9 ms·

If the FBI has been tracking down SilkRoad for years, I find it completely reasonable that they finally find the location of the server just based on traffic an

If the FBI has been tracking down SilkRoad for years, I find it completely reasonable that they finally find the location of the server just based on traffic analysis. I'm sure that FBI or NSA runs number of exit and intermediate nodes to collect statistical correlations from traffic and track down hidden services given enough time (there is even public research that shows how it can be done: http://epub.uni-regensburg.de/11919/1/authorsversion-ccsw09.pdf http://epub.uni-regensburg.de/11919/1/authorsversion-ccsw09....). All that said, its even more likely that they found his identity other way. He seems to have slipped from time to time. I think most people underestimate the amount of boring and tedious chores they must do year after year if they want to conceal their identity from FBI who is actively searching them online. It seems that the main theme in revealed identities seems to be reusing usernames or using the same email in two different contexts that link person to his anonymous identity.

AJ007 13y ago
Starting on page 24, 1) Located the first reference to "silk road" on the internet. You can find this yourself on Google: "silk road" site:shroomery.org Date range: Jan 1,2011 - Jan 31,2011 * 2) The same username, "altoid", showed up on a bitcointalk days later. 3) Later in 2011 "altoid" made a post on bitcointalk with his email address, containing his real name, in it: https://bitcointalk.org/index.php?topic=47811.msg568744#msg568744 https://bitcointalk.org/index.php?topic=47811.msg568744#msg5... If you search the name on Google it doesn't show up, but if you look at the user's page you can see it in his posts. That seems like more than enough for a warrant for this individual. Everything after that should be easy. I've used Google before to locate when a particular word or phrase first appeared. Kind of surprising someone didn't figure this one out quicker. * Obviously this is a common word, so either adding other keywords with it would be likely.
- leokun 13y ago
  That's not enough for a warrant. No way, I don't believe it.
  - bcrescimanno 13y ago
    Alone, no. Read the 10 pages of corroborating evidence following these initial steps and there's definitely enough for a warrant.
  - nazgulnarsil 13y ago
    adorable.
  - rollo_tommasi 13y ago
    It is definitely enough to have CBP flag any packages crossing the border that are associated with that name, for which no warrant is required. After that, well, I'm no lawyer, but I think intercepting a package full of fake IDs is enough to justify a broader criminal investigation.
  - mpyne 13y ago
    A warrant for search and seizure of his computers and everything in his apartment? Probably not. A warrant to keep "pulling the string", issuing subpoenas, and compelling production of evidence from those who might have it? Absolutely!
  - AJ007 13y ago
    What is the cut off for using pseudonyms on obtaining a warrant? I assumed bitcointalk had a small member base when "altoid" joined. A quick look at their tables show 3,694 total new registered users through January 2011. "altoid" registered on shroomery on January 27th 2011 and the "altoid" who revealed his name publicly registered on bitcointalk on January 29th 2011.
  - tedks 13y ago
    It's definitely enough to ask Google, and possibly his bank or credit card company (to see if he bought any servers recently).
- mcosta 13y ago
  > 3) Later in 2011 "altoid" made a post on bitcointalk with his email address, containing his real name, in it: https://bitcointalk.org/index.php?topic=47811.msg568744#msg5.. https://bitcointalk.org/index.php?topic=47811.msg568744#msg5.... If you search the name on Google it doesn't show up, but if you look at the user's page you can see it in his posts. And a few post below someone says: > I'm interested Ross Spy film discretion here.
  - zaroth 13y ago
