It Was DPR, in the Tor HS, With the BTC
grugq.github.io
grugq.github.io
In case of living life on the edge (of legality), all it takes it one slip-up and then you're doing 40 years of hard time. In terms of predator-prey, hackers will now always be running and desperately looking behind them.
Good advice: Predators always love playing with their prey, so make sure you're not being manipulated.
and especially in an environment where your peers sing like canaries because they usually lack the (violence-driven) codex regarding the treatment of snitches. and yeah, I remember the case of that tortured guy from that cc forums, but from what I read about all those arrests, it's an exception that proves the rule.
This is what happens when you remain silent rather than turn informant [3]. I have immense respect for Stephen Watt for keeping his honor, but I would not recommend taking that path to anyone in a similar situation. Lawyer up, and angle for the best plea deal you can get.
[0] http://grugq.tumblr.com/post/61946725012/hizb-allah-resurrec...
[1] http://grugq.tumblr.com/post/59968838056/mastering-secret-wo...
[2] http://tensmiths.files.wordpress.com/2012/08/15914572-ira-gr...
Yeah, you are absolutely right, but still I wouldn't compare lulzsec to the orgs you mentioned or mobsters. Lets get this straight - no hacktivist or cracker was found hanging on the cell bars or shot in the woods, that's just not a comparable environment to serious organized crime. If nobody is afraid even of getting their knees broken, not to mention ditched in a hole, is there anything stopping them from snitching the minute le shows up at the door? Snitching is punishable for a reason, and there is a reason that ruleset goes all the way down to street level crime or even minor offences (that last one actually differs among places for cultural and political reasons).
Read the links I posted. Read this analysis of evolving terrorist tradecraft: http://grugq.tumblr.com/post/61952592764/evolution-of-terror...
Modern clandestine organisations use strict compartmentation to limit the information available to operatives so that informants have limited information. Examples of this exist even in the movies: http://grugq.github.io/blog/2013/03/11/opsec-lessons-from-re...
It is the lack of self preservation forward thinking of the ones not caught.
Crime syndicates usually have insurance for families for people caught, and assurance that when they came out they will keep their share. If they didn't have this benefit they would be talking the same.
One of the reasons I stopped being a hacker a long time ago. You never know how good you've covered tracks until the Feds show up in your dorm room, take you to a windowless room and grill you for about an hour, scaring the shit out of you in the process.
I was lucky, I only lost some network privileges. Today the stakes are way higher and the Feds have some insane resources at their disposal. It's a zero sum game to them. You will lose every time.
Nowadays the rate at which you'll get fucked hard is pretty fast, and they won't waste their time washing you through the legal system instead of letting you stew in a holding cell. Sure you'll get your plea bargain, but you won't like the part where you're forced to work as an informant immediately.
There are some basic lessons here that are applicable to anyone using the internet, even just for casual reasons. That includes your parents or grandparents. What do you think the chances are that they would be able to proactively defend themselves against someone tearing apart their private lives based on information they didn't even know was public?
-Not sharing/linking email addresses an alias
How is this relevant? This could be as basic as not wanting to link your persona as a member of the town council to your postings in a World of Warcraft forum.
Even if your life is mundane and none of your hobbies are embarrassing this is still important. Forum posts, which most users treat as casual chat, along with many social media interactions are permanent, public, and searchable.
There is no compelling reason to allow anyone in the world to know an enormous amount of personal details about you. At least on your Facebook page, if Zuckerburg hasn't recently screwed with your privacy settings, you are narrowing the number of people who can look at these things.
I'm not going to endorse any particular services, but many sites allow you to search accounts by email address. Amazon, in particular, can reveal your public wishlist based on email address (rossulbricht@gmail.com shows an account but not a wishlist.) You can figure out a lot about a person from their wishlist + reviews.
Quite frankly I think this all is very relevant and mass marketable to anyone building tools and products to firewall personal information.
(It doesn't still make me root for the FBI though)
I also strongly suspect that many of the undercover agents were acting as agent provocateurs, urging him on towards more extreme positions and actions. The Maryland Indictment reads like a set piece put-up job. I can believe that it was an operation with the dual intent of (a) documenting DPR committing a heinous crime, and (b) unmasking DPR, most likely though the wire transfer. Even if (b) failed, they would still have (a) to prosecute him with later.
http://www.reddit.com/r/Anarcho_Capitalism/comments/1nlyfd/l...
Edit: There's always still the possibility that DPR was aware he wasn't hiring hitmen, but felt it was the best negotiation tactic.
DPR then asked to be put in contact with the upstream supplier so he could "sort something out".
The timeline of events is here: http://grugq.tumblr.com/post/62928607375/dread-pirate-robert...
Shipping companies semi-frequently seem to find themselves in situations where the wake up and think "Oh shoot, I need to hire some mercenaries." It takes some work to get into that sort of situation, but does that imply that they shouldn't have gotten themselves into that pickle?
In the case of mercenaries or bodyguards or whatever, that is exactly the kind of precaution one can take to avoid being in a truly nasty pickle.
