some of the more specific variables, such as decoys, stealth methods and means of discovery, were manually identified and further operationalised into categorical or binary variables. Additional quotes were drawn out of the data to provide examples and support the analysis. These were marked as example reports, by their number, and by the country to which they are relevant (e.g., ER1 – Spain). The gathered information was ultimately checked against the news reports to ensure the accuracy of information.

Results

Suitable target

In the arrest cases, many different types of drugs were sold by vendors in the sample. Fentanyl (29), methamphetamine (26), heroin (18), cocaine (16), oxycodone (13), MDMA (12) and Xanax (11) were the most popular.

[Redacted] identified the following items for sale: 10 mg of Fentanyl HCL 98% purity $20 + $35 for Express 1 days shipping … 50 mg of Fentanyl HCL 98% purity $55 + $35 for Express 1 days shipping … 50 mg of Fentanyl HCL 98% purity $105 + $35 for Express 1 days shipping…. (EC1 – United States)

Other drugs, such as marijuana (12), LSD (7), psilocybin (3), ketamine (2) and DMT (2) appeared less frequently than expected. Primary drug type reflected similar trends, with opioids (40) and stimulants (22) being the flagship drug types sold by most vendors, with marijuana (5) and psychedelic drugs (3) being less common. Most vendors (79) specialised in the sale of one drug (31), with fewer selling multiple (22) or only two (22) drugs.

Agents have also observed distinctive markings on some of the controlled substances offered for sale by [redacted] on the website. In particular, agents observed [redacted] offering for sale cocaine, heroin, MDMA, and ecstasy pills with ‘question mark’ logo stamps and ‘white speaker’ stamps. (EC2 – the Netherlands)

In the news reports, parcels primarily contained stimulants (185), cannabinoids (168), opioids (109), psychedelics (30) and other drugs (13). A wide variety of unique drugs were listed (39), including cannabis and cocaine, and less popular substances like methaqualone and mitragynine. Cannabis (165) was the most trafficked drug, followed by cocaine (68), ecstasy/MDMA (53), methamphetamine (46) and heroin (33).

A huge haul of drugs and cash has been seized after suspicious Post Office staff alerted police to a ‘smelly package’. At 4.13pm on Wednesday, police received a call from staff at [redacted] Office who had concerns about a package. Police say someone had dropped off the parcel for special delivery and claimed it was paperwork. But staff grew suspicious due to the heavy weight of the parcel, and because it had a strong smell of cannabis. (ER1 – United Kingdom)

Less common drugs, such as fentanyl (31), were still intercepted frequently, while certain popular drugs, such as LSD (18), were intercepted less often. While drug types varied across countries, distinct patterns emerged in some regions, but not in others. In North America, for instance, over half of the parcels shipped from California contained cannabis (31), whereas all parcels shipped from Puerto Rico contained cocaine (25). In Europe, variety was present across the board.

Dublin Mail Centre Revenue officers, with the assistance of detector dog Sam, seized various types of illegal drugs with an estimated value of €117,000 at Dublin mail Centre today. Almost 16 kg worth of drugs, including herbal cannabis, magic mushrooms and cannabis infused jelly sweets, along with 4.5 litres of liquid amphetamines, were discovered in parcels that originated from the US, France and the Netherlands. The parcels were declared as items such as ‘ornaments’, ‘candy’, ‘clothing’ and ‘gifts’ and were destined for addresses in Dublin and Louth. (ER2 – Ireland)

In the arrest cases, the quantities of drugs¹ (61) that vendors sold tended to be small (53), as opposed to medium (20) or large (6). Most vendors specialised (37), while some offered to sell across multiple sizes (16). These apparent limitations did not appear to hamper sales or earnings. The length of vendor operations (77) tended to be extensive, with an average of 19 months and a range of 1–96 months. As such, sales (38) were high, with a significant average (6306) and range (50–78,000). Earnings (29) were similarly high averaging $2,090,717 and ranging from $100,000 to $19,000,000.

A review of open-source intelligence related to [redacted], reviews found on the Dream Market vendor page associated with [redacted], and discussions with other agents familiar with the investigation indicate that [redacted] has been operating on multiple Darknet Marketplaces since 2017, is responsible for more than 28,000 individual sales on Dream Market alone, and is estimated to have grossed in excess of $8.8 million in sales. (EC3 – United States)

In the news reports, vendors showed a willingness to send parcels of significant weights and values (Table 1).

Over 3000 ecstasy pills have been found in a parcel at the Central Mail Exchange, Sri Lanka Customs said. According to Sri Lanka Customs 3050 ecstasy pills were detected in the parcel which arrived from Portugal. (ER3 – Sri Lanka)

Table 1.

Selected intercepted drugs with average weights/amounts and values.

Drug	Weight_freq (k)	Weight_mean	Amount_freq	Amount_mean (n)	Value_freq	Value_mean
Cannabis	115	2.8			55	€31,499.51
Cocaine	45	2.3			6	€57,390.83
Methamphetamine	22	0.9	6	2066	8	€76,811.25
Heroin	17	0.7			6	€12,799.50
MDMA	24	1.7	12	2948	11	€142,792.55
Khat	6	32.9			6	€20,959.17
Amphetamine	4	21.0			4	€25,017.00
Fentanyl	3	0.0	3	34,167		N/G
Ketamine	2	8.0				N/G
LSD			3	833	2	€30,238.00
Other	9	8.5	9	164,228	3	€41,915.67

Note: freq: frequency.

Out of the reports mentioning drug parcel weights (247), they ranged from 0.0022 grams (cannabis) to 118 kilos (khat), averaging 3504 kilos. For pill-based drugs, out of the articles with this data (33), quantities ranged from 24 pills (tramadol) to 800,000 pills (alprazolam), averaging 53,790 pills. Out of the reports mentioning drug values (103), they ranged from €178 to €600,000, with an average of €47,293.17.

In the arrest cases, the locality of the operation was not frequently referenced (17); in the cases where it was, some vendors only shipped nationally (10), while the remaining shipped both nationally and internationally (7).

Surveillance footage shows [redacted] mailing two of the seized parcels … One parcel contained approximately 72 grams of methamphetamine and was destined for Australia; the second parcel contained approximately one kilogram of methamphetamine and was destined for New Zealand. (EC4 – United States)

In the news reports, of the incidents where the shipping range of the parcels was provided (398), international shipping was favoured (259) compared to domestic shipping (139).

