If Ross Ulbricht is really the guy who ran this site, why in the world was he doing his work from San Francisco? His alleged job was the pinnacle of "work anywhere". He took so many precautions to keep his identity secret that he must've known that his activities would at some point gather focused attention from the authorities.
Living in San Francisco allowed the feds to pick them up on their lunch hour. Even just hopping the border to Mexico would've required them to get international cooperation and extradite him.
He'd likely be a free man if he were in Croatia or Kazakhstan.
> He'd likely be a free man if he were in Croatia or Kazakhstan.
You're talking out of your ass. As a person who was born in Croatia and lived there for almost 25 years I can tell you that Croatia has been extraditing people left and right for years now.
I don't know what kind of lawless country you're imagining, but in reality Croatia is subject to EU laws, cooperates with lots of international institutions, has very strict anti-drug laws and there is no way an international criminal of DPR's profile would ever be safe there. I've seen my friends go down and get criminal records over a few grams of weed... DPR would have someone knocking on his door as soon as his cover was blown.
Ex-soviet countries would be a much safer bet as they don't seem to want to cooperate with US authorities (Snowden et al). Central America might also be a good bet, but then you risk getting killed by the cartels for undermining their business model, if they ever find out who you are.
My understanding is that the cartels care a lot more about distribution than retail, though my information is removed enough it could easily be flat out wrong...
I mentioned this in a reply below, but I'm an American who lived in Croatia for a little over a year. I lived there with a few other Americans. I'm not sure if any of this is true, but we were told Croatia has very strict anti-drug laws. We were told that if we were caught with any amount of drugs whatsoever we would be instantly deported, no questions asked. I wasn't sure if it was a "you better not do it" exaggeration warning or it was truth. Either way, once a police officer stopped a few other Americans I was living with on the street out of the blue and flat out asked them if they were carrying any drugs. I wasn't with them at the time, I only heard the story when they got home. They were obvious foreigners because they were speaking English to each other while walking down the street. I believe the officer also checked everyone's IDs and the papers we had to carry that showed we registered our address with the local police. Yes, as foreigners staying in Croatia we had to register with the local police.
"He'd likely be a free man if he were in Croatia or Kazakhstan."
You think so? One of my college professors was jailed in Kazakhstan because he neglected to bribe one of the customs workers on his way out of the country. That professor had grown up in Kazakhstan and still managed to get screwed over by the government there -- even after he was released, he could not get his money back, as the authorities had "lost" it.
The reality is that there are benefits to living in a developed country, even the USA. I can understand why he would not have wanted to leave even though he was running SR, even with the risks of being caught.
I read the entire thing and I think what you said is the easy but not necessarily accurate conclusion. The site was in business since February of 2011. The operator of the site was careful enough that they successfully ran the world's largest black market website for over 2.5 years. Doesn't really align with a characterization of "careless".
Sure, he re-used a few login names but I don't know how many people could've successfully gone without doing that over a 2.5 year period. I think it's more accurate to say he "wasn't perfectly careful" than it is to say he was careless.
OPSEC for Hackers ( http://www.youtube.com/watch?v=9XaYdCdwiWU ) uses a quote from The Wire to reference what you're talking about: “The thing is, you only got to fuck up once. Be a little slow, be a little late, just once. And how you ain’t never gonna be slow, never be late? You can’t plan for no shit like this, man. It’s life.”
The Grugq addresses this issue by recommending that one set up an entire fake persona before doing anything, and then doing all the activities "in character" as that persona. If you stay in character, then even making the types of mistakes DPR made would only lead the authorities to the persona rather than yourself.
Granted, this video didn't exist when DPR made Silk Road...
grugq makes plenty of mistakes, just like the rest of us. He's just pimping an image to suck up more 0day from independent developers to unethically onsell to various dot govs. Sad friggin' industry, full of vacuous husks of people.
I believe Grugq's message is just that: everyone makes mistakes, and therefore if you're in that line of work you need infrastructure to shield yourself from those inevitable mistakes.
However, I'm not sure how his academic discussion about OPSEC "pimps an image" for his 0day business -- wouldn't security researchers writing 0days not really need the advice in OPSEC For Hackers since they are still acting legally?
wouldn't security researchers writing 0days not really need the advice in OPSEC For Hackers since they are still acting legally?
Your own government isn't your only potential enemy.
True story: A friend of mine works for a large defense contractor. He's done a fair amount of foreign travel to support projects on foreign soil. Not clandestine projects, they are fully above board with the cooperation of the host countries, but as Kissinger said, america has no permanent friends or enemies, only interests. (Kissinger's a douche, but he's right about that)
The result of all his work travel is that he's made it onto spear-phishing lists at all kinds of national hacker groups. His employer's IT security has had to put his corporate email address in a special group that gets extra scrutiny because of all the attacks directed specifically at him.
