Feds Investigating Silk Road Accused Of Stealing Bitcoin, Abusing Gov't Power, Issuing Fake Subpoenas

from the the-movie-plot-just-got-a-sequel dept

Many people have noted that the story of Ross Ulbricht, supposed darkmarket underlord of the original Silk Road marketplace, felt like a made-for-Hollywood movie script. It appears that script just got another real world sequel, as the government has charged two members of the federal investigative team with Bitcoin money laundering and wire fraud. It appears that the DEA's Carl Force and the Secret Service's Shaun Bridges became experts in Bitcoin, that they used the investigation as an opportunity to enrich themselves. While it probably won't have much of an impact on Ulbricht's eventual court results on appeal, it still is going to raise some more significant questions about some of the investigations (though, it appears that both Force and Bridges were part of the Maryland investigations team, which was separate from the NY one that was the first to bring Ulbricht down).

And, no, this wasn't just these guys stashing a few extra Bitcoins into personal accounts because of easy temptation. Force, in particular, seems to have gone out of his way to abuse his position in multiple ways. Force -- while still employed by the DEA -- apparently acted as the "Chief Compliance Officer" of the fairly well known Bitcoin exchange site Coinmkt, and used his position and power to abuse the system and steal money from customers. Here's from the criminal complaint:

Force used his official position as a DEA agent to illegally run criminal history checks on individuals for the benefit of a third-party digital currency exchange company, CoinMKT, in which Force had personally invested approximately $110,000 worth of bitcoin.

Force functioned as the de facto Chief Compliance Officer for CoinMKT all the while employed as a DEA agent, even allowing himself to be featured in CoinMKT's "pitch decks" to venture capital investors and allowing himself to be listed as CoinMKT's anti-money laundering and/or compliance officer in order to benefit CoinMKT (a company in which Force had invested).

Force improperly directed CoinMKT to freeze one of its individual customer's accounts containing a large amount of digital currency, worth approximately $297,000, even though he lacked a sufficient legal basis on which to do so, and Force then illegally seized those funds and transferred them into his personal account.

Force used his supervisor's signature stamp, without authorization, on an official U.S. Department of Justice subpoena and sent the subpoena to a payments company, Venmo, directing the company to unfreeze his own personal account, which had been previously frozen due to certain suspicious activity. Force then sought to conceal evidence of his improper use of an official subpoena by directing the company not to contact the DEA and attempting to destroy copies of the subpoena. When the company did not comply, Force asked another agent on the Baltimore Silk Road Task Force, an IRS agent, to collaborate with him on seizing that company's bank accounts.

This is someone abusing all sorts of power to steal a ton of money and then continuing to abuse that power to try to cover it all up. The full details of the affidavit throw up all sorts of red flags. Force communicated directly with Ulbricht using PGP encrypted emails, but didn't tell anyone else on the Silk Road task force about it -- nor share with anyone his PGP key and record what the emails said. That's what he would have done if the communications were for the investigation, not for his own personal gain:

I have conferred with other law enforcement agents who conduct online undercover operations and believe the failure to preserve the private PGP keys while simultaneously directing a target to use PGP to encrypt messages makes little sense in the context of a law enforcement investigation, particularly taking into account that this task force involved multiple law enforcement officers, all of whom might require access to the evidence Force gathered in his dealings with DPR. In the event Force were to lose the PGP private keys, or that something were to happen to Force, any evidence contained in the encrypted PGP format would effectively be lost and unusable without the private keys. Force's apparent failure to document the private PGP keys for his communications with DPR anywhere in his case file, or to provide them to others at the DEA or to the prosecutor, leads me to believe he did not want anyone other than himself (Force) to be able to decrypt certain of those communications, and that, as a result, he sought to deliberately undermine the integrity of the ongoing Baltimore Silk Road Task Force investigation.

From there, the affidavit details how Force stole Bitcoin, convincing Ulbricht to pay him for information, and then pretending that Ulbricht did not actually pay. The report also details evidence strongly suggesting that Force revealed to Ulbricht (in exchange for $100,000) that Mt. Gox's Mark Karpeles gave up his name to DHS officials. Amazingly, the first note sent in that thread involves the person signing off as "Carl" and then later pretending to be named "Carla Sophia" (nice one, Carl).