    Umm... that reply was posted TODAY, not back in October 2011.
    - pyre 13y ago
      To be fair, someone back in October 2011 could have made that comment too, as his name was in the email address that he gave.
  - fnordfnordfnord 13y ago
    >And a few post below someone says: >> I'm interested Ross >Spy film discretion here. That post was made today.
- rayiner 13y ago
  From the GP: "If that's the case, it betrays a level of capability that ought to be frightening for the operators of other anonymous Tor services." Google searches and reading some public forum threads... Staggering sophistication!
  - davmre 13y ago
    The Google searches give a hint at DPR's identity. They don't give you the location of the actual Silk Road server. Obviously there's lots of ways that guessing DPR's identity might allow someone with the FBI's resources to unmask the Silk Road server, though I don't know enough to know whether the forum post on its own would be considered sufficient evidence for a warrant to bug all of Ross Ulbricht's online activities. A lot of the more damning evidence for Ross Ulbricht as DPR (IP logs, the connection to the counterfeit documents, hostname of his personal machine, etc) seems to come from forensics on the captured server image. Analysis of Tor traffic doesn't seem like an implausible hypothesis, especially because that's a capability we'd be expecting the FBI/NSA to be developing anyway.
  - zaroth 13y ago
    Seems likely to me that NSA found the server and imaged it. FBI's job was pretty easy after that. Someone asking for help on the bitcointalk forum for a new venture? Happens almost daily. Someone asking a question on SO about how to access Tor? Ditto. You don't discover who "Dread Pirate Roberts" is from this. But you do discover these types of things pretty easily AFTER the NSA tells you who DPR is.
  - jawr 13y ago
    Reminds me of the recent South Park episode on the NSA/public privacy.
- dlss 13y ago
  This does seem plausible, so I almost don't think this is worth mentioning, but don't forget about "parallel construction". Having the world believe they can't reverse Tor would clearly be more valuable than having the world believe they can. Remember that Tor explicitly doesn't protect against a global passive adversary.
  - pyre 13y ago
    We don't know that any "parallel construction" is at work here. It seems like most of the information stemmed from the discovery of the Silk Road web server, and I haven't seen how they were able to determine that. If this goes to trial, then the FBI will have to say how it got that information (assuming he has a competent defense team).
    - mculp 13y ago
      The point of parallel construction is that we don't know that it's at work.
      - pyre 13y ago
        If they used parallel construction, then why didn't they list how they got the information about the location/IP of the Silk Road webserver? I would assume that they would have ParallelConstruction'd a reasonable way for them to have obtained that information, no?
        vidarh 13y ago
        Why would they show their hand before they need to, and give more opportunities for poking holes in it?
        pyre 13y ago
        Because they are legally obligated to 'show their hand' when the defendant's legal representative asks for it?
- hisabness 13y ago
  is there anyway to prove that the post in the forum occurred when alleged?
bentcorner 13y ago
All it takes is just once. I saw a reddit comment that documented how one user determined the real-life identity of another user who was attempting to stay anonymous. The slip up? Two photos posted by the user under two different accounts shared the same background, and the user posted using both accounts in the same comment thread.
- erock 13y ago
  ahh yes, the creepy gone wild stalker story
  - aestra 13y ago
    What's the full story?
    - heyitsnick 13y ago
