15 ms·

Dropgangs, or the future of darknet markets

445 points by arikr 8y ago

crowbahr 8y ago
Very interesting reading the obstacles faced by the black market drug trade and how they're overcoming them. It seems like the producer layer is most susceptible to penetration as it is essentially identical to most gangs. It's entirely glossed over here but procuring the product seems like a difficult problem for an anonymized distributor: How do you make sure the product gets to your support layers? As interesting as it all is, it's also very concerning for Law Enforcement. While petty things like drugs don't really worry me much, the advances in the anonymized distributed networks like this do mean that things that previously required big budgets of national intelligence agencies become easier for common malcontents to use. The article essentially describes a quintessential terror cell structure, but with the added benefit of 0 direct interaction. The separation of layers has always existed with limits (IE you had to have some form of communication) but this potentially allows for goods and services to easily be passed from fully anonymized layers to others without every having any interaction at all.
- amundsentb 8y ago
  Maybe it will force the police to focus on violent crimes. The best counter to terrorism is a homogeneous population.
- nyolfen 8y ago
  >As interesting as it all is, it's also very concerning for Law Enforcement. it seems better from their perspective than street gangs shooting each other over turf imo. an improvement for everyone involved, frankly. >How do you make sure the product gets to your support layers? through dead drops, of course ;)
  - agumonkey 8y ago
    if the darkweb resolves the drug on war issue .. that will be something
    - taurath 8y ago
      Unlikely. It just decentralizes distribution and dealing - bulk darkweb drugs still end up in the hands of street resellers.
      - austhrow743 8y ago
        At the moment that's how it works. If it's true that things are moving in to telegram and other encrypted chat platforms then it could change. It makes it simple enough for the average person to do.
        nyolfen 8y ago
        exactly, who on earth would prefer dealing with some street tough
        mtgx 8y ago
        Telegram isn't anymore encrypted than Skype by default.
  - wpietri 8y ago
    I'm not seeing why this would particularly reduce violence. Some gang violence isn't about drug sales, but the same sort of territorial control that nation-states like to fight over too. And for the violence that is about drug sales, I'm not seeing why that wouldn't continue. Dead drops are just as local as corners are, and there's just as much incentive to fight over business as there was previously.
    - tyre 8y ago
      In the current system, you have to have dealers hanging out on the corners. To take territory, you shoot at the dealers and either kill them or scare them away. In this system, you have drops. How does a rival gang know where they are? They'd have to buy the product to discover the drop and drops shouldn't be used multiple times. They could watch a user find one, but then that drop wouldn't be used again so they couldn't stake out and wait for their rival to refill it.
      - wpietri 8y ago
        It's not clear to me how much gang violence is specifically driven by fights over corners, rather than other kinds of inter-gang fighting. But let's assume it's significant. I think it's very unlikely a drug business can get to scale without reusing drops; the cost of scouting a good drop is significant, and the number is finite. Regardless, the value of a drop declines the farther it is from customers and from the dealers who supply the drop. So in practice, gangs will still have an incentive to claim turf and to harm other dealers using drops on their turf. Even if that somehow doesn't happen, they'll still have the same strong competitive incentives. So they'll be very much inclined, as now, to discover rivals and take over their business through violence.
        CryptoPunk 8y ago
        If gangs are claiming turf and excluding other dealers, then those aren't dead drops, which by definition are undetected drops by anonymous parties. It's an open question whether effective dead drops are even possible, but if they are, and come to be widely adopted for trade in contraband, then a significant portion of the source of territorial conflicts between criminal organizations vanishes.
- zozbot123 8y ago
  > As interesting as it all is, it's also very concerning for Law Enforcement ... things that previously required big budgets of national intelligence agencies become easier for common malcontents to use. We'll probably see "white hat" distributed networks with pseudonymous reputation used for the provision of security and crime-prevention services, with no need for traditional Law Enforcement to get involved in any real way other than in a secondary, oversight role. After all, tools that "common malcontents" can use, can also be used by people working for the social good.
- SolarNet 8y ago
  Since you are primed on the question. You should read Rainbows End by Vernor Vinge. It's a near-future sci-fi book that tackles these sorts of questions. As a bit of a "spoiler" his solution is a covenant with the citizens. The government will hack all of our computers, will own the IME equivalents of every machine, and in return they will only use this power to hunt down terrorists and mass murderers, people who are looking to leverage technology to build nuclear weapons, bio-weapons, etc. Things like parallel construction would have to stop though. Or be considered an immediate dismissal.
  - selestify 8y ago
    How could the citizens trust the government to do only that?
    - dahdum 8y ago
      A strong judiciary, high bar to change the law, and harsh accountability. Still a fine line to walk.
      - atemerev 8y ago
        People from more or less politically stable countries like the US are very naive in not considering what can happen to the best of governments overnight. People from Europe have this sort of... experience. Most of us know that trusting the government with our lives is not a good idea.
        jacquesm 8y ago
        > People from more or less politically stable countries like the US I would have agreed with that assessment in the past but in the present I really can't.
        atemerev 8y ago
        Come on, if your country can handle _this_ president without collapsing immediately, your political system is really well designed!
- CryptoPunk 8y ago
  I think the right (though not necessarily the most likely) solution to the problems you allude to is more powerful local governments able to monitor the goods coming into/out-of their jurisdiction, a sort of return to the more decentralized political structure of the feudal era. In this sort of arrangement, a jurisdiction's authorities could require shipments to be bonded, with forfeiture of the bond if it is found to contain a restricted substance. This would result in policing happening at the edges, by those providing the bonds, and likely relying on trust networks to assess the risk that a package originator is a terrorist. Such a world would have a lot more trade friction than an idealized world govermment that centralized control of the movement of goods to prevent malevolent behaviour while allowing free trade of benign goods, at least in the earlier stages where localized solutions are not well-developed/efficient, but it would mean a far lower chance of a significant fraction of the world coming under the tyranny of a single malevolent government. An all-powerful central govermment will always pose a far greater threat to the advancement of society than chaos IMHO.
- dghori 8y ago
  There's nothing to be worry dangers of this network. I don't believe that our intelligence agencies haven't found a way break this anonymized distribution network. Its a well known fact that IA is indirectly sponsoring this network to get funds for their illicit operations. And I am pretty sure that they have planted backdoor in this network.
  - dfischer 8y ago
    What is IA?
    - amdavidson 8y ago
      Presumably, "intelligence agencies".
- mirimir 8y ago
  > The article essentially describes a quintessential terror cell structure, but with the added benefit of 0 direct interaction. Isn't "terror cell" a little over-the-top? It's just trade craft. The US does it. Russia and China do it. The various mafias (at least, modern ones) do it.
  - crowbahr 8y ago
    It's not over the top, it's what I was talking about. Terror cells have had to operate with reduced resources since the dawn of terrorism. The terror cell structure is trying to keep things as isolated as possible, and I'm saying this structuring and proliferation of dead-drop tech will all boost the potential power of the terror cell. I'm saying that what they've described is a structure analogous to what exists, just higher tech. The time to adoption of this by terror elements is going to be short.
- dsfyu404ed 8y ago
  >As interesting as it all is, it's also very concerning for Law Enforcement. While petty things like drugs don't really worry me much, the advances in the anonymized distributed networks like this do mean that things that previously required big budgets of national intelligence agencies become easier for common malcontents to use. Last years state only tech is next years commercial tech. Once upon a time only the clergy were literate, now everyone can read and write whatever they want. Once upon a time the state could control the news. Now anyone with an internet connection can publish stuff. Once upon a time only major powers had tanks and artillery now every podunk warlord has them. Once upon a time only superpowers sent things into space. Now companies are doing it and making a profit. Once upon a time only the three letter agencies could bug a room. Now anyone can buy pinhole cameras for $5. Trying to stand in the way of that is just stupid. You can't stop the long slow march of technological progress. At best you can quarantine off some small dystopia that you control.
drcode 8y ago
I wonder if dark web markets will ever establish a comprehensive alternative parcel system... that seems like the natural, final extension of these ideas. The technical challenges to this would of course be significant (I'll refrain from listing them and suggesting potential workarounds since I don't really want to give anybody any specific ideas on this LOL)
- CamperBob2 8y ago
  There are quite a few holes in the scheme as outlined in the article. The author asserts that dead drops are better than post office boxes because they're harder to surveil, but what keeps law enforcement from signing up their own personnel as distributors? Then it's just a matter of staking out their own dead drop and arresting whoever shows up. This is why the first rule of opsec has always been, "Involve as few people as possible." You can't improve security by adding more people to the loop. The best way to do this is probably for the 'salesperson' to drive to an isolated area and chuck packages into the bushes at random intervals. The packages then send their GPS locations to a LoRaWAN gateway somewhere, to which their buyers have been sold access tokens. LE can still infiltrate the organization in the sales role, but with more difficulty. Adding an extra distribution layer with fixed dead-drop locations just seems pointless.