> Sure, he re-used a few login names but I don't know how many people could've successfully gone without doing that over a 2.5 year period.
That is the difference between a professional and an amateur. An amateur tries hard to get things done, but doesn't really pay attention to methods or details. A professional knows that methods and details matter more than knowledge... and uses best practices to get things done.
If you're running the worlds largest illegal market place, the primary goal should be security and privacy. He re-used login names by accident, or maybe even just laziness.
A simple way of avoiding the above issue is to have a "personal" computer with personal accounts and activity, and a "work" computer, with work accounts and activity. Never use the work computer at home, and never use the home computer in the same place you use the work one. There's no way to confuse identities or traffic patterns.
I think Silk Road is proof of just how good Tor is. It can protect you from governments who are trying to find you. It can even protect someone who knows nothing about programming or security.
He definitely thought he was untouchable, a clear sign of an amateur. Even after all the press touting the fact he was running a huge illegal drug market under the FBI's noses, he continued to carry on like he wasn't going to get caught. Even the most low level criminals have a healthy sense of paranoia. Even close calls will make them completely change how they do things.
Even if he took the modest steps you proposed, he could have wiped and then physically destroyed the HD, tossed into a trash bin and flee the country for a few years until things quieted down. I mean, he had plenty of money, in the most secure, untraceable form so it would've been cake to hideout for a few years or forever if need be.
The other problem is learning as you go. It seems like some of his mistakes were in the very early days of the site, and they were uncorrectable due to Google caches and such.
"A simple way of avoiding the above issue is to have a "personal" computer with personal accounts and activity, and a "work" computer, with work accounts and activity. Never use the work computer at home, and never use the home computer in the same place you use the work one. There's no way to confuse identities or traffic patterns."
The problem with this approach is that you need to never use the wrong computer for the wrong thing. You can help yourself somewhat by setting up different window colors / desktop backgrounds / etc, but what happens when you go visit your great aunt for thanksgiving and forget to pack both laptops? What happens when your work laptop breaks, and you desperately need to update the site to deal with some issue?
A more reliable approach would be to have one computer with two accounts (or if you like technically sophisticated approaches, use a mandatory ACL system), one for work one for personal things. Set up each account with noticeably different colors / themes, so that you are less likely to accidentally use the wrong account for the wrong thing. If you forget/damage your laptop, you have less of a temptation to use the wrong computer.
I am sure that Truecrypt fans will point out that hidden volumes work equally well, though the extra effort required is something of a stumbling block in my opinion (and I am not a big fan of hidden volumes to begin with).
So, I have been mulling this over. Not because of SR but just as anti doxing hive BS. I started to use prng to generate usernames (I was already using it for passwords). But the "problem" is that these prng usernames hit like lazer beams in database searches. And I would assume that the surveillance companies everywhere hone in on tracking usernames everywhere like crazy.
I guess you want to pick names that have lots of false positives when searching. But of course you can't ping google to check. Is there a known mechanism for this? I guess the old dice + newspaper to pick a phrase?
Maybe I'm too sensitive about this since nobody in the history of the known universe has the same name that my parents picked, so any hits in search engines are never about anyone else. Unique usernames function the same way.
An easy way to disguise your behavior is to steal someone else's username. Pick a popular user on a popular site, and then assume their name on a new service.
It would have been rather uncomfortable to have been a Tor user with "Dread Pirate Roberts" as a username, if you knew nothing about Silk Road and happened to be a Princess Bride fan.
I guess you want to pick names that have lots of false positives when searching
I think that's right. I got my first modem in 1985 and been on the Internet since the start of the 90s. I never re-use user names between sites, frequently delete my accounts and start with fresh ones.
I've started recently using random word generators to generate common words to use as usernames.
Whenever I want a username that isn't associated with any internet persona of mine, I look around on big forums for names and start googling them. I think the best is to find one that's a character in some obscure book/story, and then pick another character from that story - thank Wikipedia for having this type of info for all sorts of things. Best is something odd enough that it isn't likely to be taken already, but still common enough that the search results for it are too noisy to see a few forum posts.
But then, it depends a lot on what you're trying to hide, and who you're trying to hide it from. Keeping bored teenagers on 4chan from finding your home address and keeping whole departments of the FBI from tracking you down are whole different ballgames.
