XFTFSecurity For the Folks

Lesson 6.5

Safe Research Practices

Learning Objectives

  • After this, students can explain why dark web research needs written authorization and legal guidance before it starts.
  • After this, students can describe isolated research environments (Whonix, Tails) and Tor Browser’s security levels.
  • After this, students can list the actions researchers must never take on underground sites, and why.
  • After this, students can document findings safely without collecting harmful or sensitive material.
  • After this, students know exactly what to do if they encounter child sexual abuse material, and how to protect their own wellbeing.

Class rule: Students do not browse the dark web for this course. Dark web experience comes from intelligence platforms, Flare Academy’s Darkroom lab, and an instructor-led demo of legitimate onion sites. This file describes how professionals work so students understand the discipline involved.

Dark web research can go wrong legally in ways normal OSINT rarely does. Before any professional engagement:

Get it in writing

  • Who authorized it and for what purpose (e.g., monitoring for the organization’s leaked data)
  • Scope — which sources, which search terms, which organizations and people
  • Allowed actions — passive viewing only? Creating accounts? Interacting with anyone? (Most programs: passive only.)
  • Data handling — what can be collected, where it’s stored, when it’s deleted
  • Escalation — who to contact if something unexpected or illegal is found

Laws differ by country and state, and several areas are risky:

Risk Why it matters
Accessing systems Logging into accounts or bypassing controls can violate computer crime laws (e.g., the CFAA — see Module 2).
Handling stolen data Downloading, keeping, or using breached data raises legal and privacy issues.
Buying anything Purchasing stolen data or services funds crime and can itself be illegal.
Sanctions Some markets and services are sanctioned. For example, the US sanctioned the Hydra marketplace in 2022 after its seizure; paying a sanctioned entity can violate sanctions law.
Illegal content Child sexual abuse material (CSAM) is illegal to view, download, or possess — see Section 6.

This is an overview, not legal advice.

Organizational policy

Mature threat intel teams have written policies covering all of the above, plus approval processes for any sock puppet accounts (see Module 8 OPSEC).

2. Isolated Research Environments

Never research underground sources from your everyday computer or browser. The goals are to protect your identity, protect your organization’s network, and contain malware.

Whonix

  • Runs as two virtual machines:
  • Whonix-Gateway runs Tor and acts as the network gateway.
  • Whonix-Workstation runs your applications on a completely isolated network that can only reach the internet through the Gateway.
  • Because the Workstation has no direct route to the internet, applications can’t accidentally leak your real IP address — even if something inside the Workstation is compromised.
  • Good fit for analysts who need a persistent research VM.

Tails

  • A portable operating system you boot from a USB stick.
  • Routes connections through Tor and is designed to leave no trace on the computer by default (“amnesic”) — everything is wiped at shutdown unless you set up encrypted persistent storage.
  • In September 2024, the Tails project merged its operations into the Tor Project; Tails continues as its own product.
  • Good fit for one-off research sessions.

General practices

  • Use a dedicated research machine or VM; take snapshots and revert after sessions.
  • Never log into personal or work accounts in the research environment.
  • Keep the research environment separate from the corporate network where possible.
  • Use approved research personas only (see Module 8 OPSEC for sock puppets, VPN/Tor considerations, and common mistakes).
  • Commercial “managed attribution” browsers and research platforms exist for organizations that need this at scale.

3. Tor Browser Security Levels

Tor Browser has three Security Levels (shield icon → settings):

Level What it does When to use
Standard (default) All browser features enabled, including JavaScript Normal browsing of legitimate sites
Safer Blocks JavaScript on non-HTTPS sites; hardens JavaScript elsewhere (e.g., disables the just-in-time compiler); restricts some fonts and media Moderate-risk browsing
Safest Disables JavaScript everywhere, plus many other features attacks have historically used Underground research — accept that some sites will break

Additional habits:
- Restart Tor Browser after changing the security level so it fully takes effect.
- Don’t install extensions — they make your browser unique and add risk.
- Don’t open downloaded documents while online; files can contain content that connects to the internet outside Tor and reveals your real IP. (Better: don’t download at all.)

4. The “Never” List

Never… Why
Download files Malware, illegal content, stolen data you now possess
Buy anything — data, access, services, “samples” Funds crime, may be illegal (stolen goods, sanctions), and is often a scam anyway
Engage, message, or negotiate with threat actors without explicit authorization and training Can tip off actors, compromise investigations, create legal exposure, and put you at risk. Undercover engagement is specialized professional work. (Flare’s Darkroom lets students practice this safely with AI-simulated actors.)
Use your real identity — names, emails, phone numbers, usernames, writing quirks Criminals research the researchers
Log in with leaked or stolen credentials Unauthorized access — a crime regardless of intent
Post, comment, or contribute Can facilitate crime and expose you
Enable JavaScript or plugins “just to make the page work” Most browser attacks need them
Use a personal or corporate daily-use device Contamination and exposure
Go beyond scope because something looks interesting Scope protects you legally
Share screenshots containing victims’ personal data casually Victims deserve privacy; minimize and redact

5. Documentation Without Collecting Harm

Good documentation proves what you saw without making you a warehouse of stolen or harmful material.

