5 ms·

Some press on this case implies that the FBI found this person from his activity our site. I can't disprove that, but it is much more likely that they found him

Some press on this case implies that the FBI found this person from his activity our site. I can't disprove that, but it is much more likely that they found him through other means, and then tracked his activity on various sites to build enough evidence for an arrest, indictment, etc. Anyone care to speculate how they found him?

ritchiea 13y ago
It has been reported in many places that Canadian authorities intercepted a package to him containing several fake IDs with his face on them and passed that along to US authorities. I imagine he was under serious scrutiny after that happened (this may be sourced from the complaint against him, but I haven't personally read the complaint).
logn 13y ago
The NSA et al. know everything. It's just a matter of whether they can figure it out again using legal investigative techniques. I imagine it like the solutions in the back of a math textbook. I'm given the answer but I won't get credit for answering them correctly unless I can actually list every step in deriving the solution. See the recent news stories on NSA-DEA parallel reconstruction. Specifically to your question, I'd guess they run a large number of Tor exit nodes and from there it was fairly simple to see exactly who was doing what. Also it's come out recently in the Guardian, the NSA can backdoor machines through special servers running man-in-the-middle attacks. Basically, the Internet (and planet Earth too) is not secure, so trying to pull off a large-scale crime is kind of foolish.
- krapp 13y ago
  >The NSA et al. know everything. Parallel construction doesn't actually imply that the NSA is omniscient and that the entire rest of the American justice system is a charade meant to mask its power from the muggles. The NSA doesn't know everything. They don't see everything. They don't whisper words of power into the ears of every prosecutor, and a dark man smoking a cigarette doesn't appear from out of the shadows with fabricated evidence for the Department of Justice and a dossier from ten minutes into the future every time a hacker opens their browser. It gets mentioned every time a post comes up involving court case or arrest, and it's quite honestly as useless a form of speculation as suggesting divine intervention as a first cause in science. Assuming too much power on the part of the NSA (and by extension, that no other methods used by any other bureau or department are effective except as a smokescreen) is as dangerous as dismissing them entirely.
  - logn 13y ago
    My 'know everything' comment was a slight exaggeration for effect. I didn't say they fabricate evidence (you said that) or that they divulge their secrets to every prosecutor (those are your words, portrayed as mine). You have a good point though that maybe my comment is not constructive. I don't wish for this to become a cliche response on HN that it 'must have been the NSA' but we must acknowledge that they posses powers of surveillance the world has never before seen (except if you believe in God... however, we actually have architecture diagrams and proof of the NSA technology... not just 'The Book of Edward'). But yeah, it's dangerous to dismiss the NSA entirely and dangerous to make it a given they're more powerful than they are. However, given their secrecy, that's all a fairly expected situation for us.
    - krapp 13y ago
      Fair enough, I admit I was extrapolating from a number of comments i've seen, and I shouldn't have implied things in your comment that, you're right, weren't there.
- adventured 13y ago
  If this were true, that the NSA knows all, 50% of all murders wouldn't go unsolved in Detroit.
  - alan_cx 13y ago
    Low value victims and criminals? Its awful to say, but do you think a murder in Detroit gets the same attention this guy or Snowden does/did?
meowface 13y ago
It's hard to know the entire timeline of their investigation, but from how they describe it, the first lead they got was the username "altoid" posting what is apparently one of the first advertisements for Silk Road on a drug forum in January 2011, and then 2 days afterwards, an "altoid" posted on Bitcointalk looking for an IT pro to contact him at rossulbricht@gmail.com. They implied this was the first thing they did. The interception of the fake IDs may have occurred before or after he was already under heavy suspicion of being Dread Pirate Roberts. I also believe there was some discussion that the fake IDs might've actually sent by an undercover agent. Either way, I think it's very likely that they already had the idea that Ross Ulbricht == DPR before finding his Stack Overflow post.
- asveikau 13y ago
  Regarding the mailing of fake IDs and other stuff, I heard so many media accounts of Silk Road in the last week or so, and I really didn't understand this part: why bother to go through the trouble of all that crypto and anonymizing if in the end you are going to use your real street address? I thought this part was the dumbest aspect of the whole arrangement, but then I heard about posting on Stack Overflow to get your bugs fixed, and "contact me at rossulbricht@gmail.com kthxbye", and I begin to think that "criminal mastermind" is not exactly an apt description of this guy. I find it hard to contain my laughter at this.