Living in San Francisco might have allowed him in hide in plain sight. Who is going to suspect a 20-somthing year old who lives in San Fran of running a multi million dollar drug business. He doesn't attract attention to himself, especially from his family and friends who are most likely to report any suspicious behavior of his to authorities. If he moved overseas and started buying mansions in cash, a red flag somewhere might have gone off. His family might start asking questions he didn't have the answers to. After all, the unabomber was only caught because of the suspicions of his sister in law and brother.
He might have thought of himself as immune to being found out, so it didn't occur to him to move. He was content where he was, and just stayed. Getting caught didn't even come to mind, because he was so confident in himself. He obviously was confident.
And that process becomes increasingly more difficult as you go from selling 1 to 10 to 100 to 1000 BTC.
At each step you lose more and more of your anonymity and safety...
Because you can't open up a MtGox account and offer 10k BTC to then cash out anonymously, nor create a localbitcoins account and use meatspace for this large amount without possibly getting robbed or killed.
Not to mention some of those transactions can be traced back via the chainblock after-the-fact, creating more problems for you as now the FEDs know it's SR related.
And that even does not bring up the fact that large transactions can easily cause BTC prices to go down dramatically, since the majority of upticks are based on small transactions that are fraudulently gaming the system.
I imagine DPR basically had little to no money and a lot of BitCoins he could not sell.
>Because you can't open up a MtGox account and offer 10k BTC to then cash out anonymously, nor create a localbitcoins account and use meatspace for this large amount without possibly getting robbed or killed.
My guess would be that if he had this type of btc, he'd begin to work on establishing reliable, trustworthy in-person communicants to perform his big transfers. Perhaps another reason why SF was an important place for him to be. It'd also be intelligent to bring some muscle along to the transfer.
>Not to mention some of those transactions can be traced back via the chainblock after-the-fact, creating more problems for you as now the FEDs know it's SR related.
Obviously, all bitcoins obtained from this type of activity should automatically go through a thorough, trustworthy mixer, perhaps even one that the btc owner wrote himself.
> He'd likely be a free man if he were in Croatia or Kazakhstan.
Both narcotics trafficking and murder-for-hire are things for which the US has been known to send armed agents -- or actual military -- into foreign countries without coordination with the local government to capture people to be brought back to the US for trial.
> Even just hopping the border to Mexico would've required them to get international cooperation and extradite him.
No, it wouldn't. See, e.g., United States v. Alvarez-Machain, 504 U.S. 655 (1992)
He'd likely be a free man if he were in Croatia or Kazakhstan
You think Croatia or Kazakhstan don't have anti drug laws? You think they have stricter rules about police, law enforcement, or picking people up off the streets? You think those countries have nicer prisons and less corrupt judges and cops than USA?
Given the right amount of cash, yes. If I'd need to go undercover, my bets would be either Yugoslavia or the communist states in South America. Julian Assange actually managed to outbid the USA in the open (but I'm not sure if one can call his current situation a win)
It's not just cash. It's political favours, foreign aid, trade deals, international bodies etc.
my bets would be either Yugoslavia
Well that country doesn't exist any more, it broke up. Some of the former Yugoslavia are in the European Union (Croatia, Slovenia). The rest want it. "Oh sorry, we can't let you in/let you in the eurozone/let you in schengen until you abide by international law and extradite these people!". This has happened before, with war crimes, and generals in the Yugoslav wars.
Croatia? SERIOUSLY? Croatia is a member of NATO, for one.
For two, there is no extradition treaty between the U.S. and Croatia. For three, the only reason I listed Croatia was because it is so often referenced as a place to flee if the U.S. government is after you:
Hopefully that's enough - I invite you to use Google to decrease the level of your incredulity in regard to Croatia being a haven to hide from the U.S. It might not be the best place but a lot of people seem to think it is.
Do you think a fellow NATO member state would cooperate with the United States when they knew one of their most wanted fugitives was there? Don't you think it would be in their best interest to cooperate? Why would they create a rift in the biggest military alliance in the world?
Don't give me silly articles. I am an American who has lived in Croatia and I'm pretty familiar with how the average Croatian views the United States, and I am pretty confident in my experience that they would have no problem handing him over even without a formal treaty. There is literally no reason to not do it.
As a Croatian, living in Croatia, I can re-affirm your position. He would get extradited with a complimentary cake for CIA in no time at all. Our ties with US are deeper than the ones with EU, and we are a EU member. Hell, even our chief intelligence officer has dual citizenship (US and Croatian).
Not to mention it isn't like the US and Croatia haven't worked together at least once in apprehending a criminal living in Croatia wanted by the United States.
American and Croatian police have worked together to arrest Ukrainian hacker Sergei Litvinenko in Croatia, reports Croatian radiotelevision.