  - solarkraft 8y ago
    This requires both GPS and LoRaWAN hardware, which would introduce a financial overhead of about 20-30$ per package. Fascinating idea, however.
    - TehCorwiz 8y ago
      It's plausible that the beacon need not be directly co-located with the drop, but be near enough. It should also be possible to re-use them for some time. I would imagine that the actual cost overhead would really only be $20 - $30 per active dead-drop location + some percentage for lost or damaged beacons.
  - keithnz 8y ago
keithnz 8y ago
Kind of interesting distribution is kind of like darknet geocaching. I wonder how much accidental discovery occurs.
- tomglynch 8y ago
  The other issue I see is at some point, all secret hiding spaces will be used. For a consumer, checking previous drop locations may result in finding free goods.
  - droopyEyelids 8y ago
    If this becomes big business then every retail store will start providing airport locker type storage.
    - olefoo 8y ago
      In a known, easily watched location? Did you read the article?
rospaya 8y ago
A very long article with the only takeaway being... a better use of dead drops? Am I missing something bigger here?
deleted 8y ago
[deleted]
zzzcpan 8y ago
Using telegram for communications with customers also allowed marketing to escape darknet forums and into the walls of public places. Normal people don't even need to know about darknet to buy drugs and what those @usernames on walls are is becoming common knowledge.
JohnJamesRambo 8y ago
Dead drops sounds like an awful way to distribute anything at scale. The loss from other people finding stuff seems enormous also.
- loeg 8y ago
  Illicit drug and alcohol distribution has traditionally large nominal margins and large expected loss at every layer, commensurate with the efficacy of law enforcement.
- bigiain 8y ago
  So long as there's sufficient profit margin to allow for an acceptable "shrinkage", it just becomes a cost of doing business. The benefits in terms of privacy/security for the typical darknet vendor probably make it well worth low double digit percentage losses, given the assumed margins from source to end user...
  - JohnJamesRambo 8y ago
    I don't know how secure it is when a cop sees you drop a bag of heroin behind a bench instead of just shipping people stuff.
    - 6nf 8y ago
      They wouldn't drop at a public bench with people around
- orbifold 8y ago
  Even normal drug dealers often don’t have the drugs on their person. Instead they are stashed away somewhere close and retrieved on demand.
jorblumesea 8y ago
The biggest flaw here is the dead drop system. It doesn't scale well and involves many more complex steps and people in the system. For example, a drone on surveillance duty that continuously watches the area will be able to identify patterns and pick out possible outliers. Combined that video feed with machine learning and it may be possible actively identify dead drop participants.
- anon_cow1111 8y ago
  If the system becomes that large and profitable, those surveillance drones are going to end up mounted on plaques like big game trophies.
  - deleted 8y ago
    [deleted]
bfuller 8y ago
Russian darkmarkets started using dead drops years ago if I recall correctly
GistNoesis 8y ago
How do you defend against the eye in the sky, video surveillance or location tracking ? There seems to be conflicting objectives. When hiding an object you don't want too many people around to see where you hide it. Yet if you record only two person going to exactly the same non standard spot it's pretty much a red flag, then you follow the person in the recording to identify them. Most buildings are probably not valid because they can't be entered easily by both parties.
- perlmutterlabs 8y ago
  Yeah, it's a great story, but machine vision + machine learning + surveillance could pull the rug out from the dropgangs market in a second. But really, other than this fatal flaw, it's a great narrative of the internet spilling into and interfacing with analog markets
  - zzzcpan 8y ago
    It's not a fatal flaw, unless they choose a location with police surveillance, but why would they?
    - perlmutterlabs 8y ago
      Taking a guess: ML is just too good. Don't forget, it's also a signal to leave surveillance areas, eg "last seen driving into the desert". Any kind of outlier behavior is PART of the detection model ... that's where probabilistic models gain leverage, in fact ...
      - maxander 8y ago
        I think if “he left surveilled areas for no registered reason” is something that law enforcement observes and considers evidence of criminal activity, we’ll have well and truly lost any semblance of being a free society.
        perlmutterlabs 8y ago
bittermang 8y ago
The elephant in the room that this article highlights, but never addresses. A mobile phone has become a de facto a requirement for illegal commerce, as described, and to me presents a pretty huge single point of failure. And yes, I know, EVERYBODY has a phone. But I don't. Why would I want to carry a police officer in my pocket? Especially if I'm a criminal.
- zzzcpan 8y ago
  Dead drops don't require a phone, only something to take a photo of the hiding place.
  - bittermang 8y ago
    The chat networks do. As well as several of the methods outlined for protecting/locating the dead drops. WiFi hotspots, bluetooth beacons, etc.
    - yyx 8y ago
      You'd love to know that Telegram works on PC too.
      - wbl 8y ago
        What is the going price for a Telegram 0-day again?
        brohee 8y ago
        Up to $500,000 for RCE+LPE (https://www.zerodium.com/program.html https://www.zerodium.com/program.html)
- stuaxo 8y ago
  Tonnes of people buy things like this right now, on their personal phones using text messages to people that they actually go and meet (or their drivers), using no encryption whatsover.
kahlonel 8y ago
My vision was distorted for full 30 seconds after reading this page.
- theelous3 8y ago
  Yeah. High contrast is only good for people with serious vision problems. Awful to read.
monotone666 8y ago
Dead drops can’t compete with USPS. They require a court order to open your package and even then can’t charge anyone with possession. All they do is send you a “love letter” and people have reported receiving future packages just fine. Millions of people use dark net marketplaces. The war on drugs has fueled their growth and more serious crimes like identity theft have benefited from it.
- omeid2 8y ago
  The war on drug has to be one of the top contributors and financiers of crime and criminal gangs. Imagine a world where criminal gangs don't have access to the money they make through drugs and a government that doesn't have to spend huge amount of money on drug laws enforcement because drug trafficking would be much less lucrative in the existence of legal access and you get fewer and very cash-strapped drug gangs, and government making money from taxing drugs. Surely such massive savings and earnings can be spent to help problem users and reduce violence, no?
  - hiccuphippo 8y ago
    It can't help with getting voters though. At least until new voters come around and old voters get phased out.
  - sigmaprimus 8y ago
    The war on drugs is also a big contributor to the LEGAL gangs such as police,distric attornies, defence attorneys, prison officials and worst of all judges. Definitely an industrial economic complex similar to the Military Industrial Complex.
    - omeid2 8y ago
      Don't forget for-profit prisons.
    - cf498 8y ago
      And protects the market of big pharma as well as the tobacco and alcohol industry. There is a reason these are among the top contributes for campaigns against the legalization of illegal drugs.
chrisweekly 8y ago
Excellent summary. I'm reminded of the old saw, "The future is already here, it's just not evenly distributed".
- bigiain 8y ago
  "Old saw"? I remember that quote being new, it's not _that_ old... <google google google> It's from 2003. https://www.goodreads.com/quotes/681-the-future-is-already-here-it-s-just-not-evenly https://www.goodreads.com/quotes/681-the-future-is-already-h...
  - hinkley 8y ago
    Sit down. You're not going to like what I'm about to say. This is going to start happening to you (us, really) more and more. Things that happened in the 00's happened a 'long time ago' to a larger and larger group of loud people with Internet access. People who can drink legally were born in '98. What's up with that shit? https://en.wikiquote.org/wiki/William_Gibson#Quotes https://en.wikiquote.org/wiki/William_Gibson#Quotes has a citation for him saying it in '99 and an unsupported assertion that it might have been said in '93. I've been hearing this long enough that I believe the '99 date, but I'm skeptical about '93.
    - bigiain 8y ago
      Yeah yeah. I know... And I would have gotten away with it too, if it weren't for you meddling kids and your damned dog... -- Old Man Big from The Haunted Amusement Park
DonHopkins 8y ago
Pokemon Blow!
sigmaprimus 8y ago
My biggest problem with using the Darknet, messaging apps, or old school methods such as dial a dope or hitting up the guy on the street corner to buy drugs is the same. How can I really trust someone willing to break the rules and sell drugs or other non legal goods? You lay down with dogs you get fleas!! Last thing I would want is to eat, smoke or snort something from someone I have never met even if they have a 5 star rating on a darknet review board. Don't even get me started on messaging out to someone whos' contact info is written out next to a pay phone or on a bathroom wall and the likes!
- kakarot 8y ago
  Generally speaking, if you can't trust someone directly then the next best thing is consensus among others. Ideally, a connection only occurs in real life because one or more mutual acquaintances have decided they trust both parties involved. Relying on the word of others, on a network of trust, is paramount. Remember, these distributors also have their own set of problems when it comes to trusting others. Most open marketplaces on the internet, not just darknet markets, provide reputation systems for this purpose. Even Amazon has a review and rating system in place, which was integral towards building initial trust with its buyers and sellers.
- mirimir 8y ago
  Yes, you never know what you'll get. But you can protect yourself. Whenever you have a new batch of some street drug, you test with a small dose. Maybe 10% of what you'd normally use. If it's too little, test with maybe twice as much. Waiting as appropriate, if tolerance is an issue (as with LSD). And then use what you need, to get the desired effect. In most cases, bad drugs are either cut way too much, or adulterated with some other drug. But it's pretty rare for someone to be selling outright poison. So maybe an amphetamine in the MDMA or LSD. But nothing that's likely to kill at 10% of a typical dose. The one key exception is fentanyl. So yes, some idiot may indeed sell you heroin (or even cocaine) containing too much fentanyl. However, you can still protect yourself by initially testing a small dose.
- amundsentb 8y ago
