5 ms·

Oh wow, providing a tracking number, huge OPSEC mistake

by thecatspaw 8y ago

nyolfen 8y ago
only way to prove fulfillment of services on a dnm
- thecatspaw 8y ago
  Seems like a huge risk though. Is it worth saving yourself from a few refunds if you substantially increase your target surface? I see the neee to proove shippment though. But surely giving out the tracking number to the receiver is unneccessary. Any of his customer could find out where he ships from, not just leo
  - ryanlol 8y ago
    Customers inevitably get the tracking # when they receive the product, no?
    - flatiron 8y ago
      Usually the tracking number is used by the seller and the moderators to settle disputes. I’ve never had a tracking number sent to me but have had sellers say “it’s supposed to be coming tomorrow” This is on cgmc
      - ryanlol 8y ago
        Generally my cgmc orders come with the tracking # on the packaging, USPS kind of needs that to be able to update the tracking.
  - threwawasy1228 8y ago
    At the same time if he was following standard OPSEC to not ship from the same place twice, and not ship from near where he lived, tracking number would have been completely fine.
    - wmf 8y ago
      Except then he'd spend all his time driving instead of earning money. And if he got caught despite following standard OPSEC then armchair commenters would invent new OPSEC that he "should have" followed.
      - threwawasy1228 8y ago
        Sure, I don't think that is necessarily a bad thing, OPSEC in and of itself is definitely a perpetually unfinished iterative process by its nature. If you are actually interested in this gwern has done some excellent statistical analysis on all known arrests related to DNMs over a few specific timeframes.[0] The canonical method seems to be (though I can't confirm this, I am armchair commentator as you say) that most sellers wait until they have a queue of several packages ready and then only do one drive to drop them in the mail, so then it doesn't cut into their time or profits dramatically, whilst also giving them an extra bit of protection. [0] https://www.gwern.net/DNM-arrests https://www.gwern.net/DNM-arrests
CharlesColeman 8y ago
> Oh wow, providing a tracking number, huge OPSEC mistake Double mistake: he habitually used the same postbox to mail his packages. He might have had better luck if he drove well out of his way to mail them. Though I'm kinda surprised the police weren't able to get a firmer lead on him from the tracking numbers. Is it really possible to get those anonymously issued? I'd assumed they'd at least be able to track him back to a store with security camera footage.
- jopsen 8y ago
  Probably he could use a stolen identity to buy postage online. > Double mistake: he habitually used the same postbox to mail his packages. I suppose the problem here is scale and habit. To avoid using the same postbox you'd need to drive far, and send a lot at once. If you do small transactions like 120 USD it'll take a long time to make real money. Maybe you could use a mail relay service in another country, but still.. That said, look at the resources this operation took, how likely was it that he would be caught? Most small fish like him probably won't be.
- JimboOmega 8y ago
  The article mentioned that he mailed them from a box across from a police station, not a store. And basically yes. You get the tracking number when you create the shipping label, and the info is generated when it's first scanned, no need to be physically present when that occurs
- theNJR 8y ago
  I miss the dark net subreddits where people would talk about OPSEC like this. Until right now, I forgot they got banned and stopped showing up in my feed.

Oh wow, providing a tracking number, huge OPSEC mistake

nyolfen 8y ago

only way to prove fulfillment of services on a dnm

thecatspaw 8y ago
Seems like a huge risk though. Is it worth saving yourself from a few refunds if you substantially increase your target surface? I see the neee to proove shippment though. But surely giving out the tracking number to the receiver is unneccessary. Any of his customer could find out where he ships from, not just leo
- ryanlol 8y ago
  Customers inevitably get the tracking # when they receive the product, no?
  - flatiron 8y ago
    Usually the tracking number is used by the seller and the moderators to settle disputes. I’ve never had a tracking number sent to me but have had sellers say “it’s supposed to be coming tomorrow” This is on cgmc
    - ryanlol 8y ago
      Generally my cgmc orders come with the tracking # on the packaging, USPS kind of needs that to be able to update the tracking.
- threwawasy1228 8y ago
  At the same time if he was following standard OPSEC to not ship from the same place twice, and not ship from near where he lived, tracking number would have been completely fine.
  - wmf 8y ago
    Except then he'd spend all his time driving instead of earning money. And if he got caught despite following standard OPSEC then armchair commenters would invent new OPSEC that he "should have" followed.
    - threwawasy1228 8y ago
      Sure, I don't think that is necessarily a bad thing, OPSEC in and of itself is definitely a perpetually unfinished iterative process by its nature. If you are actually interested in this gwern has done some excellent statistical analysis on all known arrests related to DNMs over a few specific timeframes.[0] The canonical method seems to be (though I can't confirm this, I am armchair commentator as you say) that most sellers wait until they have a queue of several packages ready and then only do one drive to drop them in the mail, so then it doesn't cut into their time or profits dramatically, whilst also giving them an extra bit of protection. [0] https://www.gwern.net/DNM-arrests https://www.gwern.net/DNM-arrests

CharlesColeman 8y ago

> Oh wow, providing a tracking number, huge OPSEC mistake Double mistake: he habitually used the same postbox to mail his packages. He might have had better luck if he drove well out of his way to mail them. Though I'm kinda surprised the police weren't able to get a firmer lead on him from the tracking numbers. Is it really possible to get those anonymously issued? I'd assumed they'd at least be able to track him back to a store with security camera footage.

jopsen 8y ago
Probably he could use a stolen identity to buy postage online. > Double mistake: he habitually used the same postbox to mail his packages. I suppose the problem here is scale and habit. To avoid using the same postbox you'd need to drive far, and send a lot at once. If you do small transactions like 120 USD it'll take a long time to make real money. Maybe you could use a mail relay service in another country, but still.. That said, look at the resources this operation took, how likely was it that he would be caught? Most small fish like him probably won't be.
JimboOmega 8y ago
The article mentioned that he mailed them from a box across from a police station, not a store. And basically yes. You get the tracking number when you create the shipping label, and the info is generated when it's first scanned, no need to be physically present when that occurs
theNJR 8y ago
I miss the dark net subreddits where people would talk about OPSEC like this. Until right now, I forgot they got banned and stopped showing up in my feed.