Litvinenko was wanted by US federal police for fraud he had committed in the United States. The federal courts had issued a warrant for his arrest and he was caught in Croatia earlier this week.
There is literally no reason why they wouldn't extradite such a highly valued criminal to the US, formal treaty or not. The ties between the two countries are too strong.
You don't see them extraditing Snowden, do you? Regardless, despite your lack of tact you claim to know more about Croatia than I do and you dismiss web citations that claim to know more than you so it's pointless to discuss further.
If you did, you would find the last one points to this PDF on the US Dept of State Website: http://www.state.gov/documents/organization/71600.pdf which is CHAPTER 209--EXTRADITION of CRIMES AND CRIMINAL PROCEDURE.
That lists Yugoslavia which isn't even a country anymore, but has a note
\1\ For the successor States of Yugoslavia, inquire of the Treaty Office of the United States Department of
State.
Croatia is a successor States of Yugoslavia, however, I originally ignored that because I thought I'd have to contact the State Department. Then I decided to see if that info is published. Alright, Lets check out the Treaty Office of the United States Department of State.
JUDICIAL ASSISTANCE
CROATIA — INVESTMENT
Agreement on enhancing cooperation in
preventing and combating serious crime.
Signed at Washington February 16, 2011.
Entered into force August 19, 2011.
TIAS
That's pretty vague, but there is some agreement there.
You need to understand geopolitics a bit (USA supported /s Croatia against their arch enemy, Serbia). Also in countries like Croatia things are done with a wink and a nod and a lot of rules are bent.
If USA wants you in Croatia or virtually any Balkan or third world country not slaved to China /Russia, you will be placed in a private FBI jet in no time.
They're trying to extradite Snowden from Russia but Russia says, "Too bad we don't have an extradition treaty".
There are plenty of countries that would scoff at extraditing him for this simple fact of not having a treaty. Even countries that we do have a treaty with would've locked up extradition in the courts for years because he's facing life imprisonment for making a website and a bunch of other garbage they found on his servers:
If convicted, Ulbricht could be sentenced to life in prison.
They're also charging him with paying to have someone killed merely based on chat logs. They even said there's no evidence anyone was killed or frankly any evidence at all other than the chat logs.
We charge people all the time for soliciting murder, he asked to have someone murdered, paid the money to get the person murdered, and requested photos of the bodies after the deeds were done. Bitcoin transactions can be publicly viewed and the transaction he made to the Canadian leakers apparent connection to have the leaker killed was made and confirmed. Also he received what he believed to be a photo of the victims corpse and thanked the person. The same bitcoin confirmation, photo conformation, and thanks was also done in the fake hit that the FBI set up around a former friend of DPR who stole a bunch of coke or something. DPR should and will be charged for both of these and many solicitors of murder have been charged for much much less.
To go along with "work anywhere" is "live anywhere." If you can live anywhere, then you will pick a place where you actually want to live. Croatia or Kazakhstan might be nice for a visit, but I doubt you would want to live in either of these places unless you had substantial roots there (you were born and raised there.)
Given there are so many independently wealthy people living in San Francisco, it must have its charm.
This is what I keep wondering. The caribbean coast of Venezuela has many expatriate enclaves where he could be living like a king with no possibility of extradition. That, along with hiring an FBI agent for a hit, makes me think he was not as clever as he was made out to be.
Likely just lulled himself into a false sense of security. He believed his own story that his precautions were sufficient and effective, and that he could just walk amongst the public and never be caught.
He'd likely be a free man if he were in Croatia or Kazakhstan.
In small countries with no culture of westerners living there long term he'd stand out like a sore thumb. In dictatorial countries they'd think he was a CIA operative and be tailed. Oh, and upon capture he'd be beaten until he told them every little secret, bitcoin passwords included.
So good old USA was better and SF is probably the best way for a guy "acting weird" and staying online all the time to hide. He should have retired a year ago. It's a like playing in a casino, you're bound to lose long term
I think Ecuador still has extradition treaties with the US, the cases with Snowden and Assange are asylum cases which are regarded a little differently.
Your reply is downright silly and it seems youre someone who really doesn't travel much or know many people who do.
Not every place outside the USA is automatically a totalitarian, xenophobic shithole where foreigners are so rare that they get stared at on the streets and followed by secret police.
I happen to be from Croatia and currently live in a less then touristy part of central America and guess what? While us western white folks aren't exactly saturating the local landscape, there are more than enough travelers/students/business people from the US and other Anglo countries here long term for us not really get considered that big of a deal.
Same rules apply to many other places I've been. There's lots of travel happening in the world these days and foreigners in developing countries are hardly a big wonder.