  If something is illegal, it does not follow that it is also immoral. You may actually deal with a very moral person.
mirimir 8y ago
It's cool to see serious tradecraft applied to this stuff. Especially compartmentalization. And yes, using traditional shipping systems is a serious problem for old-school dark markets. I've thought off and on for several years about the potential for using dead drops with accurate GPS. I mean, geocaching. Many years ago, when I was dealing LSD, it was pretty common to use dead drops. But then, they were typically rental lockers in bus and train stations. I agree that ubiquitous surveillance is a problem. However, it's ~clueless customers and low-level distributors who'll most likely get pwned. And they won't know anything important about the operation overall. Anyway, time will tell.
- kakarot 8y ago
  > However, it's ~clueless customers and low-level distributors who'll most likely get pwned. INTERPOL has made some large busts in the past, but afaik it always has come down to failure to maintain proper OPSEC. There's also the issue of possible directives in the future to prosecute customers en masse after major domestic busts using backlogged USPS analytics. As traffic obfuscation methods continuously improve, the economics of such directives will begin to look more and more reasonable when the goal is not to stop trade directly, but by establishing fear with precedent. The problem with dead drops is that on a large scale where the level of trust is sufficiently low, it inevitably requires an escrow and resolution system with human moderation. And then you've just centralized trust instead of circumventing it. Dropgangs in the form described by the article do not provide the full package. The article itself claims dropgangs and off-market platforms are the future and then goes on to state: > Cryptocurrencies are still the main means of payment, but due to the higher customer-binding, and vetting process by the merchant, escrows are seldom employed. Usually only multi-party transactions between customer and merchant are established, and often not even that. The author doesn't seem to make the connection that higher levels of trust means less scalability. The success of these platforms however is directly related to their scalability. Yes, this is a dangerous, criminal activity for both parties and I definitely do not appreciate the explosion in popularity of these kinds of markets. I have seen regular people get serious federal prison time due to the Dunning-Kruger effect. The barrier for entry is much higher for new distributors as well, because A) at this membrane exists highest ratio of undercover law enforcement and B) establishing initial trust is key to something like dead drops, which typically will involve high-dollar, distributor-to-distributor transactions. Open markets help to facilitate initial trust-building by providing a trustworthy platform.
panarky 8y ago
Anonymous, decentralized transactions using dead drops only works with side-channels for reputation, or with security deposits. Side-channels for reputation like posting cryptographic proof on darknet forums isn't scalable or reliable. And security deposits without a third-party adjudicator just move the trust issue around without eliminating it. One ideal solution could be a cryptocurrency with on-chain confirmation of the real-world transaction by both parties after the fact. When both parties to the transaction can point to a series of successful transactions through a web of trust, then the central marketplace for reputation or escrow is no longer needed.
- runeks 8y ago
  > One ideal solution could be a cryptocurrency with on-chain confirmation of the real-world transaction by both parties after the fact. How do you prevent merchants from just creating a thousand fake transactions to make them look reputable?
  - panarky 8y ago
    This is where the web of trust comes in. You give the greatest trust to reviews provided by the anonymous identities you have transacted with. You give progressively less trust to reviews by identities 1, 2, ..., n hops away from those you have transacted with. If a merchant creates 1000 sock-puppet consumers, they won't be reachable from your trust network, so you'll give them little if any weight.
    - runeks 8y ago
      > You give the greatest trust to reviews provided by the anonymous identities you have transacted with. I don’t quite follow. Consumers deal with merchants. Consumers give reviews to merchants. So the anonymous identities you mention will be customers that I don’t know. Merchants won’t review each other, I presume. In other words, as I understand it, the “anonymous identities I’ve transacted with” will be merchants, who don’t review other merchants. > If a merchant creates 1000 sock-puppet consumers, they won't be reachable from your trust network, so you'll give them little if any weight. What if do a successful deal with this merchant? Will I then trust that all those 1000 fake transactions took place? And will the people who trust me also believe that?
bayesian_horse 8y ago
From what I know about drug users' level of motivation I'd say the dealers will regret using dead drops quickly...
yownie 8y ago
Few years ago it was revealed USPS was photographing all senders and recipient addresses on all mail in order to 'backtrack' packages in order to aid in investigations. https://www.offthegridnews.com/privacy/vast-postal-surveillance-system-tracking-mail/ https://www.offthegridnews.com/privacy/vast-postal-surveilla...
- yownie 8y ago
  more: http://www.washingtonpost.com/wp-dyn/content/article/2008/02/17/AR2008021701801.html?hpid=sec-tech&noredirect=on http://www.washingtonpost.com/wp-dyn/content/article/2008/02...
  - yownie 8y ago
    https://en.wikipedia.org/wiki/Mail_cover https://en.wikipedia.org/wiki/Mail_cover
    - yownie 8y ago
      https://en.wikipedia.org/wiki/Mail_Isolation_Control_and_Tracking https://en.wikipedia.org/wiki/Mail_Isolation_Control_and_Tra...
stcredzero 8y ago
The current method of reporting sales experience on forums is open to spamming and manipulation since it is hard to show that a deal even took place. It is likely that forums and merchants develop best practices to solve this problem. There is the potential that merchants will start to issue “proofs of sale” in a cryptographic form, that customers then use to make statements about the performance of the merchant in public forums. Could a blockchain or some other kind of public ledger be used to create a public sales rating record? I don't see how such a thing can respond to spamming and deliberate manipulation, however. Another thought I just had: could some combination of drones and self driving cars revolutionize dead drops?
- zhoujianfu 8y ago
  Yeah, and you can at least sort of solve the manipulation issue by weighting ratings based on “bitcoin days” of the address making the review. (Number of bitcoin on the address times time it’s been there.)
3131s 8y ago
> “The Silk Road” was the first of a phenomenon that became widely known: Darknet Markets. The history is way off here, Silk Road was one of the first two completely public darknet markets (the other being the short-lived Open Vendor Database) but there were private darknet markets long before, e.g. The Farmer's Market. > Use of the Internet to facilitate the marketing and sales of physical goods - drugs, weapons, false identification papers - began latest in the late 1990s, but usually focused on local geographic markets in major cities. This was due to the fact that payment and delivery still required in person meetings. Not so, back then and still to this day drug dealers simply throw a stack of cash in the mail. The clearnet markets for "research chemicals" all operated this way and went basically unchecked until Operation Web Tryp in 2004, which began an era of harsher enforcement of the Federal Analogue Act.
- mirimir 8y ago
  Well, it was Adamflowers "long before". And its OPSEC was over-the-top lame. I mean, Hushmail? But then, DPR was also very sloppy.
  - krageon 8y ago
    If you really look at how the big names have gotten busted, you will see that their opsec is bad with no exceptions. Apparently people that actually know the craft don't see enough upside to running a marketplace like that, which should make you wonder about the ones that still exist.
    - mirimir 8y ago
      Yes, indeed. I did look, rather carefully, a couple years ago. And OPSEC failure (sometimes spectacular) explained all of the the major busts that were widely reported.[0] However, I did not research criminal court records. Accessing that data is nontrivial, especially for someone using a pseudonym, who can't show up physically, has no ID, and can't pay with a mainstream credit/debit card. Few, if any, courts accept Bitcoin etc. Also, I made no effort to check for parallel construction, except by looking for inconsistencies among published accounts of investigations. And I do understand that the US DEA's Special Operations Division (SOD) funnels information from the NSA, CIA, etc to federal investigators.[1] With the understanding that "the utilization of SOD cannot be revealed or discussed in any investigative function".[2] And that includes outright perjury, if necessary. Just as we've seen regarding the use of Stinger intercepts. It's hard to say whether people who know tradecraft well just prudently avoid running dark markets, as you say. Or whether they do, but don't get caught. Time will tell, I guess. At least, if remaining ones do get busted. But if they don't, there's the implication that the operators practice good OPSEC. Or, that they're honeypots ;) 0) https://www.ivpn.net/privacy-guides/online-privacy-through-opsec-and-compartmentalization-part-2 https://www.ivpn.net/privacy-guides/online-privacy-through-o... 1) https://www.deamuseum.org/wp-content/uploads/2015/08/042215-DEAMuseum-LectureSeries-MLS-SOD-transcript.pdf https://www.deamuseum.org/wp-content/uploads/2015/08/042215-... 2) http://www.reuters.com/article/us-dea-sod-idUSBRE97409R20130805 http://www.reuters.com/article/us-dea-sod-idUSBRE97409R20130...
nopacience 8y ago
I get the idea. However if someone does this, it means 99% they trade something prohibited by the law. > Now, goods are hidden in publicly accessible places like parks and the location is given to the customer on purchase. Then the merchant can wait and see who picks the package. The merchant might be someone with a machete.
tomcooks 8y ago
Been a big fan of this author since the cypherpunk podcast, strange to see "smuggler" reveal his real (?) name.
- arikr 8y ago
  Could you please link the podcast?
auslander 8y ago
Dark Drones!
cvza 8y ago
"What is illegal and unethical trade for one is perfectly legal for another. Judge for yourself." Is it just me, or is this statement just plain incorrect?
- trevyn 8y ago
  Jurisdiction.
tw1010 8y ago
> "What is illegal and unethical trade for one is perfectly legal for another" What in the world does that mean? There's only one rule of law.
- mr_pinnen 8y ago
  That might be true for one specific country/state. But different countries have different laws.
grugq 8y ago