Now, remember all the hubbub in the Baltimore indictment of Ulbricht about how he had communicated with an undercover agent to murder an employee who Ulbricht believed had stolen some money? Some people noticed that all the details of that hit seemed to disappear from the actual trial of Ulbricht. Perhaps it's because the details of this complaint reveal that it was actually the Federal agents who stole the money in the first place -- and then got Ulbricht to give $100,000 to "kill" the employee... who the federal agents had already arrested (which is how they stole the money in the first place!). The twists and turns here are amazing. The employee goes by the initials C.G., and he was grabbed by the Maryland task force (where these two guys served), and gave up his login to his Silk Road identity, known as "Flush." Soon after that it appears that Flush robbed Silk Road, but it was actually people from the task force. From there we pick up the complaint:

January 25, 2013, C.G. debriefed with FORCE, BRIDGES, and other members of the Baltimore Silk Road Task Force. According to report of the interview, C.G. showed them how to log into Silk Road vendor accounts and reset passwords, how to change the status of a seller to a vendor, how to reset pins, and information about how the Silk Road administrative functions worked. BRIDGES' text messages indicate that he left the proffer session after one day, and a Silk Road Task Force member stated that BRIDGES told him that he left the latter part of the January 25, 2013, proffer.

On January 25, 2013, during the afternoon and into the night, the Silk Road website suffered a series of sizeable thefts. These thefts affected certain Silk Road vendors and overlapped with the time of the C.G. proffer session. The thefts were accomplished through a series of vendor password and pin resets, something that could be accomplished with the administrator access that C.G. had given to the Baltimore Silk Road Task Force.

On January 26, 2013, the proffer of C.G. continued. BRIDGES left early and did not participate on this day. At some point during that day, DPR communicated to Nob (FORCE) that Silk Road had suffered thefts and that those thefts were associated with C.G.'s account. Law enforcement questioned C.G. about this, and C.G. denied that he had committed the thefts. According to chats I have reviewed from the Silk Road servers and from Ulbricht's laptop (as well as communications between DPR and one of his employees at the time of the January 25, 2013 thefts) it appears that DPR and the employee believed C.G. was responsible for the thefts, because they managed to associate account, "Flush," with the theft. As a result of belief that C.G. was responsible for the thefts, DPR communicated with Nob (FORCE) -- whom he believed to be a major drug dealer with the ability to procure hit men and hired Nob to have his associates kill C.G. DPR also communicated with another individual and commissioned a hit on C.G. For the hit that Nob's associates were to perform, DPR paid Nob a total of approximately $80,000 through a bank wire transfer for the murder. FORCE and CG, together with assistance from others on the Baltimore Silk Road Task Force, then faked death to make it look as if Nob's associates had killed C.G. BRIDGES was to assist with perpetrating this supposed murder-for-hire by working on "proof of death" photographs of C.G. that Nob (FORCE) was to send to DPR.

Got that? It's a bit confusing, but really crazy. The feds collared this guy, C.G., who gave them his administrative login. From there, it appears that someone on the task force, likely Bridges, proceeded to slip out of the room and go rob Silk Road. In response to this, Ulbricht reasonably flipped out, blaming C.G., and just happened to reach out to another guy on the same task force, Carl Force, to help him kill C.G. So then Force, Bridges and C.G. staged the fake hit on C.G. while it was (allegedly, according to this complaint) Bridges who had swiped the Bitcoin. Holy crap.

Bridges appears to have also been fairly naive about this whole thing. Days after allegedly swiping all that Bitcoin from Ulbricht, Bridges asked Force to ask Ulbricht how to best exchange Bitcoin for cash. Because that's not suspicious at all. Soon after that, the complaint claims, Bridges set up a new company called Quantum International Investments LLC. A few months later, Quantum got $820,000 from a Mt. Gox account. Apparently, right after transferring that money out of Mt. Gox and into his personal Fidelity account, Bridges was a key player in the affidavit to seize Mt. Gox's bank accounts. What a shock that he got his money out "just in time."

The final wire from Mt. Gox to Quantum account was on May 7, 2013. Just two days later, BRIDGES served as the affiant on a seizure warrant for $2.1 million in Mt. Gox accounts. I know from my training and experience as a law enforcement officer that the process of putting together an affidavit in support of a warrant is time consuming and often takes several days, if not longer, to prepare. In serving as an affiant for Mt. Gox bank accounts a mere two days after he had personally received a wire from Mt. Gox (the latest in a series of wires), BRIDGES had a conflict of interest.

A conflict of interest? You don't say...

