Silk Road Journal Found On Ulbricht's Laptop: "Everyone Knows Too Much"

sarahnaomi writes On Wednesday, prosecutors in the Silk Road trial began to lay out the wealth of evidence found on the laptop taken from accused kingpin Ross Ulbricht in a San Francisco library in October 2013. The evidence presented by prosecutor Timothy Howard was the most comprehensive and damning thus far, including more than a thousand pages of chats between the site's pseudonymous operator Dread Pirate Roberts and Silk Road administrators. Also entered into evidence was a journal that dates back to at least 2010 describing the creation and operation of the site. FBI computer scientist Thomas Kiernan, the second witness in the trial, testified about the day Ulbricht was arrested and the evidence gathered from his laptop.

Comments

What an idiot

[wiredlogic]

So not only could he not secure his black site, he couldn't even secure the files on his own laptop.

It makes you wonder how he ever got it running in the first place.

Re:What an idiot

[Anonymous Coward]

You eventually need to decrypt your own files so you can use them, so the trick is to catch the person when they're actually sitting at their machine using it so that they don't have time to slam the lid on the laptop. If they can do that they can plug in an external drive and copy everything, unencrypted. They got him when he was at the SF public library, agents probably swooped in and manhandled him before he could react.

Re:What an idiot

[Anonymous Coward]

On the other hand, a psychopath is marked by superhuman hubris, i.e. the assumption that everyone is stupid except them. This is often their downfall when it comes to criminal trial, because they are genuinely shocked that other people are smart enough to have figured them out.

Re:What an idiot

[grnbrg]

Apparently he was arrested (in public) at a library, and the techs who got the laptop knew what they were doing...

It was logged in, and they spend several hours copying data without letting it sleep or lock.

Full disk encryption is great, but assumes that you won't have unlocked it for the attacker.

Re:What an idiot

[Anonymous Coward]

There's actually some neat forensic gear out there designed for this kind of situation. It's basically a battery with a fast UPS style switchover mechanism and various bits for tapping into the power line connected to a computer. Basically they wire this thing in, pull the plug, and the battery keeps the machine running and unlocked while they cart it away/image it/etc. They've also got devices called "jigglers" that simulate mouse movement to keep the screen from locking.

Obviously this turns into a cat and mouse thought experiment with a variety of rube goldberg type countermeasures and counter-countermeasures, but against the average guy this kinda thing probably works quite well.

Re:What an idiot

[ganjadude]

why would you assume he is a psychopath?

Re:What an idiot

[CaptBubba]

Yeah they had two agents get into a fight right behind him and when he jumped up to see what was going on (just like anyone would do) another agent snatched the laptop and started the task of getting evidence off it and mirroring the drive's contents.

The FBI is often really fucking good at what they do.

Re:What an idiot

[h4ck7h3p14n37]

Full disk encryption is great, but assumes that you won't have unlocked it for the attacker.

That's why you also encrypt sensitive files separately. You only unlock the file when you're actually using it and then lock it back up when done.

Just use dd to create some space to use, create a filesystem on the file and then apply your preferred means of encryption. Encrypted USB sticks are another good solution.

Re:What an idiot

[Bill Hayden]

How about a dead-man's switch, like the ones worn when you drive a WaveRunner or SnowMobile? It might be a physical lanyard, or a more modern approach could be Bluetooth based. When the BT dongle/wristband/whatever that you are wearing gets more than the range of Bluetooth away from the laptop, it auto-locks.

Re:What an idiot

[KingMotley]

Sort of like windows-L?

Too bad he wasn't running windows. Linux is so insecure.

Re:What an idiot

[kylemonger]

The simplest strategy would have been to have already moved to a non-extradition country. He'd already racked up tens of millions of dollars in profits! What was he waiting for?

Re:What an idiot

[DrXym]

Perhaps that, in itself, is compelling evidence that he didn't.

"Your honour, the defence submits that the fact that an entire room of people saw the accused stab the victim and state he was glad he did it, proves conclusively that he didn't. There is so much compelling evidence against our client that it is actually evidence of his innocence. And with that the defence rests."

Doesn't exactly work.

Re:What an idiot

[DrXym]

The most likely diagnosis is the Dunning-Kruger effect. He thought himself smarter than he actually was. Add to that the fact he was running a market in illegal goods (drugs, weapons, hitmen etc.) which tends to make law enforcement throw lots of manpower at finding out who the perpetrator is and the determination to take them down.

