4 ms·

This is what made Kaczynski (the Unabomber) so difficult to track. IIRC, he would travel for a few hours (by bus) to a town and deposit his packages in a mailbo

by nickles 13y ago

This is what made Kaczynski (the Unabomber) so difficult to track. IIRC, he would travel for a few hours (by bus) to a town and deposit his packages in a mailbox there [citation needed]. This made it difficult to track him, since the origin of the package didn't leak any information about the sender. For sellers, proper OPSec requires that they do not leave fingerprints in/on the package, that mailing locations are reasonably random and not isolated to a small geographic area, and that the sender masks his identity (veiled face, no cellphone, no car) when dropping off the packages. Additionally, a seller should use a variety of packaging types for shipments to make detecting the illicit shipments harder. Given these precautions, it would likely be infeasible for law enforcement agencies to identify a given seller. However, they would also reduce profits for the vendor.

UVB-76 13y ago
A good precaution would be to use a range of mail boxes that, when plotted on a map, form a ring around a population centre far removed from the one you are actually residing in.
darkarmani 13y ago
Isn't that also a result in the quantity of packages sent? If you want to run a business, you'd need a much larger set of "random" mailboxes then if you are sending out a handful of bombs over years.
- jarrett 13y ago
  Exactly. There's very little incentive to participate as a seller on Silk Road if you have to take these extreme measures for every package you send out. It's not economical. If you're smart enough to devise these opsec procedures, you're probably smart enough to make a decent living doing something legal. So being a drug dealer is only worth it if you can do it at scale and make serious money. But these opsec procedures would significantly erode your hourly rate, making Silk Road an unattractive proposition. Unless, of course, you're willing to throw caution to the wind and optimize for efficiency rather than security.
  - nekopa 13y ago
    Unless the seller is actually a co-op of sellers, distributed world-wide. It would be fairly trivial to make the seller group wide enough, and using a lifestyle type of profit (i.e. each person makes a reasonable amount of money, but no-one becomes a millionaire) it may not be worthwhile for law enforcement to coordinate and monitor so many drop points around the world
- fleitz 13y ago
  Not really, if you take a major metropolitan area there are plenty of mailboxes. The post office also happens to have a list of these mailboxes, if you use random selection and travel during peak hours they can't reduce much below the 'people who live in the metro area and commute' level.
jarrett 13y ago
Even then, there are still possible information leaks. For example, conceivably when you package the drugs in your warehouse, local pollens and molds could find their way into the insides of the packaging. If the distribution of pollens and molds is unique to a reasonably small area, that would be an information leak. A bit sci-fi? Sort of. You'd need a database of mold and pollen distributions for the whole country, plus tools to analyze the distribution in a given package. That's daunting, and maybe it's more trouble than it's worth for drug enforcement. But it's not outright impossible. And I have no idea what's the maximum effort DEA is willing to spend to track down Silk Road sellers. This is just one example of a possible information leak, off the top of my head. I'm sure we could come up with others, if we thought hard enough about it. All of this is to say that it's not the information leak you're worried about, it's the one you haven't thought of that will ruin you.
- fleitz 13y ago
  DEA effort is generally a faster than the slowest person type problem, you don't need to be better than the DEA, just better than someone else. Agents need to make busts in order to get promoted, therefore 'rational' agents will catch those easier to catch before devoting resources to harder to catch suspects.
  - jarrett 13y ago
    In the aggregate, I'm sure this is true. If I were an individual criminal, I'd still be nervous. What if I'm the outlier, i.e. the criminal who gets caught despite an abundance of caution? Not that I'm disagreeing with you at all. Your point seems spot-on.
deleted 13y ago
[deleted]

by nickles 13y ago

UVB-76 13y ago

A good precaution would be to use a range of mail boxes that, when plotted on a map, form a ring around a population centre far removed from the one you are actually residing in.

darkarmani 13y ago

Isn't that also a result in the quantity of packages sent? If you want to run a business, you'd need a much larger set of "random" mailboxes then if you are sending out a handful of bombs over years.

jarrett 13y ago
Exactly. There's very little incentive to participate as a seller on Silk Road if you have to take these extreme measures for every package you send out. It's not economical. If you're smart enough to devise these opsec procedures, you're probably smart enough to make a decent living doing something legal. So being a drug dealer is only worth it if you can do it at scale and make serious money. But these opsec procedures would significantly erode your hourly rate, making Silk Road an unattractive proposition. Unless, of course, you're willing to throw caution to the wind and optimize for efficiency rather than security.
- nekopa 13y ago
  Unless the seller is actually a co-op of sellers, distributed world-wide. It would be fairly trivial to make the seller group wide enough, and using a lifestyle type of profit (i.e. each person makes a reasonable amount of money, but no-one becomes a millionaire) it may not be worthwhile for law enforcement to coordinate and monitor so many drop points around the world
fleitz 13y ago
Not really, if you take a major metropolitan area there are plenty of mailboxes. The post office also happens to have a list of these mailboxes, if you use random selection and travel during peak hours they can't reduce much below the 'people who live in the metro area and commute' level.

jarrett 13y ago

Even then, there are still possible information leaks. For example, conceivably when you package the drugs in your warehouse, local pollens and molds could find their way into the insides of the packaging. If the distribution of pollens and molds is unique to a reasonably small area, that would be an information leak. A bit sci-fi? Sort of. You'd need a database of mold and pollen distributions for the whole country, plus tools to analyze the distribution in a given package. That's daunting, and maybe it's more trouble than it's worth for drug enforcement. But it's not outright impossible. And I have no idea what's the maximum effort DEA is willing to spend to track down Silk Road sellers. This is just one example of a possible information leak, off the top of my head. I'm sure we could come up with others, if we thought hard enough about it. All of this is to say that it's not the information leak you're worried about, it's the one you haven't thought of that will ruin you.

fleitz 13y ago
DEA effort is generally a faster than the slowest person type problem, you don't need to be better than the DEA, just better than someone else. Agents need to make busts in order to get promoted, therefore 'rational' agents will catch those easier to catch before devoting resources to harder to catch suspects.
- jarrett 13y ago
  In the aggregate, I'm sure this is true. If I were an individual criminal, I'd still be nervous. What if I'm the outlier, i.e. the criminal who gets caught despite an abundance of caution? Not that I'm disagreeing with you at all. Your point seems spot-on.

deleted 13y ago

[deleted]