Exactly my thoughts. The quote from the manager of crime operations made me laugh:
> "Criminals are attempting to exploit the international mail system through online networks, but the recent arrest demonstrates that we are one step ahead of them."
Yes, you intercepted one transaction. Congratulations.
One of the reasons the Silk Road operates in the relative open with such impunity is because of the absurdly low probability that a small quantity of well-packaged drugs will be detected unless they pass through customs. The USPS is especially good since it extends Fourth Amendment protections to parcels, which the commercial carriers don't need to do.
Pause for a moment and consider that one can purchase narcotics from an anonymised network using virtual money. There's no need to read speculative science fiction these days, you can just read the news.
Those drugs still have to be shipped via a real postal system. Speculative scifi suggests that I will have a machine in my house that will produce drugs on the fly, with chemical reactions that are controlled by software.
It actually wouldn't be much more complicated to have a machine into which you pour a bit of bakers yeast, sugar and water and out comes a highly-enriched biomolecule of your choice. Most (recreational) drugs can be created via natural biochemical pathways. Honestly, not that much more complicated than your espresso machine.
Sure, but at that point it isn't a printer, and let's not forget that while any one particular chemical may have a simple synthesis process, different chemicals don't generally have the same process, which makes synthesizing an arbitrary chemical in a printer-sized box that sits on your desk a difficult prospect.
No need to wait for 3D printing, last night I was reading a short story [1] in which the players in an ARG earned experience points via the hand delivery of items from one player to another in the real world forming an alternative delivery system from the postal carriers.
Similarly, in Daniel Suarez's Daemon [2] he describes how a series of net connected people pass around individual parts that they have no idea the purpose of until they all get delivered to one guy who assembles them into a gun.
On the orig bitcointalk thread when SR first advertised there somebody suggested this kind of a network and there's 20 pages of replies why this wont work for narcotics the biggest reason being theft downline the second being arrested with a ton of drugs and authorities wont care you were in an anonymous network you are getting a major trafficking charge
"We perform a comprehensive measurement analysis of Silk Road... We gather and analyze data over eight months between the end of 2011 and 2012... We evaluate the total revenue made by all sellers, from public listings, to slightly over USD 1.2 million per month..." http://arxiv.org/abs/1207.7139
I never know from stories like this if law enforcement are hopelessly clueless or if they do know what they're doing but just not releasing details.
While the tech is probably secure it's easy for people to make mistakes that leak information; and while NSA or GCHQ probably find it easy to get that information they have no interest in doing so. So, do police agencies have people who know enough about the mistakes people make with Tor and Bitcoin?
"So, do police agencies have people who know enough about the mistakes people make with Tor and Bitcoin?"
I met a researcher who did some work on attacking Tor, the results of which were given to law enforcement agencies. He was a bit light on details, but the basic idea of his approach was this:
1. You narrow down the geographic location of your target. Not hard in the case of the Silk Road, since there is a physical package being shipped.
2. You connect to your target's system, and modulate the latency of packets that you send. This is a covert channel.
3. You have a van rolling around the geographic region you believe the target to be in, and listen on wifi frequencies. When the covert channel is detected, you home in until you have located the target computer.
Obviously you can defend against this sort of attack by just not using wifi, although similar attacks at the ISP level are possible. Cover traffic helps with this, assuming the covert channel has low tolerance to noise (this may not be true; again, few details were given). It is also wise to avoid connecting from your house, if possible, and to use a public location where you can quickly shut down your laptop when you see the cops.
Or, you know, you could not sell large quantities of illegal drugs over the Internet, since it is basically asking for trouble.
Yes they are. He said a researcher shared that information with police officers, not that they did anything but say "thanks a lot, this will help". I'm willing to bet no officer on the drug enforcement team even read the paper.
No law local enforcement agency will known how to even begin step 2, and none will waste the time and resources for step 3.
Does this really work in the case of the Silk Road? Communication is completely asynchronous, the people sending and receiving packages never make a direct connection. You would need to find a geographic area for the server itself, which is presumably a closely guarded secret.
