Strategies for the Shadows: Protecting your Company’s IP Rights on the Dark Web

09 July 2018

Companies already face formidable challenges in protecting their IP rights online, but a new threat is emerging from the shadows - the growing incidence of IP rights infringement on the enigmatic and nebulous dark web.

Although for many the dark web is still largely a mystery, it is critical that companies educate themselves and understand the potential risks it poses to their business, especially as dark web users become more numerous in the wake of increasing tech literacy and growing privacy concerns on the surface web.

The surface web includes all public content, i.e. anything that can be indexed by a search engine. There's also the "deep web", which comprises all content protected by login credentials and which cannot be indexed by a search engine. Your private social media profile and your corporate intranet, for example, are considered part of the deep web.

The dark web, by contrast, is a place of complete anonymity, where the location of host servers and users alike are hidden, and where websites cannot be indexed by search engines. Websites must be indexed manually, and everything is typically paid for in untraceable cryptocurrency. It requires a special browser to gain access (such as the TOR browser) and is most prudently surfed with cyber safety precautions in place, such as a dedicated computer system, a VPN, and a unique, hard-wired internet connection.

Given its anonymity, the dark web is an ideal location for illicit activities to take place.

The dark web is widely accessed for its online marketplaces (such as the Silk Road), where all manner of goods and services can be purchased, including goods and services that may infringe your company's IP rights. For example, the sale of counterfeit goods is extremely common on the dark web, from knockoff watches and handbags to sophisticated counterfeit pharmaceuticals. Other items are also for sale on the dark web, such as pirated digital products, product keys, trade secrets, account information, passports and IDs, and credit card information.

At this time, there is a fairly limited customer base on the dark web, as only a small percentage of the general public know how to access the dark web and how to deal in cryptocurrency. Enforcement is also difficult on the dark web given the anonymity of the users and the untraceable nature of cryptocurrency. There is no regulated entity to turn to, and law enforcement professionals will only get involved in limited circumstances, such as when there is a health and safety risk to the general public.

However, now is a good time for monitoring and intelligence-gathering to assess whether your company faces a credible and ongoing risk of infringement of its IP rights on the dark web. This intelligence is key to developing adequate prevention measures and an enforcement strategy for your company. For example, monitoring relevant dark web discussion boards and setting up test buys could reveal information about an infringer's location, which would allow your company to take advantage of traditional enforcement techniques like cease and desist letters and court-ordered search warrants.

In general, if you are considering accessing the dark web in order to monitor and enforce your company's IP rights, you should not do it alone and ideally should leave it to the professionals. The dark web poses very serious dangers to you and your company given its unsavoury users and content.

Moreover, dark web monitoring and enforcement may not be an area your company needs to allocate its resources. For example, if your company already faces a large-scale counterfeiting problem on the surface web and there are only rare, sporadic counterfeit sales of your products on the dark web, then dark web monitoring and enforcement may not be a priority. By contrast, if you are a pharmaceutical company and consistent, routine sales of health-hazardous counterfeit pharmaceuticals occur on the dark web, you may be wise to invest in dark web monitoring and enforcement. Similarly, if you are a company that holds sensitive trade secret information or extensive customer account information, you may benefit from ensuring adequate cyber protection mechanisms are in place to minimize your risk exposure on the dark web.

Legal professionals and professionals who specialize in cyber security can help you develop a dark web strategy that is best suited to your company's needs.

NOT LEGAL ADVICE. Information made available on this website in any form is for information purposes only. It is not, and should not be taken as, legal advice. You should not rely on, or take or fail to take any action based upon this information. Never disregard professional legal advice or delay in seeking legal advice because of something you have read on this website. Gowling WLG professionals will be pleased to discuss resolutions to specific legal concerns you may have.