  - gwern 13y ago
    > why bother to go through the trouble of all that crypto and anonymizing if in the end you are going to use your real street address? I would have thought the server seizure demonstrated exactly why you would go to this bother: when you encrypt your address to the seller's public key, and send the encrypted address rather than the plaintext address, now all the FBI gets is an encrypted message they can't read. And the Tor connections means that they can't look up your IP in the logs, and so on and so forth.
    - asveikau 13y ago
      > when you encrypt your address to the seller's public key, and send the encrypted address rather than the plaintext address, now all the FBI gets is an encrypted message they can't read. And how can I trust that the seller isn't an FBI agent? Still seems kind of risky. Even if they aren't an FBI agent, they're going to decrypt the address, and who knows what they'll do with it in plaintext? For one, they will write it on an envelope, leaving open the potential for exactly what happened with the fake IDs. If not these scenarios involving law enforcement, there's also the risk that the seller, who has my address, will extort me for cash or whatever.
kbuck 13y ago
The criminal complaint[1] mentioned the FBI searching for the earliest mention of Silk Road. The earliest they found was a user called 'altoid' advertising it in two separate places (including bitcointalk) around the same time. Later, 'altoid' posted a second time on bitcointalk searching for an "IT Pro" and publicly listed the email address "rossulbricht@gmail.com" as the contact info for the gig. This was also the email address he used to register his Stack Overflow account. [1]: http://www1.icsi.berkeley.edu/~nweaver/UlbrichtCriminalComplaint.pdf http://www1.icsi.berkeley.edu/~nweaver/UlbrichtCriminalCompl...
jpalioto 13y ago
Since you're asking for speculation ... between FH, Atlantis and SR all going down so quickly, I would guess that TOR is compromised in some way (regardless of what the complaint says). IMHO, the probability that this case was cracked by a random CBP seizure is 0.
- ivmi 13y ago
  And how strongly do you believe your speculation? I think you are completely wrong, so I'm curious. What do you place the odds at that sites similar to Atlantis and SR(namely sheep and bmr) will go down by the end of the year?
- dobbsbob 13y ago
  Atlantis market disappeared probably because they didn't make any money and risk didn't equal reward, they claimed agents were messaging them looking to find informants but it's likely they just scammed all their users of a lot of escrow coins and disappeared. Freedom Hosting was likely a NSA op to get a hold of tormail.org messages and history because Snowden was either using it or emailing somebody using it. The FBI will use parallel construction to cover that one. SR I suspect they simply watched him sitting at cafes and libraries and logging into his virtual cartel. There were also numerous people who had discovered leakage and were able to find the server many of whom ended up working for DPR. Either way it wasn't set up very well, who knows maybe the FBI uploads spyware.js as an image while posting a new order or broke through the php5-mysql plugin. I'm sure they will discover that half his inner circle of close associates were informants too maybe they leaked the address. Remember he once put out applications for database administrators you can guarantee dozens of agents signed up for the job.
revelation 13y ago
A critical hint might be that the code example that DPR used on his StackOverflow post was found on the seized SilkRoad server(s). They might have just googled that, found DPRs post and then asked StackOverflow for the data on that user. I do not know why any judge would issue one of those searches + gag included orders based on a random code fragment, but then of course I know that judges just robosign these things from the FBI turned intelligence agency.
gojomo 13y ago
Arstechnica has a good writeup: http://arstechnica.com/security/2013/10/silk-road-mastermind-unmasked-by-rookie-goofs-complaint-alleges/ http://arstechnica.com/security/2013/10/silk-road-mastermind... From that account, it looks like the key break was likely that the first alias to promote Silk Road (altoid) was at one later point also linked to a real-name gmail address (rossulbrecht@gmail). Even if that association was brief, plenty of people (and even law enforcement researchers) are likely scraping/archiving or email-subscribed to the bitcoin forum where the association appeared. The same goes for 'tor' forums or tags elsewhere... so an actual law-enforcement approach to StackOverflow/Bitcointalk/Gmail/etc may not have even been necessary. (OTOH, Bitcointalk.org is currently down after an attack that may have resulted in the leak of username/hashed-password/email records. User altoid's email address there could have been obtained by law enforcement, by subpoena or hack, and also pointed towards Ulbrecht.)
rodgerd 13y ago
He's alleged to have paid to have someone tortured to death after they were arrested, on the off-chance that the person might have talked to police (the $80,000 murder). Not because the person talked, but because the person had been arrested. I don't know about you, but I'm pretty sure any half-decent cop would be using the logs of that conversation to convert that person into a witness.