Even more ridiculous, after the FBI interviewed him over all of this, he apparently ran to his computer to transfer $250,000 out to another account, because that wouldn't look suspicious at all. Bridges also reached out directly to Coinbase, the very popular online Bitcoin site, who he was talking to for another investigation, and apparently quizzed them about whether or not the money from Mt. Gox could be traced. As the affidavit notes: "Coinbase found this odd, given that the stated purpose of BRIDGES' calls concerned an unrelated investigation." Oh and just a couple weeks ago, after being told he was being suspended and to leave his government laptops in the "evidence vault," Bridges decided to try something else:

On March 18, 2015, BRIDGES resigned after being told he was being suspended. USSS personnel advised BRIDGES to leave behind his two government-issued computers in the evidence vault. Although he properly tendered one computer where directed, he placed a second Apple brand laptop computer in a cabinet directly above an area that Baltimore personnel use as a "wipe" station. I do not believe BRIDGES would have any reason to store the laptop in this area, other than for it to be in close proximity to computers to be wiped, as personnel has advised this is not a storage area for laptops. Moreover, after BRIDGES was advised of his suspension, he asked his supervisor if he could access his Dell laptop computer to copy electronic receipts of personal items he had purchased from internet merchants. However, instead of copying receipts, BRIDGES began copying a folder entitled "Bitstamp." Upon noticing what BRIDGES was copying, his supervisor secured the laptop and did not allow BRIDGES further access.

I'm sure there are more details yet to come (and, as always, you're only hearing one side from a federal indictment, that may leave out some pertinent details). However, this does raise a lot of questions about who the Feds use in investigating cases that involve Bitcoin and how they find trustworthy participants.

Filed Under: bitcoins, carl force, dea, investigation, secret service, shaun bridges, silk road, stealing, wire fraud
Companies: silk road

Jury Wastes No Time In Finding Ross Ulbricht Guilty On All Counts

from the going-away-for-a-long-time dept

If you've been following the Ross Ulbricht trial, this won't come as much of a surprise, but Ulbricht has been found guilty of all the charges related to creating, running and using the Silk Road dark marketplace:

1. Distribution/Aiding and Abetting the Distribution of Narcotics
2. Distribution/Aiding and Abetting the Distribution of Narcotics by Means of the Internet
3. Conspiracy to Distribute Narcotics
4. Continuing Criminal Enterprise
5. Conspiracy to Commit or Aid and Abet Computer Hacking
6. Conspiracy to Traffic in Fraudulent Identity Documents
7. Conspiracy to Commit Money Laundering

Sentencing will be May 15th, but it seems likely that he'll be locked up for a fairly long time. There is likely to be some sort of appeal, and some have made a valid argument that the court very much limited Ulbricht's possible defenses. Also, as with the Kevin Bollaert revenge porn conviction earlier this week, there are concerns to be raised about how this kind of ruling could be used to pin liability on other websites for activities done by users of those websites. It seems likely that some of Ulbricht's direct activities violated the law, but it still appears that some of the charges conflate his own actions with users of his site -- and so it's a concern about what kind of precedent that sets for other cases involving less controversial websites and services.

Either way, this kind of result was almost a foregone conclusion. In a criminal case, the defense almost always wins if it gets to trial. Also, even for the more nuanced legal arguments -- or Ulbricht's attorney's chosen path of trying to toss out a bunch of alternate scenarios to sow "reasonable doubt" in the jury -- the simple nature of the fact that many people used Silk Road to buy and sell illegal drugs was always going to cloud the overall case against Ulbricht.

Filed Under: dark market, guilty, ross ulbricht, silk road
Companies: silk road

Ross Ulbricht's Lawyers Claim That Mt. Gox CEO Was The Real Dread Pirate Roberts

from the behind-this-curtain... dept

It's pretty rare that a trial has a real "surprise" unveiling or twist. It happens all the time in TV and movie courtrooms, but in real courtrooms... not so much. Most people know the basics. Someone may admit something surprising, or testimony can go awry, but the "big dramatic reveal" isn't so common. Yet in the trial of Ross Ulbricht, concerning whether he was or wasn't the "Dread Pirate Roberts" behind the Silk Road hidden market, things are already off to quite a start. We'd already mentioned his "some other dude did it" defense (while he admits that he did create the site, he argues he handed it over to someone else long before that). However, during yesterday's testimony Ulbricht's lawyer revealed who they believed the "other" Dread Pirate Roberts really was: Apparently they believe it was Bitcoin pariah and Mt. Gox CEO, Mark Karpeles.