The researcher's original work was meant to crack down on child pornography distribution, where the covert channel would be embedded in the download of a video or large file of some sort.
In the case of the Silk road, the police would probably need to direct the target to another website, and somehow convince the target to leave that website open. Harder, yes, although probably not impossible -- one might, for example, claim to be directing the target to a website where a PGP key is being distributed, and then use Javascript to open a window in the background (one of the many reasons why one should disable Javascript whenever they use Tor). It is generally considered to be good advice not to follow off-site links for something like Silk Road, but the reality is that most people who go there are not experts on computer security and do not understand how Tor might be attacked (consider, for example, this case: http://www.wired.com/threatlevel/2007/11/encrypted-e-mai/ ). The police may not be world-class cryptanalysts, but they are pretty good at tricking people.
The challenge isn't locating or identifying average users, though, since they'll gladly send you their name and address. The challenge is finding the distributors, who are (presumably) more careful to follow the rules. It sounds like this technique can't really do that in the general case.
Even distributors probably do not know all the ways that Tor can be attacked. Look at the Hushmail/DEA case: you had a reasonably big steroids distributor using Hushmail, sending mountains of incriminating evidence through that system apparently unaware that there was a major security problem. Is it really so hard to believe that the police might be able to get a Silk Road distributor to follow an off-site link?
A distributor, sure. Some people are that dumb. But enough to make a dent? I doubt it.
There are site rules and best practices and distributors are ranked (among other factors) on how well they keep to those. The rules say (among other things) to only communicate through the site, to PGP encrypt any sensitive information, and never to store any information longer than necessary to complete the transaction. I'm not saying there are no possible attacks against that surface, but I don't think the one you've described gets there.
Anyone who breaks those rules puts themselves and their customers at risk. If a distributor got busted because they clicked an off-site link, I imagine the community would say good riddance. And keep trading drugs.
Prosecutions are public in many countries, so we can use that as a metric. If they knew what they were doing I imagine we'd see dozens or hundreds of Silk Road-related prosecutions. Or maybe Silk Road is mostly used by people who are too small-time for the police to bother with.
The FBI has an internal "manual" on Bitcoin that leaked a while back and they certainly have the skill to use various pre-existing open source tools to link addresses with names. In this case I wouldn't be surprised if Australian customs did most of the work though.
To be realistic though, bitcoin is mostly used for gambling and drugs. Depending on your philosophy, the freedom it enables is far more important than what it's used for.
You pose an interesting philosophical quandary. If the freedom it enables is simply the freedom to gamble illegally and trade illicit goods, is that important...?
Do people make the argument that freedom is simply intrinsically good? Or do they argue, like with bittorrent, that the possible occasional positive uses outweigh the more common, primarily negative uses ?
Wait, what? There are no transactions that should be blocked?
I'll be a little bit extreme here and agree that there are no voluntary transactions, made between consenting adults, that should be blocked. Any use of force (or threat of force) to try and achieve some social or political end is evil, IMO. Even if the "end" is a noble one, like preventing arson. It's the act of the arsonist which is evil, and intervening to prevent him/her from torching someone else's property is just self defense, which I would consider acceptable.
But, then again, I'm a radical anarcho-capitalist / voluntaryist, so I'm a bit biased.
How can you be radical if you feel "a bit biased"? I am radical voluntaryist myself because it's the only way to figure out what is right or wrong, what works and what doesn't. Whenever you have coercion, you cannot have study of human choices (that is, economics and ethics). It is as simple as that. If one wants to be coercive and violent - it's their choice, but it is illogical to claim that it's for someone's good. Because the only way to know anything about good is when you put your guns down and apply reason.
Am I being a bit biased with this idea? Can anybody study human choices by not giving them choices?
