Australian police prosecute man for buying drugs via Tor and Silk Road | Hacker News Reader

Australian police prosecute man for buying drugs via Tor and Silk Road

theage.com.au

38 pointsjval41 comments

They didn't circumvent anything.

(1) over 10,700 clear text msgs about drug dealing (2) announced to a forum probably watched by every police outfit in the world he was in Australia and about to start importing a lot of product and selling locally, basically inviting Aus feds to contact him and set up stings (3) imported drugs directly from a known drug exporting country (netherlands) through probably the toughest customs on earth who scan every package, who no doubt flag everything including envelopes from there for investigation.

I do like his defence of being the village idiot though. Seems to have worked since he's only getting 2-3yrs, which means 1yr and parole.

"Mr Jassar told Judge Murphy that Ms Ormsby was in court and that her piece – Silk Road: The eBay of Illegal Drugs – was the first views on the website by a journalist." lol Adrien Chen, your thunder stolen.

I do agree with all of your advice, but there is something more to this.

If it was a simple package intercept alone, there would be no way for them to link the suspect to SR, let alone link him to a certain SR profile, let alone getting access to private information on that profile (his transaction history, which I assume was given as evidence of the 11 alleged importations).

Either he gave up that information somehow (as the TOR browser doesn't save credentials), used a username he is "known" to use on the clearnet, or the more nefarious possibility:

It could be likely that Aussie feds set up a fake NL vendor account in order to set up a "deal" with that target. This would give them his real name and address (thus linking him to the SR profile) and ultimately establish PC for the raid. By sending him small amounts to establish trust (giving the feds evidence of the 11 "importations") they probably got him with a much larger importation charge then he otherwise would have gotten.

It seems more likely that they seized his computers. The guy clearly wasn't very good at covering his tracks (lots of text messages show that) and he plead guilty - an indication that he was to some extent cooperating with the police.

If they seized his computer they wouldn't know his SR name unless he left SR logged in and the TOR browser open. The TOR browser doesn't save credentials otherwise.

You're giving the guy a lot more credit than he deserves. Beyond the fact you don't have to use the TOR browser to access TOR, it's fairly easy to change the settings to remember passwords. Maybe he was forgetful? Maybe along with his guilty plea he gave them his credentials? Maybe he used the same username and password for everything?

If they'd set up a sting involving a fake seller, it would be in their interest to publicise it. Our drug enforcement process is built around throwing the book at a few people to attempt to discourage many. If people thought that the seller they were buying off was likely to be a cop, that would significantly discourage SR buying.

FWIW, Ormsby has been pointing out that she didn't write anything about Silk Road until months after Jassar first began using SR and she has no idea why her article is involved in the trial: http://allthingsvice.com/2013/02/05/when-a-journo-becomes-th... http://allthingsvice.com/2013/02/05/a-response-to-vexnews/

Most of the time, when a stern announcement is made about how We Will Catch You, they try to hint that they have magical cryptography-busting powers.

All BS, of course. Most such people are charged because Customs open a percentage of all packages entering the country and have a look inside. And it's not necessarily at random; the method for reliably fooling a good sniffer dog has yet to be devised.

Until someone solves the problem that you can't easily do dual key encryption on molecules, people are going to keep getting busted by old fashioned customs and police work.

If he made a mistake, it wasn't some Tor-related misconfiguration. It's that he didn't bribe the right Customs officials.

> the method for reliably fooling a good sniffer dog has yet to be devised

It is indeed surprisingly hard to make an airtight container. A ziploc bag doesn't work. Even setting your drugs in a block of concrete does not work. What does work is enclosing that block with a layer of melted lead and letting that cool down. Of course that might be suspicious in other ways (and expensive).

But to install Tor and then leave such evidence behind on your PC screams of gross negligence. They obviously confiscated his electronic devices and were easily able to identify his SR account and various postings.

Had they not found that, would they have a case if they could only prove someone was sending him drugs in the mail?

I don't think having Tor installed would prove, beyond reasonable doubt, that you did anything.