If you don't follow the Bitcoin space, you might not recognize the name. However, in the Bitcoin space, Karpeles is widely despised. For a long time, Mt. Gox was the Bitcoin exchange for people who wanted to buy or sell Bitcoin. However it mysteriously shut down over a year ago under questionable circumstances -- with Karpeles arguing that Mt. Gox had all its Bitcoins stolen, while many people claimed that the evidence didn't suggest that at all, and that there may have been a lot of other fraud going on. In short, if you wanted to pick someone who is widely hated among Bitcoin supporters, Karpeles is the perfect "villain." And Ulbricht's lawyers make the case that the Homeland Security Investigator who infiltrated Silk Road and helped nab Ulbricht, Jared DerYeghiayan, originally suspected Karpeles:

"I have a wealth of evidence to prove that [Karpeles] is Dread Pirate Roberts," the agent wrote at the time.

Karpeles, who is from France, ran what was once the world's largest Bitcoin exchange, Mt. Gox, which was based in Tokyo. DerYeghiayan's theory was that Karpeles wanted to create a market that used Bitcoin in order to keep the price of the semi-anonymous cryptocurrency robust, which he believed was probable cause for Karpeles's arrest. (Mt. Gox went bankrupt in early 2014.)

"[Silk Road] would be a device for leveraging the value of Bitcoin, and if he could create a site independent of Bitcoin, you could control the value of Bitcoin," Dratel said, reading from DerYeghiayan's emails.

DerYeghiayan believed his evidence was so strong that he even drafted a search warrant for Karpeles's email in May of 2013.

Later, prosecutors objected to this effort, but the judge, Katherine Forrest, correctly pointed out that the idea was to "raise reasonable doubt that the defendant is the real DPR."

Karpeles, not surprisingly, is denying that he is DPR. According to Ars Technica:

"This is probably going to be disappointing for you, but I am not Dread Pirate Roberts," Karpeles told Ars via e-mail. "The investigation reached that conclusion already—this is why I am not the one sitting during the Silk Road trial, and I can only feel defense attorney Joshua Dratel trying everything he can to point the attention away from his client."

He also posted this to Twitter: During the trial, the prosecution did also reveal that other investigators, in Baltimore, had seized a site that was run by Karpeles. The Vice article doesn't name that site, but Sarah Jeong points out that it was SilkRoadMarket.org. In his denial to Ars Technica, Karpeles discusses that domain:

"I have nothing to do with Silk Road and do not condone what has been happening there," Karpeles continued. "I believe Bitcoin (and its underlying technology) is not meant to help people evade the law, but to improve everyone's way of life by offering never thought before possibilities. As for the silkroadmarket.org domain, it was registered by a KalyHost.com customer and paid in Bitcoins (KalyHost is a service of Tibanne that has been up since 2009)."

Tibanne was Karpeles' company that supposedly purchased Mt. Gox. However, his argument here seems a bit questionable, as the Feds have released the seizure warrant showing that Karepeles was directly involved. As another article on Ars Technica summarizes:

Homeland Security used a confidential informant, based in Maryland, to conduct the investigation. The informant simply created accounts with Dwolla and Mt. Gox, bought bitcoins, and then changed them back into dollars. Tracing that money, HSI was able to see that the money passed through a Wells Fargo account, number 7657841313, which was created by a single authorized signer: Mark Karpeles, the president and CEO of Mt. Gox. The Dwolla account shows transfers to Dwolla going back to at least December 2011, according to the warrant.

That account was registered to Mutum Sigillum LLC, which is the company that supposedly registered the silkroadmarket.org domain. And the reason Karpeles got in trouble: Mutum Sigillum, when it opened the account, denied that it was in the money services business, even though it clearly was. All of this is a bit of a mess. Either way, the point here isn't to necessarily prove that Karpeles absolutely was DPR, but rather to show reasonable doubt to get Ulbricht off the hook. While a fascinating turn of events all around, this still seems like an uphill battle for Ulbricht's lawyers.

