4 ms·

> considering that the sellers might be cops Why wouldn't law enforcement pose as buyers, as well? This is a common tactic in narcotics enforcement. Entrapment

by jarrett 13y ago

> considering that the sellers might be cops Why wouldn't law enforcement pose as buyers, as well? This is a common tactic in narcotics enforcement. Entrapment often isn't an issue, as the seller took the first step of advertising the drugs for sale. Are you getting at the fact that the buyer must have a receiving address, while the seller can ship anonymously? I would be skeptical of that. If I were attempting to track the source of a package, and I had the full force of warrants behind me, I bet I could track down most shippers. Every shipping company has its own tracking information. Much of this may be opaque to the end user. The tracking might be much more detailed than what you can see as an end user with a tracking number. Assuming the carrier cooperates with law enforcement, tracking could (presumably) be further enhanced for targeted post offices, routes, etc.. For example, suppose I, as a law enforcement agent, receive an order from a Silk Road seller. Let's say it was shipped in an envelope, dropped off at a USPS street-corner box. From the tracking info, I identify which post office first handled the envelope. Thus I narrow my search to a few possible mailboxes served by that post office. I instruct the carriers at that post office to assist me. As they follow their routes, emptying mailboxes, I have them sort outgoing mail into separate bags, one per box. I have the post office flag any mail going to my address. I place another order from the same seller. When it hits the post office, it gets flagged, and because of the per-box sorting, I know which mailbox was used. For round three, I place yet another order, this time with the mailbox under surveillance. I also install a camera inside the mailbox that sees the destination address of every envelope deposited. When the seller drops his shipment, my surveillance team detects it. They then follow the person who dropped the letter. Now I have the shipper's identity. Can these measures be defeated with appropriate opsec? Maybe, if you know exactly what tactics law enforcement will employ. But you don't. You could spend all your time defending against the tactics I just described, only to get caught because law enforcement came up with a totally different strategy. My point is, opsec is really, really hard.

deleted 13y ago
[deleted]
ye 13y ago
> Why wouldn't law enforcement pose as buyers, as well? Because as a buyer you don't know who the seller is. You just receive your package. But as a seller, you know your buyer's mailing address. It becomes trivial to catch the buyer.
- jarrett 13y ago
  As described in my post above, the police don't initially know who the seller is. But the whole point is to find out by working backwards from the package the police receive.
nickles 13y ago
This is what made Kaczynski (the Unabomber) so difficult to track. IIRC, he would travel for a few hours (by bus) to a town and deposit his packages in a mailbox there [citation needed]. This made it difficult to track him, since the origin of the package didn't leak any information about the sender. For sellers, proper OPSec requires that they do not leave fingerprints in/on the package, that mailing locations are reasonably random and not isolated to a small geographic area, and that the sender masks his identity (veiled face, no cellphone, no car) when dropping off the packages. Additionally, a seller should use a variety of packaging types for shipments to make detecting the illicit shipments harder. Given these precautions, it would likely be infeasible for law enforcement agencies to identify a given seller. However, they would also reduce profits for the vendor.
- UVB-76 13y ago
  A good precaution would be to use a range of mail boxes that, when plotted on a map, form a ring around a population centre far removed from the one you are actually residing in.
- darkarmani 13y ago
  Isn't that also a result in the quantity of packages sent? If you want to run a business, you'd need a much larger set of "random" mailboxes then if you are sending out a handful of bombs over years.
  - jarrett 13y ago
    Exactly. There's very little incentive to participate as a seller on Silk Road if you have to take these extreme measures for every package you send out. It's not economical. If you're smart enough to devise these opsec procedures, you're probably smart enough to make a decent living doing something legal. So being a drug dealer is only worth it if you can do it at scale and make serious money. But these opsec procedures would significantly erode your hourly rate, making Silk Road an unattractive proposition. Unless, of course, you're willing to throw caution to the wind and optimize for efficiency rather than security.
UVB-76 13y ago
I'm sure there are other examples, but this method of monitoring mailboxes was used more than a decade ago to catch the person behind the Tesco letterbomb campaign: https://en.wikipedia.org/wiki/Tesco_bomb_campaign https://en.wikipedia.org/wiki/Tesco_bomb_campaign
- singular 13y ago
  That guy seems to have been pretty stupid, to be frank. Used the same postbox for all letters, and didn't put enough stamps on some packages. I don't think this in any way suggests somebody with basic common sense couldn't be quite considerably more secure when sending things they don't want traced back to themselves. "...while the Royal Mail intercepted several other packages, which had been held up because insufficient stamps had been put on them." "After receiving the second letter, which had been damaged by fire, police made enquiries with the Royal Mail and discovered that a fire had been reported in a postbox on Bradpole Road, Bournemouth, leading to speculation that "Sally"—the alias by which all the letters were signed—had changed his mind and attempted to destroy the letter." "The police received another letter from "Sally" on 7 December. Once again, the letter was traced back to the Bradpole road postbox, where the surveillance operation had continued. The operation had captured good-quality footage of all the users of the postbox that day, but, as it was close to Christmas, the postbox was busier than normal, with 172 items posted by 38 people. Royal Mail regulations meant that detectives could not open or delay the letters, so they made enquiries with the recipients to identify the senders. They eventually managed to identify all but a small number of the senders." "On 17 February 2001—over six months after the receipt of the first demand and three months since the last letter from "Sally"—the police made a major breakthrough. Detective Constable Alan Swanton, a junior detective on the case, spotted one of the people caught by the surveillance of the postbox who had yet to be identified. The man was carrying a fuel container, which Swanton believed had come from a nearby filling station. Officers obtained CCTV footage from the filling station, where their suspect had paid by cheque, and identified the man as Robert Edward Dyer."
warfangle 13y ago
> Why wouldn't law enforcement pose as buyers, as well? And then you end up with covert LEO buying, and covert LEO selling ... and find yourself knee deep in a Philip K Dick novel.