Under the brand name [redacted], the gang members sent drugs, including LSD, ecstasy, 2CB, ketamine and valium, to buyers around the world. In the course of 6305 individual sales, the [redacted] sent almost 17 kg of liquid ecstasy, equivalent to 240,000 tablets, through the post to buyers. (ER4 – United Kingdom)

Given that the case repository was drawn from the United States, the vast majority of vendors operated in America (78), with the remainder operating out of Europe (2), in France and the Netherlands. In the news reports, among the incidents in which the region of origin was provided (415), almost half were sent from North America (200), while others originated from Europe (101), Asia (46), South America (32), Africa (26) and Australia (10).

A Polish couple were sentenced on Thursday to seven and six and a half years’ imprisonment for international trafficking in synthetic drugs paid in virtual currency (bitcoins). The collective court has proven the drug trafficking offense they had indicted and sentenced [redacted] to seven years in jail and his wife [redacted] to five years and six months. Psychotropic substances were sent to various markets in Europe and the United States in letters and parcels which, when unclaimed, were sent back to the sender, whose home was that of the [redacted]. (ER5 – Poland)

Relatedly, of the incidents in which the region of destination was provided (438), almost half were sent to North America (213), followed by Europe (115), Asia (75) and Australia (35). On a country level, a vast spread of countries acted as unique points of origin (37), while a slightly smaller but still significant number served as unique points of destination (25).

The primary countries of origin and of destination are displayed in Table 2.

Table 2.

List of most frequent countries of origin and destination.

Country	Origin frequency	Destination frequency	Total involvement
The United States	206	208	414
Not given	89	71	160
Other	94	52	146
The United Kingdom	32	32	64
Ireland	0	62	62
India	19	40	59
Australia	10	25	35
The Netherlands	23	3	26
Canada	19	5	24
China	11	7	18
Germany	12	3	15
Sri Lanka	0	15	15
Total	505	505	1010

On the city/county level (229), several unique cities/counties of origin (79) and destination (164) were reported. These included both large, populous metropolitan areas such as New York, Mumbai and Hong Kong, as well as small, moderately populated cities such as Londonderry, Bruges and Knoxville. Certain cities attracted more attention than others. Californian cities (60) accounted for substantial portion of all US-originated parcels, as did the territory of Puerto Rico² (25). Globally, Dublin (46) had the highest number of reported interceptions, significantly higher than any other city in the sample – the next highest being New York (14), a city far more populous than the Irish capital.

Rational offender

In the cases (72), vending firms were generally small, compromised of either a solo entrepreneur (29), a group with a clear structure of leadership (29), or a more fluid operation based on co-conspiracy (14).

During this group chat [redacted – actor 1] told [redacted – actor 2] that she is doing the ‘list’, referring to the online customer orders for drugs. [redacted – actor 1] followed by stating that she was taking over the ‘orders’ from [redacted – actor 3]. [Redacted – actor 2] stated she is waiting to do the ‘labels’, referring to shipping labels for the drug packages, until they receive the ‘inventory’, referring to drugs. [Redacted – actor 1] further stated that [redacted – actor 3] put money on her card and she intended to provide it to [redacted – actor 4]. (EC5 – United States)

Relatedly, in the incidents referenced in the news reports (118), when vendors were identified, they were reported to work alone (54), in a team (43) or in a pair (21).

…members of the conspiracy imported kilogram quantities of MDMA (3,4-methylenedioxymethamphetamine, a Schedule I controlled substance commonly known as Ecstasy) into the United States via the mail from various countries in Europe. The transnational organization operated online as the darknet vendor [redacted] and used encrypted email and TOR-based online black markets, such as the now defunct Silk Road and Silk Road 2.0, to sell the MDMA, primarily to United States and Canadian customers. (ER6 – Romania)

Regarding the physical environment where drugs were packed, residences (44), such as the vendor's home or rented accommodation, were almost exclusively used, with vendors operating on schedule to pack efficiently.

Emails created by Wunderlist whereby [redacted – vendor 1] and [redacted – vendor 2] shared do-to items. The following are items added to or completed on the shared app: ‘100 pre-scale EVERY PRODUCT. No it's or buts.’ ‘Shipping supplies – medium ziplock bags, mailers, etc.’ ‘Have orders out by 3.00pm goal’. (EC6 – United States)

In the cases, the base of operations (44), which may have involved one or more buildings, tended to focus on private residences³ (48) with a lesser emphasis on rented business-related spaces (15).

[Redacted] obtained a federal search warrant … located approximately 400 pounds of Xanax precursors and Benzodiazepine, approximately 5000 pills of pressed Xanax, approximately 100 US Postal packaged boxes containing various amounts of Xanax pills, three (3) electronic industrial sized pill presses, two (2) electronic industrial drug mixers and a medium sized box with hundreds of preprinted USP delivery labels. (EC7 – United States)

In the incidents referenced in the news reports, of those that referenced the base of operations (44), most focused on private residence (40), with much fewer mentioning business-related spaces (4).

When the police raided the apartment in [redacted], it was in a completely different case, when the police suspected a minor drug handling on the spot. But they were met by what was later described as a small factory … The sale has taken place under different aliases on various sites on darknet and the business is described as very well organized. The drugs in question include cocaine, amphetamines, MDMA and cannabis. (ER7 – Sweden)

In the cases, offline roles (80) were clearly divided, with specific designations given to packing (61), dropping off (43) and drug production (23).

The investigation also revealed that [redacted – actor 1] and [redacted – actor 2] used [redacted – informant 1] and [redacted – informant 2] to deceptively package and ship the Fentanyl pills to customers who ordered them from [redacted – actor 1] and [redacted – actor 2] via their Darknet Store. (EC8 – United States)

While in the incidents in the news reports where details about the base of operations were provided (44), several referenced manufacturing equipment (19) while fewer made direct reference to the shipping component of the crime (7).

When the defendants were arrested, authorities seized a pill press lab in [redacted]apartment, along with bags that contained nearly 3 kilograms of what appear to be counterfeit oxycodone and Xanax pills, and bags that contained approximately 4.5 kilograms of white and blue powders that are currently being tested. (ER8 – United States)

In the arrest cases, vendors exhibited considerable effort in packing (61), employing a variety of materials such as printed labels (30), false return addresses (28), decoys (16), mylar (16), vacuum sealing (14) and tracking (12) for preparing drug parcels. These efforts were typically colligated; one vendor, for instance, sent parcels in a bubble mail, priority-post envelope, plastered with a printed label and a false return address, containing a stuffed animal decoy.