You use an extreme example as a red herring. There are very few aggressive napalm-obsessive maniacs (outside the military agencies), but there are tons of regular folks who do no harm to anybody, but are constantly threatened by quirks in the laws. Do you know for 100% sure that you have paid all your taxes and filled all the forms correctly and never misspelled or accidentally lied in some gov. paper? So that if someone would want your ass, they would never find anything in your history against you? With such amount of laws, regulations, police abuse and complex expensive judicial system, you can never feel safe. So please don't think that some abstract triple-arsonist is your biggest threat. Your biggest threat is IRS. When your govt wants to kill some arabs, they will force you to pay for that and you cannot unsubscribe. And then you, not the govt will receive terrorist bombings in response.
And while I don't think that taking drugs is a good idea, I don't think paying for fighting them should be compulsory on the part of general population outgunned by the police and brainwashed in public schools.
Ok, correction: I think ethics is akin to medicine or nutrition. It really helps if you consistently apply it everywhere in order to prevent extreme scenarios. And when they occur, and ethics do not help, it's not a failure of ethics, but your failure to use ethics to avoid situation when someone actually threatens you with a nuke.
To say that general rule "do not use violence" does not work in extreme cases, is like saying that medicine is useless because it cannot make you perfectly healthy when you have a heart attack. But it is useful because it helps you to prevent heart attack in the first place. And if you ignored the knowledge and now having a heart attack, then how can you say that it is useless?
I think that the black markets are just the first adopters. After that, bitcoin will enable low-cost payment and payout processing and money transfer automation for everyone in the world. This is a great thing.
The only "good press" Bitcoin could get is if a major government started accepting it for tax payments, which is less likely than Chris Dodd being investigated for bribery.
Silk Road is a burden. Most serious Boitcoin discussion forums and chat channels will ban you for mentioning it. We're trying to change how cash transactions work, not help teens go to rave parties.
I mean, help me along with this. Bitcoin is like cash, but you need to use a computer. If I'm already using a computer, there are many reasons I might prefer to use another payment system: Traceability, reversibility, confirmability, et cetera. These are generally very useful features that translate directly into me paying less for stuff.
It seems to me like for most people, the only real advantage to cash is that it is anonymous, and the only reason most people need anonymity is if what they're buying is actually illegal, and for most people that means drugs.
So if I'm an average guy with a job, a mortgage, and a credit card, if I pay my taxes, and stop for pedestrians, and I like to drop acid occasionally, what am I going to use bitcoin for?
Sure, but when there's an economic incentive to having things tracked most people put up with it. I'm not saying drugs are the only thing anyone would use bitcoin for, just the most likely thing for the average person to.
I think the cash economy is much larger than people just buying drugs.
Estimates of the size of shadow economies are between 14% and 22% of GDP in the developed world. [1] I'm just guessing that's significantly larger than the drug trade.
I disagree about the privacy issues as well, in some countries in Europe people still remember governments using records to round people up.
I'd like some clarification on Tor, please. Namely, how can the silkroad's site operate without the owners being detected? AFAIK Tor has its own DNS with <hash>.onion, but don't those resolve to regular IPs? And if police have a normal everyday IP, can't they just imprison the site's owners directly?
If they're smart, they'll just focus on compromising the site itself or using fake buyers/sellers. There are tons of ways to attack a site like that which do not rely on attacking tor.
Compromise the site itself & gather information. Catch & turn real sellers. Crapflood it with fake buyers/sellers making it less useful. Order drugs & gather forensic info from the packages. Try to trace the money trail via the bitcoin block chain. While bitcoin is nominally anonymous, I believe there was an article a while back about how easy it is to accidentally deanonymize your bitcoins (see https://en.bitcoin.it/wiki/Weaknesses for example). Heck, agree to sell someone drugs and actually send them flour + a GPS/camera if you want to go that route.
For the most part, just go after the weak human links in the chain and use standard anti-network tactics like turning people into informants and isolating everyone via mistrust.
Heck, they could just start scamming folks on the site. Create lots of new sellers, never deliver the promised drugs. BTC aren't revokable, so you can just rob them blind. The marketplace requires trust and there are lots of ways to break that. Yes, they could start building escrow services and the like, but those just create new avenues for attack.
With a little imagination, this could be used by the police as a giant honeypot.
> Compromise the site itself & gather information.