      It's funny, i so rarely browse reddit, but i somehow happened upon this story this week - i guess it came up in some kind of mega "what are you most ashamed of" thread or somesuch. Ultimately it was as GP described; a redditor researched one of 'gone wild' big 'stars', poured through her history ,ultimately found another reddit account of a selfie shot that had the same background as the 'gone wild' shot so concluded they were the same or friends, researched back that history and ultimately found her real identity.
    - marti 13y ago
      Here's a link to it: http://www.reddit.com/r/AskReddit/comments/1ndvh3/serious_whats_the_creepiest_most_obsessive_thing/cchrguv http://www.reddit.com/r/AskReddit/comments/1ndvh3/serious_wh...
- deadfall 13y ago
  The internet is full of smart individuals with an eye for detail. Lesson learned, if trying to stay anonymous only use cat photos as profile pictures found on google images.
at-fates-hands 13y ago
>>>> I think most people underestimate the amount of boring and tedious chores they must do year after year if they want to conceal their identity from FBI who is actively searching them online. Most people don't realize the government can have an army of people working 24/7 to track you down while you're busy trying to cover your tracks. The odds are never in your favor. Also, having an active social media presence doesn't help either. lol
- phaus 13y ago
  This should be common sense, but as you stated, people seem to forget. We have supposedly spent a trillion dollars on the war on drugs, it seems silly for this guy to think he didn't warrant at least a multi-million dollar investigation. From the time the silk road sold it's first product, it was only a matter of time before it's owner went to prison. If he were as smart as he thought he was, he would have gotten out of the business and the country shortly after he became a millionaire.
  - tdfx 13y ago
    > If he were as smart as he thought he was, he would have gotten out of the business and the country shortly after he became a millionaire. I believe this guy is the second owner. If I recall correctly, the first guy did pretty much exactly what you said.
    - Phlarp 13y ago
      The current owner stated this was the case in an interview he gave after the FBI had already found and imaged the server hosting Silk Road. Given the information released today this claim seems to be false in every way.
    - joshrivers 13y ago
      Seriously? "I am not the first Dread Pirate Roberts" ?
      - 13y ago
yaongi 13y ago
The server image was made July 23, his fake IDs were intercepted July 10. I guess the investigation stemming from the IDs was probably where it started to come together.
nikatwork 13y ago
Even after they rumbled his name, I wonder if he could have avoided direct culpability by keeping his net connection three hops away from the source systems, and using forged identity docs for anything official (mobile wifi connection and visa debit card)?
s_q_b 13y ago
If the FBI systematically performed traffic confirmation on the Tor network, this would be a rather sloppy sources and methods cover, as they would eventually be forced to disclose the existence of the traffic confirmation system. If the servers' IPs were obtained as a result of a passive traffic confirmation system that breaks Tor's anonymity, I would expect a detailed parallel construction to demonstrate an alternate explanation for how they unmasked the servers. Any defense attorney worth his salt is going to request the evidence relating to the method of de-anonymization of the Silk Road servers. If a traffic confirmation system was used, the prosecution would be forced to disclose that to the defense, which could very well raise a solid argument that it violated the defendant's Fourth Amendment rights. My guess is that the FBI used the gmail account information and early public silk road advertisements to obtain a warrant from a friendly judge to remotely monitor DPR's computer, and waited until he connected to the server. It's also possible that they exploited the web server, as was the case with FreedomHost.

