13 ms·

Apparently the FBI managed to track down the actual server running the site: During the course of this investigation, the FBI has located a number of compu

by davmre 13y ago

Apparently the FBI managed to track down the actual server running the site: During the course of this investigation, the FBI has located a number of computer servers, both in the United States and in multiple foreign countries, associated with the operation of Silk Road. In particular, the FBI has located in a certain foreign country the server used to host Silk Road's website (the "Silk Road Web Server"). Pursuant to a Mutual Legal Assistance Treaty Request, an image of the Silk Road Web Server was made on or about July 23, 2013 and produced thereafter to the FBI. This server image seems to have been the source of a lot of the evidence leading to the arrest warrant: the IP logs that matched his location, an account name that matched his StackOverflow account, and of course all the private messages and chat logs regarding his personal location (messages indicating Pacific time), operation of the site (payments to other admins), and the extortion attempt/attempted hit. What the complaint doesn't specify is how the FBI managed to locate the Silk Road server. It's possible that they already had some suspicion of DPR's identity, and managed to bug his computers or otherwise track his activity well enough to figure out what systems he was logging into. But given how coy the complaint is about this, I wonder if in fact this is the result of a sophisticated analysis of Tor network traffic (possibly in collaboration with the NSA?). If that's the case, it betrays a level of capability that ought to be frightening for the operators of other anonymous Tor services. Anyone with more Tor expertise want to comment on how likely this is? Edit: the excerpt quoted is from the (now unsealed) FBI complaint, first linked elsewhere in this thread: http://krebsonsecurity.com/wp-content/uploads/2013/10/UlbrichtCriminalComplaint.pdf http://krebsonsecurity.com/wp-content/uploads/2013/10/Ulbric.... The whole thing is pretty interesting reading.

