[1] https://www.justice.gov/opa/press-release/file/982821/downlo... (pdf)
This is true, but it dangerously misses the point. Every time someone gets taken down, the know-it-alls on various fora sneer and go "Ha! What terrible opsec! I wouldn't have made that mistake!" No, you would've made some other mistake.
To run a darknet market and not get caught, your opsec has to be perfect. Every second, every minute, every day, every person involved, forever. That is simply not possible once an operation exceeds a certain size. Like the IRA once said: "We only need to be lucky once. You need to be lucky every time". This is the "defender's dilemma" that guarantees you will be caught as t goes to infinity: sooner or later, you'll make some mistake that burns you.
Focusing on the specific mistakes made by bust-ees only boosts your confidence and ignores that you, in their situation, would've leaked information somewhere else.
A good argument for not getting too greedy and keeping things small. It's the nail that sticks out that gets hammered down.
One of the cornerstones of OPSEC is persona creation & management. This is orders of magnitude easier to perform in cyberspace than in real life, and can be used as a catch-all safety -- for exactly when mistakes are made and layers are compromised --.
You will make many many mistakes, but part of a well-implemented OPSEC strategy, is to have those mistakes land in a compartment, an illusionary persona that you created out of thin air. Operation size has nothing to do with it and should be completely irrelevant when the compartmentation strategy used is solid.
So that these are the stated reasons is no indication that they are the real reasons.
They are, in fact, so very, very convenient the they smell like parallel construction to me.
Might not be, but they certainly aren't good evidence that parallel construction isn't going on.
On the other hand, the evidence that parallel construction is going on appears to be a belief that everything is parallel construction.
1) They were investigating AlphaBay for nearly 3 years 2) They came upon somehow control of an email address which contained 3 year old mail that contained the password reset email 3) They are capturing and storing large amounts of tor traffic much like the NSA does on clearnet see: xkeyscore
This isn't really explained in the indictment
That seems like one plausible possibility.
When he was busted he was logged in to the site, and had several passwords/keys stored in plaintext on his machine.
Multiple OpSec failures.
Good analysis here: https://medium.com/@thegrugq/dark-net-trap-545ae5dd8476