How Journalists Research the Dark Web

Reporters do not need a hoodie to open Tor Browser. They need a reason, a clean setup, and an editor who will kill a story that cannot be verified. The dark web shows up in newsrooms as a leak inbox, a market they are writing about, a forum where a fraud pattern appears first, or a place a source already is. It is a beat, not a personality. This page is a workflow. It is not a permission slip and it is not legal advice.

Why a newsroom goes there at all

Four recurring assignments:

A source already used the overlay. They will only talk on an onion form. You meet them where they are; see SecureDrop.
The story is the market or the forum. You cannot describe Incognito or Dread from a press release alone.
The story is a fraud or a leak that started there. Ransomware blogs, dump forums, phishing kits. The who uses the dark web explainer is the demographic map; you are here for method.
Censorship and exile reporting. A source in a blocked network can reach you on Tor when mail is watched. That is a connectivity story, not a crime story.

Is the dark web illegal? — opening the browser is not the offence in the US or UK. Downloading certain material, paying for drugs, or sitting on undisclosed crime-scene files is. Draw that line before you log in, not after a folder appears.

A boring safety setup

Use the official Tor Browser, installed from torproject.org and signature-checked. Do not install random extensions. Do not log the research identity into a personal Google account "just this once."

If the assignment is more than a quick look at a public onion, use a dedicated profile or a dedicated machine. Tails or Whonix exist for the cases where a later seizure of your laptop would mix source material with your family photos. Most daily reporting does not need that. A story about a seized market's clearnet court file does not need it at all.

Keep two identities apart: the reporter who emails a press officer, and the session that opens an untrusted onion. OPSEC failures in this field are usually that mix, not a failed handshake.

Verification: screenshots are not a story

Anyone can generate an onion, put a skull on it, and type "we have the documents." Rules that save careers:

Hash and archive the page you saw (WARC or a hashed HTML snapshot) with a time. The next visit will differ. Directories in particular lie; see Hidden Wiki risks.
Do not treat a vendor chat as a fact. Markets are theatre. Confirm with a second independent source, a court record, or a dataset you can explain.
Fake leaks are a genre. A "CIA dump" that is last year's public PDF with a new title still fools people. Compare hashes to known public files.
Signed statements only count after you pin the key. A "Good signature" from a key created yesterday is a sticker.
Photos of a "control panel" are cheap. Ask what would be true in the world if the screenshot were real, then check that.

The dark web news page is about outlets; this is about not becoming one of the outlets that launders a phishing site.

Sources and SecureDrop

If a person wants to send files, give them the onion printed on your newsroom's HTTPS site, or tell them to find it there themselves. Do not paste onions into Twitter DMs. Do not invent a Gmail "for this project."

On your side: treat incoming files as malware. Open them on an isolated workstation. Strip metadata before the files land in a general-purpose CMS. Privilege is a legal doctrine, not a folder name — talk to counsel about notes, and about what you will refuse to accept (certain categories of illegal imagery are not "research," they are a crime to possess).

Lines that are not worth crossing

Do not buy illegal goods "to see if the market works." Courts have seen that defence. It goes badly.
Do not download collections you cannot legally hold. "I needed it for the story" is not a category in the statute.
Do not run your own phishing clone to "catch scammers."
Do not publish working exploit links or live card data.
If a lawyer in your jurisdiction has not signed off on a plan, you do not have a plan.

None of that prevents you from reading unsealed indictments, Chainalysis blog posts, Tor metrics, or a market's public front page long enough to describe the layout. Most good dark-web stories are court-record stories with a little overlay colour.

Frequently Asked Questions

Do I need Tor to write about the dark web?

Often no. Seizure press releases, sentencing memos and company blogs carry most of the facts. Use Tor when the thing you must see is only on an onion, or when a source will only submit that way.

Can a reporter be prosecuted for visiting a market?

Visiting is not the usual charge. Buying, hosting, or possessing illegal material is. Your newsroom's counsel, not a blog, owns that answer for your country.

How do I know a leak is real?

You mostly know after you have matched it to something in the physical world: a source with access, a document number, a court file, a company admission. The onion it arrived on is the least interesting part.

Should I use a VPN as well?

Only if you have a specific reason (a hotel that blocks Tor, a need to hide Tor use from a local network). It is not a default upgrade. See Tor over VPN.