Tor network fundamentals for dark web investigators

The Tor network is a layered anonymity architecture that routes traffic through a chain of volunteer-operated relays, encrypting each hop so that no single node knows both the origin and destination of a connection. For investigators, Tor is not primarily a privacy tool: it is the access layer for .onion hidden services, the delivery mechanism for anonymous source submissions via SecureDrop, and the infrastructure underpinning legitimate journalism platforms operated by outlets including ProPublica and the BBC. Knowing how Tor works, where it fails, and how to use it without compromising an investigation is a prerequisite for any dark web research workflow.

Tor access is appropriate when a target site is unreachable via standard browsers, when source identity requires protection, or when institutional IP exposure would compromise an operation. The network imposes operational constraints, and those constraints shape investigative method: a maximised browser window reveals screen resolution; a personal account login immediately deanonymises a session; a document opened outside the sandboxed environment can connect to clearnet infrastructure. Each constraint, treated in isolation, appears manageable. The pattern of failures, when any one is overlooked, is not.

DRK-002 sets out the methodology for accessing, documenting, and preserving dark web content to evidentiary standard.

A PDF version of DRK-002 is available below for Signal subscribers.