The illicit market is where the information about individuals ends up after it is stolen or hacked by criminals from any of the discussed domains, including data brokers. There are two primary types of illicit market activity: criminal networks and statesponsored data theft and collection. Criminal networks are more likely managing the stolen data in spreadsheets rather than “organizational databases.” Data from statesponsored theft are ending up in large databases and being correlated with other data sets from other sources, including publicly available data (Figure 16.1).

Relationship to Other Domains

Actors from the illicit market are actively involved in stealing data from all of the other domains articulated in this research.

Description of the Illicit Market

The illicit market is where data stolen by criminals from large databases of PII are traded. Just like the data broker industry, there is no enrollment process for individuals and no direct connection between individuals and the entities stealing their data. The main difference between the illicit market actors and the data broker industry is that data brokers operate legally, buying data from their sources and then reselling it to other legitimate businesses. The illicit market actors are stealing the data of people and using it for criminal activity themselves or repackaging the data to sell to criminal enterprises.

We can also compare this domain to the categories of surveillance. It is not voluntary known surveillance because people don't agree to it. If you actually know your data was stolen because of a data breach notification, your condition is similar to the involuntary known state of surveillance. Individuals who know their data has been stolen can take steps to try and mitigate harm with credit freezes and creditmonitoring services. When individuals do not know their data has been stolen, it is similar to involuntary unknown surveillance.

The information asymmetry created between an individual and the actors in the illicit market is very high. This is especially true given that it is an entirely illegal activity. So, unlike some data brokers, illicit market actors have little or no incentive to provide a way to see information they hold about individuals.