Follow Slashdot stories on Twitter

 


Forgot your password?
Close
typodupeerror
×
Crime Bitcoin The Courts

Silk Road Journal Found On Ulbricht's Laptop: "Everyone Knows Too Much" 180

Posted by timothy from the that's-not-my-bag-baby-honestly dept.
sarahnaomi writes On Wednesday, prosecutors in the Silk Road trial began to lay out the wealth of evidence found on the laptop taken from accused kingpin Ross Ulbricht in a San Francisco library in October 2013. The evidence presented by prosecutor Timothy Howard was the most comprehensive and damning thus far, including more than a thousand pages of chats between the site's pseudonymous operator Dread Pirate Roberts and Silk Road administrators. Also entered into evidence was a journal that dates back to at least 2010 describing the creation and operation of the site. FBI computer scientist Thomas Kiernan, the second witness in the trial, testified about the day Ulbricht was arrested and the evidence gathered from his laptop.
This discussion has been archived. No new comments can be posted.

Silk Road Journal Found On Ulbricht's Laptop: "Everyone Knows Too Much" More

Silk Road Journal Found On Ulbricht's Laptop: "Everyone Knows Too Much"

Comments Filter:

  • What an idiot (Score:5, Insightful)

    by wiredlogic ( 135348 ) on Thursday January 22, 2015 @02:35PM (#48877579)

    So not only could he not secure his black site, he couldn't even secure the files on his own laptop.

    It makes you wonder how he ever got it running in the first place.

    • Re: (Score:1)

      by Anonymous Coward

      It makes you wonder how he ever got it running in the first place.

      Perhaps that, in itself, is compelling evidence that he didn't.

      • Re:What an idiot (Score:4, Insightful)

        by Anonymous Coward on Thursday January 22, 2015 @02:50PM (#48877817)

        On the other hand, a psychopath is marked by superhuman hubris, i.e. the assumption that everyone is stupid except them. This is often their downfall when it comes to criminal trial, because they are genuinely shocked that other people are smart enough to have figured them out.

        • why would you assume he is a psychopath?

        • Re:What an idiot (Score:4, Insightful)

          by DrXym ( 126579 ) on Thursday January 22, 2015 @04:38PM (#48879011)
          The most likely diagnosis is the Dunning-Kruger effect. He thought himself smarter than he actually was. Add to that the fact he was running a market in illegal goods (drugs, weapons, hitmen etc.) which tends to make law enforcement throw lots of manpower at finding out who the perpetrator is and the determination to take them down.

          • He may well have been as smart as he thought (I'm not saying that is the case for sure, mind) but turns out others were smart enough, and more knowledgeable in the ways that mattered.

            Hans Reiser is a good example. Man is unquestionably very smart. However, he had the geek hubris that I call SMFU, Smartest Motherfucker in the Universe syndrome. He figured he was so much smarter than everyone else, he could easily get away with his crime. Turns out that the police have some smart people too, and those people

      • Re:What an idiot (Score:4, Funny)

        by DrXym ( 126579 ) on Thursday January 22, 2015 @04:34PM (#48878981)

        Perhaps that, in itself, is compelling evidence that he didn't.

        "Your honour, the defence submits that the fact that an entire room of people saw the accused stab the victim and state he was glad he did it, proves conclusively that he didn't. There is so much compelling evidence against our client that it is actually evidence of his innocence. And with that the defence rests."

        Doesn't exactly work.

      • If that worked, then it would work for every "criminal mastermind" ever prosecuted.

        "You say I hatched this ingenious plan! But if I were that clever, you never would have caught me!"

      • According to a referenced article on the link above, he got a lot of help from a Comp Sci friend, in setting up the site - but the guy doing it wasn't fully involved - just giving bits of code and advice. So it's conceivable he knew enough and had enough help to get the site running - but didn't think through all the elements of what he was doing, properly.

        It seems he told his GF, who later broke up with him and told her friends... one of whom posted on his Facebook page: "I’m sure the authorities w

    • Re: (Score:2, Informative)

      by Anonymous Coward

      You eventually need to decrypt your own files so you can use them, so the trick is to catch the person when they're actually sitting at their machine using it so that they don't have time to slam the lid on the laptop. If they can do that they can plug in an external drive and copy everything, unencrypted. They got him when he was at the SF public library, agents probably swooped in and manhandled him before he could react.