Aloisius 13y ago
Running this kind of service becomes infinitely more difficult if you can't hide your hidden services. Also I wonder how they got a server image without him noticing since it is typically something you'd need to shut down the machine for. Was the whole thing running off a hosting service? It would be pretty impressive if he physically had servers in multiple countries. Just setting them up without involving other people seems difficult. Edit: He did use hosting services which probably used virtualization so it is easy to clone drives for. The complaint has him buying fake ids (which were confiscated in transit!) in order to rent more servers.
- nocman 13y ago
  If by "server image" they mean image(s) of the hard disk partition(s) (that's what I suspect they mean) -- easy. If the server is using LVM or some similar technology -- you can take a snapshot while the server is still running, no problem.
  - lucaspiller 13y ago
    You can do `cat /dev/sda` on a live server (as root) without any special stuff like LVM or a hypervisor, it just isn't guaranteed to take a clean image, as it isn't a snapshot. In most cases you'd probably just need to run fdisk to tidy it up and get 99% of the data back in one piece.
    - dsl 13y ago
      You can't make any modifications for it to be admissible in court. This includes logging into a live server to take an image, or 'fixing' errors introduced during the copy. Professional forensic investigators have what are called 'write blockers' that prevent all writes when drives are plugged in to be imaged.
      - pyre 13y ago
        It was in another country, and the image was provided by the other country. Not sure about the law/case-law around how that works with respect to chain-of-evidence.
        dublinben 13y ago
        I think a good defense lawyer should be able to get the server image thrown out. Fat lot that will do in light of everything else though.
      - judk 13y ago
        They can create a hernetic environment to fsck a copy to find what files are on the original, and then copy the target file content from the discovered addresses. Otherwise I could shred say some paper evidence, and the course would reject a taped-up copy that shows my original document. Which they wouldn't, of course.
warcher 13y ago
Not an expert, but I've heard a lot of people discussing how Tor can be compromised via timing analysis and owning enough exit nodes. Which is well within the capabilities of large nation-states' intelligence agencies. It is a widely reported fact that the NSA will hand tips to the FBI/DEA/etc, which will then use "parallel construction" to reverse engineer legally admissible evidence once they have been tipped off to the guilty parties. The silk road flew too close to the sun. As soon as they started getting in the news, and DPR started his libertarian manifesto-ing, it was just a matter of time. There are no old, bold crooks.
- davmre 13y ago
  Silk Road is (was) a hidden service, internal to the Tor network, so controlling exit nodes wouldn't be relevant here. You'd need to actually be able to analyze traffic within the Tor network. Which still seems plausible, but maybe more difficult since the Tor network as a whole is a lot bigger than just the exit nodes, so it'd be harder to control a sizable fraction of it.
  - cookiecaper 13y ago
    Hidden services are routed through ordinary Tor nodes. You're correct that they wouldn't have to control exit nodes explicitly, they'd just have to control the routing nodes along a specific chain that formed the connection to SR.
  - warcher 13y ago
    I would presume that, given that it's a persistent service, it'd be relatively straightforward to do a timing analysis, given that an FBI computer could ping the server at will, and then the server would reply from outside the network, via an exit node, which you could analyze if you had enough exit nodes. Honestly, there might be even more exploits that I'm unaware of (still not an expert), given that the silk road server is probably doing a lot of tor traffic, which makes them an outlier, and it's tough for an outlier to blend into the background. Maybe tor can mitigate that though, don't know.
    - 13y ago
deleted 13y ago
[deleted]
hannibal5 13y ago
If the FBI has been tracking down SilkRoad for years, I find it completely reasonable that they finally find the location of the server just based on traffic analysis. I'm sure that FBI or NSA runs number of exit and intermediate nodes to collect statistical correlations from traffic and track down hidden services given enough time (there is even public research that shows how it can be done: http://epub.uni-regensburg.de/11919/1/authorsversion-ccsw09.pdf http://epub.uni-regensburg.de/11919/1/authorsversion-ccsw09....). All that said, its even more likely that they found his identity other way. He seems to have slipped from time to time. I think most people underestimate the amount of boring and tedious chores they must do year after year if they want to conceal their identity from FBI who is actively searching them online. It seems that the main theme in revealed identities seems to be reusing usernames or using the same email in two different contexts that link person to his anonymous identity.