Re:What an idiot

[Rinikusu]

And finally, once the FBI is there, knocking down your door (metaphorically speaking), you're pretty much fucked. The investigation that led them to you is probably more than enough to indict you and probably get the conviction, and refusing to turn over your keys once they already have you pinned down will be viewed as contempt of court and you'll sit in prison for a long damned time without a trial. This is why, from what I can tell, the defense is mainly focused on the procedure/evidence that led the FBI to him (poisoning the well) since if they can't give a good accounting for how they connected him to the SR, then all that evidence is for nothing if they used illegal techniques to get it.

Re:What an idiot

[DrXym]

Well obviously, but the smart perp would think of that situation. They would use encrypted drives. They would use shadow volumes. They would disable logging, or archive and encrypt them or routinely permanently erase them as a matter of habit. They would use virtual machines that didn't preserve state. They would route their activity through encrypted proxies in as many jurisdictions as humanly possible. They would situate their servers or computers with several locked doors between them and the outside. They'd have power switches within easy reach if the cops bust in. If they were super duper paranoid they'd even have the disks dangling above strong degaussing devices as a last resort. Preferably they'd be as far as way as possible from the United States when they did all this.

Re:What an idiot

[FlyHelicopters]

People DO all that, they are just not caught... We're hearing about this guy because he didn't and was caught.

Or do you think the FBI catches everyone?

Re:What an idiot

[Dan East]

A skilled hacker / engineer could create a system for under $40 that would circumvent this.

Use two microcontrollers (a raspberry pi would be overkill - I'd use a $10 STM32 Nucleo board), one hidden somewhere in your house that has a small coil around a power line which introduces a signal into the power wires, and another in the case of the PC that monitors the signal generated by the first microcontroller. As soon as the device inside the PC detected loss of the signal it could then shut the PC down. Or trip a relay connected to a servo that allows acid to flow into the HDD. It could also have light sensors (covering the largest spectrum possible) to detect the case opening, which would also trigger the destruct mechanism. It would be powered by 4 AA batteries when external power is removed. I would also add a trivial voltage divider circuit to an ADC line on the microcontroller to monitor battery power, and if it got down close to 5V it would destroy the device.

There are dozens of things you could do along those lines. Place a magnet in whatever the PC is setting on and then have a magnetometer sensor in the buttom of the case connected to the microcontroller. If the PC is moved then it destroys the media. Etc, etc.

Re:What an idiot

[Ralph Wiggam]

Prior to that, the FBI took control of a forum mod's account. They asked "dread" in chat to look into something on the site that required him to log in as an admin. When they grabbed his laptop, a window with him logged into the site admin account was open. That's pretty damning evidence even without the journal.

Re:What an idiot

[CaptainDork]

No.

Evidence is an attribute that that exists only after criteria are met. I can destroy my hard drive today and be charged with a crime tomorrow. When the authorities realize what I have done, there's nothing they can do. The hard drive only becomes evidence after probable cause has been established and a warrant has been issued and I am made aware that my hard drive is evidence.

There are exceptions, but not as relates to this matter.

... the court can instruct the jury to assume that the evidence that was destroyed showed exactly what the prosecution says it shows ...

You are an asshat and what pisses me off is that you know damn well that you are making a false statement.

So fuck you very much.

Re:What an idiot

[hoggoth]

Feds: "Grab him!"
Ross: "Beetlejuice!"
Librarian: "Shhhhhh!"
Feds "Cover his mouth quick!"
Ross: Beetlejuice!"
Feds drag Ross away with his mouth covered...

Fed1: "What was that about?"
Fed2: "It was some sort of codeword"
Fed1: "What do you mean?"
Fed2: "When he yelled Beetlejuice it activated a..."
Both: "Oh shit..."

Re:What an idiot

[citizenr]

https://www.youtube.com/watch?...

there are rfid rings/bracelets that do this already

Re:What an idiot

[JonathanR]

Knowing that there's an investigation is the key part; Viz. ...or influence the investigation or proper administration... If you pre-emtively design a self-destruct system, you've no knowledge of an investigation.

Re:What an idiot

[CaptainDork]

... knowingly ...

Those support my position.

Mental note:

[JWSmythe]

Mental note: When establishing a questionably legal site for definitely illegal transactions to be made through, don't keep any logs about it, nor your conversations regarding it.

Re:Mental note:

[slew]

Mental note: When establishing a questionably legal site for definitely illegal transactions to be made through, don't keep any logs about it, nor your conversations regarding it.

Observation: if you have a big enough ego to think you can create such a questionable site and get away with it, you have probably can't stop yourself from feeling invincible in whatever you do and dismiss any possibility that your logs will get compromised *ever*. Conversely, if have enough doubt about the eventual security of your logs in the event you might eventually get caught, you probably don't have the balls to go through with it in the first place...

Re:Mental note:

[H0p313ss]

Also "if you have a big enough ego to think you can create such a questionable site and get away with it" you're probably wrong.