Having thousands of SMSes discussing what drugs you have for sale might be a bit harder to explain.

No I think they saw his posts on the forum, then contacted him pretending to be a customer or the guy just blabbed when they picked him up. He's not exactly a master criminal I'm sure he told them his user name and everything which is why he got such a low sentence

> Most such people are charged because Customs open a percentage of all packages entering the country and have a look inside.

Oh, so I could get someone arrested by blatantly mailing them drugs? Surely a court would require proof the receiver initiated and intended the drugs to be shipped.

Yep. Though you may eventually be found not guilty by the courts when there is no other evidence around that still doesn't mean the prosecutor won't try to invent evidence, like finding out you used Tor once upon a time through your ISP logs, or something else minor they will blow up to make you look like Scarface.

Also you'll have to spend a huge amount of money on a lawyer, and most likely will be refused bail so could languish in pretrial prison for a year or so.

That's why you never sign for anything if you don't know what it is, in court they claim because you signed for it you ordered it

No. You might squeak past on reasonable doubt.

But if you have unexplained bundles of cash, some drugs, a bunch of weapons and two mobile phones with thousands of messages discussing drug discussions then you might be SOL.

Good points. Though Tor exit nodes can be run by or run under the surveillance of governments.

SR is .onion you don't use exit nodes to get to it. The only way they could get you by running infrastructre is if they controlled enough entrance and internal nodes they could do a timing attack, especially with SMF telling the world when everybody is logged in but why bother, everybody just eventually drops dimes on themselves through massive opsec violations like this one guy who announced the tiny town he lived in and that "cops will never suspect my packages because the place is so small" /facepalm. He's probably the only Tor user for 100 miles

Tor Metrics estimates around 5000 users within Australia, which means that there's probably a very good chance that he is not the only Tor user in his area.

https://metrics.torproject.org/users.html?graph=direct-users...

Australia is kinda big. 5000 users is ~593 square miles per Tor user.

The Australian population is heavily urbanised. Averaging the population over the landmass leads to silly conclusions.

I would imagine these sites would also run SSL making this point moot.

.onion sites don't need SSL as Tor traffic itself is already encrypted.

Ahh, I didn't understand how they worked; I thought exit nodes were still necessarily used.

I don't think they circumvented Tor. The police tracked him via mail deliveries, then just seized all his computers and mobile phones to get evidence.

Thanks for that, I'll change the article title.

I was going off this Ars article which made it seem as though the Australian cops were quite suggestive, but you're probably right.

http://arstechnica.com/tech-policy/2012/07/australian-cops-t...

Yea, this is just a really stupid person.

I really wish governments would stop policing the substances we put into our bodies. It really is none of their business.

It's amazing the stupid things people do to compromise their own identity on Tor. You could take all of my computers and you'd never know that I've used Tor (unless you installed a hardware key logger and then replanted the device)

Or viewed your comment history on HN.

I guess I'm fortunate that I live somewhere where it's not illegal to admit to using Tor. My point was more simple that Tor isn't compromised.

Or looked at your ISP logs. Did you use Obfsproxy every single time or tunnel Tor through a VPN to your bridge node? probably not

No-one sane does anything seriously criminal trough their own link. I built a simple directional wlan antenna. In my small city, within range of my balcony, there are some 300 open or WEP-protected networks. Not that I'd ever steal someone else's internet...

Breaking into someone's network is quite a nasty offence in itself. In Australia (where the story is from), that's hundreds of thousands in fines and jail time.

You wouldn't steal a car...

If you're doing it right you aren't doing it at home.

Wouldn't a VPN be good enough?

They can still monitor traffic peaks and match those to when criminal activity occurred.

Would that hold up in court? Anyway, I would just saturate the VPN.

Where are there resources someone can look at to not do those stupid things? I've wanted to use Tor for a while but I always got the impression it was a waste of time because it seems pretty easy to (not) do something that destroys the anonymity.

care to shed some light on how you accomplish this?

https://tails.boum.org/

What a great news for our free civilization.

Drug free society ruled by iron fist!

Reply on news.ycombinator.com