- AJ007 13y ago
  Starting on page 24, 1) Located the first reference to "silk road" on the internet. You can find this yourself on Google: "silk road" site:shroomery.org Date range: Jan 1,2011 - Jan 31,2011 * 2) The same username, "altoid", showed up on a bitcointalk days later. 3) Later in 2011 "altoid" made a post on bitcointalk with his email address, containing his real name, in it: https://bitcointalk.org/index.php?topic=47811.msg568744#msg568744 https://bitcointalk.org/index.php?topic=47811.msg568744#msg5... If you search the name on Google it doesn't show up, but if you look at the user's page you can see it in his posts. That seems like more than enough for a warrant for this individual. Everything after that should be easy. I've used Google before to locate when a particular word or phrase first appeared. Kind of surprising someone didn't figure this one out quicker. * Obviously this is a common word, so either adding other keywords with it would be likely.
  - leokun 13y ago
    That's not enough for a warrant. No way, I don't believe it.
    - bcrescimanno 13y ago
ChuckMcM 13y ago
If you read the statements in the Freedom Hosting case you can see that the FBI managed to deanonymize the Tor network using browser tricks. Once you've got the network the rest is pretty straight forward tracking the bits I would suppose. This also explains why the other market place shut down quickly, unlike DRP they apparently deduced it was only a matter of time before their location and identity was disclosed.
- shubb 13y ago
  That isn't correct. The US placed a virus on the sourcecode of freedom hosting, either by seizing control of the servers, or by hacking, which exploited a vulnerability specific to version of firefox found in a popular all in one TOR access kit. They did not compromise the network, they compromised an out of date version of firefox. They might well be able to de-annonimize TOR, by monitoring traffic between a large enough proportion of TOR nodes. Given recent NSA/GCHQ long distance cable intercept stories, this is no longer unrealistic. But there is no direct evidence yet. It is also worth mentioning that the US has spent a lot of effort developing an attack capability, and probably hit enemies like Silk Road with attacks as sophisticated as Aurora or Stuxnet. Maybe we just don't hear about that, because of the beauty of parallel construction.
  - ChuckMcM 13y ago
    The US placed a virus on the sourcecode of freedom hosting, either by seizing control of the servers, or by hacking, which exploited a vulnerability specific to version of firefox found in a popular all in one TOR access kit. I think we said the same thing, or at least if I interpret your statement correctly I meant the same thing. I said "browser tricks" and you said "vulnerability specific to firefox (a browser)" and I said "de-anonymized" (which was the analysis that most people pointed to as to why the FBI was collecting data from various hosts) and you described the same scenario " ... monitoring traffic between a large enough proportion of TOR nodes ..." My interpretation of the events was, they got to Freedom hosting, they used that to exploit browsers into giving them correlating information about Tor endpoints, and using that traffic and resources in the already documented 'meta data snooping' programs that other parts of the government have and have made available, they figured out which servers were serving up the Silk Road web site, and by that (and a copy of the servers hard drives aka a server image) figured out who the guy was who was using the Dread Pirate Roberts moniker. So is your understanding of how this went down different than that? And was that explanation different (other than detail) than my original comment which you assert was incorrect? Happy to be shown where I am wrong here, so I'm trying to figure out what what part you disagreed with.
cookiecaper 13y ago
AFAIK it'd take some doing but it's not outside of the realm of possibility. If you can monitor enough of the Tor network's traffic, you can begin to make correlations. This may not even require large-scale traffic analysis; I wonder if you configure your client to use a chain of 2 or 3 "known good" nodes, teach the nodes to block other potential users, and capture the traffic, if an effective timing attack could be done that way (request SilkRoad at 0:00, get back a page with the relevant contents at 0:01, and trace those lines through the nodes). It sounds like it'd be feasible to me, but I'm another amateur.
srollyson 13y ago