Re:Mental note:

[tlhIngan]

Mental note: When establishing a questionably legal site for definitely illegal transactions to be made through, don't keep any logs about it, nor your conversations regarding it.

Problem is, without the logs, no one would believe you!.

And by that, I mean when you eventually come around to wanting to brag about your achievements - without evidence that you actually did it, no one would believe you, and everyone thinks you're just trying to satisfy some ego thing.

Yes, that's how a lot of people get caught - they got away with it, but then their bragging gives them away to authorities.

And yet, it's human nature to want to brag about the achievement. After all, what's the point of doing something "amazing" when you can't brag about it afterwards?

Re:Mental note:

[catmistake]

I think you're missing the point of /.ers coming up with possible solutions. These aren't criminal minds sharing how to do crime. They're compulsive puzzle solvers, and there is no puzzle greater than, no solution more elusive than defeating the well-run FBI investigation. Perhaps they really want to help the FBI be even more effective and irresistable. This pursuit is no different than penetration testing, nor the ability of the logical and clever to come up with solutions for problems in fields which they have absolutely no experience or insight. Let them look for that whistle in their box of cereal, and lets not attempt to disway from nor even verbally punish for hypothetical crime. On second thought, naw, I changed my mind. Stop thinking about that right now!

Re:Journal?

[Dutchmaan]

No, the very first lesson of Criminal 101 is always operate under the assumption that you will be caught.

Re:Journal?

[Marginal Coward]

Isn't it the first thing they teach you in Criminal 101: Don't keep a journal!

It just shows what happens when you take drugs: you end up losing interest in your education and dropping out, just before you get to the part of your Criminal 101 class that you really needed. Here's the transcript:

Dear Diary,

Criminal 101 class was really, really, boring today. I don't know how much longer I can take it. We learned about a bunch of junk about how not to leave fingerprints and how to wipe a hard drive. Duh - everybody knows that. When are we gonna learn something really useful?... I think I'll just drop out.

your friend,

Ross

Re:Encryption, motherfucker, do you speak it?

[grnbrg]

It was encrypted. And seized while he was logged in and active.

Initial analysis was done before the laptop was allowed to shut down.

The feds may be cavalier about laws, but it's a mistake to think they are stupid.

Re:Journal?

[DarkOx]

Yea, but know all the folks actually majoring in Crime, just copy their answers off the Criminology major in the front of the room who is just taking class as an elective. The Crime students never do the reading...

Missing the point.

[B5_geek]

While a lot of people are jumping on the "..it wasn't encrypted.." "..FBI grabbed it while he was logged in.."
You are missing the point.
Step 1) NEVER carry incriminating evidence with you. Encrypted or not.
2) use a VPN/SSH Tunnel/etc (and/or both) to connect to the server where your data is. (make sure that server is located in a non-extraditing country, and filtered from you by a few shell companies)
3) keep an absurdly low 'idle-timeout' on your ssh sessions
4) use a dead-mans switch on that servers encrypted data
(i.e. run command "I_am_not_in_jail_yet.sh" every 15minutes.) {be more vague then this*}
5) ALWAYS assume that your local system is compromised. (boot/run from a read-only media)
6) don't brag about it! If more then 1 person knows; then your secret is not safe.

Re:Missing the point.

[Celarent Darii]

Like in C, the winning sequence starts with a 0:

Step 0) Don't do any criminal activity.

That's it, there are no more steps (not even profit!). So much can be avoided by following step 0 first.

Re:Missing the point.

[Fwipp]

None.

That's rule number 1 of crimes - never ever commit a crime before breakfast. Without the clear head that comes from getting a healthy start to the day, you'll get caught for sure.

Having a journal was the smartest thing he did

[SuperKendall]

Isn't it the first thing they teach you in Criminal 101: Don't keep a journal!

Possibly, but in Criminal 504 (Profiting in the Long Term) they teach you KEEP a journal so you can write a fully revealing book later.

He may go to jail for a bit, but he can profit afterward - just hope he had the journal backed up somewhere they could not reach it.

Geeks in particular tend to forget this

[Sycraft-fu]

The FBI may not be all up to date on the latest technologies and they aren't great at dealing with things purely in the digital world. However they are one of, if not the best investigative organizations in the world. They have a lot of experience investigating crimes of all kinds, often committed by experienced criminal organizations that are quite clever.

So there's a good chance if they are interested in getting you, they will. They are quite literally professionals at it, and they institutionally learn from their experience. You very well may know a lot more about computers than they do, but they almost certainly know way more about criminal investigations than you do.

Re:Journal?

[Rashdot]

Dear Diary,

Today I learned that I'm not so bricht after all and changed my name accordingly.

your friend,

Ross Ul