How the dark web ties to Columbus data breach
COLUMBUS, Ohio (WCMH) -- The dark web is a phrase you may have read a lot over the last few months not just from NBC4, but Columbus leaders are talking about it as well.
The massive ransomware attack on the city led to hundreds of thousands of people’s private information on the dark web. NBC4 Investigates first showed you the extent of the breach, despite the mayor’s initial claims the stolen data lacked value.
Now, NBC4 Investigates is fact-checking city leader’s claims about the dark web.
Experts took us on to the dark web again to show what else is out there, other than the city’s data. When you break it down, the dark web is really about privacy.
City leaders have claimed that in order to access the dark web, you need a certain level of expertise or are only doing it for criminal reasons. This isn’t true.
"The whole idea with this dark web is to be more anonymous," CMIT Solutions Owner Daniel Maldet said.
"Just because someone wants that in particular for themselves doesn't necessarily mean they're engaging in illegal activity," Electronic Frontier Foundation (EFF) Director of Engineering Alexis Hancock said. EFF is a non-profit that defends digital privacy and free speech.
"Privacy is important for everyone," Hancock said.
Privacy is what the “dark web” was created for, but that’s not the message from city leaders.
“It takes a level of sophistication to get to this information on the dark web, no one is just Googling 'dark web' to find this," City Attorney Zach Klein said in a press conference on Aug. 29.
Cyber security experts say otherwise.
An affidavit written by the city's Department of Technology Director Sam Orth says: “Only individuals willing to themselves navigate and interact with the criminal element on the dark web, who also have the computer expertise and tools necessary to download data from the dark web would be able to do so.”
That was written when the city filed the lawsuit against the whistleblower who helped NBC4 Investigates uncover the true extent of the breach. The lawsuit has been dropped and the whistleblower can no longer show us the city data, but other cybersecurity experts maintain Orth’s claims in that legal document are incorrect.
Getting to the dark web just takes a special browser. The most common dark web browser is called "Tor."
"You don't need sophisticated tools to access Tor,” Hancock said. “It's simple as downloading a browser and opening it and then you are on the Tor network. As far as only criminals being on the dark web, that is also not true. Yes, criminals exist on the dark web, but criminals also exist on a surface web.”
Tor is often used by activists and those under oppressive foreign regimes, including journalists.
"You’re able to access things more readily even if your government is blocking it, Tor can possibly help you reach that website," Hancock said.
The dark web was first developed as a way for U.S. intelligence members to communicate anonymously.
"These research projects were not only seen as beneficial to different government operations, but it was eventually packaged and able to be utilized by the general public," Hancock said.
Entities such as the CIA and the BBC have sites on the dark web as well. We got a look, and it took seconds: open a laptop, open Tor, find the link to the site you want to go to, and there it is. What's different from a regular online search is no one knows you visited the sites on the dark web.
"It isn't that difficult and there are YouTube videos out there that can explain ways in which to access the dark web,” Maldet said. “Again, we don't advise that people do that, but it's not that difficult to do.”
We reached out to the city attorney and Department of Technology asking if Klein and Orth stand by their statements about the dark web. Klein said he did, and Orth has not responded.
Columbus is offering free credit monitoring to anyone who is afraid their information is compromised. The deadline to sign up is next Friday, Nov. 29.