Haven't finished the complaint yet, but it looks to me like the FBI found a security vulnerability in the Silk Road website itself. More specifically, it looks like they found a way to have the PHP source code sent as an HTTP response rather than have that PHP code executed and send its output. From page 27 of the complaint: Further, based on forensic analysis of the Silk Road Web Server, I know that the server includes computer code that was once used to restrict administrative access to the server, so that only a user logging into the server from a particular IP address, specified in the code, could access it. The report later goes on to say that they mapped that IP address to a VPN provider whose account was set up from an internet cafe near the house of a friend of DPR. It looks like they first started suspecting Ulbricht when one of the forum account usernames he used to market Silk Road, "altoid", posted the GMail address "rossulbricht@gmail.com" when looking for technical help. From page 26 of the complaint: From further reviewing the Bitcoin Talk forum, Agent-1 located another posting on the forum by "altoid," made on October 11, 2011, approximately eight months after his posting about Silk Road. In this later posting, made in a separate and unrelated discussion thread, "altoid" stated that he was looking for an "IT pro in the Bitcoin community" to hire in connection with "a venture backed Bitcoin startup company." The posting directed interested users to send their responses to "rossulbricht at gmail dot com" - indicating that "altoid" uses the e-mail address "rossulbricht@gmail.com" (the "Ulbricht Gmail Account"). After DPR's mistake of using the same account to market Silk Road and solicit help with an email address, the FBI seems to have used good old-fashioned legwork to subpoena records and build a case against DPR. Super interesting read!
- davmre 13y ago
  Where in the complaint do you see evidence of a website vulnerability? The part you quoted just reads to me as describing DPR's use of a VPN, with the "forensic analysis" part referring to analysis of the disk image after the server had already been identified and imaged. That said, a security vulnerability in the website does seem like a really plausible conjecture: it's hard to write that much PHP code and not screw up somewhere, especially given that he was probably doing most of it himself, without anyone to do independent QA. And even if the site code itself was fine, the Silk Road is a high-enough value target that the FBI might have thought it worth using a PHP 0-day. Once they're into the site, it's probably not hard to get it to dump an IP address or other externally identifying information.
dailo10 13y ago
This is why you don't do an interview with Forbes and thumb your nose at the FBI when you're running an illegal operation. When I saw that interview, I knew his days were numbered. http://www.forbes.com/sites/andygreenberg/2013/08/14/an-interview-with-a-digital-drug-lord-the-silk-roads-dread-pirate-roberts-qa/ http://www.forbes.com/sites/andygreenberg/2013/08/14/an-inte...
- TDL 13y ago
  I'm going to assume the FBI (or DEA) were going after Silk Road, interview or not.
  - bentcorner 13y ago
    Rather, the type of person who was willing to engage in illegal activities while also doing a high-profile interview was unlikely to be the sort of person who was paranoid enough to cover their tracks (e.g., avoid re-using handles and other identifying information).
- wmf 13y ago
  If the guy had never talked to the press at all... you think the FBI and DEA would have just ignored a massive drug marketplace running essentially out in the open?
  - gtirloni 13y ago
    I think the point here is that, even though the letter agencies would not have ignored it... they surely got a lot more "incentives" internally to focus on SR when it got more mainstream attention. More analysts, more easily approved wiretapping/surveillance actions (not that they need approvals of any kind nowadays), essentially more money into it. People slip, it's inevitable. How fast that happens probably got accelerated by SR's owner appearances and the dent it was making in the agencies' reputation.
- gwern 13y ago
  By the time that interview was posted in August, the FBI had already imaged the SR server (in July).
jlgaddis 13y ago
*> an image ... was made on or about July 23, 2013 ... Perhaps a coincidence, but that's ~10 days before the guy who ran the Freedom Hosting gig was busted.
dobbsbob 13y ago
He also logged into his servers using clearnet/vpn they could trace. He had a degree in physics and a masters wtf was he doing playing gangster ordering hits and still running that site. Should have cashed out and fled to Brazil
downandout 13y ago
Let's also be clear that he solicited not one but two murders, and deposited money into bank accounts for those hits. Those transactions probably made him easier to identify as well. http://arstechnica.com/tech-policy/2013/10/feds-silkroad-boss-paid-80000-for-snitchs-murder-and-torture/ http://arstechnica.com/tech-policy/2013/10/feds-silkroad-bos...
- dobbsbob 13y ago
  Apparently not, as he used Technocash to do it. He probably used fake ID to pay a bitcoin exchanger to send the money 3rd party. It appears he was caught because he slipped up opsec confusing real and fake identities, he was being watched by homeland security because he stupidly tried to import 9 fake IDs to his residence, and he was logging into the server with a VPN, not SSH tunneled through Tor.