      • Re: (Score:3)

        by DrXym ( 126579 )
        Well obviously, but the smart perp would think of that situation. They would use encrypted drives. They would use shadow volumes. They would disable logging, or archive and encrypt them or routinely permanently erase them as a matter of habit. They would use virtual machines that didn't preserve state. They would route their activity through encrypted proxies in as many jurisdictions as humanly possible. They would situate their servers or computers with several locked doors between them and the outside. Th

        • People DO all that, they are just not caught... We're hearing about this guy because he didn't and was caught.

          Or do you think the FBI catches everyone?

    • Re:What an idiot (Score:5, Interesting)

      by grnbrg ( 140964 ) <slashdot@grn[ ].org ['brg' in gap]> on Thursday January 22, 2015 @02:53PM (#48877875)

      Apparently he was arrested (in public) at a library, and the techs who got the laptop knew what they were doing...

      It was logged in, and they spend several hours copying data without letting it sleep or lock.

      Full disk encryption is great, but assumes that you won't have unlocked it for the attacker.

      • Re:What an idiot (Score:5, Interesting)

        by CaptBubba ( 696284 ) on Thursday January 22, 2015 @03:12PM (#48878115)

        Yeah they had two agents get into a fight right behind him and when he jumped up to see what was going on (just like anyone would do) another agent snatched the laptop and started the task of getting evidence off it and mirroring the drive's contents.

        The FBI is often really fucking good at what they do.

        • Yeah they had two agents get into a fight right behind him and when he jumped up to see what was going on (just like anyone would do) another agent snatched the laptop and started the task of getting evidence off it and mirroring the drive's contents.

          The FBI is often really fucking good at what they do.

          Raise your hand if you immediately started thinking about how you would mitigate this. Voice commands? Bluetooth remote in your watch?

          • How about a dead-man's switch, like the ones worn when you drive a WaveRunner or SnowMobile? It might be a physical lanyard, or a more modern approach could be Bluetooth based. When the BT dongle/wristband/whatever that you are wearing gets more than the range of Bluetooth away from the laptop, it auto-locks.

          • Re:What an idiot (Score:5, Interesting)

            by kylemonger ( 686302 ) on Thursday January 22, 2015 @04:07PM (#48878747)
            The simplest strategy would have been to have already moved to a non-extradition country. He'd already racked up tens of millions of dollars in profits! What was he waiting for?

            • Re:What an idiot (Score:5, Informative)

              by Rinikusu ( 28164 ) on Thursday January 22, 2015 @04:42PM (#48879059)

              And finally, once the FBI is there, knocking down your door (metaphorically speaking), you're pretty much fucked. The investigation that led them to you is probably more than enough to indict you and probably get the conviction, and refusing to turn over your keys once they already have you pinned down will be viewed as contempt of court and you'll sit in prison for a long damned time without a trial. This is why, from what I can tell, the defense is mainly focused on the procedure/evidence that led the FBI to him (poisoning the well) since if they can't give a good accounting for how they connected him to the SR, then all that evidence is for nothing if they used illegal techniques to get it.

              • Right in that yes, they already have a lot of evidence, and are just working to seal the deal. They like to have everything in a row and an overwhelming amount of evidence before going to trial.

                Wrong about the contempt thing. If you look it up in the US you find out that the courts have decided the 5th amendment applies to passwords. So you can keep your mouth shut and they can't compel you to hand over a password. If it is locked with something physical like a key fob or fingerprint, that you have to hand

                • Passwords and the Fifth Amendment aren't that simple. The courts have held that it's legal to require a password to reveal something known to be there. The main case was a guy whose laptop showed child pornography as he went through Customs. The Customs agent testified to it, and the courts ruled that he had to hand over the password. In this case, they'd have to know there were specific illegal records on the laptop to use that as a precedent.

                  One definite case is that, if the authorities know there'

            • The simplest strategy would have been to have already moved to a non-extradition country. He'd already racked up tens of millions of dollars in profits! What was he waiting for?

              Another good strategy would be to just stop doing it. Taking a big risk when you don't have money is much different from taking it when you do. He had enough to be comfortable for the rest for his life. Why risk that? You've already won whatever game you think you're playing.

        • Geeks in particular tend to forget this (Score:5, Insightful)

          by Sycraft-fu ( 314770 ) on Thursday January 22, 2015 @04:50PM (#48879147)

          The FBI may not be all up to date on the latest technologies and they aren't great at dealing with things purely in the digital world. However they are one of, if not the best investigative organizations in the world. They have a lot of experience investigating crimes of all kinds, often committed by experienced criminal organizations that are quite clever.