The parcel, a USPS Priority Mail small-sized box, bore a pre-printed postage label with the sender information of [redacted] and the bogus recipient provided by [redacted]. Inside the parcel was a small-sized Duck brand manila envelope wrapped in bubble wrap. Inside the manila envelope was a black Shield-N-Seal vacuum-sealed package. Inside the black vacuum-sealed package was a fabric softener sheet and another clear, vacuum-sealed package. Inside the clear vacuum-sealed packaged was the free sample of marijuana. (EC9 – United States)

In the news reports, these methods were less frequently reported (80), with some mentioning false return addresses (47), express mail (18) and vacuum packing (15).

Postal Inspectors tracked the March shipment of fentanyl from [redacted] to the [redacted]. They observed [redacted] travel from his home in [redacted] to the [redacted] post office, where he attempted to mail packages using false return addresses. These packages were intercepted by agents and were found to contain fentanyl consistent with the undercover purchases. (ER10 – United States)

However, decoys were widely reported as methods used to disguise the shipped drug (190). As displayed in Table 3, the results showed significant variety, with many unique decoys used across the sample (103), the majority of which were employed only once. When categorised, specific trends emerged, with foodstuffs and toys being the most commonly used types of decoy.

Table 3.

List of decoys used in intercepted parcels categorised by type.

Type	Foodstuffs		Toys		Clothes		Homewear		Stationery		Health products		Electronics		Other
Type	Decoy	Fq.	Decoy	Fq.	Decoy	Fq.	Decoy	Fq.	Decoy	Fq.	Decoy	Fq.	Decoy	Fq.	Decoy	Fq.
Item used to disguise or conceal drugs	Biscuits	1	Beach ball	2	Wig	1	Candles	1	Cardboard	1	Ayurvedic products	1	CD	1	Ashes	1
	Candy	11	Child's chest	1	Bathrobe	1	Curtains	2	Diary	2	Face mask	2	DVD	6	Camping equipment	2
	Cans	1	Painting kit	1	Gloves	1	Cushion	1	Documents	1	Fitness supplements	1	DVD player	1	Cooling powder	1
	Cereal	1	Figurine	3	Jacket	2	Decorations	1	Wrapping	1	Health products	4	Dentistry equipment	1	Iron box	1
	Chocolate	3	Games	1	Boxing gloves	1	Lampshade	1	Greeting card	4	Herbal products	1	Exercise equipment	1	Items	5
	Coffee	6	Gifts	1	Clothes	8	Lights	1	Magazines	1	Impotence medication	1	Foot massager	1	Legal documents	1
	Dry fruits	3	Glow bracelets	5	Coat	1	Lunchbox	1	Notebooks	2	Medicine	1	Ice-cream maker	1	Surgical equipment	1
	Dried shrimp	1	Key chains	1	Fabric	4	Ornaments	1	Paperwork	1	Nutrition powder	1	Slushy maker	1
	Food	1	Model car	1	Handbag	1	Picture frame	2	Stamps	1	Shaker	1	Speaker	1
	Herbs	1	Pool Ring	1	Laundry	1	Grill	1	Stickers	5	Supplements	1
	Honeycomb	1	Puzzles	2	Make-up	2	Poster	1			Vitamins	1
	Juice	2	Souvenirs	2	Bracelets	1	Rolling pin	1
	Dairy products	1	Stuffed animal	4	Purse	1	Soap	1
	Oatmeal	1	Toys	15	Runners	1	Steel flasks	1
	Soup	1			Sweater	1	Tablecloth	1
	Sugar	1			T-shirts	1	Washing powder	1
	Tea	5			Vests	1	Water filter	1
					Gown	1
Total		41		40		30		19		19		15		14		12

Note: Fq.: frequency.

In both samples, there was also some evidence of material wealth (35, 10) present at the base.

According to the press release, the bust went down in the Spanish cities of [redacted], and resulted in the seizure of approximately €4.5 million (around $5.25 million) worth of bitcoin, lumens, and IOTA … including over €8 million (approximately $9.35 million) in fiat, loads of cryptocurrency, and three ‘real estate properties’. (ER11 – Spain)

Capable guardian

In the arrest cases referencing postal methods (64), vendors overwhelming preferred standard postal services (62) over couriers (3).⁴ When the specific form of mail was mentioned (35), it was always express/priority mail. These parcels were typically dropped off (43), specifically at mailboxes (20), post offices (13) and self-service kiosks (7). Vendors used different combinations of techniques to increase their anonymity during this process, such as rotating drop points, making the drops from the interior of their car and other methods of concealment.

…on multiple occasions, USPS employees had observed the Customer depositing a large volume of USPS envelopes in collection bins at the front of post offices in the [redacted] area. While depositing the envelopes, the Customer had worn latex-dipped gloves. (EC10 – United States)

In the news reports, a similar pattern emerged. In incidents where the postal method was recorded (432), there was a strong preference for standard postal services (385), with significantly less interest in couriers (47). Of the incidents where the package type was documented (366), parcels dominated (348), with only a few envelopes being intercepted (19).

Two men who were remanded on Saturday for eight days after being caught on Friday picking up a parcel containing 10 kilogrammes of cannabis from the same company, are reportedly believed to be linked with the same case, since the parcel had the same sender in Greece. (ER12 – Cyprus)

In the arrest cases, vendors were initially identified by law enforcement (72) through errors made by vendors, most frequently while dropping off (20) or packing (12). One vendor used a stamps.com account registered in their real name to send parcels, while another was caught on surveillance dropping-off drug parcels at their local post office – there were variate examples of identifying errors, depending on the specific case.

DEA obtained records from company A's tracking system, and learned that the package containing the heroin that was purchased on October 3, 2018, was shipped by [redacted] … the sender of the package purchased 250 shipment tracking barcodes from Company A on or about July 27, 2018, using a credit card in the name of [redacted – the vendor's real name]. (EC11 – United States)

Most cases in the sample hinged on investigations (78) by specific law enforcement agencies (70) that targeted individual vendors. These investigations employed various techniques to uncover or force a mistake that would reveal the vendor's true identity; consequently, these investigations tended to run long, averaging 9 months, with a range from 1 to 26 months.

The proceeds from certain illicit purchases conducted by [redacted] were withdrawn to a Bitcoin address ending in [redacted]. That Bitcoin address was linked to more than 100 additional Bitcoin addresses; one of those linked addresses was used to deposit Bitcoin to a Coinbase address on or about May 27, 2017. The deposit was used to process a payment to Expedia for a hotel reservation in [redacted]. The traveller's name was [redacted – the vendor's real name]. (EC12 – United States)

In the news reports, of the interceptions in which the means of discovery were provided (442), almost half (236) occurred during ongoing law enforcement investigations targeting specific vendors.