by davmre 13y ago

Aloisius 13y ago

Running this kind of service becomes infinitely more difficult if you can't hide your hidden services. Also I wonder how they got a server image without him noticing since it is typically something you'd need to shut down the machine for. Was the whole thing running off a hosting service? It would be pretty impressive if he physically had servers in multiple countries. Just setting them up without involving other people seems difficult. Edit: He did use hosting services which probably used virtualization so it is easy to clone drives for. The complaint has him buying fake ids (which were confiscated in transit!) in order to rent more servers.

nocman 13y ago
If by "server image" they mean image(s) of the hard disk partition(s) (that's what I suspect they mean) -- easy. If the server is using LVM or some similar technology -- you can take a snapshot while the server is still running, no problem.
- lucaspiller 13y ago
  You can do `cat /dev/sda` on a live server (as root) without any special stuff like LVM or a hypervisor, it just isn't guaranteed to take a clean image, as it isn't a snapshot. In most cases you'd probably just need to run fdisk to tidy it up and get 99% of the data back in one piece.
  - dsl 13y ago
    You can't make any modifications for it to be admissible in court. This includes logging into a live server to take an image, or 'fixing' errors introduced during the copy. Professional forensic investigators have what are called 'write blockers' that prevent all writes when drives are plugged in to be imaged.
    - pyre 13y ago
      It was in another country, and the image was provided by the other country. Not sure about the law/case-law around how that works with respect to chain-of-evidence.
      - dublinben 13y ago
        I think a good defense lawyer should be able to get the server image thrown out. Fat lot that will do in light of everything else though.
    - judk 13y ago
      They can create a hernetic environment to fsck a copy to find what files are on the original, and then copy the target file content from the discovered addresses. Otherwise I could shred say some paper evidence, and the course would reject a taped-up copy that shows my original document. Which they wouldn't, of course.

warcher 13y ago

Not an expert, but I've heard a lot of people discussing how Tor can be compromised via timing analysis and owning enough exit nodes. Which is well within the capabilities of large nation-states' intelligence agencies. It is a widely reported fact that the NSA will hand tips to the FBI/DEA/etc, which will then use "parallel construction" to reverse engineer legally admissible evidence once they have been tipped off to the guilty parties. The silk road flew too close to the sun. As soon as they started getting in the news, and DPR started his libertarian manifesto-ing, it was just a matter of time. There are no old, bold crooks.

davmre 13y ago
Silk Road is (was) a hidden service, internal to the Tor network, so controlling exit nodes wouldn't be relevant here. You'd need to actually be able to analyze traffic within the Tor network. Which still seems plausible, but maybe more difficult since the Tor network as a whole is a lot bigger than just the exit nodes, so it'd be harder to control a sizable fraction of it.
- cookiecaper 13y ago
  Hidden services are routed through ordinary Tor nodes. You're correct that they wouldn't have to control exit nodes explicitly, they'd just have to control the routing nodes along a specific chain that formed the connection to SR.
- warcher 13y ago
  I would presume that, given that it's a persistent service, it'd be relatively straightforward to do a timing analysis, given that an FBI computer could ping the server at will, and then the server would reply from outside the network, via an exit node, which you could analyze if you had enough exit nodes. Honestly, there might be even more exploits that I'm unaware of (still not an expert), given that the silk road server is probably doing a lot of tor traffic, which makes them an outlier, and it's tough for an outlier to blend into the background. Maybe tor can mitigate that though, don't know.
  - 13y ago

deleted 13y ago

[deleted]

hannibal5 13y ago

If the FBI has been tracking down SilkRoad for years, I find it completely reasonable that they finally find the location of the server just based on traffic analysis. I'm sure that FBI or NSA runs number of exit and intermediate nodes to collect statistical correlations from traffic and track down hidden services given enough time (there is even public research that shows how it can be done: http://epub.uni-regensburg.de/11919/1/authorsversion-ccsw09.pdf http://epub.uni-regensburg.de/11919/1/authorsversion-ccsw09....). All that said, its even more likely that they found his identity other way. He seems to have slipped from time to time. I think most people underestimate the amount of boring and tedious chores they must do year after year if they want to conceal their identity from FBI who is actively searching them online. It seems that the main theme in revealed identities seems to be reusing usernames or using the same email in two different contexts that link person to his anonymous identity.

AJ007 13y ago
Starting on page 24, 1) Located the first reference to "silk road" on the internet. You can find this yourself on Google: "silk road" site:shroomery.org Date range: Jan 1,2011 - Jan 31,2011 * 2) The same username, "altoid", showed up on a bitcointalk days later. 3) Later in 2011 "altoid" made a post on bitcointalk with his email address, containing his real name, in it: https://bitcointalk.org/index.php?topic=47811.msg568744#msg568744 https://bitcointalk.org/index.php?topic=47811.msg568744#msg5... If you search the name on Google it doesn't show up, but if you look at the user's page you can see it in his posts. That seems like more than enough for a warrant for this individual. Everything after that should be easy. I've used Google before to locate when a particular word or phrase first appeared. Kind of surprising someone didn't figure this one out quicker. * Obviously this is a common word, so either adding other keywords with it would be likely.
- leokun 13y ago
  That's not enough for a warrant. No way, I don't believe it.
  - bcrescimanno 13y ago