Yea good luck with that!
> Catch & turn real sellers.
How would you do that? This seller got caught because he was a buyer too. People only selling on silk road can't be caught unless they do something really really stupid. And even if you do catch a seller what does that get you? Nothing! You're no closer to closing down Silk Road itself.
> Crapflood it with fake buyers/sellers making it less useful.
You can't be a fake buyer. Buyers must pony up the bitcoin up front and so that only helps sellers. Who cares where the actual drugs went, the seller got his money. Fake sellers are quickly caught out because of the reputation system. Buyers already know which sellers are reputable, they'll just keep buying from them. You can't do anything about that.
> Order drugs & gather forensic info from the packages.
This just targets individual sellers and won't do anything to stop Silk Road. Especially if the sellers are overseas.
> Heck, agree to sell someone drugs and actually send them flour + a GPS/camera if you want to go that route.
Yes buyers are vulnerable and always will be on Silk Road. That doesn't stop anyone and you'll usually only bust small time users which is a waste of resources.
>For the most part, just go after the weak human links in the chain and use standard anti-network tactics like turning people into informants and isolating everyone via mistrust.
Informants are useless. No seller can help you take down Silk Road because no seller knows where it's hosted or who is running it.
> Heck, they could just start scamming folks on the site.
Reputation systems stop this. Buyers only buy from reputable sellers.
> With a little imagination, this could be used by the police as a giant honeypot.
Well, for one, you can get forensics from the packages. They may be good, but I wonder if they're perfect. It's likely that they use similar methods most of the time.
If you're flooding them with fake sellers, it's going to be hard for new sellers to gain rep. Especially if you're leaving fake feedback, too.
By 'informants' I mean that you take over their Silk Road account and sell with their reputation. Turning people one at a time isn't useless if you make people afraid to use the site or to trust new sellers, then each seller you bust leaves them one less trusted place to turn to.
Reputation systems only work if there's a trusted authority to decide them or if there's more legit feedback than fake. It's not as though there are no ways to create fake accounts en masse. And it's not like a TOR hidden service can tell where the accounts are being spam registered from.
Overall, it's a cat-and-mouse game, but I don't see why it's fundamentally intractable.
I think what Natsu is suggesting is similar to what the film and music industry tried with seeding torrent sites with partial clips, or material unrelated to that which it says it was.
That was thwarted by a simple comment and up-vote system.
For something that relies on physical delivery, you can do a lot more. And there are no chargebacks with bitcoins, so I'm surprised if there aren't lots of scammers. If you can convince someone to send you bitcoins, you have their money and they can't get it back.
My understanding is .onion addresses "resolve" to the entry point of a Tor tunnel that takes you to the hidden site. The node sitting at the entry has no knowledge of where the traffic goes, just the next hop node.
I wonder if this isn't susceptible to statistical methods. The idea would be to both issue requests and to operate onion nodes, feed a big number of requests for the Silk Road into Tor, use timing and size information for the requests at your nodes to identify those that are possibly yours. Every request to the Silk Road has to terminate there, so the IP-numbers that it uses should sum to 1/(# of onion layers) of your total, minus a factor for packets you falsely identified as yours.
this was already posted here a few days ago and everybody agreed this guy was a moron, and that no magic police tor tracing was used. He told them everything when customs found a bunch of drugs in a box from the netherlands with his name on it.
This definitely is not the first silk rd conviction plenty of ppl have been nabbed by customs around the world if you read the forums just they were smart enough not to say anything without a lawyer
72 comments
[ 5.3 ms ] story [ 143 ms ] thread> "Criminals are attempting to exploit the international mail system through online networks, but the recent arrest demonstrates that we are one step ahead of them."
Yes, you intercepted one transaction. Congratulations.
1) The printer is capable of "printing" complex compounds using individual atoms
2) The printer is pre-loaded with cocaine, LSD, MDMA...
My point being not everything can be printed...
Similarly, in Daniel Suarez's Daemon [2] he describes how a series of net connected people pass around individual parts that they have no idea the purpose of until they all get delivered to one guy who assembles them into a gun.