By analysing the server's data, the police gained information about deals involving dozens of kilos of marijuana. Furthermore, the virtual currency, bitcoin, worth 203,000 euros was found deposited on the server, [redacted – law enforcement official] said. In home searches, the police uncovered dozens of cannabis plants, the LSD drug, five firearms and 600 pieces of ammunition, he said. Two men have been accused of drug delicts and one of them also of illegal possession of arms. (ER13 – Slovakia)

In addition, several interceptions resulted from parcel profiling (63), where postal centre staff became suspicious that the parcel contained drugs due to its shape, size, smell or appearance. Further detections were facilitated by drug dogs (56) and scanning technologies (20).

A man has been charged by [redacted] Police Force over the alleged importation of MDMA, which was detected by Australian Border Force (ABF) officers in a parcel from Spain. On [redacted], the ABF Detector Dog Unit identified an air cargo consignment of interest at a customs-controlled depot in Sydney. Subsequently, ABF officers x-rayed and inspected the consignment, which was found to contain colourful plastic bracelets. They also located 500 tablets inside the parcel, which were subject to further examination and a presumptive test returned positive results for 3,4-Methylenedioxymethamphetamine. (ER14 – Australia)

Discussion

The criminal opportunities created by darknet markets in the online domain have been well documented. By employing the encrypted technologies allowed for on the darknet, vendors can set up a public storefront, communicate directly with buyers and advertise their illegal wares – and do so anonymously (Christin, 2013; Joyce, 2023; Martin, 2014; van Hout and Bingham, 2014). Yet this is not the only affect darknet markets have on criminal opportunities.

Darknet markets are largely designed for drugs to be transacted by post. This marks a unique criminal opportunity for vendors, as the use of post for this purpose comes with a number of advantages. The first change relates to scope: unlike the other forms of drug dealing (Fader, 2016; Jacques and Bernasco, 2013; Korshøj and Søgaard, 2024; Moyle et al., 2019; Parker, 2000; Potter, 2009; Systema and Piza, 2018), which are limited by their locality, the use of the postal service allows vendors to deliver drugs across long distances (Aldridge and Askew, 2017; Décary-Hétu et al., 2016; Joyce, 2023, 2025; Smith and Frank, 2020), giving them access to a vast buyer pool. This creates a shift in seller behaviour. Operating outside of their locality, vendors are freed from the competition of neighbouring dealers and the broad demands of the drug-taking public, allowing them to develop a business model selling drugs of specific types, weights and values. Moreover, the drugs can be transported in bulk, meaning that large numbers of transactions to various buyers can take place in a single instance of delivery and at a relatively low cost. These elements combine to result in significant profiteering.

The second change enacted by the use of post relates to visibility. In traditional drug dealing, buyer, seller and drugs must all converge in space and time for the transaction to occur (Fader, 2016; Jacques and Bernasco, 2013; Korshøj and Søgaard, 2024; Moyle et al., 2019; Parker, 2000; Potter, 2009; Systema and Piza, 2018). Despite the clandestine nature of these interactions, there is always a visible moment when drugs exchange hands, particularly in open market dealing (Fader, 2016; Jacques and Bernasco, 2013; Systema and Piza, 2018). Yet darknet drug vending shreds this logic: drugs are carefully parcelled and transported worldwide within the flow of legitimate mail, originating and destined not just from various countries, but across diverse counties and cities within those nations. Of course, enforcement remains a possibility, but by altering the convergence of space and time, the drug deal – theoretically speaking at least – becomes less visible. As supported by previous literature, vendors in the arrest cases were willing to ship various drugs (Broadhurst et al., 2020; Christin and Thomas, 2019; Tzanetakis, 2018), while those in the news reports were ready to transport large quantities (Aldridge and Décary-Hétu, 2016; Christin and Thomas, 2019), each carrying significant monetary value. Given the significant financial capacities demonstrated by vendors in both samples, it seems unlikely that they would have undertaken serious financial risks unless they perceived postal services as reasonably dependable, especially when we remember that interceptions may result in long-term reputational damage (Décary-Hétu and Quessy-Doré, 2017; van Hout and Bingham, 2014).

There are wider concerns about a public service being used in this way to support criminal activity; while there are certainly risks, it cannot be denied that the postal service creates the opportunity for this crime to take place. Without a capacity to ship post, and to do so in a relatively cheap, easy and largely anonymous way, vendors would not be able to commit the crime of darknet drug vending; or at least it would take on a far more localised dimension, being limited to dead-drops (Daly and Shortis, 2024; Goonetilleke et al., 2023). These factors may hint at a certain symmetry across darknet market-participating countries; the broad variety of drugs being shipped, the confidence displayed in the use of postal shipping, and the emphasis on traditional post over private couriers being broadly horizontal across the two most significant geographic forces in the study, the United States and Europe.

As the drugs are transacted by post, the offline aspect of darknet drug vending is almost entirely enclosed. Other than the delivery of drugs at the post box (Aldridge and Askew, 2017; Joyce, 2023; Smith and Frank, 2020), all activities can take place in a remote base of operations. This marks a unique criminal opportunity for vendors, with the first change relating to external interaction. While in closed market dealing, transactions may take place in private residences (Curtis and Wendel, 2000; Parker, 2000; Potter, 2009; Taylor and Potter, 2013); they always involve, by definition, the meeting of persons outside of the enterprise in order to complete the transaction. In darknet drug vending, vendors operate at a physical remove from customers, and in the case of drugs being manufactured on site, from suppliers. This reduces the visibility of the operation, lowering the number of individuals who are aware of the illegal activity, and who could report on the enterprise; it may also partially explain why vendors are known for their friendly and professional relationships with buyers – when vendors are at such a remove from their customers, posturing and intimidation serve little purpose.

The second change brought on by enclosure relates to internal interaction. Operations tend to act like small firms: a single vendor, potentially supported by a small number of employees, engaged in the packing, delivering and shipping of drugs, in a manner that appears to be quite well organised. Individuals within each operation fulfil specific roles – like packing parcels – in a specific way – bagging the drugs, using mylar to block the use of X-rays, including a decoy so the package looks innocuous, ascribing a false return address to reduce trackability, etc. – that appears dictated by rational arrest avoidance (Aldridge and Askew, 2017; Joyce, 2023, 2025). As evidenced by the vast number of locations in the new reports, these enclosed operations are not limited to specific locations – they could be anywhere. The combination of these two factors – an organised operation, and one whose location is not merely unknown, but potentially at a great distance – creates a challenge for law enforcement operations unlike those faced when dealing with more public and localised drug dealing enterprises.