Filed Under: dread pirate roberts, mark karpeles, reasonable doubt, ross ulbricht, silk road
Companies: kalyhost, mt. gox, mutum sigillum, silk road, tibanne

Ross Ulbricht's Defense In Silk Road Trial: Some Other Guy Did It, I'm Just The Fall Guy

from the good-luck-with-that dept

On Tuesday, the trial for Ross Ulbricht, the guy accused of being the "Dread Pirate Roberts" behind Silk Road (1.0) began, and apparently the defense's legal strategy is to claim some other guy was the real DPR, and Ulbricht was just the fall guy. According to Andy Greenberg:

In his opening statement in a Manhattan courtroom, defense attorney Joshua Dratel began with a surprising admission: that his client Ross Ulbricht was in fact the founder of the Silk Road.

But Dratel went on to explain that the site was meant merely to be a kind of “economic experiment” that Ulbricht only controlled for a brief time. The eventual adoptive owners of the Silk Road, Dratel claimed, would later trick Ulbricht into serving as the “fall guy” when they sensed an impending law enforcement crackdown.

“After a few months, he found it too stressful for him, and he handed it over to others,” Dratel told the jury, describing the Silk Road’s early days. “At the end, he was lured back by those operators to…take the fall for the people running the website.”

That's.... a different argument than has been suggested in the past. It also seems like it would require a bit more evidence. And that's going to be tough. The admission that he created the Silk Road apparently was necessary, as Ulbricht had apparently confessed that to an old friend whom the prosecutor plans on calling as a witness. However, Ulbricht's lawyer claims they may know who the real Dread Pirate Roberts is, but, again, this seems like it's a massive legal long shot. While I have many concerns about how Ulbricht was found out, and about whether or not merely operating an online marketplace should be illegal (leaving aside the question of whether and how Ulbricht participated in that market...), to argue that "some other guy did it" and then (conveniently) set Ulbricht up to be the fall guy... seems extremely far fetched. Greenberg's summary:

The new operators of the Silk Road “had been alerted the walls were closing in,” Dratel said. “That’s what compelled the Dread Pirate Roberts to put his escape plan into action,” framing Ulbricht, according to Dratel’s telling.

In Dratel’s version of events, Ulbricht’s store of bitcoins was simply the earnings from his early investments in the cryptocurrency, not the Silk Road profits the prosecutors allege. He points out that the bitcoins seized from Ulbricht are only a “small fraction” of the full $18 million the government has said the Dread Pirate Roberts earned in Silk Road commissions. And he implied that the evidence found on Ulbricht’s computer at the time of his arrest was falsified to “leave him holding the bag when the real operators of Silk Road knew their time was up.” He didn’t elaborate on how evidence could have been planted on Ulbricht’s PC.

“[The Dread Pirate Roberts] is someone who studiously avoided revealing his identity to anyone on the site…This same person goes to a public library and uses a public Wifi connection?” Dratel asked the jury. “That Ross is DPR is a contradiction so fundamental that it defies common sense.”

There's no doubt, if the US's argument is accurate, that Ulbricht was somewhat sloppy, but using that sloppiness as "proof" that he wasn't really DPR, while admitting he had founded Silk Road and when he was found logged into the admin... just seems unbelievable.

Filed Under: defense, dread pirate roberts, ross ulbricht, silk road

Guy Accused Of Operating Silk Road 2.0 Arrested In SF... Just Like The Last One

from the yes,-the-FBI-can-track-you-down dept

This morning, the FBI excitedly announced that they had arrested Blake Benthall as the alleged operator of Silk Road 2.0, the replacement to the original Silk Road, which went down when the feds arrested Ross Ulbricht 13 months ago. As with Ulbricht, Benthall is a young tech-savvy guy living in San Francisco. Assuming he was actually running Silk Road 2.0, you'd think he'd have figured out that staying in the US while doing so is a serious occupational hazard. You can read the full complaint, but it again looks like (just like Ulbricht) he was somewhat sloppy in covering his own tracks. It didn't help that he apparently allowed an undercover FBI agent to become pretty high up as a "support" staffer, giving him access to insider forums.

The complaint (as with Ulbricht's) is an interesting read, though it will be interesting to see what other information comes out of the next few months. It's not clear how the FBI found the server (in a foreign country) and had it imaged. That raised some questions in Ulbricht's case, and will likely do the same here. Benthall bounced around a variety of jobs, including for RPX (a patent aggregator that has tried to position itself as the "not evil" version of Intellectual Ventures) and SpaceX. In fact, it appears that when Benthall took over Silk Road 2.0 from its original creator, he was employed by SpaceX at that time. The criminal complaint also notes that at some point he bought a Tesla with bitcoins, though he appears to have done so about a month after someone else made news for doing the same.