AJ007 13y ago

Starting on page 24, 1) Located the first reference to "silk road" on the internet. You can find this yourself on Google: "silk road" site:shroomery.org Date range: Jan 1,2011 - Jan 31,2011 * 2) The same username, "altoid", showed up on a bitcointalk days later. 3) Later in 2011 "altoid" made a post on bitcointalk with his email address, containing his real name, in it: https://bitcointalk.org/index.php?topic=47811.msg568744#msg568744 https://bitcointalk.org/index.php?topic=47811.msg568744#msg5... If you search the name on Google it doesn't show up, but if you look at the user's page you can see it in his posts. That seems like more than enough for a warrant for this individual. Everything after that should be easy. I've used Google before to locate when a particular word or phrase first appeared. Kind of surprising someone didn't figure this one out quicker. * Obviously this is a common word, so either adding other keywords with it would be likely.

leokun 13y ago
That's not enough for a warrant. No way, I don't believe it.
- bcrescimanno 13y ago
  Alone, no. Read the 10 pages of corroborating evidence following these initial steps and there's definitely enough for a warrant.
- nazgulnarsil 13y ago
  adorable.
- rollo_tommasi 13y ago
  It is definitely enough to have CBP flag any packages crossing the border that are associated with that name, for which no warrant is required. After that, well, I'm no lawyer, but I think intercepting a package full of fake IDs is enough to justify a broader criminal investigation.
- mpyne 13y ago
  A warrant for search and seizure of his computers and everything in his apartment? Probably not. A warrant to keep "pulling the string", issuing subpoenas, and compelling production of evidence from those who might have it? Absolutely!
- AJ007 13y ago
  What is the cut off for using pseudonyms on obtaining a warrant? I assumed bitcointalk had a small member base when "altoid" joined. A quick look at their tables show 3,694 total new registered users through January 2011. "altoid" registered on shroomery on January 27th 2011 and the "altoid" who revealed his name publicly registered on bitcointalk on January 29th 2011.
- tedks 13y ago
  It's definitely enough to ask Google, and possibly his bank or credit card company (to see if he bought any servers recently).
mcosta 13y ago
> 3) Later in 2011 "altoid" made a post on bitcointalk with his email address, containing his real name, in it: https://bitcointalk.org/index.php?topic=47811.msg568744#msg5.. https://bitcointalk.org/index.php?topic=47811.msg568744#msg5.... If you search the name on Google it doesn't show up, but if you look at the user's page you can see it in his posts. And a few post below someone says: > I'm interested Ross Spy film discretion here.
- zaroth 13y ago
  Umm... that reply was posted TODAY, not back in October 2011.
  - pyre 13y ago
    To be fair, someone back in October 2011 could have made that comment too, as his name was in the email address that he gave.
- fnordfnordfnord 13y ago
  >And a few post below someone says: >> I'm interested Ross >Spy film discretion here. That post was made today.
rayiner 13y ago
From the GP: "If that's the case, it betrays a level of capability that ought to be frightening for the operators of other anonymous Tor services." Google searches and reading some public forum threads... Staggering sophistication!
- davmre 13y ago
  The Google searches give a hint at DPR's identity. They don't give you the location of the actual Silk Road server. Obviously there's lots of ways that guessing DPR's identity might allow someone with the FBI's resources to unmask the Silk Road server, though I don't know enough to know whether the forum post on its own would be considered sufficient evidence for a warrant to bug all of Ross Ulbricht's online activities. A lot of the more damning evidence for Ross Ulbricht as DPR (IP logs, the connection to the counterfeit documents, hostname of his personal machine, etc) seems to come from forensics on the captured server image. Analysis of Tor traffic doesn't seem like an implausible hypothesis, especially because that's a capability we'd be expecting the FBI/NSA to be developing anyway.
- zaroth 13y ago
  Seems likely to me that NSA found the server and imaged it. FBI's job was pretty easy after that. Someone asking for help on the bitcointalk forum for a new venture? Happens almost daily. Someone asking a question on SO about how to access Tor? Ditto. You don't discover who "Dread Pirate Roberts" is from this. But you do discover these types of things pretty easily AFTER the NSA tells you who DPR is.
- jawr 13y ago
  Reminds me of the recent South Park episode on the NSA/public privacy.
dlss 13y ago
This does seem plausible, so I almost don't think this is worth mentioning, but don't forget about "parallel construction". Having the world believe they can't reverse Tor would clearly be more valuable than having the world believe they can. Remember that Tor explicitly doesn't protect against a global passive adversary.
- pyre 13y ago
  We don't know that any "parallel construction" is at work here. It seems like most of the information stemmed from the discovery of the Silk Road web server, and I haven't seen how they were able to determine that. If this goes to trial, then the FBI will have to say how it got that information (assuming he has a competent defense team).
  - mculp 13y ago
    The point of parallel construction is that we don't know that it's at work.
    - pyre 13y ago
      If they used parallel construction, then why didn't they list how they got the information about the location/IP of the Silk Road webserver? I would assume that they would have ParallelConstruction'd a reasonable way for them to have obtained that information, no?
      - vidarh 13y ago
        Why would they show their hand before they need to, and give more opportunities for poking holes in it?
        pyre 13y ago
        Because they are legally obligated to 'show their hand' when the defendant's legal representative asks for it?
hisabness 13y ago
is there anyway to prove that the post in the forum occurred when alleged?