by jarrett 13y ago

deleted 13y ago

[deleted]

ye 13y ago

> Why wouldn't law enforcement pose as buyers, as well? Because as a buyer you don't know who the seller is. You just receive your package. But as a seller, you know your buyer's mailing address. It becomes trivial to catch the buyer.

jarrett 13y ago
As described in my post above, the police don't initially know who the seller is. But the whole point is to find out by working backwards from the package the police receive.

nickles 13y ago

This is what made Kaczynski (the Unabomber) so difficult to track. IIRC, he would travel for a few hours (by bus) to a town and deposit his packages in a mailbox there [citation needed]. This made it difficult to track him, since the origin of the package didn't leak any information about the sender. For sellers, proper OPSec requires that they do not leave fingerprints in/on the package, that mailing locations are reasonably random and not isolated to a small geographic area, and that the sender masks his identity (veiled face, no cellphone, no car) when dropping off the packages. Additionally, a seller should use a variety of packaging types for shipments to make detecting the illicit shipments harder. Given these precautions, it would likely be infeasible for law enforcement agencies to identify a given seller. However, they would also reduce profits for the vendor.

UVB-76 13y ago
A good precaution would be to use a range of mail boxes that, when plotted on a map, form a ring around a population centre far removed from the one you are actually residing in.
darkarmani 13y ago
Isn't that also a result in the quantity of packages sent? If you want to run a business, you'd need a much larger set of "random" mailboxes then if you are sending out a handful of bombs over years.
- jarrett 13y ago
  Exactly. There's very little incentive to participate as a seller on Silk Road if you have to take these extreme measures for every package you send out. It's not economical. If you're smart enough to devise these opsec procedures, you're probably smart enough to make a decent living doing something legal. So being a drug dealer is only worth it if you can do it at scale and make serious money. But these opsec procedures would significantly erode your hourly rate, making Silk Road an unattractive proposition. Unless, of course, you're willing to throw caution to the wind and optimize for efficiency rather than security.

UVB-76 13y ago

I'm sure there are other examples, but this method of monitoring mailboxes was used more than a decade ago to catch the person behind the Tesco letterbomb campaign: https://en.wikipedia.org/wiki/Tesco_bomb_campaign https://en.wikipedia.org/wiki/Tesco_bomb_campaign

singular 13y ago
That guy seems to have been pretty stupid, to be frank. Used the same postbox for all letters, and didn't put enough stamps on some packages. I don't think this in any way suggests somebody with basic common sense couldn't be quite considerably more secure when sending things they don't want traced back to themselves. "...while the Royal Mail intercepted several other packages, which had been held up because insufficient stamps had been put on them." "After receiving the second letter, which had been damaged by fire, police made enquiries with the Royal Mail and discovered that a fire had been reported in a postbox on Bradpole Road, Bournemouth, leading to speculation that "Sally"—the alias by which all the letters were signed—had changed his mind and attempted to destroy the letter." "The police received another letter from "Sally" on 7 December. Once again, the letter was traced back to the Bradpole road postbox, where the surveillance operation had continued. The operation had captured good-quality footage of all the users of the postbox that day, but, as it was close to Christmas, the postbox was busier than normal, with 172 items posted by 38 people. Royal Mail regulations meant that detectives could not open or delay the letters, so they made enquiries with the recipients to identify the senders. They eventually managed to identify all but a small number of the senders." "On 17 February 2001—over six months after the receipt of the first demand and three months since the last letter from "Sally"—the police made a major breakthrough. Detective Constable Alan Swanton, a junior detective on the case, spotted one of the people caught by the surveillance of the postbox who had yet to be identified. The man was carrying a fuel container, which Swanton believed had come from a nearby filling station. Officers obtained CCTV footage from the filling station, where their suspect had paid by cheque, and identified the man as Robert Edward Dyer."

warfangle 13y ago

> Why wouldn't law enforcement pose as buyers, as well? And then you end up with covert LEO buying, and covert LEO selling ... and find yourself knee deep in a Philip K Dick novel.