Did Stack Exchange staff members assist in the apprehension of Ross Ulbricht?

http://meta.stackoverflow.com/questions/199353/did-the-stack-exchange-staff-members-assist-in-the-apprehension-of-ross-ulbricht

by codezero • 13 years ago

68 46 13 years ago

meta.stackoverflow.com

benologist2• 13 years ago

Almost as contrived as the crap all over Quora.

logn3• 13 years ago

Not sure I agree or get your point. Seems like he's doing the best he can to explain what happened without being taken to a secret prison.

My guess is they've gotten one request from the NSA ('give us all your data for everyone... otherwise we will just tap into your fiber lines at ISPs') and one from the FBI ('we are doing some parallel re-construction and it says here we have a warrant for a user by the name of Frosty').

I'm just surprised an admin on the site didn't close the Q&A as non-constructive and speculative :)

benologist2• 13 years ago

The very boring truth is the feds probably just put the guy's name, usernames, email addresses etc into Google and got a court order to explore certain results. People using SO should be aware of how to google something and able to reach such an obvious conclusion - and this probably happened to 100s or 1000s of sites they encountered and in most other cases since MySpace reached critical mass years ago.

The only question is whether they pay someone to do it manually or they paid someone like a SO user to automate it.

nullc• 13 years ago

Seems like he's doing the best he can to explain what happened without being taken to a secret prison.

National security letters are only supposed to be used for national security, not random drug busts. If they used an NSL it was unlawful.

If this was just a sealed request it should be open now that the indictment has been handed down. If it was reasonable and lawful they should be asking for it to be unsealed and the request should be granted.

anfedorov• 13 years ago

Some press on this case implies that the FBI found this person from his activity our site. I can't disprove that, but it is much more likely that they found him through other means, and then tracked his activity on various sites to build enough evidence for an arrest, indictment, etc.

Anyone care to speculate how they found him?

ritchiea• 13 years ago

It has been reported in many places that Canadian authorities intercepted a package to him containing several fake IDs with his face on them and passed that along to US authorities. I imagine he was under serious scrutiny after that happened (this may be sourced from the complaint against him, but I haven't personally read the complaint).

logn3• 13 years ago

The NSA et al. know everything. It's just a matter of whether they can figure it out again using legal investigative techniques. I imagine it like the solutions in the back of a math textbook. I'm given the answer but I won't get credit for answering them correctly unless I can actually list every step in deriving the solution. See the recent news stories on NSA-DEA parallel reconstruction.

Specifically to your question, I'd guess they run a large number of Tor exit nodes and from there it was fairly simple to see exactly who was doing what.

Also it's come out recently in the Guardian, the NSA can backdoor machines through special servers running man-in-the-middle attacks.

Basically, the Internet (and planet Earth too) is not secure, so trying to pull off a large-scale crime is kind of foolish.

krapp2• 13 years ago

The NSA et al. know everything.

Parallel construction doesn't actually imply that the NSA is omniscient and that the entire rest of the American justice system is a charade meant to mask its power from the muggles. The NSA doesn't know everything. They don't see everything. They don't whisper words of power into the ears of every prosecutor, and a dark man smoking a cigarette doesn't appear from out of the shadows with fabricated evidence for the Department of Justice and a dossier from ten minutes into the future every time a hacker opens their browser.

It gets mentioned every time a post comes up involving court case or arrest, and it's quite honestly as useless a form of speculation as suggesting divine intervention as a first cause in science. Assuming too much power on the part of the NSA (and by extension, that no other methods used by any other bureau or department are effective except as a smokescreen) is as dangerous as dismissing them entirely.

adventured• 13 years ago

If this were true, that the NSA knows all, 50% of all murders wouldn't go unsolved in Detroit.

meowface• 13 years ago

It's hard to know the entire timeline of their investigation, but from how they describe it, the first lead they got was the username "altoid" posting what is apparently one of the first advertisements for Silk Road on a drug forum in January 2011, and then 2 days afterwards, an "altoid" posted on Bitcointalk looking for an IT pro to contact him at rossulbricht@gmail.com.

They implied this was the first thing they did. The interception of the fake IDs may have occurred before or after he was already under heavy suspicion of being Dread Pirate Roberts. I also believe there was some discussion that the fake IDs might've actually sent by an undercover agent.