bentcorner 13y ago

All it takes is just once. I saw a reddit comment that documented how one user determined the real-life identity of another user who was attempting to stay anonymous. The slip up? Two photos posted by the user under two different accounts shared the same background, and the user posted using both accounts in the same comment thread.

erock 13y ago
ahh yes, the creepy gone wild stalker story
- aestra 13y ago
  What's the full story?
  - heyitsnick 13y ago
    It's funny, i so rarely browse reddit, but i somehow happened upon this story this week - i guess it came up in some kind of mega "what are you most ashamed of" thread or somesuch. Ultimately it was as GP described; a redditor researched one of 'gone wild' big 'stars', poured through her history ,ultimately found another reddit account of a selfie shot that had the same background as the 'gone wild' shot so concluded they were the same or friends, researched back that history and ultimately found her real identity.
  - marti 13y ago
    Here's a link to it: http://www.reddit.com/r/AskReddit/comments/1ndvh3/serious_whats_the_creepiest_most_obsessive_thing/cchrguv http://www.reddit.com/r/AskReddit/comments/1ndvh3/serious_wh...
deadfall 13y ago
The internet is full of smart individuals with an eye for detail. Lesson learned, if trying to stay anonymous only use cat photos as profile pictures found on google images.

at-fates-hands 13y ago

>>>> I think most people underestimate the amount of boring and tedious chores they must do year after year if they want to conceal their identity from FBI who is actively searching them online. Most people don't realize the government can have an army of people working 24/7 to track you down while you're busy trying to cover your tracks. The odds are never in your favor. Also, having an active social media presence doesn't help either. lol

phaus 13y ago
This should be common sense, but as you stated, people seem to forget. We have supposedly spent a trillion dollars on the war on drugs, it seems silly for this guy to think he didn't warrant at least a multi-million dollar investigation. From the time the silk road sold it's first product, it was only a matter of time before it's owner went to prison. If he were as smart as he thought he was, he would have gotten out of the business and the country shortly after he became a millionaire.
- tdfx 13y ago
  > If he were as smart as he thought he was, he would have gotten out of the business and the country shortly after he became a millionaire. I believe this guy is the second owner. If I recall correctly, the first guy did pretty much exactly what you said.
  - Phlarp 13y ago
    The current owner stated this was the case in an interview he gave after the FBI had already found and imaged the server hosting Silk Road. Given the information released today this claim seems to be false in every way.
  - joshrivers 13y ago
    Seriously? "I am not the first Dread Pirate Roberts" ?
    - 13y ago

yaongi 13y ago

The server image was made July 23, his fake IDs were intercepted July 10. I guess the investigation stemming from the IDs was probably where it started to come together.

nikatwork 13y ago

Even after they rumbled his name, I wonder if he could have avoided direct culpability by keeping his net connection three hops away from the source systems, and using forged identity docs for anything official (mobile wifi connection and visa debit card)?

s_q_b 13y ago

If the FBI systematically performed traffic confirmation on the Tor network, this would be a rather sloppy sources and methods cover, as they would eventually be forced to disclose the existence of the traffic confirmation system. If the servers' IPs were obtained as a result of a passive traffic confirmation system that breaks Tor's anonymity, I would expect a detailed parallel construction to demonstrate an alternate explanation for how they unmasked the servers. Any defense attorney worth his salt is going to request the evidence relating to the method of de-anonymization of the Silk Road servers. If a traffic confirmation system was used, the prosecution would be forced to disclose that to the defense, which could very well raise a solid argument that it violated the defendant's Fourth Amendment rights. My guess is that the FBI used the gmail account information and early public silk road advertisements to obtain a warrant from a friendly judge to remotely monitor DPR's computer, and waited until he connected to the server. It's also possible that they exploited the web server, as was the case with FreedomHost.