Kind of off topic, but suppose "FC" were arrested, could this person be charged with malicious entry into an otherwise illegal enterprise?
Do those legal rights extend to people who had already been breaking laws?
Obviously, a bank robber has a right to not to be murdered by another bank robber. But can the other bank robber be charged with stealing the victim's ill-gotten money in addition to the murder?
I think the Feds played him (Ross Ulbricht) in this case and totally set him up for a fall. I accept that he stepped off that cliff himself, but I think it is likely that he was guided the whole way there by the Feds.
After this first hit, orchestrated from start to finish (?) by the feds, the second one seemed easier. He had learned to live with himself after the deed was done, he had pushed beyond that moral barrier of "don't have other people tortured and killed", and he had learned that violence can solve problems.
Now, as to whether this second "hit" was just him negotiating with a scammer, or whether he believed he was actually having someone killed. I think it is clear that without that first job, that first hand held walk through the dark side of the underground, he wouldn't have reacted that way.
I think he would have been less susceptible to the manipulations of the feds if he was in a normal social peer group. If he had some rational people who weren't inside the Silk Road bubble who could say "you want to have someone killed because they stole some SHA256 hashsums? Are you fucking insane?!?"
If you do have the assumption, axiom, belief, whatever, that drugs are moral and ease suffering, and that releasing data on these people will lead to long lives in prison, causing a chain of disastrous effects on many families, then yes, stopping the person that is trying to harm these other people may be considered.
Many people die each year due to the USG's war on drugs policy, and it has a violent affect on many of the countries to the south of Texas. Just for a bit of context/scope.
Edit: On second reading, I actually dislike your rhetoric even less. You can rephase anything as a series of immediate actions. It's not the harm of "reporting to law enforcement" it's what happens next.
To arrive at another outcome, you'd need to weigh the suffering and somehow decide that a single person's life, who is actively trying to hurt others (that is, they aren't an innocent bystander), is somehow worth more. In some scenarios this can be a philosophical debate (how much small annoyance to millions of people is one other person's life worth?), but with an active adversary and no other course of action, it seems like the only rational decision.
You seem to be indicating that in this scenario you'd always value a single person's life (despite their actions) above many others' suffering. Is it because you view LE as morally superior, or do you have another set of priors that shape your reasoning?
Anyways, my original question to you (and on other threads, like where you appear to defend seizure actions) is where exactly are you getting your priors? In all your replies you just rephase things as if we're supposed to draw the right conclusion.
And I'm only asking because it's you, someone proven in security and rather insightful on many threads.
If it's just an innate, fundamental belief you hold, fine. I was just wondering if you had some special source or logic that lets you decide these things so absolutely.
That makes zero sense, if $500K was actually owed. I doubt DPR was so naive to think that instantly a new contact would come online and trust him completely and be willing to negotiate a murder.
It looks FAR more likely that DPR and FC both "knew" the "dealer" was just FC on another account, and it was a way of negotiating that let DPR look "hard".
The complaint also makes it clear that police found no evidence of such a murder around the timeframe given.
Second, the story you provide here is implausible. The "way of negotiating" you describe here doesn't make Ulbricht look hard; it makes him look guilty of an extremely serious felony. It would be well beyond incompetent to use "I'm ordering a hit on you" as a cover story.
I'd be pretty sure his failure mode didn't take into account severity of his crimes. If you're gonna go operate on the scale he did, might as well go all out. Considering they can prosecute and probably give him life if they want, what's a few additional life sentences?
Ridiculous and slightly offensive comparison: It's not like Thomas Jefferson left an out clause for himself when starting the US revolution.
I doubt that DPR was weighing these issues if indeed he tried to get someone killed. More likely it was simple self-preservation.
I'd love to see a citation for this "probability."
Putting scare quotes only makes sense if you think he meant more likely than not, since otherwise he's just saying that whatever probability it is needs consideration (if you're in that situation). Which seems utterly reasonable.
""" > Considering the probability that people reported to law enforcement agencies will be killed as a result
I'd love to see a citation for this "probability." """
Those quotes are not about the meaning of the word. They were the reason I assumed he was misunderstanding the (likely, in my opinion) use of the word "probability". (These quotes are about the meaning of the word... :) )
Maybe rayiner considered it, and considers it unlikely. Does he need to keep considering it until he changes his mind?
I don't understand where you think I said anything of the sort; I meant only that by using those quotes, rayiner seemed to have taken the original commenter to which he replied to mean it was more probable than not. Apparently other people also believe that it was meant that way, so perhaps I'm completely wrong about how it was meant.
Except that rayiner then suggested he took the word the same way I did, and just wanted the original commenter's citation of a probability figure that wasn't offered in the first place, which means I have no idea what he was suggesting by putting it in quotes.
Clearly I'm failing badly at communicating what I mean and understanding others. :/
My only point was that we should not immediately assume that reporting SR users to the police is a morally justifiable thing to do, and that the morals of killing someone to protect SR users are not unambiguous. I also said that more likely than not, if DPR tried to order such a hit it was because he was worried about his business, not his customers or the innocent bystanders who might be harmed by police raids.