          So there's a good chance if they are interested in getting you, they will. They are quite literally professionals at it, and they institutionally learn from their experience. You very well may know a lot more about computers than they do, but they almost certainly know way more about criminal investigations than you do.

          • I don't know about that. Years and years (literally) someone hacked a linux system I had and was using to mess with other systems remotely, including some involved with the government. The FBI sent a woman who was /very/ smart about all things linux. I suspect they eventually caught that guy.

        • Re:What an idiot (Score:5, Informative)

          by Ralph Wiggam ( 22354 ) on Thursday January 22, 2015 @05:44PM (#48879621) Homepage

          Prior to that, the FBI took control of a forum mod's account. They asked "dread" in chat to look into something on the site that required him to log in as an admin. When they grabbed his laptop, a window with him logged into the site admin account was open. That's pretty damning evidence even without the journal.

      • Re:What an idiot (Score:5, Insightful)

        by h4ck7h3p14n37 ( 926070 ) on Thursday January 22, 2015 @03:13PM (#48878117) Homepage

        Full disk encryption is great, but assumes that you won't have unlocked it for the attacker.

        That's why you also encrypt sensitive files separately. You only unlock the file when you're actually using it and then lock it back up when done.

        Just use dd to create some space to use, create a filesystem on the file and then apply your preferred means of encryption. Encrypted USB sticks are another good solution.

        • Re: (Score:2)

          by sudon't ( 580652 )

          That's why you also encrypt sensitive files separately.

          This.

        • Re: (Score:2)

          by rtb61 ( 674572 )

          Who is kidding who. When a whole bunch of skilled people are specifically focused on getting evidence of criminal actions you have committed they will get you, if they do not make any mistakes and there is nothing you can do to prevent it. The idea is not to make so many mistakes that a whole bunch of skilled people become specifically focused upon you because by then it is way too late already. Of course once you get neck deep in criminal activity and when greed becomes you sole guiding motivation. The eg

          • This. The FBI has a lot of very skilled people working on cyber crime. You're kidding yourself if you think otherwise.

            • Re: (Score:2)

              by rtb61 ( 674572 )

              I specifically mentioned no organisation as this is a global issue and that globally, yes, investigatory agencies do have very skilled people working for them and I thought I was pretty clear on that. Note, those same agencies just by the application of statistics also get very low skilled people working for them. Some agencies are even stupid enough to use lie detectors, which ensure those most skilled at lying ie psychopaths still get hired and they are far more interested in pursuing their own ego and t

      • Basic OpSec would insist that you keep the incriminating stuff locked in a separate container that you only open when needed and with a low inactivity timeout to demount it when you forget.

    • Re: (Score:2)

      by sudon't ( 580652 )

      So not only could he not secure his black site, he couldn't even secure the files on his own laptop.
      It makes you wonder how he ever got it running in the first place.

      Well, that's a big part of his defense: "How could someone so stupid be the kingpin and mastermind the government is making him out to be?" I'm starting to believe it myself.

      • He admits to creating the site originally, but claims he sold it or gave it away before any drugs were sold. So he can't be *that* dumb.

    • Re: (Score:2)

      by Thud457 ( 234763 )
      ob. Bloom County [comic-rocket.com]

    • I mean, I encrypt my journal, in which I write about what movies I saw recently and the progress of people I tutor in math. And this guy doesn't encrypt the record of his illegal activities? What the hell man?!

  • Mental note: (Score:4, Insightful)

    by JWSmythe ( 446288 ) <jwsmytheNO@SPAMjwsmythe.com> on Thursday January 22, 2015 @02:36PM (#48877593) Homepage Journal

    Mental note: When establishing a questionably legal site for definitely illegal transactions to be made through, don't keep any logs about it, nor your conversations regarding it.

    • Re:Mental note: (Score:5, Interesting)

      by slew ( 2918 ) on Thursday January 22, 2015 @02:47PM (#48877751)

      Mental note: When establishing a questionably legal site for definitely illegal transactions to be made through, don't keep any logs about it, nor your conversations regarding it.

      Observation: if you have a big enough ego to think you can create such a questionable site and get away with it, you have probably can't stop yourself from feeling invincible in whatever you do and dismiss any possibility that your logs will get compromised *ever*. Conversely, if have enough doubt about the eventual security of your logs in the event you might eventually get caught, you probably don't have the balls to go through with it in the first place...