Ulbricht could have easily moved to a dozen different countries in central america, south america or eastern europe and southeast asia and comfortably stayed anonymous in any of them.
Your wording implies you're already aware of this, but I'll say it anyways:
Survivor Bias.
The criminals that do all of the obvious smart things are much less likely to get arrested. The ones that do get arrested, are disproportionately the ones that did something not-smart. The the larger the quantity and (not-)quality of their mis-steps, the more likely they are to be the one you read about for being arrested.
Living in SF seems like a fairly reasonable mistake--it's simple confidence that you won't be caught.
Criminals face the same sort of issue DRM makers do: they only need to make one big mistake.
Some of their mistakes may go unnoticed for a long period of time, but in the long run, just one mistake is all it takes for everything to come undone.
The ones that aren't caught are almost certainly not perfect criminals, either, they're just lucky criminals whose errors happen to have intersected with the gaps in imperfect law enforcement.
Different people crave different things in a place to live. Big metropolitan cities have a certain allure to many. They're exciting, happening, and full of intersting people.
One of my goals is to put myself in a situation to live comfortably on the North Shore of Oahu in the future, because that's where I want to be.
Gotcha! And I'd like to mention I wasn't trying to be snarky (not to you, just in general).
I've always had a pull away, out into a large unpopulated area and it makes complete sense that some people have the opposite. The hustle and bustle can have it's allure and with that many different people around, things are always interesting. It's night that gets me. I love stepping out into a clearing on a star filled night with no noise besides the bugs and my own feet in the leaves.
* _astronomical_ cost of living compared to "less desirable" environs like Denver, Omaha, Salt Lake, Dallas, or other large mid/mountain west localities
* family unfriendliness, as the chic "millennial" crowd despises children
* bad politics that impact everyday life (gun ownership, etc.) and high tax rates
and there are many other reasons to _not_ want to be in one of those hotspots.
Surprising as it may seem to some of you, there are cool and interesting people everywhere.
Er, all of those except the last of those reasons you give boil down to symptoms of either:
a) Lots of people in general want to live there, and
b) Lots of people of a generation and attitude want to live there.
(The last actually fits in (b), but for a different attitude than the others.)
And the person in question is at least of the generation, and arguably of the attitude referred to in those other than the last, so its a pretty unconvincing list of why you'd think that person wouldn't want to live there.
I am of the generation and arguably the attitude of many of my contemporaries and I have no interest in, and have in fact actively avoided and denied, opportunities to relocate to those areas. It's hard to argue with California's geography but the rest of the package makes it easy to pass. The other major locales mentioned have no allure for me. Please don't be so myopic.
The subject of the article obviously was at least semi-content living in SF, as he definitely had the means to depart if he wanted to do so. My list is meant more as a general reply to "why wouldn't someone want to live in one of those places?" It may just be my background of living in several different places, but personally I have a difficult time grasping why people assume that LA, SF, NY, or Chicago are the only reasonable places to live.
And, places do not have to be dirty, crowded, or high-traffic just because a lot of people want to live there. If things are designed reasonably and the populous behaves reasonably, traffic should continue to flow, there should be adequate personal space, and thoroughfares and public places should be clean and satisfactory.
Some people have hobbies that require other people nearby who share those hobbies to work. I like improv and various other kinds of comedy. You can do that in LA, SF, NY, Chicago, and Austin (where I live). You can't do that as well in Omaha, Salt Lake or Dallas. I also like riding bikes. Cycling infrastructure requires living in an area where lots of other people agree that it's a priority. Once again, the cities you suggest don't qualify.
No man is an island. The people you surround yourself with matter.
Biking is a major activity in both Utah and Colorado. Denver or SLC would be great places for a serious cyclist -- they definitely offer more interesting terrain than Austin.
I agree that dependent on the level of immersion necessary, serious improv practitioners may find places that aren't the cities you listed restrictive, but there are well-attended improv troupes in other areas.
"there are cool and interesting people everywhere"
This I agree with wholeheartedly, which is why, despite having grown up in California, I'm not currently living there and have no plans to move back in the terribly near future.
However, I think all of the other things in your list can also be found nearly everywhere. It all depends on your perspective and your desires.
For what it's worth, from someone who has a great deal of experience living in many different cities, including San Francisco, it's a perfectly serviceable place to live. It is slightly inflated at the moment due to the tech demand, but not by much; otherwise the price reflects the value.
Living in San Francisco allowed the feds to pick them up on their lunch hour. Even just hopping the border to Mexico would've required them to get international cooperation and extradite him.
He'd likely be a free man if he were in Croatia or Kazakhstan.