ChuckMcM 13y ago

If you read the statements in the Freedom Hosting case you can see that the FBI managed to deanonymize the Tor network using browser tricks. Once you've got the network the rest is pretty straight forward tracking the bits I would suppose. This also explains why the other market place shut down quickly, unlike DRP they apparently deduced it was only a matter of time before their location and identity was disclosed.

shubb 13y ago
That isn't correct. The US placed a virus on the sourcecode of freedom hosting, either by seizing control of the servers, or by hacking, which exploited a vulnerability specific to version of firefox found in a popular all in one TOR access kit. They did not compromise the network, they compromised an out of date version of firefox. They might well be able to de-annonimize TOR, by monitoring traffic between a large enough proportion of TOR nodes. Given recent NSA/GCHQ long distance cable intercept stories, this is no longer unrealistic. But there is no direct evidence yet. It is also worth mentioning that the US has spent a lot of effort developing an attack capability, and probably hit enemies like Silk Road with attacks as sophisticated as Aurora or Stuxnet. Maybe we just don't hear about that, because of the beauty of parallel construction.
- ChuckMcM 13y ago
  The US placed a virus on the sourcecode of freedom hosting, either by seizing control of the servers, or by hacking, which exploited a vulnerability specific to version of firefox found in a popular all in one TOR access kit. I think we said the same thing, or at least if I interpret your statement correctly I meant the same thing. I said "browser tricks" and you said "vulnerability specific to firefox (a browser)" and I said "de-anonymized" (which was the analysis that most people pointed to as to why the FBI was collecting data from various hosts) and you described the same scenario " ... monitoring traffic between a large enough proportion of TOR nodes ..." My interpretation of the events was, they got to Freedom hosting, they used that to exploit browsers into giving them correlating information about Tor endpoints, and using that traffic and resources in the already documented 'meta data snooping' programs that other parts of the government have and have made available, they figured out which servers were serving up the Silk Road web site, and by that (and a copy of the servers hard drives aka a server image) figured out who the guy was who was using the Dread Pirate Roberts moniker. So is your understanding of how this went down different than that? And was that explanation different (other than detail) than my original comment which you assert was incorrect? Happy to be shown where I am wrong here, so I'm trying to figure out what what part you disagreed with.

cookiecaper 13y ago

AFAIK it'd take some doing but it's not outside of the realm of possibility. If you can monitor enough of the Tor network's traffic, you can begin to make correlations. This may not even require large-scale traffic analysis; I wonder if you configure your client to use a chain of 2 or 3 "known good" nodes, teach the nodes to block other potential users, and capture the traffic, if an effective timing attack could be done that way (request SilkRoad at 0:00, get back a page with the relevant contents at 0:01, and trace those lines through the nodes). It sounds like it'd be feasible to me, but I'm another amateur.

srollyson 13y ago

Haven't finished the complaint yet, but it looks to me like the FBI found a security vulnerability in the Silk Road website itself. More specifically, it looks like they found a way to have the PHP source code sent as an HTTP response rather than have that PHP code executed and send its output. From page 27 of the complaint: Further, based on forensic analysis of the Silk Road Web Server, I know that the server includes computer code that was once used to restrict administrative access to the server, so that only a user logging into the server from a particular IP address, specified in the code, could access it. The report later goes on to say that they mapped that IP address to a VPN provider whose account was set up from an internet cafe near the house of a friend of DPR. It looks like they first started suspecting Ulbricht when one of the forum account usernames he used to market Silk Road, "altoid", posted the GMail address "rossulbricht@gmail.com" when looking for technical help. From page 26 of the complaint: From further reviewing the Bitcoin Talk forum, Agent-1 located another posting on the forum by "altoid," made on October 11, 2011, approximately eight months after his posting about Silk Road. In this later posting, made in a separate and unrelated discussion thread, "altoid" stated that he was looking for an "IT pro in the Bitcoin community" to hire in connection with "a venture backed Bitcoin startup company." The posting directed interested users to send their responses to "rossulbricht at gmail dot com" - indicating that "altoid" uses the e-mail address "rossulbricht@gmail.com" (the "Ulbricht Gmail Account"). After DPR's mistake of using the same account to market Silk Road and solicit help with an email address, the FBI seems to have used good old-fashioned legwork to subpoena records and build a case against DPR. Super interesting read!