While details vary from vendor to vendor – sales made, types of drugs sold, stealth techniques used – in the broadest sense, it appears that the offline practises used to complete this crime, whether in the United States, Europe or beyond, remain broadly the same (Joyce, 2023). While modus operandi, business model and degree of caution employed by the given vendor may mean that different vendors send parcels using different methods, or containing different drugs, vendors generally must ship drugs, in a parcel, by post, in order to complete this crime, and it appears that, regardless of the origin of said parcel, the application of some stealth techniques to increase security, and the shipping of drugs by the public postal service are ubiquitous in their application. In this sense, it might be considered that, like the online side of the crime, the offline side, while literally localised, is similarly global in its expression. This stands in stark contrast to traditional drug dealing, where the differences between practises across countries are often quite pronounced.

The criminal opportunities presented by the use of the post for shipping drugs, and the enclosed nature of the vending base of operations, present new challenges for guardians seeking to disrupt darknet drug vending. Here, we see a kind of tension. On the one hand, enforcement is possible. Scanning technologies, sniffer dogs, parcel profiling, beyond the remit of policing itself, the shipping of drugs in the post opens vendors up to additional risks of enforcement. Although their drug targets are mobile and largely invisible, once released into the public domain, they are beyond the vendor's control. The discovery of a drug parcel can trigger or contribute to an ongoing investigation, and once a parcel is dropped off, there is little a vendor can do to further mitigate the risk. Time exacerbates this factor: unlike traditional drug transactions that occur over a relatively brief period (Fader, 2016; Jacques and Bernasco, 2013; Parker, 2000; Potter, 2009; Systema and Piza, 2018), darknet drug parcels may take weeks to deliver, during which period the drugs remain vulnerable to interception. On the other hand, vendors may take measures to mitigate these risks. The two data samples presented different findings: the arrest cases, which reveal successful long-term operations, evidenced cautious approaches with fastidious packing techniques being widely documented. In contrast, the news reports, which recorded interceptions, displayed a greater propensity for risk-taking, with fewer instances of employing stealth techniques – supporting the rather normative conclusion that adapting to risk can lower the likelihood of interception (Bhaskar et al., 2019; Nurmi et al., 2017; van Hout and Bingham, 2014). However, regardless of measures taken, in the event of an existing law enforcement investigation, vendors will end up under close scrutiny. Though investigations tend to be lengthy and involve the expertise of high-level agencies such as the FBI, CIA and DEA, just one error of anonymity can be enough to identify the vendor and break the case. This creates a certain contradiction of terms: vendors have near-total offline protection that can be shattered by a single mistake.

Through guardianship we can recognise the potential for more pronounced country-level differences in the offline dimension of this crime. In European countries, as Europe is frequently treated as a single market by vendors (Christin and Thomas, 2019; Demant et al., 2019), there may be more potential for interception than in the United States, as parcels are more likely to cross borders and thus be subject to customs checks; while across the water, there seems to be a more specific law enforcement agenda at play, driving investigations. In the United States, fentanyl, though opioids only take up a small portion of the overall market share (Broadhurst et al., 2020; Tzanetakis, 2018) emerged as the most widely targeted drug; while Europe followed more normative patterns, with marijuana being the most widely reported drug. Though consumer countries dominate supply lines (Demant et al., 2018b), it remains unclear to what extent differences in guardianship vary from country to country, and how these differences impact vendor behaviour. While Australia has long been considered a strict postal border (Morgenthaler and Leclerc, 2023) and American vendors appear to eschew internationalism by availing of their substantial internal market, the nexus between European customs and darknet drug vending remains under-researched. Further work is thus required before conclusions can be reached on the substantive differences between expressions of guardianship in Europe and elsewhere.

Limitations

The present study is subject to some limitations. First, there is a limitation in the data sources. Arrest cases, prepared by law enforcement or lawyers, might be shaped by the specific needs and arguments pertinent to each case. Similarly, open-source reports, drawn from media outlets and official organisations, may be influenced by editorial or ideological interests. This also files into reporting affects: larger shipments may be more likely to attract public attention, and more monetarily successful vendors might be more frequently targeted for investigation and arrest. Reliance on either source alone could compromise the empirical value of research. Therefore, the two sources were triangulated to balance potential biases and enrich the results.

Second, there is a limitation in the sampling. Both data sources are drawn from points of failure, either vendors who were arrested or parcels which were intercepted. Initially, this seems problematic, as the argument made in the discussion relates largely to the advantageous criminal opportunities granted vendors by the offline context. However, despite the collective focus on operational failure, by taking a closer look – particularly the contrast between the consistent success of vendors in the arrest cases and their immediate failure in the reports – we can see that the results support the argument for criminal advantage rather than undermine it. Much like in the online domain, breaches of anonymity appeared due to vendor error, the context of using post for deliveries, and managing operations from an enclosed space offering significant protections to vendors, especially when coupled with appropriate mitigating measures.

Third, there is a limitation related to language and geographic region. The arrest cases were all drawn from an American repository, which may render the results more specific to that country rather than entirely representative of the global situation. Additionally, the language covered in the news reports was biased towards English, as most of the articles within the LexisNexis database were presented in this language. Consequently, while the results were international, countries with predominantly English-language reporting were emphasised. This resulted in an international perspective that was distinctly Anglo-centric. While this bias reflects the predominant use of English within the darknet and the significant presence of American actors, future research could benefit from adopting a broader approach to investigate this phenomenon.

Fourth, there is a limitation related to the content of this paper. While this work has provided new insights into how several facets of the offline side of darknet drug vending function, and has furthered our theoretical understanding of the advantages that the use of the postal service and an enclosed base of operations have for vendors, it has ultimately been exploratory in nature. Acting as a kind of first step, further research is required to gain a fuller picture of the offline side of darknet drug vending, with aspects such as vendors’ social lives, their sourcing of drugs, and interaction with organised crime proper still waiting to be considered.

Conclusion

While the debate about the applicability of RAT to the online side of cybercrime continues (Leukfeldt and Yar, 2016; Yar, 2005), this research has shown that it may be useful in framing offline activities. Even if the disruption of the time-space convergence remains, by shifting attention towards the offline domain, issues surrounding the virtuality of cyberspace may be avoided, and the crime, may be (partially) conceptualised as RAT intended.