1 - http://www.amazon.com/Metatropolis-John-Scalzi/dp/B0058M5ZJ6 - "The Red in the Sky is Our Blood"
2 - http://www.amazon.com/Daemon-ebook/dp/B003QP4NPE/
http://imgur.com/a/asNew
The numbers from the store are unknown, and also I'm pretty sure it is very difficult to get a realistic volume from the sales.
While the tech is probably secure it's easy for people to make mistakes that leak information; and while NSA or GCHQ probably find it easy to get that information they have no interest in doing so. So, do police agencies have people who know enough about the mistakes people make with Tor and Bitcoin?
I met a researcher who did some work on attacking Tor, the results of which were given to law enforcement agencies. He was a bit light on details, but the basic idea of his approach was this:
1. You narrow down the geographic location of your target. Not hard in the case of the Silk Road, since there is a physical package being shipped.
2. You connect to your target's system, and modulate the latency of packets that you send. This is a covert channel.
3. You have a van rolling around the geographic region you believe the target to be in, and listen on wifi frequencies. When the covert channel is detected, you home in until you have located the target computer.
Obviously you can defend against this sort of attack by just not using wifi, although similar attacks at the ISP level are possible. Cover traffic helps with this, assuming the covert channel has low tolerance to noise (this may not be true; again, few details were given). It is also wise to avoid connecting from your house, if possible, and to use a public location where you can quickly shut down your laptop when you see the cops.
Or, you know, you could not sell large quantities of illegal drugs over the Internet, since it is basically asking for trouble.
No law local enforcement agency will known how to even begin step 2, and none will waste the time and resources for step 3.
In the case of the Silk road, the police would probably need to direct the target to another website, and somehow convince the target to leave that website open. Harder, yes, although probably not impossible -- one might, for example, claim to be directing the target to a website where a PGP key is being distributed, and then use Javascript to open a window in the background (one of the many reasons why one should disable Javascript whenever they use Tor). It is generally considered to be good advice not to follow off-site links for something like Silk Road, but the reality is that most people who go there are not experts on computer security and do not understand how Tor might be attacked (consider, for example, this case: http://www.wired.com/threatlevel/2007/11/encrypted-e-mai/ ). The police may not be world-class cryptanalysts, but they are pretty good at tricking people.
There are site rules and best practices and distributors are ranked (among other factors) on how well they keep to those. The rules say (among other things) to only communicate through the site, to PGP encrypt any sensitive information, and never to store any information longer than necessary to complete the transaction. I'm not saying there are no possible attacks against that surface, but I don't think the one you've described gets there.
Anyone who breaks those rules puts themselves and their customers at risk. If a distributor got busted because they clicked an off-site link, I imagine the community would say good riddance. And keep trading drugs.
The FBI has an internal "manual" on Bitcoin that leaked a while back and they certainly have the skill to use various pre-existing open source tools to link addresses with names. In this case I wouldn't be surprised if Australian customs did most of the work though.
Do people make the argument that freedom is simply intrinsically good? Or do they argue, like with bittorrent, that the possible occasional positive uses outweigh the more common, primarily negative uses ?
I know I'm being a little extreme, but again- what!?!
I'll be a little bit extreme here and agree that there are no voluntary transactions, made between consenting adults, that should be blocked. Any use of force (or threat of force) to try and achieve some social or political end is evil, IMO. Even if the "end" is a noble one, like preventing arson. It's the act of the arsonist which is evil, and intervening to prevent him/her from torching someone else's property is just self defense, which I would consider acceptable.
But, then again, I'm a radical anarcho-capitalist / voluntaryist, so I'm a bit biased.
Am I being a bit biased with this idea? Can anybody study human choices by not giving them choices?
I just mean, biased relative to what you might call "the mainstream". Luckily I give about half a shit about what "the mainstream" think.
And while I don't think that taking drugs is a good idea, I don't think paying for fighting them should be compulsory on the part of general population outgunned by the police and brainwashed in public schools.