Either way, I think it's very likely that they already had the idea that Ross Ulbricht == DPR before finding his Stack Overflow post.

asveikau4• 13 years ago

Regarding the mailing of fake IDs and other stuff, I heard so many media accounts of Silk Road in the last week or so, and I really didn't understand this part: why bother to go through the trouble of all that crypto and anonymizing if in the end you are going to use your real street address?

I thought this part was the dumbest aspect of the whole arrangement, but then I heard about posting on Stack Overflow to get your bugs fixed, and "contact me at rossulbricht@gmail.com kthxbye", and I begin to think that "criminal mastermind" is not exactly an apt description of this guy. I find it hard to contain my laughter at this.

kbuck• 13 years ago

The criminal complaint[1] mentioned the FBI searching for the earliest mention of Silk Road. The earliest they found was a user called 'altoid' advertising it in two separate places (including bitcointalk) around the same time. Later, 'altoid' posted a second time on bitcointalk searching for an "IT Pro" and publicly listed the email address "rossulbricht@gmail.com" as the contact info for the gig. This was also the email address he used to register his Stack Overflow account.

[1] http://www1.icsi.berkeley.edu/~nweaver/UlbrichtCriminalCompl...

jpalioto• 13 years ago

Since you're asking for speculation ... between FH, Atlantis and SR all going down so quickly, I would guess that TOR is compromised in some way (regardless of what the complaint says). IMHO, the probability that this case was cracked by a random CBP seizure is 0.

ivmi• 13 years ago

And how strongly do you believe your speculation? I think you are completely wrong, so I'm curious. What do you place the odds at that sites similar to Atlantis and SR(namely sheep and bmr) will go down by the end of the year?

dobbsbob2• 13 years ago

Atlantis market disappeared probably because they didn't make any money and risk didn't equal reward, they claimed agents were messaging them looking to find informants but it's likely they just scammed all their users of a lot of escrow coins and disappeared.

Freedom Hosting was likely a NSA op to get a hold of tormail.org messages and history because Snowden was either using it or emailing somebody using it. The FBI will use parallel construction to cover that one.

SR I suspect they simply watched him sitting at cafes and libraries and logging into his virtual cartel. There were also numerous people who had discovered leakage and were able to find the server many of whom ended up working for DPR. Either way it wasn't set up very well, who knows maybe the FBI uploads spyware.js as an image while posting a new order or broke through the php5-mysql plugin. I'm sure they will discover that half his inner circle of close associates were informants too maybe they leaked the address. Remember he once put out applications for database administrators you can guarantee dozens of agents signed up for the job.

revelation• 13 years ago

A critical hint might be that the code example that DPR used on his StackOverflow post was found on the seized SilkRoad server(s). They might have just googled that, found DPRs post and then asked StackOverflow for the data on that user.

I do not know why any judge would issue one of those searches + gag included orders based on a random code fragment, but then of course I know that judges just robosign these things from the FBI turned intelligence agency.

gojomo• 13 years ago

Arstechnica has a good writeup:

http://arstechnica.com/security/2013/10/silk-road-mastermind...

From that account, it looks like the key break was likely that the first alias to promote Silk Road (altoid) was at one later point also linked to a real-name gmail address (rossulbrecht@gmail).

Even if that association was brief, plenty of people (and even law enforcement researchers) are likely scraping/archiving or email-subscribed to the bitcoin forum where the association appeared. The same goes for 'tor' forums or tags elsewhere... so an actual law-enforcement approach to StackOverflow/Bitcointalk/Gmail/etc may not have even been necessary.

(OTOH, Bitcointalk.org is currently down after an attack that may have resulted in the leak of username/hashed-password/email records. User altoid's email address there could have been obtained by law enforcement, by subpoena or hack, and also pointed towards Ulbrecht.)

rodgerd2• 13 years ago

He's alleged to have paid to have someone tortured to death after they were arrested, on the off-chance that the person might have talked to police (the $80,000 murder). Not because the person talked, but because the person had been arrested.

I don't know about you, but I'm pretty sure any half-decent cop would be using the logs of that conversation to convert that person into a witness.

turboroot• 13 years ago

It's interesting to note from page 30 of the criminal complaint, StackOverflow was able to record "Ulbricht [changing] his registration email [...] to 'frosty@frosty.com'".