ritchiea 13y ago

It has been reported in many places that Canadian authorities intercepted a package to him containing several fake IDs with his face on them and passed that along to US authorities. I imagine he was under serious scrutiny after that happened (this may be sourced from the complaint against him, but I haven't personally read the complaint).

logn 13y ago

The NSA et al. know everything. It's just a matter of whether they can figure it out again using legal investigative techniques. I imagine it like the solutions in the back of a math textbook. I'm given the answer but I won't get credit for answering them correctly unless I can actually list every step in deriving the solution. See the recent news stories on NSA-DEA parallel reconstruction. Specifically to your question, I'd guess they run a large number of Tor exit nodes and from there it was fairly simple to see exactly who was doing what. Also it's come out recently in the Guardian, the NSA can backdoor machines through special servers running man-in-the-middle attacks. Basically, the Internet (and planet Earth too) is not secure, so trying to pull off a large-scale crime is kind of foolish.

krapp 13y ago
>The NSA et al. know everything. Parallel construction doesn't actually imply that the NSA is omniscient and that the entire rest of the American justice system is a charade meant to mask its power from the muggles. The NSA doesn't know everything. They don't see everything. They don't whisper words of power into the ears of every prosecutor, and a dark man smoking a cigarette doesn't appear from out of the shadows with fabricated evidence for the Department of Justice and a dossier from ten minutes into the future every time a hacker opens their browser. It gets mentioned every time a post comes up involving court case or arrest, and it's quite honestly as useless a form of speculation as suggesting divine intervention as a first cause in science. Assuming too much power on the part of the NSA (and by extension, that no other methods used by any other bureau or department are effective except as a smokescreen) is as dangerous as dismissing them entirely.
- logn 13y ago
  My 'know everything' comment was a slight exaggeration for effect. I didn't say they fabricate evidence (you said that) or that they divulge their secrets to every prosecutor (those are your words, portrayed as mine). You have a good point though that maybe my comment is not constructive. I don't wish for this to become a cliche response on HN that it 'must have been the NSA' but we must acknowledge that they posses powers of surveillance the world has never before seen (except if you believe in God... however, we actually have architecture diagrams and proof of the NSA technology... not just 'The Book of Edward'). But yeah, it's dangerous to dismiss the NSA entirely and dangerous to make it a given they're more powerful than they are. However, given their secrecy, that's all a fairly expected situation for us.
  - krapp 13y ago
    Fair enough, I admit I was extrapolating from a number of comments i've seen, and I shouldn't have implied things in your comment that, you're right, weren't there.
adventured 13y ago
If this were true, that the NSA knows all, 50% of all murders wouldn't go unsolved in Detroit.
- alan_cx 13y ago
  Low value victims and criminals? Its awful to say, but do you think a murder in Detroit gets the same attention this guy or Snowden does/did?

meowface 13y ago

It's hard to know the entire timeline of their investigation, but from how they describe it, the first lead they got was the username "altoid" posting what is apparently one of the first advertisements for Silk Road on a drug forum in January 2011, and then 2 days afterwards, an "altoid" posted on Bitcointalk looking for an IT pro to contact him at rossulbricht@gmail.com. They implied this was the first thing they did. The interception of the fake IDs may have occurred before or after he was already under heavy suspicion of being Dread Pirate Roberts. I also believe there was some discussion that the fake IDs might've actually sent by an undercover agent. Either way, I think it's very likely that they already had the idea that Ross Ulbricht == DPR before finding his Stack Overflow post.