davmre 13y ago
Where in the complaint do you see evidence of a website vulnerability? The part you quoted just reads to me as describing DPR's use of a VPN, with the "forensic analysis" part referring to analysis of the disk image after the server had already been identified and imaged. That said, a security vulnerability in the website does seem like a really plausible conjecture: it's hard to write that much PHP code and not screw up somewhere, especially given that he was probably doing most of it himself, without anyone to do independent QA. And even if the site code itself was fine, the Silk Road is a high-enough value target that the FBI might have thought it worth using a PHP 0-day. Once they're into the site, it's probably not hard to get it to dump an IP address or other externally identifying information.

dailo10 13y ago

This is why you don't do an interview with Forbes and thumb your nose at the FBI when you're running an illegal operation. When I saw that interview, I knew his days were numbered. http://www.forbes.com/sites/andygreenberg/2013/08/14/an-interview-with-a-digital-drug-lord-the-silk-roads-dread-pirate-roberts-qa/ http://www.forbes.com/sites/andygreenberg/2013/08/14/an-inte...

TDL 13y ago
I'm going to assume the FBI (or DEA) were going after Silk Road, interview or not.
- bentcorner 13y ago
  Rather, the type of person who was willing to engage in illegal activities while also doing a high-profile interview was unlikely to be the sort of person who was paranoid enough to cover their tracks (e.g., avoid re-using handles and other identifying information).
wmf 13y ago
If the guy had never talked to the press at all... you think the FBI and DEA would have just ignored a massive drug marketplace running essentially out in the open?
- gtirloni 13y ago
  I think the point here is that, even though the letter agencies would not have ignored it... they surely got a lot more "incentives" internally to focus on SR when it got more mainstream attention. More analysts, more easily approved wiretapping/surveillance actions (not that they need approvals of any kind nowadays), essentially more money into it. People slip, it's inevitable. How fast that happens probably got accelerated by SR's owner appearances and the dent it was making in the agencies' reputation.
gwern 13y ago
By the time that interview was posted in August, the FBI had already imaged the SR server (in July).

jlgaddis 13y ago

*> an image ... was made on or about July 23, 2013 ... Perhaps a coincidence, but that's ~10 days before the guy who ran the Freedom Hosting gig was busted.

dobbsbob 13y ago

He also logged into his servers using clearnet/vpn they could trace. He had a degree in physics and a masters wtf was he doing playing gangster ordering hits and still running that site. Should have cashed out and fled to Brazil

downandout 13y ago

Let's also be clear that he solicited not one but two murders, and deposited money into bank accounts for those hits. Those transactions probably made him easier to identify as well. http://arstechnica.com/tech-policy/2013/10/feds-silkroad-boss-paid-80000-for-snitchs-murder-and-torture/ http://arstechnica.com/tech-policy/2013/10/feds-silkroad-bos...

dobbsbob 13y ago
Apparently not, as he used Technocash to do it. He probably used fake ID to pay a bitcoin exchanger to send the money 3rd party. It appears he was caught because he slipped up opsec confusing real and fake identities, he was being watched by homeland security because he stupidly tried to import 9 fake IDs to his residence, and he was logging into the server with a VPN, not SSH tunneled through Tor.