Dead drop based drug distribution doesn’t scale to retail levels. It is used in Moscow and I know of people who will order from a dealer, then search the surrounding area and clear out all the drops they find. It works for them, although one questions the sanity of stealing from Russian drug dealers. For more practical guides on how people who sell drugs avoid the negative repercussions: • AlpraKing’s business guide is hard to beat. https://archive.is/K7j1U https://archive.is/K7j1U (It’s a great business guide in general, actually) • Gary Cooper’s Never Get Busted Again and Never Get Raided Again shows practical use of dead drops for dealing. Busted: https://m.youtube.com/watch?v=ZyAjLkBCWKI https://m.youtube.com/watch?v=ZyAjLkBCWKI Raided: https://m.youtube.com/watch?v=ML6VAy_ygVs https://m.youtube.com/watch?v=ML6VAy_ygVs
- DyslexicAtheist 8y ago
  some really great links thanks! >although one questions the sanity of stealing from Russian drug dealers. I'd conjecture that the value of the booty would be quite limited too? (small envelopes not kilograms exchanging hands). A smack-head probably wouldn't care about the risks just as long as they get their next fix? EDIT: "4. Don't hire people under 30 years old" that is great advise. You want Mike Ehrmantraut like characters (from "Better call Saul") ... btw that show was consistently good in OpSec lessons (unlike the parent show "Breaking Bad").
  - grugq 8y ago
    Sure, they aren’t stealing to supply their own business but to supply their partying. Apparently there’s some trick involved in selecting a dealer who offers a variety of options, not just one substance. They cache one or more of each in an area, so you buy a mid size quantity of something and the surrounding block probably has 5x as much plus other things... because the dealers are humans, they develop patterns of drop locations. Once these guys learn the pattern, they know where to look. The drops get ripped so frequently there is a process for handling a drop that has been unloaded before the customer get there. The customer has to supply pictures of the drop location and the empty drop, then the dealer will send them to another place. Dead drops provide some security, but they’re a trade off. I think the Gary Cooper videos are massively underrated for security principles. He explains how the adversary operates, how they think, and what their capabilities are, then based on that he distills core security strategies to exploit their operational limitations and mitigate their capabilities. This is really great stuff for understanding how to counteract a threat, how to do proper counterintelligence analysis and apply it for security. The problem is that people see these as “stoner videos” rather than “the design and implementation of counter law enforcement techniques, by a former cop.” There is a lot to be learned, both from general security principles (such as compartmentation, cover, and concealment) But also how to analyze an adversary and develop a plan to mitigate their capabilities. I was going to do a write up them years ago but someone scooped me by seeing my recommendation and then doing a (crappy) writeup before me. Just one of the things that killed my enthusiasm for sharing recommendations. But, I should do a write up. For a counterintelligence analysis they are sublime.
golergka 8y ago
Once again, I'm completely surprised how behind is western dark market world compared to Russia in that regard. Tor-based marketplaces with dead drops in parks and around the city have been around since 2013 and are now the only practical way to buy any drugs. Telegram channels have been widely used since at least 2015. Any city park has police squads patrolling the exits at night - they search people, open up your phone and look up Telegram and Tor apps if they suspect you've gone there to get a drop. Drops (they're actually called "buried treasure", or "klad" here) moved from parks to the city - you get instructions, for example, to go to some floor of a random apartment building, stop the elevator and search for a magnet-attached package behind it's doors. I don't think that this article doesn't do a good job on the risk model because it doesn't understand how law enforcement operates - at least in Russia, the picture is completely different. Law enforcement has KPIs to catch some amount of drug dealers and users, and they have developed ways to do this reliably. So, instead of intercepting communication between the drug sellers and drug buyers, they prefer to work together with sellers (taking considerate money for 'protection') and arrest some proportion of buyers when they go for the drop.
- tawm 8y ago
  Thank you for this valuable comment. It is highly likely that police would go for the lower hanging fruit of buyers instead of sellers in a system so opaque and decentralized. The old thinking of "what could happen, they only want the big guys anyway" should have no place in OpSec. And when information on these networks is so hard to come by to begin with, a buyer being busted is very desirable. The way I see this "evolution" of the dark markets, is that it mostly protects vendors while inconveniencing and endangering buyers.
  - golergka 8y ago
    It's always been like that here - the police departments that were supposed to fight drug trade basically overtook it. So why would they arrest their own employees when they can close their quota with drug users instead?
- mirimir 8y ago
  It's the same in Mexico.
rayrrr 8y ago
When Pokemon Go hit, it was impossible not to notice in public. Just a thought.
jimb1 8y ago
Yes, I am also quite impressed at the amount of thought that has been put into this concept. I would be quite interested in helping in designing these systems, as I have been following some of the necessary technologies for years. Jim I foresee a stiff plastic or metal pipe, tapered to a point at one end, which can be driven by force into soil or into a lawn, so that it ends up to be approximately flush with the plane of the soil. Once placed, a smaller cylindrical container, as well as active elements, if needed, can be slid into the metal pipe, from above. From the linked article: https://opaque.link/post/dropgang/ https://opaque.link/post/dropgang/ "This challenge is met by Dropgangs in various ways. The primary one is that the documentation of each dead drop is conducted in minute detail, covering GPS coordinates, photos of the surrounding and the location, as well as photos of the concealment device in which the product is hidden (such as an empty coke can). The documentation however increases the risk for the Dropgang since whoever creates it would be more easy to identify by surveillance. In addition, even great documentation still requires the customer to understand it and follow it precisely, which can lead to suspicious behavior around the dead drop location (staring at photos, visually comparing them to the surrounding, etc)." [end of partial quote] Ordinarily, smartphones that use GPS, don't use accurizing features, such as WAAS. (Wide Area Augmentation System). See https://en.wikipedia.org/wiki/Wide_Area_Augmentation_System https://en.wikipedia.org/wiki/Wide_Area_Augmentation_System WAAS correction data is probably already available on the Internet. "Accuracy[edit] The WAAS specification requires it to provide a position accuracy of 7.6 metres (25 ft) or less (for both lateral and vertical measurements), at least 95% of the time.[2] Actual performance measurements of the system at specific locations have shown it typically provides better than 1.0 metre (3 ft 3 in) laterally and 1.5 metres (4 ft 11 in) vertically throughout most of the contiguous United States and large parts of Canada and Alaska.[3] With these results, WAAS is capable of achieving the required Category I precision approach accuracy of 16 metres (52 ft) laterally and 4.0 metres (13.1 ft) vertically. [end of partial quote] WAAS might be described as a form of differential GPS. If the location as computed by the smartphone was improved by WAAS, the statement above indicates an accuracy within about 1 meter. IR-specific retroreflectors to greatly simplify things. The article describes complicated systems using Bluetooth or WiFi to help locate these dead-drops. While they are certainly innovative, they add cost and complexity to the hardware involved. I have thought of a much-cheaper system that I feel is sufficiently secure and simple for common use. Light-retroreflectors are commonly made from Scotchlite https://en.wikipedia.org/wiki/Retroreflective_sheeting https://en.wikipedia.org/wiki/Retroreflective_sheeting or plastic molded corner-cubes. If a rather small (say, 1/4 in diameter) sphere covered with retroreflector material was held up from the insert, possibly by a short, thin stiff wire, the sphere could be visible, but not excessively obvious even during the daylight. It would be easy to find this device with a flashlight in the dark. For added security, an infrared-transmitting plastic (such as is often used to cover IR-activating remote controls, such as https://www.eplastics.com/plexiglass/acrylic-sheets/ir-transmitting https://www.eplastics.com/plexiglass/acrylic-sheets/ir-trans... ) could be used to ensure that only IR is retroreflected back to a searcher. Ordinary smart-phone camera arrays are not only sensitive to human-visible light (generally described as 400-700 nanometer wavelength), but are also sensitive to near-IR wavelengths. If a smartphone camera was combined with a directional IR LED, substituting for the white light LED lamp used for photography, and aiming in the same direction, a user would be able to see (through the camera display) the IR-specific reflections from an IR-limited retroreflector, and this would probably be doable both during the day and at night. A person operating such a camera would "look like" he was doing photography, or perhaps playing a game. Somebody watching, even at night, could not see the IR. The IR 'searchlight' could be a narrow-beam device, perhaps with a full-angle of 16 degrees or so (typical for a narrow-beam IR LED), so it wouldn't be particularly obvious even if watched through an IR viewer. (If the IR LED itself was shielded from direct view.) One advantage of this technique is that the searcher could identify the target from a very long distance away, perhaps many tens of meters, and thus approach it in a more "innocent" fashion. No obvious "searching" would have to be performed in the open. And, the person who placed the dead drop could ascertain its status without later needing to approach it closely. This technique could be combined with Bluetooth or WiFi techniques, too. The retroreflector could normally be retracted, and only raised if the proper Bluetooth or WiFi signal was heard. Or, perhaps, the target would contain an exposed IR LED, which would activate from an battery only if the proper signals were heard. The resulting dead-drop would be virtually impossible to find.
DoctorOetker 8y ago
Is this how people will deal food during a food scarcity in a previously developed society?
jimb1 8y ago
This system has problems deleting messages.
- deleted 8y ago
  [deleted]
- deleted 8y ago
  [deleted]
- mirimir 8y ago
  There's a 10-20 minute window for deleting messages. And then a ~1 hour window for editing them. So if you miss the delete window, you can just edit to "[post deleted]". But maybe there's some minimum karma needed. I don't remember. Edit: OK, 20-30 minute window for deleting.