      • Also "if you have a big enough ego to think you can create such a questionable site and get away with it" you're probably wrong.

      • I think you're missing the point of /.ers coming up with possible solutions. These aren't criminal minds sharing how to do crime. They're compulsive puzzle solvers, and there is no puzzle greater than, no solution more elusive than defeating the well-run FBI investigation. Perhaps they really want to help the FBI be even more effective and irresistable. This pursuit is no different than penetration testing, nor the ability of the logical and clever to come up with solutions for problems in fields which they

    • Re: (Score:2)

      by OzPeter ( 195038 )

      Mental note: When establishing a questionably legal site for definitely illegal transactions to be made through, don't keep any logs about it, nor your conversations regarding it.

      The first rule of Questionably Legal Site is . . . [fill in the blanks]

    • i know if i were trying someone, and wanted them to appear as a criminal mastermind, a self penned manifesto/journal would be an incredibly convenient piece of evidence. Perfectly convenient, it could turn a technically challenging case into a total slam dunk.

      Fortune favors the feds in such situations it seems.

    • Re: (Score:3)

      by tlhIngan ( 30335 )

      Mental note: When establishing a questionably legal site for definitely illegal transactions to be made through, don't keep any logs about it, nor your conversations regarding it.

      Problem is, without the logs, no one would believe you!.

      And by that, I mean when you eventually come around to wanting to brag about your achievements - without evidence that you actually did it, no one would believe you, and everyone thinks you're just trying to satisfy some ego thing.

      Yes, that's how a lot of people get caught -

  • Comment removed based on user account deletion

  • Missing the point. (Score:4, Interesting)

    by B5_geek ( 638928 ) on Thursday January 22, 2015 @03:25PM (#48878281)

    While a lot of people are jumping on the "..it wasn't encrypted.." "..FBI grabbed it while he was logged in.."
    You are missing the point.
    Step 1) NEVER carry incriminating evidence with you. Encrypted or not.
    2) use a VPN/SSH Tunnel/etc (and/or both) to connect to the server where your data is. (make sure that server is located in a non-extraditing country, and filtered from you by a few shell companies)
    3) keep an absurdly low 'idle-timeout' on your ssh sessions
    4) use a dead-mans switch on that servers encrypted data
    (i.e. run command "I_am_not_in_jail_yet.sh" every 15minutes.) {be more vague then this*}
    5) ALWAYS assume that your local system is compromised. (boot/run from a read-only media)
    6) don't brag about it! If more then 1 person knows; then your secret is not safe.

    • Like in C, the winning sequence starts with a 0:

      Step 0) Don't do any criminal activity.

      That's it, there are no more steps (not even profit!). So much can be avoided by following step 0 first.

      • How many crimes do you commit before breakfast?

        You might be surprised.

      • Re: (Score:2)

        by reikae ( 80981 )

        Technically correct, but do you not consider some laws unworthy of respect? Outside the area of drug and gun laws for example (AFAIK) anal and oral sex were criminal in many parts of the US as recently as twelve years ago.

    • Re: (Score:2)

      by vux984 ( 928602 )

      You are missing the point.

      No. You are. You can't have perfect security.

      With the exception of point 5 and 6, which are simply just good advice (but #5 wouldn't have helped him here; and #6 makes it difficult to provide a criminal service -- after all someone else needs to know about it.)

      All your suggestions have caveats and vulnerabilities. I'm picking on 1 and 4 in particular below, but there are issues with 2, 3, 5 too.

      Step 1) NEVER carry incriminating evidence with you. Encrypted or not.

      Good advice, but h

  • Oh Boy! (Score:2)

    by PPH ( 736903 )

    I hope they never examine all the stuff I've saved on my PC and posted on line.

    -- Signed,
    Walter Mitty.

  • If I were going to create an underground illegal drug black market, don't keep a journal and detailed notes that can easily be recovered by investigators.

  • "Three can keep a secret, if two of them are dead."

    ~ Benjamin Franklin

  • Every time /. has news on someone, who has committed [cyber]crime, the comments read like from ask.slashdot.org article "I would like to set up a criminal enterprise online. Any helpful tips?"

    As per all "ask /." articles, most comments are borderline manslplaining (meaning, author has no experience in the field, has idea what he is talking about, but somehow it makes sense in his head and he is happy to share it). As in all diverse communities, some try to suggest that this is a bad idea and shouldn't be at

Slashdot Top Deals

"May your future be limited only by your dreams." -- Christa McAuliffe

Close