Once we accept that there are indeed circumstances where the harm of killing somebody is outweighed by the harm of reporting a community to law enforcement, the question becomes "Is this situation one of them."
The war on drugs is extremely problematic for a multitude of reasons; are these reasons relevant in this case?
Could anything at all similar to that hypothetical circumstance happen (or have already happened in history) in real life? I don't think the answer is a definite "no".
This example is rather black and white, though it is extreme. Before the inevitable objections to how extreme it is roll in, let me point out that it is suppose to be extreme; it establishes that there is a boundary, somewhere out there.
The DPR case is less extreme; is not nearly so black and white. The question we should ask is "How gray is it?".
I can't believe there's anyone on HN who thinks that really thinks putting a hit out on a SR snitch is defensible.
Change the setting to the Underground Railroad and try that on for size: As far as the law was concerned, the people who were transported by the Underground Railroad were property. The law enforcement did not necessarily consider themselves to be apart of some sort of atrocity (although we can of course all agree that they were). They were, undeniably, law enforcement. There is no question in either of our minds that they were acting in a reprehensible manner, but they were nevertheless law enforcement.
It would be, unambiguously (in my not so humble opinion, although I can't believe there's anyone on HN who would disagree), justifiable to kill anybody that threatened to bring law enforcement down on the 'operators' or 'passengers' of the Underground Railroad.
Note that I am not saying that DPR putting out a hit is justifiable (and to continue to head off the annoyingly standard complaint others here like to throw out: No, I am not saying the Underground Railroad and the Silk Road are comparable in importance, severity, morality, etc).
What I am saying is that it sits in a gray area that requires some consideration. I am not willing to write it off carelessly.
"Dan contacts Steve and tells Steve that he has information on drug dealers and users in Singapore. He intends to turn this information over to the government of Singapore. Steve knows that Singapore will execute many of these people, imprison others (some of them for life) and will viciously beat likely all of them."
How far can Steve go to ensure that Dan does not turn these people over to the government of Singapore? Is having Dan killed to spare those other people completely off the table?
Lets say that Steve is unwilling to call that bluff, or he is confident that there is no bluff. Is having Dan killed off the table for Steve?
Being shot in the kneecap is likely to make you run and hide as well as doing the act you've been threatening.
Edit: Kneecapping is only used where you believe the target will actually reform, or as intimidation on someone that doesn't have any leverage (like some poor kid that took out a loan and isn't paying it back). In high-stakes like the one outlined here, it's not relevant.
Also this whole subthread was supposed to be "given these priors" but everyone seems to get hung up on murder, ignoring that other peoples' deaths are regularly accepted in society by pretty much everything we do.
Back on point, the recognition that killing Dan is on the table at all puts us on the same page. I certainly would not suggest jumping straight to that unless the circumstances made it absolutely necessarily.
If you asked me what I would decide in a situation similar to DPR's two weeks ago, I doubt "put a hit on the blackmailer" would have crossed my mind... That's a totally different world to me. I think I might try guilt-tripping the blackmailer over the consequences if he released the information, or offer him a lesser amount of funds to buy some personal security against or transportation away from the supposed creditor... Who knows how successful either of those would be in stopping the release?
I'm curious what you would have had DPR do and what do you think the consequences would be?
Denouncing one side does not require you to cheer for the other. Just FYI.
Living somewhere else would be a minor hurdle. SR was an international site. Even without an extradition treaty, the feds would go to the country, say "psst, wanna hit a major international drug dealer?" And local police could bust him, jail him, then deport him, and then the USG could try him too.
If your opsec relies on you laughing from some small country, hoping legal barriers prevent your capture, you've totally failed.
Edit: He should have panicked as soon as agents visited him, but I guess he probably talked himself down. Probably figured "well they already have me or they don't", which, was probably true.
The key question for me is still: how did the FBI locate the Silk Road hidden service servers? They never disclose how that was accomplished. If they had an assist from the NSA in breaking Tor, I would like to know. It has been shown that Tor hidden services are not anywhere near as secure as they are thought to be... but has anyone done a practical attack in the wild? Enquiring minds want to know!
Edit: looks like he did move after the feds showed up. http://www.forbes.com/sites/ryanmac/2013/10/09/living-with-r...
I find it VERY odd how they mention they imaged the server with zero information on how they found it. Smells very funny, like they intentionally left that part out. If it was a simple "we asked Rackspace for files on a one Ross Ulbricht" then they'd have said so.
OTOH, they may want us to think it was a secret attack, when it was just more of DPR's poor opsec. If he ordered fake IDs to hire servers but with his real picture... who knows.
I think it'd be hard to become a citizen of a country that has nice imprisonment terms, is where you want to live, and will ensure you're only tried once and never extradited.
Long-term, the best strategy probably would have been to launder the money[1], then become a large donor/philanthropist and get lots of political friends and great lawfirm on retainer. That way if they do catch up to him he's in a better position to deal with the DoJ.
1: Yes, I know, a non-trivial endeavor.
/s
For people analyzing the lessons learned it's easy...