445 points by arikr 8y ago

Very interesting reading the obstacles faced by the black market drug trade and how they're overcoming them. It seems like the producer layer is most susceptible to penetration as it is essentially identical to most gangs. It's entirely glossed over here but procuring the product seems like a difficult problem for an anonymized distributor: How do you make sure the product gets to your support layers? As interesting as it all is, it's also very concerning for Law Enforcement. While petty things like drugs don't really worry me much, the advances in the anonymized distributed networks like this do mean that things that previously required big budgets of national intelligence agencies become easier for common malcontents to use. The article essentially describes a quintessential terror cell structure, but with the added benefit of 0 direct interaction. The separation of layers has always existed with limits (IE you had to have some form of communication) but this potentially allows for goods and services to easily be passed from fully anonymized layers to others without every having any interaction at all.

amundsentb 8y ago
Maybe it will force the police to focus on violent crimes. The best counter to terrorism is a homogeneous population.
nyolfen 8y ago
>As interesting as it all is, it's also very concerning for Law Enforcement. it seems better from their perspective than street gangs shooting each other over turf imo. an improvement for everyone involved, frankly. >How do you make sure the product gets to your support layers? through dead drops, of course ;)
- agumonkey 8y ago
  if the darkweb resolves the drug on war issue .. that will be something
  - taurath 8y ago
    Unlikely. It just decentralizes distribution and dealing - bulk darkweb drugs still end up in the hands of street resellers.
    - austhrow743 8y ago
      At the moment that's how it works. If it's true that things are moving in to telegram and other encrypted chat platforms then it could change. It makes it simple enough for the average person to do.
      - nyolfen 8y ago
        exactly, who on earth would prefer dealing with some street tough
      - mtgx 8y ago
        Telegram isn't anymore encrypted than Skype by default.
- wpietri 8y ago
  I'm not seeing why this would particularly reduce violence. Some gang violence isn't about drug sales, but the same sort of territorial control that nation-states like to fight over too. And for the violence that is about drug sales, I'm not seeing why that wouldn't continue. Dead drops are just as local as corners are, and there's just as much incentive to fight over business as there was previously.
  - tyre 8y ago
    In the current system, you have to have dealers hanging out on the corners. To take territory, you shoot at the dealers and either kill them or scare them away. In this system, you have drops. How does a rival gang know where they are? They'd have to buy the product to discover the drop and drops shouldn't be used multiple times. They could watch a user find one, but then that drop wouldn't be used again so they couldn't stake out and wait for their rival to refill it.
    - wpietri 8y ago
      It's not clear to me how much gang violence is specifically driven by fights over corners, rather than other kinds of inter-gang fighting. But let's assume it's significant. I think it's very unlikely a drug business can get to scale without reusing drops; the cost of scouting a good drop is significant, and the number is finite. Regardless, the value of a drop declines the farther it is from customers and from the dealers who supply the drop. So in practice, gangs will still have an incentive to claim turf and to harm other dealers using drops on their turf. Even if that somehow doesn't happen, they'll still have the same strong competitive incentives. So they'll be very much inclined, as now, to discover rivals and take over their business through violence.
      - CryptoPunk 8y ago
        If gangs are claiming turf and excluding other dealers, then those aren't dead drops, which by definition are undetected drops by anonymous parties. It's an open question whether effective dead drops are even possible, but if they are, and come to be widely adopted for trade in contraband, then a significant portion of the source of territorial conflicts between criminal organizations vanishes.
zozbot123 8y ago
> As interesting as it all is, it's also very concerning for Law Enforcement ... things that previously required big budgets of national intelligence agencies become easier for common malcontents to use. We'll probably see "white hat" distributed networks with pseudonymous reputation used for the provision of security and crime-prevention services, with no need for traditional Law Enforcement to get involved in any real way other than in a secondary, oversight role. After all, tools that "common malcontents" can use, can also be used by people working for the social good.
SolarNet 8y ago
Since you are primed on the question. You should read Rainbows End by Vernor Vinge. It's a near-future sci-fi book that tackles these sorts of questions. As a bit of a "spoiler" his solution is a covenant with the citizens. The government will hack all of our computers, will own the IME equivalents of every machine, and in return they will only use this power to hunt down terrorists and mass murderers, people who are looking to leverage technology to build nuclear weapons, bio-weapons, etc. Things like parallel construction would have to stop though. Or be considered an immediate dismissal.
- selestify 8y ago
  How could the citizens trust the government to do only that?
  - dahdum 8y ago
    A strong judiciary, high bar to change the law, and harsh accountability. Still a fine line to walk.
    - atemerev 8y ago
      People from more or less politically stable countries like the US are very naive in not considering what can happen to the best of governments overnight. People from Europe have this sort of... experience. Most of us know that trusting the government with our lives is not a good idea.
      - jacquesm 8y ago
        > People from more or less politically stable countries like the US I would have agreed with that assessment in the past but in the present I really can't.
        atemerev 8y ago
        Come on, if your country can handle _this_ president without collapsing immediately, your political system is really well designed!
CryptoPunk 8y ago
I think the right (though not necessarily the most likely) solution to the problems you allude to is more powerful local governments able to monitor the goods coming into/out-of their jurisdiction, a sort of return to the more decentralized political structure of the feudal era. In this sort of arrangement, a jurisdiction's authorities could require shipments to be bonded, with forfeiture of the bond if it is found to contain a restricted substance. This would result in policing happening at the edges, by those providing the bonds, and likely relying on trust networks to assess the risk that a package originator is a terrorist. Such a world would have a lot more trade friction than an idealized world govermment that centralized control of the movement of goods to prevent malevolent behaviour while allowing free trade of benign goods, at least in the earlier stages where localized solutions are not well-developed/efficient, but it would mean a far lower chance of a significant fraction of the world coming under the tyranny of a single malevolent government. An all-powerful central govermment will always pose a far greater threat to the advancement of society than chaos IMHO.
dghori 8y ago
There's nothing to be worry dangers of this network. I don't believe that our intelligence agencies haven't found a way break this anonymized distribution network. Its a well known fact that IA is indirectly sponsoring this network to get funds for their illicit operations. And I am pretty sure that they have planted backdoor in this network.
- dfischer 8y ago
  What is IA?
  - amdavidson 8y ago
    Presumably, "intelligence agencies".
mirimir 8y ago
> The article essentially describes a quintessential terror cell structure, but with the added benefit of 0 direct interaction. Isn't "terror cell" a little over-the-top? It's just trade craft. The US does it. Russia and China do it. The various mafias (at least, modern ones) do it.
- crowbahr 8y ago
  It's not over the top, it's what I was talking about. Terror cells have had to operate with reduced resources since the dawn of terrorism. The terror cell structure is trying to keep things as isolated as possible, and I'm saying this structuring and proliferation of dead-drop tech will all boost the potential power of the terror cell. I'm saying that what they've described is a structure analogous to what exists, just higher tech. The time to adoption of this by terror elements is going to be short.
dsfyu404ed 8y ago
>As interesting as it all is, it's also very concerning for Law Enforcement. While petty things like drugs don't really worry me much, the advances in the anonymized distributed networks like this do mean that things that previously required big budgets of national intelligence agencies become easier for common malcontents to use. Last years state only tech is next years commercial tech. Once upon a time only the clergy were literate, now everyone can read and write whatever they want. Once upon a time the state could control the news. Now anyone with an internet connection can publish stuff. Once upon a time only major powers had tanks and artillery now every podunk warlord has them. Once upon a time only superpowers sent things into space. Now companies are doing it and making a profit. Once upon a time only the three letter agencies could bug a room. Now anyone can buy pinhole cameras for $5. Trying to stand in the way of that is just stupid. You can't stop the long slow march of technological progress. At best you can quarantine off some small dystopia that you control.

drcode 8y ago

I wonder if dark web markets will ever establish a comprehensive alternative parcel system... that seems like the natural, final extension of these ideas. The technical challenges to this would of course be significant (I'll refrain from listing them and suggesting potential workarounds since I don't really want to give anybody any specific ideas on this LOL)

CamperBob2 8y ago
There are quite a few holes in the scheme as outlined in the article. The author asserts that dead drops are better than post office boxes because they're harder to surveil, but what keeps law enforcement from signing up their own personnel as distributors? Then it's just a matter of staking out their own dead drop and arresting whoever shows up. This is why the first rule of opsec has always been, "Involve as few people as possible." You can't improve security by adding more people to the loop. The best way to do this is probably for the 'salesperson' to drive to an isolated area and chuck packages into the bushes at random intervals. The packages then send their GPS locations to a LoRaWAN gateway somewhere, to which their buyers have been sold access tokens. LE can still infiltrate the organization in the sales role, but with more difficulty. Adding an extra distribution layer with fixed dead-drop locations just seems pointless.
- solarkraft 8y ago
  This requires both GPS and LoRaWAN hardware, which would introduce a financial overhead of about 20-30$ per package. Fascinating idea, however.
  - TehCorwiz 8y ago
    It's plausible that the beacon need not be directly co-located with the drop, but be near enough. It should also be possible to re-use them for some time. I would imagine that the actual cost overhead would really only be $20 - $30 per active dead-drop location + some percentage for lost or damaged beacons.
- keithnz 8y ago

keithnz 8y ago

Kind of interesting distribution is kind of like darknet geocaching. I wonder how much accidental discovery occurs.

tomglynch 8y ago
The other issue I see is at some point, all secret hiding spaces will be used. For a consumer, checking previous drop locations may result in finding free goods.
- droopyEyelids 8y ago
  If this becomes big business then every retail store will start providing airport locker type storage.
  - olefoo 8y ago
    In a known, easily watched location? Did you read the article?

rospaya 8y ago

A very long article with the only takeaway being... a better use of dead drops? Am I missing something bigger here?

deleted 8y ago

[deleted]

zzzcpan 8y ago

Using telegram for communications with customers also allowed marketing to escape darknet forums and into the walls of public places. Normal people don't even need to know about darknet to buy drugs and what those @usernames on walls are is becoming common knowledge.