To say that general rule "do not use violence" does not work in extreme cases, is like saying that medicine is useless because it cannot make you perfectly healthy when you have a heart attack. But it is useful because it helps you to prevent heart attack in the first place. And if you ignored the knowledge and now having a heart attack, then how can you say that it is useless?
If someone sets fire to 3 buildings I expect them to be in prison.
I mean, help me along with this. Bitcoin is like cash, but you need to use a computer. If I'm already using a computer, there are many reasons I might prefer to use another payment system: Traceability, reversibility, confirmability, et cetera. These are generally very useful features that translate directly into me paying less for stuff.
It seems to me like for most people, the only real advantage to cash is that it is anonymous, and the only reason most people need anonymity is if what they're buying is actually illegal, and for most people that means drugs.
So if I'm an average guy with a job, a mortgage, and a credit card, if I pay my taxes, and stop for pedestrians, and I like to drop acid occasionally, what am I going to use bitcoin for?
Also, drugs aren't the only black market trade.
Estimates of the size of shadow economies are between 14% and 22% of GDP in the developed world. [1] I'm just guessing that's significantly larger than the drug trade.
I disagree about the privacy issues as well, in some countries in Europe people still remember governments using records to round people up.
[1] http://www.voxeu.org/article/shadow-economies-around-world-m...
tl;dr hidden services are anonymous
Which is actually pretty neat.
For the most part, just go after the weak human links in the chain and use standard anti-network tactics like turning people into informants and isolating everyone via mistrust.
Heck, they could just start scamming folks on the site. Create lots of new sellers, never deliver the promised drugs. BTC aren't revokable, so you can just rob them blind. The marketplace requires trust and there are lots of ways to break that. Yes, they could start building escrow services and the like, but those just create new avenues for attack.
With a little imagination, this could be used by the police as a giant honeypot.
Yea good luck with that!
> Catch & turn real sellers.
How would you do that? This seller got caught because he was a buyer too. People only selling on silk road can't be caught unless they do something really really stupid. And even if you do catch a seller what does that get you? Nothing! You're no closer to closing down Silk Road itself.
> Crapflood it with fake buyers/sellers making it less useful.
You can't be a fake buyer. Buyers must pony up the bitcoin up front and so that only helps sellers. Who cares where the actual drugs went, the seller got his money. Fake sellers are quickly caught out because of the reputation system. Buyers already know which sellers are reputable, they'll just keep buying from them. You can't do anything about that.
> Order drugs & gather forensic info from the packages.
This just targets individual sellers and won't do anything to stop Silk Road. Especially if the sellers are overseas.
> Heck, agree to sell someone drugs and actually send them flour + a GPS/camera if you want to go that route.
Yes buyers are vulnerable and always will be on Silk Road. That doesn't stop anyone and you'll usually only bust small time users which is a waste of resources.
>For the most part, just go after the weak human links in the chain and use standard anti-network tactics like turning people into informants and isolating everyone via mistrust.
Informants are useless. No seller can help you take down Silk Road because no seller knows where it's hosted or who is running it.
> Heck, they could just start scamming folks on the site.
Reputation systems stop this. Buyers only buy from reputable sellers.
> With a little imagination, this could be used by the police as a giant honeypot.
I don't see it.
If you're flooding them with fake sellers, it's going to be hard for new sellers to gain rep. Especially if you're leaving fake feedback, too.
By 'informants' I mean that you take over their Silk Road account and sell with their reputation. Turning people one at a time isn't useless if you make people afraid to use the site or to trust new sellers, then each seller you bust leaves them one less trusted place to turn to.
Reputation systems only work if there's a trusted authority to decide them or if there's more legit feedback than fake. It's not as though there are no ways to create fake accounts en masse. And it's not like a TOR hidden service can tell where the accounts are being spam registered from.
Overall, it's a cat-and-mouse game, but I don't see why it's fundamentally intractable.
That was thwarted by a simple comment and up-vote system.
This definitely is not the first silk rd conviction plenty of ppl have been nabbed by customs around the world if you read the forums just they were smart enough not to say anything without a lawyer