The existing literature has already extensively documented the advantages of the online domain for vendors (e.g., Aldridge, 2019; Bancroft et al., 2019; Christin, 2013; Christin and Thomas, 2019; Décary-Hétu and Giommoni, 2017; Duxbury and Haynie, 2018; Hämäläinen, 2015; Martin, 2014; van Hout and Bingham, 2014; van Wegberg and Verburgh, 2018). By capitalising on RAT, this research sheds light on the advantages of its offline counterpart. Drugs are packed using stealth techniques to evade detection, and shipped through legitimate postal services across long distances, in a largely clandestine manner. Vendors, and their employees, operate out of enclosed spaces that, benefitting from reduced contact with the outside world, can function efficiently, and with reduced risk. Enforcement efforts often rely on prolonged investigations and identifying critical vendor errors to make arrests – something which can pose a significant challenge. It is through these measures that the offline side of darknet drug vending, in a manner similar to the online side, presents advantageous criminal opportunities for vendors.

The confidence vendors show in these safeguards has important implications. Operationally, it highlights the difficulty of intercepting drug parcels through the mail and subsequently apprehending offenders. From a policy perspective, it raises concerns about the misuse of public services for criminal activities. Theoretically, it calls for a shift in research focus towards understanding the dynamics of the offline dimension of internet drug trafficking and how these environments contribute to vendor anonymity.

Implementing more stringent inspections and investigative protocols within postal services could potentially mitigate the shipment of large drug parcels, thereby introducing obstacles to the trafficking process. However, the persistence of darknet vendors in leveraging postal services for drug shipments suggests a resilient adaptation to law enforcement. This study not only emphasises the measures vendors may use to safeguard their anonymity across digital and physical domains, but also underscores the enduring difficulties law enforcement agencies encounter in effectively countering these complex operations.

Footnotes

Acknowledgements

We would like to sincerely thank our colleagues at Transcrime for providing access to their open-source intelligence platform.

ORCID iDs

Thomas Joyce

Maria Jofre

Funding

The authors received no financial support for the research, authorship and/or publication of this article.

Declaration of conflicting interests

The authors declared no potential conflicts of interest with respect to the research, authorship, and/or publication of this article.

Notes

References

Aldridge

(2019) Does online anonymity boost illegal market trading? Media, Culture and Society 41: 578–583.

Aldridge

Askew

(2017) Delivery dilemmas: How drug cryptomarket users identify and seek to reduce their risk of detection by law enforcement. International Journal of Drug Policy 41: 101–109.

Aldridge

Décary-Hétu

(2014) Not an “eBay for drugs”: The cryptomarket “Silk Road” as a paradigm shifting criminal innovation. SSRN Electronic Journal. https://doi.org/10.2139/ssrn.2436643 .

Aldridge

Décary-Hétu

(2016) Hidden wholesale: The drug diffusing capacity of online drug cryptomarkets. International Journal of Drug Policy 35: 7–15.

Bakken

Moeller

Sandberg

(2018) Coordination problems in cryptomarkets: Changes in cooperation, competition and valuation. European Journal of Criminology 15(4): 442–460.

Bakken

Oksanen

Demant

(2023) Capital in illegal online drug markets: How digital capital changes the cultural environment of drug dealing. Theoretical Criminology 27(3): 421–438.

Bancroft

(2017) Responsible use to responsible harm: Illicit drug use and peer harm reduction in a darknet cryptomarket. Health, Risk and Society 19(7–8): 336–350.

Bancroft

(2023) Darknet, bitcoins and the role of the internet in drug supply. In: Ayres

Ancrum

(eds) Understanding Drug Dealing and Illicit Markets: National and International Perspectives. Routledge, 311–324. https://doi.org/10.4324/9781351010245 .

Bancroft

Squirrell

Zaunseder

, et al. (2019) Producing trust among illicit actors: A techno-social approach to an online illicit market. Sociological Research Online 25(3): 456–472.

10.

Barratt

Ferris

Winstock

(2016) Safer scoring? Cryptomarkets, social supply and drug market violence. International Journal of Drug Policy 35: 24–31.

11.

Bhaskar

Linacre

Machin

(2019) The economic functioning of online drugs markets. Journal of Economic Behaviour and Organization 159: 426–441.

12.

Bossler

Holt

(2009) On-line activities, guardianship, and malware infection: An examination of routine activities theory. International Journal of Cyber Criminology 3(1): 400–420.

13.

Broadhurst

Ball

Trivedi

(2020) Fentanyl availability on darknet markets. Trends and Issues in Crime and Criminal Justice 590: 1–14.

14.

Broséus

Rhumorbarbea

Morelatob

, et al. (2017) A geographical analysis of trafficking on a popular darknet market. Forensic Science International 277: 88–102.

15.

Capeller

(2001) Not such a neat net: Some comments on virtual criminality. Social and Legal Studies 10(2): 229–242.

16.

Caudevilla

Ventura

Fornis

, et al. (2016) Results of an international drug testing service for cryptomarket users. International Journal of Drug Policy 35: 38–41.

17.

Caulkins

Johnson

Taylor

, et al. (1999) What drug dealers tell us about their costs of doing business. Journal of Drug Issues 29(2): 323–340.

18.

Childs

Coomber

Bull

, et al. (2020) Evolving and diversifying selling practices on drug cryptomarkets: An exploration of off-platform “direct dealing”. Journal of Drug Issues 50(2): 173–190.

19.

Choi

(2008) Computer crime victimization and integrated theory: An empirical assessment. International Journal of Cyber Criminology 2(1): 308–333.

20.

Christin

(2013) Traveling the silk road: A measurement analysis of a large anonymous online marketplace. In: WWW’13: Proceedings of the 22nd International Conference on World Wide Web (eds Schwabe

Almeida

Glaser

, et al.), Rio de Janeiro, Brazil, 13–17 May 2013. New York: Association for Computing Machinery, 213–224. https://doi.org/10.1145/2488388.2488408 .

21.

Christin

(2017) An EU-focused analysis of drug supply on the AlphaBay marketplace. Available at: https://www.emcdda.europa.eu/system/files/attachments/6622/AlphaBay-final-paper.pdf (accessed 24 November 2021).

22.

Christin

Thomas

(2019) Analysis of the supply of drugs and new psychoactive substances by Europe-based vendors via darknet markets in 2017-18. Available at: https://www.emcdda.europa.eu/system/files/attachments/12104/EDMR2019_BackgroundReport_Darknet.pdf (accessed 24 November 2021).