JohnJamesRambo 8y ago

Dead drops sounds like an awful way to distribute anything at scale. The loss from other people finding stuff seems enormous also.

loeg 8y ago
Illicit drug and alcohol distribution has traditionally large nominal margins and large expected loss at every layer, commensurate with the efficacy of law enforcement.
bigiain 8y ago
So long as there's sufficient profit margin to allow for an acceptable "shrinkage", it just becomes a cost of doing business. The benefits in terms of privacy/security for the typical darknet vendor probably make it well worth low double digit percentage losses, given the assumed margins from source to end user...
- JohnJamesRambo 8y ago
  I don't know how secure it is when a cop sees you drop a bag of heroin behind a bench instead of just shipping people stuff.
  - 6nf 8y ago
    They wouldn't drop at a public bench with people around
orbifold 8y ago
Even normal drug dealers often don’t have the drugs on their person. Instead they are stashed away somewhere close and retrieved on demand.

jorblumesea 8y ago

The biggest flaw here is the dead drop system. It doesn't scale well and involves many more complex steps and people in the system. For example, a drone on surveillance duty that continuously watches the area will be able to identify patterns and pick out possible outliers. Combined that video feed with machine learning and it may be possible actively identify dead drop participants.

anon_cow1111 8y ago
If the system becomes that large and profitable, those surveillance drones are going to end up mounted on plaques like big game trophies.
- deleted 8y ago
  [deleted]

bfuller 8y ago

Russian darkmarkets started using dead drops years ago if I recall correctly

GistNoesis 8y ago

How do you defend against the eye in the sky, video surveillance or location tracking ? There seems to be conflicting objectives. When hiding an object you don't want too many people around to see where you hide it. Yet if you record only two person going to exactly the same non standard spot it's pretty much a red flag, then you follow the person in the recording to identify them. Most buildings are probably not valid because they can't be entered easily by both parties.

perlmutterlabs 8y ago
Yeah, it's a great story, but machine vision + machine learning + surveillance could pull the rug out from the dropgangs market in a second. But really, other than this fatal flaw, it's a great narrative of the internet spilling into and interfacing with analog markets
- zzzcpan 8y ago
  It's not a fatal flaw, unless they choose a location with police surveillance, but why would they?
  - perlmutterlabs 8y ago
    Taking a guess: ML is just too good. Don't forget, it's also a signal to leave surveillance areas, eg "last seen driving into the desert". Any kind of outlier behavior is PART of the detection model ... that's where probabilistic models gain leverage, in fact ...
    - maxander 8y ago
      I think if “he left surveilled areas for no registered reason” is something that law enforcement observes and considers evidence of criminal activity, we’ll have well and truly lost any semblance of being a free society.
      - perlmutterlabs 8y ago

bittermang 8y ago

The elephant in the room that this article highlights, but never addresses. A mobile phone has become a de facto a requirement for illegal commerce, as described, and to me presents a pretty huge single point of failure. And yes, I know, EVERYBODY has a phone. But I don't. Why would I want to carry a police officer in my pocket? Especially if I'm a criminal.

zzzcpan 8y ago
Dead drops don't require a phone, only something to take a photo of the hiding place.
- bittermang 8y ago
  The chat networks do. As well as several of the methods outlined for protecting/locating the dead drops. WiFi hotspots, bluetooth beacons, etc.
  - yyx 8y ago
    You'd love to know that Telegram works on PC too.
    - wbl 8y ago
      What is the going price for a Telegram 0-day again?
      - brohee 8y ago
        Up to $500,000 for RCE+LPE (https://www.zerodium.com/program.html https://www.zerodium.com/program.html)
stuaxo 8y ago
Tonnes of people buy things like this right now, on their personal phones using text messages to people that they actually go and meet (or their drivers), using no encryption whatsover.

kahlonel 8y ago

My vision was distorted for full 30 seconds after reading this page.

theelous3 8y ago
Yeah. High contrast is only good for people with serious vision problems. Awful to read.

monotone666 8y ago

Dead drops can’t compete with USPS. They require a court order to open your package and even then can’t charge anyone with possession. All they do is send you a “love letter” and people have reported receiving future packages just fine. Millions of people use dark net marketplaces. The war on drugs has fueled their growth and more serious crimes like identity theft have benefited from it.

omeid2 8y ago
The war on drug has to be one of the top contributors and financiers of crime and criminal gangs. Imagine a world where criminal gangs don't have access to the money they make through drugs and a government that doesn't have to spend huge amount of money on drug laws enforcement because drug trafficking would be much less lucrative in the existence of legal access and you get fewer and very cash-strapped drug gangs, and government making money from taxing drugs. Surely such massive savings and earnings can be spent to help problem users and reduce violence, no?
- hiccuphippo 8y ago
  It can't help with getting voters though. At least until new voters come around and old voters get phased out.
- sigmaprimus 8y ago
  The war on drugs is also a big contributor to the LEGAL gangs such as police,distric attornies, defence attorneys, prison officials and worst of all judges. Definitely an industrial economic complex similar to the Military Industrial Complex.
  - omeid2 8y ago
    Don't forget for-profit prisons.
  - cf498 8y ago
    And protects the market of big pharma as well as the tobacco and alcohol industry. There is a reason these are among the top contributes for campaigns against the legalization of illegal drugs.

chrisweekly 8y ago

Excellent summary. I'm reminded of the old saw, "The future is already here, it's just not evenly distributed".

bigiain 8y ago
"Old saw"? I remember that quote being new, it's not _that_ old... <google google google> It's from 2003. https://www.goodreads.com/quotes/681-the-future-is-already-here-it-s-just-not-evenly https://www.goodreads.com/quotes/681-the-future-is-already-h...
- hinkley 8y ago
  Sit down. You're not going to like what I'm about to say. This is going to start happening to you (us, really) more and more. Things that happened in the 00's happened a 'long time ago' to a larger and larger group of loud people with Internet access. People who can drink legally were born in '98. What's up with that shit? https://en.wikiquote.org/wiki/William_Gibson#Quotes https://en.wikiquote.org/wiki/William_Gibson#Quotes has a citation for him saying it in '99 and an unsupported assertion that it might have been said in '93. I've been hearing this long enough that I believe the '99 date, but I'm skeptical about '93.
  - bigiain 8y ago
    Yeah yeah. I know... And I would have gotten away with it too, if it weren't for you meddling kids and your damned dog... -- Old Man Big from The Haunted Amusement Park

DonHopkins 8y ago

Pokemon Blow!

sigmaprimus 8y ago

My biggest problem with using the Darknet, messaging apps, or old school methods such as dial a dope or hitting up the guy on the street corner to buy drugs is the same. How can I really trust someone willing to break the rules and sell drugs or other non legal goods? You lay down with dogs you get fleas!! Last thing I would want is to eat, smoke or snort something from someone I have never met even if they have a 5 star rating on a darknet review board. Don't even get me started on messaging out to someone whos' contact info is written out next to a pay phone or on a bathroom wall and the likes!

kakarot 8y ago
Generally speaking, if you can't trust someone directly then the next best thing is consensus among others. Ideally, a connection only occurs in real life because one or more mutual acquaintances have decided they trust both parties involved. Relying on the word of others, on a network of trust, is paramount. Remember, these distributors also have their own set of problems when it comes to trusting others. Most open marketplaces on the internet, not just darknet markets, provide reputation systems for this purpose. Even Amazon has a review and rating system in place, which was integral towards building initial trust with its buyers and sellers.
mirimir 8y ago
Yes, you never know what you'll get. But you can protect yourself. Whenever you have a new batch of some street drug, you test with a small dose. Maybe 10% of what you'd normally use. If it's too little, test with maybe twice as much. Waiting as appropriate, if tolerance is an issue (as with LSD). And then use what you need, to get the desired effect. In most cases, bad drugs are either cut way too much, or adulterated with some other drug. But it's pretty rare for someone to be selling outright poison. So maybe an amphetamine in the MDMA or LSD. But nothing that's likely to kill at 10% of a typical dose. The one key exception is fentanyl. So yes, some idiot may indeed sell you heroin (or even cocaine) containing too much fentanyl. However, you can still protect yourself by initially testing a small dose.
amundsentb 8y ago
If something is illegal, it does not follow that it is also immoral. You may actually deal with a very moral person.

