He kept encrypted chat logs, presumably because he thought the encryption would keep it safe from the police. He also kept a diary. From the sentencing proceed

He kept encrypted chat logs, presumably because he thought the encryption would keep it safe from the police. He also kept a diary. From the sentencing proceedings at http://motherboard.vice.com/read/unsealed-transcript-shows-how-a-judge-justified-ross-ulbrichts-life-sentence http://motherboard.vice.com/read/unsealed-transcript-shows-h... : Then, in Government Exhibit 241, March 2014, you wrote a journal of short snippets of your day and you write -- and each of these snippets is going to be one after another, they're just tiny snippets with a period in between: March 28: "Being blackmailed with user info. Talking with large distributor, (hell's angels)." Then, March 29th: "Commissioned hit on blackmailer with angels." April 1: "Got word that blackmailer was executed. Created file upload script." So, you went back to the technical work right after getting word that the blackmailer had been executed. "Started to fix problem with bond refunds." Government Exhibit 936 details communications relating to that hit further. Apparently you were sent a photo of the hit. The photo was no longer in existence, you acknowledge receiving the photo and deleting it. A short time later you wrote, on April 6: "Make sure backup crons are working. Gave angels go ahead to find tony76." Who was the subject of the next hit. "Cleaned up unused libraries on server." Two days later on April 8 you write: "Sent payments to angel for hit on Tony76 and his three associates. setting up hecho as standby" -- I have no idea what that is -- "refactored main and category pages to be more efficient."