asveikau 13y ago
Regarding the mailing of fake IDs and other stuff, I heard so many media accounts of Silk Road in the last week or so, and I really didn't understand this part: why bother to go through the trouble of all that crypto and anonymizing if in the end you are going to use your real street address? I thought this part was the dumbest aspect of the whole arrangement, but then I heard about posting on Stack Overflow to get your bugs fixed, and "contact me at rossulbricht@gmail.com kthxbye", and I begin to think that "criminal mastermind" is not exactly an apt description of this guy. I find it hard to contain my laughter at this.
- gwern 13y ago
  > why bother to go through the trouble of all that crypto and anonymizing if in the end you are going to use your real street address? I would have thought the server seizure demonstrated exactly why you would go to this bother: when you encrypt your address to the seller's public key, and send the encrypted address rather than the plaintext address, now all the FBI gets is an encrypted message they can't read. And the Tor connections means that they can't look up your IP in the logs, and so on and so forth.
  - asveikau 13y ago
    > when you encrypt your address to the seller's public key, and send the encrypted address rather than the plaintext address, now all the FBI gets is an encrypted message they can't read. And how can I trust that the seller isn't an FBI agent? Still seems kind of risky. Even if they aren't an FBI agent, they're going to decrypt the address, and who knows what they'll do with it in plaintext? For one, they will write it on an envelope, leaving open the potential for exactly what happened with the fake IDs. If not these scenarios involving law enforcement, there's also the risk that the seller, who has my address, will extort me for cash or whatever.

kbuck 13y ago

The criminal complaint[1] mentioned the FBI searching for the earliest mention of Silk Road. The earliest they found was a user called 'altoid' advertising it in two separate places (including bitcointalk) around the same time. Later, 'altoid' posted a second time on bitcointalk searching for an "IT Pro" and publicly listed the email address "rossulbricht@gmail.com" as the contact info for the gig. This was also the email address he used to register his Stack Overflow account. [1]: http://www1.icsi.berkeley.edu/~nweaver/UlbrichtCriminalComplaint.pdf http://www1.icsi.berkeley.edu/~nweaver/UlbrichtCriminalCompl...

jpalioto 13y ago

Since you're asking for speculation ... between FH, Atlantis and SR all going down so quickly, I would guess that TOR is compromised in some way (regardless of what the complaint says). IMHO, the probability that this case was cracked by a random CBP seizure is 0.

ivmi 13y ago
And how strongly do you believe your speculation? I think you are completely wrong, so I'm curious. What do you place the odds at that sites similar to Atlantis and SR(namely sheep and bmr) will go down by the end of the year?
dobbsbob 13y ago
Atlantis market disappeared probably because they didn't make any money and risk didn't equal reward, they claimed agents were messaging them looking to find informants but it's likely they just scammed all their users of a lot of escrow coins and disappeared. Freedom Hosting was likely a NSA op to get a hold of tormail.org messages and history because Snowden was either using it or emailing somebody using it. The FBI will use parallel construction to cover that one. SR I suspect they simply watched him sitting at cafes and libraries and logging into his virtual cartel. There were also numerous people who had discovered leakage and were able to find the server many of whom ended up working for DPR. Either way it wasn't set up very well, who knows maybe the FBI uploads spyware.js as an image while posting a new order or broke through the php5-mysql plugin. I'm sure they will discover that half his inner circle of close associates were informants too maybe they leaked the address. Remember he once put out applications for database administrators you can guarantee dozens of agents signed up for the job.

revelation 13y ago

A critical hint might be that the code example that DPR used on his StackOverflow post was found on the seized SilkRoad server(s). They might have just googled that, found DPRs post and then asked StackOverflow for the data on that user. I do not know why any judge would issue one of those searches + gag included orders based on a random code fragment, but then of course I know that judges just robosign these things from the FBI turned intelligence agency.

gojomo 13y ago

Arstechnica has a good writeup: http://arstechnica.com/security/2013/10/silk-road-mastermind-unmasked-by-rookie-goofs-complaint-alleges/ http://arstechnica.com/security/2013/10/silk-road-mastermind... From that account, it looks like the key break was likely that the first alias to promote Silk Road (altoid) was at one later point also linked to a real-name gmail address (rossulbrecht@gmail). Even if that association was brief, plenty of people (and even law enforcement researchers) are likely scraping/archiving or email-subscribed to the bitcoin forum where the association appeared. The same goes for 'tor' forums or tags elsewhere... so an actual law-enforcement approach to StackOverflow/Bitcointalk/Gmail/etc may not have even been necessary. (OTOH, Bitcointalk.org is currently down after an attack that may have resulted in the leak of username/hashed-password/email records. User altoid's email address there could have been obtained by law enforcement, by subpoena or hack, and also pointed towards Ulbrecht.)

rodgerd 13y ago

He's alleged to have paid to have someone tortured to death after they were arrested, on the off-chance that the person might have talked to police (the $80,000 murder). Not because the person talked, but because the person had been arrested. I don't know about you, but I'm pretty sure any half-decent cop would be using the logs of that conversation to convert that person into a witness.