23.

Cohen

Felson

(1979) Social change and crime rate trends: A routine activity approach. American Sociological Review 44: 588–608.

24.

Cook

Giommoni

Trajtenberg

, et al. (2023) Fear of economic cybercrime across Europe: A multilevel application of routine activity theory. British Journal of Criminology 63(2): 384–406.

25.

Cornish

Clarke

(1986) The Reasoning Criminal: Rational Choice Perspectives on Offending – Criminal Law and Criminal Justice Book Reviews. New York: Springer-Verlag.

26.

Cunliffe

Décary-Hêtu

Pollak

(2019) Nonmedical prescription psychiatric drug use and the darknet: A cryptomarket analysis. International Journal of Drug Policy 73: 263–272.

27.

Cunliffe

Martin

Décary-Hétu

, et al. (2017) An island apart? Risks and prices in the Australian cryptomarket drug trade. International Journal of Drug Policy 50: 64–73.

28.

Curtis

Wendel

(2000) Toward the development of a typology of illegal drug markets. In: Natarajan M and Hough M (eds) Illegal Drug Markets: From Research to Prevention Policy. Crime Prevention Studies, vol. 11. Monsey: Criminal Justice Press, 121–152.

29.

Daly

Shortis

(2024) Breaking Klad: Russia's Dead Drop Drug Revolution. Geneva, Switzerland: Global Initiative Against Transnational Organised Crime. Available at: https://globalinitiative.net/wp-content/uploads/2024/11/Max-Daly-Patrick-Shortis-Breaking-Klad-Russias-dead-drop-drug-revolution-GI-TOC-November-2024.pdf (accessed 5 March 2025).

30.

Décary-Hétu

Giommoni

(2017) Do police crackdowns disrupt drug cryptomarkets? A longitudinal analysis of the effects of Operation Onymous. Crime Law and Social Change 67: 55–75.

31.

Décary-Hétu

Paquet-Clouston

Aldridge

(2016) Going international? Risk taking by cryptomarket drug vendors. International Journal of Drug Policy 35: 69–76.

32.

Décary-Hétu

Quessy-Doré

(2017) Are repeat buyers in cryptomarkets loyal customers? Repeat business between dyads of cryptomarket vendors and users. American Behavioral Scientist 61: 1341–1357.

33.

Demant

Bakken

Oksanen

, et al. (2019) Drug dealing on Facebook, Snapchat and Instagram. A qualitative analysis of novel drug markets in the Nordic countries. Drug and Alcohol Review 38(4): 377–385.

34.

Demant

Munksgaard

Décary-Hétu

, et al. (2018b) Going local on a global platform: A critical analysis of the transformative potential of cryptomarkets for organized illicit drug crime. International Criminal Justice Review 28(3): 255–274.

35.

Demant

Munksgaard

Houborg

(2018a) Personal use, social supply, or redistribution? Cryptomarket demand on Silk Road 2 and Agora. Trends in Organised Crime 21: 42–61.

36.

Duxbury

Haynie

(2018) Building them up, breaking them down: Topology, vendor selection patterns, and a digital drug market’s robustness to disruption. Social Networks 52: 238–250.

37.

Eck

(1994) Drug markets and drug places: A case-control study of the spatial structure of illicit drug dealing . Doctoral Dissertation, University of Maryland, College Park, MD.

38.

Eck

Weisburd

(2015) Crime places in crime theory. Crime Prevention Studies 4: 1–33.

39.

Fader

(2016) Selling smarter, not harder: Life course effects on drug sellers’ risk perceptions and management. International Journal of Drug Policy 36: 120–129.

40.

Felson

Clarke

(1998) Opportunity Makes the Thief: Practical Theory for Crime Prevention (Police Research Series Paper No. 98). Research, Development and Statistics Directorate, London. https://popcenter.asu.edu/sites/default/files/opportunity_makes_the_thief.pdf

41.

Goonetilleke

Knorre

Kuriksha

(2023) Hydra: Lessons from the world’s largest darknet market. Criminology and Public Policy 22: 735–777.

42.

Grabosky

(2001) Virtual criminality: Old wine in new bottles? Social and Legal Studies 10(2): 243–249.

43.

Hämäläinen

(2015) Usernames of illegal drug vendors on a darknet cryptomarket. Onoma 50: 45–71.

44.

Hollis-Peel

Reynald

van Bavel

, et al. (2011) Guardianship for crime prevention: A critical review of the literature. Crime, Law and Social Change 56(1): 53–70.

45.

Jacques

Bernasco

(2013) Drug dealing: Amsterdam’s red light district. In: Leclerc

Wortely

(eds) Cognition and Crime. London: Routledge, 7–20. https://doi.org/10.4324/9780203083482 .

46.

Jacques

Wright

(2011) Informal control and illicit drug trade. Criminology: An Interdisciplinary Journal 49: 729–765.

47.

Jardine

(2021) Policing the cybercrime script of darknet drug markets: Methods of effective law enforcement intervention. American Journal of Criminal Justice 46: 980–1005.

48.

Joyce

(2023) Following the DNM Bible? A crime script analysis of darknet drug vending. Crime, Law and Social Change 80(4): 1–21.

49.

Joyce

(2025) Situating high-level darknet drug vending: An emancipation from open and closed market drug dealing? Trends in Organised Crime. https://doi.org/10.1007/s12117-025-09560-w .

50.

Korshøj

Søgaard

(2024) Hybrid drug dealing: Merging on- and offline spheres when dealing drugs via social media. International Journal of Drug Policy 130: 104509.

51.

Lamy

Daniulaityte

Barratt

, et al. (2021) “Etazene, safer than heroin and fentanyl”: Non-fentanyl novel synthetic opioid listings on one darknet market. Drug and Alcohol Dependence 225: 108790.

52.

Leukfeldt

(2014) Phishing for suitable targets in the Netherlands. Routine activity theory and phishing victimization. Cyberpsychology, Behavior and Social Networking 17(8): 551–555.

53.

Leukfeldt

Yar

(2016) Applying routine activity theory to cybercrime: A theoretical and empirical analysis. Deviant Behavior 37(3): 263–280.

54.

Lusthaus

(2018) Industry of Anonymity: Inside the Business of Cybercrime. USA: Harvard University Press.

55.

Maddox

Barratt

Allen

, et al. (2016) Constructive activism in the dark web: Cryptomarkets and illicit drugs in the digital ‘demimonde’. Information, Communication and Society 19(1): 111–126.