Why do sites like StackOverflow keep audit logs of your account information?

baudehlo• 13 years ago

More likely historical database backups

pstack• 13 years ago

Actually, it's almost certainly as the other person stated - for administrative moderation purposes. There is no other purpose to maintaining historical backups of this sort of data. Especially not when that costs money.

When I built a site that existed for a very long time, was very popular, and involved monetary transactions, I had to track nearly everything. IP addresses, address changes, email changes. Everything I could think of. This was then utilized when I suspected someone of fraudulent behavior. I could pull up an administrative screen that compared data in an archive copy (where I dumped the older information for just this purpose and to specifically keep it inaccessible to the outside world for user security purposes). With that, I could see whether several users were actually the SAME user. I even tracked things like user-agent string and detected screen resolution.

A lot of pieces of data can come together to provide more than circumstantial evidence that someone is shilling, trying to feedback-bomb another user, and so on. Enough correlated points of data can confirm suspicions like this. You'd be surprised how many people use an email address for one account, change that address, then create a second account with the email address they used to have on the first account and then use the second address to drive up the value of their stuff by shill-bidding against another user on their own item.

dangrossman• 13 years ago

Among other reasons, to stop spammers and trolls from evading their bans/restrictions.

mjmsmith• 13 years ago

This happens very, very rarely. I have more than enough fingers to count the times this has occurred since I started working here a year and a half ago. I wouldn't need a single toe, and I'm pretty sure I wouldn't need both hands.

I'm not sure that I would call multiple times a year "very, very rarely".

bsullivan01• 13 years ago

I'm not sure that I would call multiple times a year "very, very rarely".

Every service loves to use their total number of members and say that requests are very rare--relative to their number of users.

But honestly not sure what they could have done, if FBI comes in with a legal request for a specific user's data, what are your options?

benaiah• 13 years ago

For a site that large and well-visited, with almost entirely user-generated content, all of which are on technical problems many of which could involve illegal activity?

I'd agree that that's very, very rarely.

sneak4• 13 years ago

This just in: absolutely no strangers (save statistically insignificant outliers like Nacchio) will go to jail to protect your data during a police investigation - nor should they.

Plan accordingly.

kylemaxwell• 13 years ago

So on one hand, we have the execution of a warrant or subpoena that is narrowly written, specific and reasonable, based on probable cause, and signed by a judge.

On the other hand, we have recently seen much greater evidence about the wholesale surveillance of society under secret law and apparently not accountable in any practical sense to oversight.

The first is normal and appropriate and well within the bounds of civil liberties guaranteed by Fourth Amendment. The second is highly problematic - but one doesn't necessarily lead to the other. Our civil liberties and civil rights have always been subject to appropriate exceptions. The problem is when those exceptions become so broad as to render the freedoms ineffective, not that they exist at all.

rodgerd2• 13 years ago

Unfortunately the Dunning-Krugerrand crowd seem determined to try to conflate what seems to be a fairly legitimate piece of police work[1] with the Orwellian surveillance state.

[1] Well, obviously one can disagree about the criminalisation of recreational drugs, but they are, so the cops are working within their brief.

microcolonel• 13 years ago

"This happens very, very rarely. I have more than enough fingers to count the times this has occurred since I started working here a year and a half ago. I wouldn't need a single toe, and I'm pretty sure I wouldn't need both hands."

Pfft, he's counting in ternary.

kevinpet• 13 years ago

Can we please not get distracted by police investigating criminal activity acting within the bounds of individualize specific suspicion of a crime and keep things concentrated on warrantless wiretapping and wholesale surveillance?

IvyMike• 13 years ago

The question (probably unanswerable) that fascinates me is: Did the authorities find DPR by analyzing Tor network traffic, or by some other means? The Tor network being ineffective has wide-reaching ramifications.

I know the evidence has presented to make us think they found him via a series of mistakes, but the existence of parallel construction makes me question everything.

sneak4• 13 years ago

It looks like the government needs major surgery.

Why don't we deal with the widespread corruption and overreach of power on all levels, from blue-clad street thugs, through federal prosecutors who see nothing wrong with pre-trial asset forfeiture, all the way up to and including the military-surveillance complex?

Did Stack Exchange staff members assist in the apprehension of Ross Ulbricht?

Related Stories