mirimir 8y ago

It's cool to see serious tradecraft applied to this stuff. Especially compartmentalization. And yes, using traditional shipping systems is a serious problem for old-school dark markets. I've thought off and on for several years about the potential for using dead drops with accurate GPS. I mean, geocaching. Many years ago, when I was dealing LSD, it was pretty common to use dead drops. But then, they were typically rental lockers in bus and train stations. I agree that ubiquitous surveillance is a problem. However, it's ~clueless customers and low-level distributors who'll most likely get pwned. And they won't know anything important about the operation overall. Anyway, time will tell.

kakarot 8y ago
> However, it's ~clueless customers and low-level distributors who'll most likely get pwned. INTERPOL has made some large busts in the past, but afaik it always has come down to failure to maintain proper OPSEC. There's also the issue of possible directives in the future to prosecute customers en masse after major domestic busts using backlogged USPS analytics. As traffic obfuscation methods continuously improve, the economics of such directives will begin to look more and more reasonable when the goal is not to stop trade directly, but by establishing fear with precedent. The problem with dead drops is that on a large scale where the level of trust is sufficiently low, it inevitably requires an escrow and resolution system with human moderation. And then you've just centralized trust instead of circumventing it. Dropgangs in the form described by the article do not provide the full package. The article itself claims dropgangs and off-market platforms are the future and then goes on to state: > Cryptocurrencies are still the main means of payment, but due to the higher customer-binding, and vetting process by the merchant, escrows are seldom employed. Usually only multi-party transactions between customer and merchant are established, and often not even that. The author doesn't seem to make the connection that higher levels of trust means less scalability. The success of these platforms however is directly related to their scalability. Yes, this is a dangerous, criminal activity for both parties and I definitely do not appreciate the explosion in popularity of these kinds of markets. I have seen regular people get serious federal prison time due to the Dunning-Kruger effect. The barrier for entry is much higher for new distributors as well, because A) at this membrane exists highest ratio of undercover law enforcement and B) establishing initial trust is key to something like dead drops, which typically will involve high-dollar, distributor-to-distributor transactions. Open markets help to facilitate initial trust-building by providing a trustworthy platform.

panarky 8y ago

Anonymous, decentralized transactions using dead drops only works with side-channels for reputation, or with security deposits. Side-channels for reputation like posting cryptographic proof on darknet forums isn't scalable or reliable. And security deposits without a third-party adjudicator just move the trust issue around without eliminating it. One ideal solution could be a cryptocurrency with on-chain confirmation of the real-world transaction by both parties after the fact. When both parties to the transaction can point to a series of successful transactions through a web of trust, then the central marketplace for reputation or escrow is no longer needed.

runeks 8y ago
> One ideal solution could be a cryptocurrency with on-chain confirmation of the real-world transaction by both parties after the fact. How do you prevent merchants from just creating a thousand fake transactions to make them look reputable?
- panarky 8y ago
  This is where the web of trust comes in. You give the greatest trust to reviews provided by the anonymous identities you have transacted with. You give progressively less trust to reviews by identities 1, 2, ..., n hops away from those you have transacted with. If a merchant creates 1000 sock-puppet consumers, they won't be reachable from your trust network, so you'll give them little if any weight.
  - runeks 8y ago
    > You give the greatest trust to reviews provided by the anonymous identities you have transacted with. I don’t quite follow. Consumers deal with merchants. Consumers give reviews to merchants. So the anonymous identities you mention will be customers that I don’t know. Merchants won’t review each other, I presume. In other words, as I understand it, the “anonymous identities I’ve transacted with” will be merchants, who don’t review other merchants. > If a merchant creates 1000 sock-puppet consumers, they won't be reachable from your trust network, so you'll give them little if any weight. What if do a successful deal with this merchant? Will I then trust that all those 1000 fake transactions took place? And will the people who trust me also believe that?

bayesian_horse 8y ago

From what I know about drug users' level of motivation I'd say the dealers will regret using dead drops quickly...

yownie 8y ago

Few years ago it was revealed USPS was photographing all senders and recipient addresses on all mail in order to 'backtrack' packages in order to aid in investigations. https://www.offthegridnews.com/privacy/vast-postal-surveillance-system-tracking-mail/ https://www.offthegridnews.com/privacy/vast-postal-surveilla...

yownie 8y ago
more: http://www.washingtonpost.com/wp-dyn/content/article/2008/02/17/AR2008021701801.html?hpid=sec-tech&noredirect=on http://www.washingtonpost.com/wp-dyn/content/article/2008/02...
- yownie 8y ago
  https://en.wikipedia.org/wiki/Mail_cover https://en.wikipedia.org/wiki/Mail_cover
  - yownie 8y ago
    https://en.wikipedia.org/wiki/Mail_Isolation_Control_and_Tracking https://en.wikipedia.org/wiki/Mail_Isolation_Control_and_Tra...

stcredzero 8y ago

The current method of reporting sales experience on forums is open to spamming and manipulation since it is hard to show that a deal even took place. It is likely that forums and merchants develop best practices to solve this problem. There is the potential that merchants will start to issue “proofs of sale” in a cryptographic form, that customers then use to make statements about the performance of the merchant in public forums. Could a blockchain or some other kind of public ledger be used to create a public sales rating record? I don't see how such a thing can respond to spamming and deliberate manipulation, however. Another thought I just had: could some combination of drones and self driving cars revolutionize dead drops?

zhoujianfu 8y ago
Yeah, and you can at least sort of solve the manipulation issue by weighting ratings based on “bitcoin days” of the address making the review. (Number of bitcoin on the address times time it’s been there.)

3131s 8y ago

> “The Silk Road” was the first of a phenomenon that became widely known: Darknet Markets. The history is way off here, Silk Road was one of the first two completely public darknet markets (the other being the short-lived Open Vendor Database) but there were private darknet markets long before, e.g. The Farmer's Market. > Use of the Internet to facilitate the marketing and sales of physical goods - drugs, weapons, false identification papers - began latest in the late 1990s, but usually focused on local geographic markets in major cities. This was due to the fact that payment and delivery still required in person meetings. Not so, back then and still to this day drug dealers simply throw a stack of cash in the mail. The clearnet markets for "research chemicals" all operated this way and went basically unchecked until Operation Web Tryp in 2004, which began an era of harsher enforcement of the Federal Analogue Act.

mirimir 8y ago
Well, it was Adamflowers "long before". And its OPSEC was over-the-top lame. I mean, Hushmail? But then, DPR was also very sloppy.
- krageon 8y ago
  If you really look at how the big names have gotten busted, you will see that their opsec is bad with no exceptions. Apparently people that actually know the craft don't see enough upside to running a marketplace like that, which should make you wonder about the ones that still exist.
  - mirimir 8y ago
    Yes, indeed. I did look, rather carefully, a couple years ago. And OPSEC failure (sometimes spectacular) explained all of the the major busts that were widely reported.[0] However, I did not research criminal court records. Accessing that data is nontrivial, especially for someone using a pseudonym, who can't show up physically, has no ID, and can't pay with a mainstream credit/debit card. Few, if any, courts accept Bitcoin etc. Also, I made no effort to check for parallel construction, except by looking for inconsistencies among published accounts of investigations. And I do understand that the US DEA's Special Operations Division (SOD) funnels information from the NSA, CIA, etc to federal investigators.[1] With the understanding that "the utilization of SOD cannot be revealed or discussed in any investigative function".[2] And that includes outright perjury, if necessary. Just as we've seen regarding the use of Stinger intercepts. It's hard to say whether people who know tradecraft well just prudently avoid running dark markets, as you say. Or whether they do, but don't get caught. Time will tell, I guess. At least, if remaining ones do get busted. But if they don't, there's the implication that the operators practice good OPSEC. Or, that they're honeypots ;) 0) https://www.ivpn.net/privacy-guides/online-privacy-through-opsec-and-compartmentalization-part-2 https://www.ivpn.net/privacy-guides/online-privacy-through-o... 1) https://www.deamuseum.org/wp-content/uploads/2015/08/042215-DEAMuseum-LectureSeries-MLS-SOD-transcript.pdf https://www.deamuseum.org/wp-content/uploads/2015/08/042215-... 2) http://www.reuters.com/article/us-dea-sod-idUSBRE97409R20130805 http://www.reuters.com/article/us-dea-sod-idUSBRE97409R20130...

nopacience 8y ago

I get the idea. However if someone does this, it means 99% they trade something prohibited by the law. > Now, goods are hidden in publicly accessible places like parks and the location is given to the customer on purchase. Then the merchant can wait and see who picks the package. The merchant might be someone with a machete.

tomcooks 8y ago

Been a big fan of this author since the cypherpunk podcast, strange to see "smuggler" reveal his real (?) name.

arikr 8y ago
Could you please link the podcast?

auslander 8y ago

Dark Drones!

cvza 8y ago

"What is illegal and unethical trade for one is perfectly legal for another. Judge for yourself." Is it just me, or is this statement just plain incorrect?

trevyn 8y ago
Jurisdiction.

tw1010 8y ago

> "What is illegal and unethical trade for one is perfectly legal for another" What in the world does that mean? There's only one rule of law.

mr_pinnen 8y ago
That might be true for one specific country/state. But different countries have different laws.