  • Screenshot instead of downloading. Capture the page with the URL, date, and time visible.
  • Record metadata for every finding: full URL, page title, date and time (UTC), source type, how you found it, and your confidence level.
  • Hash your evidence files (e.g., SHA-256) if they may be used in legal proceedings, and maintain a chain of custody.
  • Redact personal data you don’t need. Record that “credentials for 12 Company X accounts were listed,” not the passwords themselves.
  • Never store plaintext passwords in notes, tickets, chats, or reports.
  • Store evidence encrypted, restrict access, and delete it on schedule.
  • Prefer platform exports — intelligence platforms keep archived copies, so you can reference their record instead of saving risky content yourself.

(See Module 7 Verification & Reporting for full documentation and reporting practices.)

6. If You Encounter Child Sexual Abuse Material (CSAM)

Some underground link lists and sites contain CSAM. Viewing, downloading, saving, or sharing it is a serious crime and harms real children. If you ever encounter it:

  1. Stop immediately. Close the page. Don’t scroll, click further, or “investigate.”
  2. Do not screenshot, download, save, copy, forward, or show it to anyone — including to “prove” what you saw.
  3. Report it in the US to the National Center for Missing & Exploited Children (NCMEC) CyberTipline:
    - Online: report.cybertip.org
    - Phone: 1-800-THE-LOST (1-800-843-5678)
    - Available 24/7. The CyberTipline is the US’s centralized reporting system for online child exploitation. Provide the URL and where you found it if you have it, without revisiting the content.
  4. Tell your supervisor/instructor and follow your organization’s policy, including involving legal counsel.
  5. Outside the US, report to your national hotline or law enforcement (verify the right hotline for your country before class).

Note for professionals: US law places specific reporting obligations on electronic service providers to report apparent CSAM to NCMEC (verify details of 18 U.S.C. § 2258A before class). Individual researchers should follow their organization’s policy and legal counsel’s guidance — and report.

7. Analyst Wellbeing

Dark web work can expose analysts to violence, abuse, extremism, and the stolen private lives of real victims. Being affected by that is normal, not a weakness.

Risks
- Vicarious (secondary) trauma — stress reactions from exposure to others’ trauma
- Desensitization, anxiety, sleep problems, burnout

Individual practices
- Prefer text-first tools and platforms that summarize content over browsing raw pages.
- Keep images off or blurred where possible; use grayscale or smaller thumbnails.
- Limit session length and take regular breaks.
- Decompress after sessions — don’t go straight from research to sleep.
- Talk to peers, supervisors, or a counselor; use employee assistance programs where available.
- Know your limits and say so — it’s okay to step away from a task.

Organizational practices
- Rotate difficult duties and avoid solo exposure to the worst content.
- Provide regular debriefs, access to mental health support, and clear escalation paths.
- Train analysts before exposure, not after.

8. Pre-Flight Checklist (Professional Use)

  • Written authorization with scope, allowed actions, and escalation contacts
  • Legal counsel has reviewed the plan
  • Isolated environment ready (Whonix VM, Tails, or approved platform); snapshot taken
  • Tor Browser set to Safest and restarted
  • No personal or work accounts logged in; approved persona only
  • Documentation template ready (URL, UTC time, source, confidence)
  • Encrypted evidence storage ready
  • CSAM reporting procedure known (NCMEC CyberTipline)
  • Session time limit set; someone knows you’re doing this work

Key Terms

  • Authorization / rules of engagement: Written permission defining what research is allowed.
  • Whonix: A two-VM system (Gateway + Workstation) that forces all traffic through Tor.
  • Tails: An amnesic, Tor-routed operating system that boots from USB; now part of the Tor Project.
  • Amnesic: Designed to forget everything at shutdown.
  • Security Levels (Tor Browser): Standard, Safer, and Safest settings that disable risky features.
  • Chain of custody: A record showing who handled evidence and when, proving it wasn’t altered.
  • Managed attribution: Controlling how your online research appears to others so it can’t be traced to you or your organization.
  • CSAM: Child sexual abuse material.
  • NCMEC CyberTipline: The US centralized reporting system for online child exploitation.
  • Vicarious trauma: Emotional effects from repeated exposure to other people’s trauma.

Key Takeaways

  • Dark web research starts with written authorization and legal guidance — not curiosity.
  • Use isolated environments: Whonix (Gateway + Workstation VMs) or Tails (amnesic USB OS, now part of the Tor Project).
  • Set Tor Browser to Safest (JavaScript off everywhere) for underground research.
  • Never download, buy, engage, log in with stolen credentials, or use your real identity.
  • Screenshot and record metadata; never store plaintext passwords or unnecessary personal data.
  • If you encounter CSAM: stop, don’t save or share, and report to the NCMEC CyberTipline (report.cybertip.org, 1-800-843-5678).
  • Protect your wellbeing — limit exposure, take breaks, and talk to someone.
  • In this class: platforms, Darkroom, and legitimate onion site demos only.

References

Free to use, copy, change and teach. Security For the Folks dedicates this course to the public domain under CC0 1.0 Universal: no permission or credit needed. Quoted material and the sources it links to belong to their own authors.