56.

Marcum

Higgins

Ricketts

(2010) Potential factors of online victimization of youth: An examination of adolescent online behaviors utilizing routine activity theory. Deviant Behavior 31(5): 381–410.

57.

Martin

(2014) Lost on the Silk Road: Online drug distribution and the ‘cryptomarket’. Criminology and Criminal Justice 14: 351–367.

58.

Messner

Tardiff

(1985) The social ecology of urban homicide: An application of the ‘routine activities’ approach. Criminology: An Interdisciplinary Journal 23(2): 241–267.

59.

Miró

(2014) Routine activity theory. In: Miller JM (ed) The Encyclopedia of Theoretical Criminology. John Wiley & Sons, Ltd.

60.

Moeller

Munksgaard

Demant

(2021) Illicit drug prices and quantity discounts: A comparison between a cryptomarket, social media, and police data. International Journal of Drug Policy 91: 102969.

61.

Morelatoa

Broséus

De Graziac

, et al. (2018) Forensic drug intelligence and the rise of cryptomarkets. Part II: Combination of data from the physical and virtual markets. Forensic Science International 288: 201–210.

62.

Morgenthaler

Leclerc

(2023) Crime script analysis of drug importation into Australia facilitated by the dark net. Global Crime 24(3): 169–194.

63.

Morselli

Décary-Hétu

Paquet-Clouston

, et al. (2017) Conflict management in illicit drug cryptomarkets. International Criminal Justice Review 27: 237–254.

64.

Moyle

Childs

Coomber

, et al. (2019) #Drugsforsale: An exploration of the use of social media and encrypted messaging apps to supply and access drugs. International Journal of Drug Policy 63: 101–110.

65.

Negri

Townshend

McSweeney

, et al. (2021) Carfentanil on the darknet: Potential scam or alarming public health threat? International Journal of Drug Policy 91: 103–118.

66.

Norbutas

(2018) Offline constraints in online drug marketplaces: An exploratory analysis of a cryptomarket trade network. International Journal of Drug Policy 56: 92–100.

67.

Nurmi

Kaskela

Perälä

, et al. (2017) Seller’s reputation and capacity on the illicit drug markets: 11-month study on the Finnish version of the Silk Road. Drug and Alcohol Dependence 178: 201–207.

68.

Paquet-Clouston

Décary-Hétu

Morsellia

(2018) Assessing market competition and vendors’ size and scope on AlphaBay. International Journal of Drug Policy 54: 87–98.

69.

Parker

(2000) How young Britons obtain their drugs: Drugs transactions at the point of consumption. Crime Prevention Studies No. 11. In: Natarjan

Hough

(eds) Illegal Drug Markets: From Research to Prevention Policy. Monsey, NY: Willow Tree Press.

70.

Petrescu

Gironda

Korgaonkar

(2018) Online piracy in the context of routine activities and subjective norms. Journal of Marketing Management 34(3–4): 314–346.

71.

Potter

(2009) Exploring retail-level drug distribution: Social supply, “real” dealers and the user/dealer interface. In: Demetrovics

Fountain

Kraus

(eds) Old and New Policies, Theories, Research Methods and Drug Users across Europe. Lengerich, Germany: PABST.

72.

Rhumorbarbe

Staehli

Broséus

, et al. (2016) Buying drugs on a darknet market: A better deal? Studying the online illicit drug market through the analysis of digital, physical, and chemical data. Forensic Science International 267: 173–182.

73.

Sandberg

(2012) The importance of culture for cannabis markets: Towards an economic sociology of illegal drug markets. The British Journal of Criminology 52(6): 1133–1151.

74.

Smith

Frank

(2020) Dishing the Deets: How dark-web users teach each other about international drug shipments. In: Proceedings of the 53rd Hawaii International Conference on System Sciences, Maui, Hawaii, USA, 7–10 January 2020. Available at: https://scholarspace.manoa.hawaii.edu/handle/10125/64319 (accessed 30 November 2021).

75.

Søgaard

Bræmer

Pedersen

(2021) Drug Supply, Violence and Exploitation of Vulnerable Groups in Denmark. Report for the European Monitoring Centre for Drugs and Drug Addiction. Lisbon, Portugal: European Union Drugs Agency (EUDA). Available at: https://www.euda.europa.eu/publications/technical-reports/drug-supply-violence-and-exploitation-vulnerable-groups-denmark_en (accessed 5 March 2025).

76.

Søgaard

Kolind

Haller

, et al. (2019) Ring and bring drug services: Delivery dealing and the social life of a drug phone. International Journal of Drug Policy 69: 8–15.

77.

Systema

Piza

(2018) Script analysis of open-air drug selling: A systematic social observation of CCTV footage. Journal of Research in Crime and Delinquency 55(1): 78–102.

78.

Taylor

Potter

(2013) From “social supply” to “real dealing”: Drift, friendship, and trust in drug-dealing careers. Journal of Drug Issues 43(4): 392–406.

79.

Tzanetakis

(2018) Comparing cryptomarkets for drugs. A characterisation of sellers and buyers over time. International Journal of Drug Policy 56: 17–186.

80.

van Buskirk

Bruno

Dobbins

, et al. (2017) The recovery of online drug markets following law enforcement and other disruptions. Drug and Alcohol Dependence 173: 159–162.

81.

van Buskirk

Naicker

Roxburgh

, et al. (2016) Who sells what? Country specific differences in substance availability on the Agora cryptomarket. International Journal of Drug Policy 35: 16–23.

82.

van Hout

Bingham

(2014) Responsible vendors, intelligent consumers: Silk Road, the online revolution in drug trading. International Journal of Drug Policy 25(2014): 183–189.

83.

van Hout

Bingham

(2013) ‘Surfing the Silk Road’: A study of users’ experiences. International Journal of Drug Policy 24: 524–529.

84.

van Wegberg

Verburgh

(2018) Lost in the dream? Measuring the effects of Operation Bayonet on vendors migrating to Dream Market. In: Evolution of the Darknet Workshop at the Web Science Conference (WebSci18), Amsterdam, the Netherlands, 27–30 May 2018. New York: Association for Computing Machinery, 1–5.

85.

Wall

(2007/10) ‘Policing cybercrimes: Situating the public police in networks of security within cyberspace' (Revised May 2010). Police Practice & Research: An International Journal 8(2): 183–205.

86.

Yar

(2005) “The novelty of cybercrime”: An assessment in light of routine activity theory. European Journal of Criminology 2(4): 407–427.