grugq 8y ago

Dead drop based drug distribution doesn’t scale to retail levels. It is used in Moscow and I know of people who will order from a dealer, then search the surrounding area and clear out all the drops they find. It works for them, although one questions the sanity of stealing from Russian drug dealers. For more practical guides on how people who sell drugs avoid the negative repercussions: • AlpraKing’s business guide is hard to beat. https://archive.is/K7j1U https://archive.is/K7j1U (It’s a great business guide in general, actually) • Gary Cooper’s Never Get Busted Again and Never Get Raided Again shows practical use of dead drops for dealing. Busted: https://m.youtube.com/watch?v=ZyAjLkBCWKI https://m.youtube.com/watch?v=ZyAjLkBCWKI Raided: https://m.youtube.com/watch?v=ML6VAy_ygVs https://m.youtube.com/watch?v=ML6VAy_ygVs

DyslexicAtheist 8y ago
some really great links thanks! >although one questions the sanity of stealing from Russian drug dealers. I'd conjecture that the value of the booty would be quite limited too? (small envelopes not kilograms exchanging hands). A smack-head probably wouldn't care about the risks just as long as they get their next fix? EDIT: "4. Don't hire people under 30 years old" that is great advise. You want Mike Ehrmantraut like characters (from "Better call Saul") ... btw that show was consistently good in OpSec lessons (unlike the parent show "Breaking Bad").
- grugq 8y ago
  Sure, they aren’t stealing to supply their own business but to supply their partying. Apparently there’s some trick involved in selecting a dealer who offers a variety of options, not just one substance. They cache one or more of each in an area, so you buy a mid size quantity of something and the surrounding block probably has 5x as much plus other things... because the dealers are humans, they develop patterns of drop locations. Once these guys learn the pattern, they know where to look. The drops get ripped so frequently there is a process for handling a drop that has been unloaded before the customer get there. The customer has to supply pictures of the drop location and the empty drop, then the dealer will send them to another place. Dead drops provide some security, but they’re a trade off. I think the Gary Cooper videos are massively underrated for security principles. He explains how the adversary operates, how they think, and what their capabilities are, then based on that he distills core security strategies to exploit their operational limitations and mitigate their capabilities. This is really great stuff for understanding how to counteract a threat, how to do proper counterintelligence analysis and apply it for security. The problem is that people see these as “stoner videos” rather than “the design and implementation of counter law enforcement techniques, by a former cop.” There is a lot to be learned, both from general security principles (such as compartmentation, cover, and concealment) But also how to analyze an adversary and develop a plan to mitigate their capabilities. I was going to do a write up them years ago but someone scooped me by seeing my recommendation and then doing a (crappy) writeup before me. Just one of the things that killed my enthusiasm for sharing recommendations. But, I should do a write up. For a counterintelligence analysis they are sublime.

golergka 8y ago

Once again, I'm completely surprised how behind is western dark market world compared to Russia in that regard. Tor-based marketplaces with dead drops in parks and around the city have been around since 2013 and are now the only practical way to buy any drugs. Telegram channels have been widely used since at least 2015. Any city park has police squads patrolling the exits at night - they search people, open up your phone and look up Telegram and Tor apps if they suspect you've gone there to get a drop. Drops (they're actually called "buried treasure", or "klad" here) moved from parks to the city - you get instructions, for example, to go to some floor of a random apartment building, stop the elevator and search for a magnet-attached package behind it's doors. I don't think that this article doesn't do a good job on the risk model because it doesn't understand how law enforcement operates - at least in Russia, the picture is completely different. Law enforcement has KPIs to catch some amount of drug dealers and users, and they have developed ways to do this reliably. So, instead of intercepting communication between the drug sellers and drug buyers, they prefer to work together with sellers (taking considerate money for 'protection') and arrest some proportion of buyers when they go for the drop.

tawm 8y ago
Thank you for this valuable comment. It is highly likely that police would go for the lower hanging fruit of buyers instead of sellers in a system so opaque and decentralized. The old thinking of "what could happen, they only want the big guys anyway" should have no place in OpSec. And when information on these networks is so hard to come by to begin with, a buyer being busted is very desirable. The way I see this "evolution" of the dark markets, is that it mostly protects vendors while inconveniencing and endangering buyers.
- golergka 8y ago
  It's always been like that here - the police departments that were supposed to fight drug trade basically overtook it. So why would they arrest their own employees when they can close their quota with drug users instead?
mirimir 8y ago
It's the same in Mexico.

rayrrr 8y ago

When Pokemon Go hit, it was impossible not to notice in public. Just a thought.

jimb1 8y ago

Yes, I am also quite impressed at the amount of thought that has been put into this concept. I would be quite interested in helping in designing these systems, as I have been following some of the necessary technologies for years. Jim I foresee a stiff plastic or metal pipe, tapered to a point at one end, which can be driven by force into soil or into a lawn, so that it ends up to be approximately flush with the plane of the soil. Once placed, a smaller cylindrical container, as well as active elements, if needed, can be slid into the metal pipe, from above. From the linked article: https://opaque.link/post/dropgang/ https://opaque.link/post/dropgang/ "This challenge is met by Dropgangs in various ways. The primary one is that the documentation of each dead drop is conducted in minute detail, covering GPS coordinates, photos of the surrounding and the location, as well as photos of the concealment device in which the product is hidden (such as an empty coke can). The documentation however increases the risk for the Dropgang since whoever creates it would be more easy to identify by surveillance. In addition, even great documentation still requires the customer to understand it and follow it precisely, which can lead to suspicious behavior around the dead drop location (staring at photos, visually comparing them to the surrounding, etc)." [end of partial quote] Ordinarily, smartphones that use GPS, don't use accurizing features, such as WAAS. (Wide Area Augmentation System). See https://en.wikipedia.org/wiki/Wide_Area_Augmentation_System https://en.wikipedia.org/wiki/Wide_Area_Augmentation_System WAAS correction data is probably already available on the Internet. "Accuracy[edit] The WAAS specification requires it to provide a position accuracy of 7.6 metres (25 ft) or less (for both lateral and vertical measurements), at least 95% of the time.[2] Actual performance measurements of the system at specific locations have shown it typically provides better than 1.0 metre (3 ft 3 in) laterally and 1.5 metres (4 ft 11 in) vertically throughout most of the contiguous United States and large parts of Canada and Alaska.[3] With these results, WAAS is capable of achieving the required Category I precision approach accuracy of 16 metres (52 ft) laterally and 4.0 metres (13.1 ft) vertically. [end of partial quote] WAAS might be described as a form of differential GPS. If the location as computed by the smartphone was improved by WAAS, the statement above indicates an accuracy within about 1 meter. IR-specific retroreflectors to greatly simplify things. The article describes complicated systems using Bluetooth or WiFi to help locate these dead-drops. While they are certainly innovative, they add cost and complexity to the hardware involved. I have thought of a much-cheaper system that I feel is sufficiently secure and simple for common use. Light-retroreflectors are commonly made from Scotchlite https://en.wikipedia.org/wiki/Retroreflective_sheeting https://en.wikipedia.org/wiki/Retroreflective_sheeting or plastic molded corner-cubes. If a rather small (say, 1/4 in diameter) sphere covered with retroreflector material was held up from the insert, possibly by a short, thin stiff wire, the sphere could be visible, but not excessively obvious even during the daylight. It would be easy to find this device with a flashlight in the dark. For added security, an infrared-transmitting plastic (such as is often used to cover IR-activating remote controls, such as https://www.eplastics.com/plexiglass/acrylic-sheets/ir-transmitting https://www.eplastics.com/plexiglass/acrylic-sheets/ir-trans... ) could be used to ensure that only IR is retroreflected back to a searcher. Ordinary smart-phone camera arrays are not only sensitive to human-visible light (generally described as 400-700 nanometer wavelength), but are also sensitive to near-IR wavelengths. If a smartphone camera was combined with a directional IR LED, substituting for the white light LED lamp used for photography, and aiming in the same direction, a user would be able to see (through the camera display) the IR-specific reflections from an IR-limited retroreflector, and this would probably be doable both during the day and at night. A person operating such a camera would "look like" he was doing photography, or perhaps playing a game. Somebody watching, even at night, could not see the IR. The IR 'searchlight' could be a narrow-beam device, perhaps with a full-angle of 16 degrees or so (typical for a narrow-beam IR LED), so it wouldn't be particularly obvious even if watched through an IR viewer. (If the IR LED itself was shielded from direct view.) One advantage of this technique is that the searcher could identify the target from a very long distance away, perhaps many tens of meters, and thus approach it in a more "innocent" fashion. No obvious "searching" would have to be performed in the open. And, the person who placed the dead drop could ascertain its status without later needing to approach it closely. This technique could be combined with Bluetooth or WiFi techniques, too. The retroreflector could normally be retracted, and only raised if the proper Bluetooth or WiFi signal was heard. Or, perhaps, the target would contain an exposed IR LED, which would activate from an battery only if the proper signals were heard. The resulting dead-drop would be virtually impossible to find.

DoctorOetker 8y ago

Is this how people will deal food during a food scarcity in a previously developed society?

jimb1 8y ago

This system has problems deleting messages.

deleted 8y ago
[deleted]
deleted 8y ago
[deleted]
mirimir 8y ago
There's a 10-20 minute window for deleting messages. And then a ~1 hour window for editing them. So if you miss the delete window, you can just edit to "[post deleted]". But maybe there's some minimum karma needed. I don't remember. Edit: OK, 20-30 minute window for deleting.