As for the actual charges, the specifics here matter. It still seems like a bit of a reach that merely running a marketplace online should make you liable for people doing illegal stuff in that marketplace, but things like Section 230 don't protect criminal activity. The complaint also has money laundering and CFAA hacking charges in there as well, though the details are still all a bit murky.

It appears that this takedown is part of a larger global effort to take down a bunch of "darknet" drug operators and websites, with Silk Road 2.0 just being the shiny one that many in the public had already heard about.

While it's reasonable to argue that this is criminal activity and should be taken down, others have suggested that by merely taking down online darkmarkets like Silk Road and Silk Road 2.0, the government is actually making the world more dangerous. Indeed, a study released a few months ago argued that Silk Road greatly reduced violence in the drug trade market. One could argue that keeping the drug market violent reduces incentives for people to get involved in it, but there is also the collateral damage that a violent drug market creates on third parties and innocent bystanders.

Either way, I doubt that this will stop Silk Road 3.0 (or something similar) from springing up before too long. And whether or not the FBI gets whoever runs that, this will be a continuous cat and mouse game, and I imagine that future darkmarkets will get more and more secure.

Filed Under: blake benthall, dark market, doj, fbi, ross ulbricht, silk road, silk road 2.0
Companies: rpx, silk road, silk road 2.0, spacex

Silk Road Judge Won't Examine FBI's Warrantless Server Hacking; Dismisses Suppression Motion On 'Privacy Interest' Technicality

from the there-are-two-ways-you-can-read-the-phrase-'criminal-investigation' dept

Judge Katherine Forrest has shot down Ross Ulbricht's defense team's motion to suppress evidence it claims was acquired illegally by the FBI. The FBI asserted in its response to the motion that Ulbricht had expressed no privacy interest in the alleged Silk Road servers located in Iceland. The FBI further claimed that it needed no legal permission (i.e., a warrant) to hack foreign servers during criminal investigations.

Those hoping to hear an argument on the legal merits of the FBI's claims will just have to keep hoping. As was noted earlier, the DOJ's response put Ulbricht in an unenviable position: either claim the disputed servers as your own or kiss any hopes of suppressing evidence under Fourth Amendment claims goodbye. From Judge Forrest's ruling [pdf link]:

Defendant has, however, brought what he must certainly understand is a fatally deficient motion to suppress. He has failed to take the one step he needed to take to allow the Court to consider his substantive claims regarding the investigation: he has failed to submit anything establishing that he has a personal privacy interest in the Icelandic server or any of the other items imaged and/or searched and/or seized. Without this, he is in no different position than any third party would be vis-a-vis those items, and vis-a-vis the investigation that led U.S. law enforcement officers to Iceland in the first place.

To make this claim and secure the attendant privacy protections (or at least attempt to), Ulbricht would have needed to demonstrate to the court his interest in the Icelandic servers. Doing so would possibly result in him incriminating himself, which would rub up against the Fifth Amendment. Unfortunately, in all the paperwork filed disputing the FBI's evidence and its questionable origins, the possible Fifth Amendment concerns were never raised. Judge Forrest points out one possible remedy, albeit one that seems to have passed its expiration date.

[D]efendant could have established such a personal privacy interest by submitting a sworn statement that could not be offered against him at trial as evidence of his guilt (though it could be used to impeach him should he take the witness stand). Yet he has chosen not to do so.

In short, despite defendant's assertions and the potential issues he and his counsel raise regarding the investigation that led to the Icelandic server, he has not provided the Court with the minimal legal basis necessary to pursue these assertions. Thus, the declaration submitted by Joshua J. Horowitz, Esq. (ECF No. 70) along with all the arguments regarding the investigation and the warrants based on it are not properly before this Court.

Further down in the ruling, Judge Forrest notes that the court will not be spending any more time trying to discern whether the FBI's hacking of the alleged Silk Road servers falls within the bounds of legality. Again, this decision traces directly back to Ulbricht's privacy interests in the servers themselves.

Here, the Court does not know whether Ulbricht made a tactical choice because he is-as they say-between a rock and a hard place, or because he truly has no personal privacy interest in the servers at issue. It is clear, however, that this Court may not proceed with a Fourth Amendment analysis in the absence of the requisite interest. If a third party leased a server on which the Government unlawfully intruded in the investigation that led to the Icelandic server, under Katz, Rakas, Payner, and a host of other case law, that is no basis for an assertion by Ulbricht that his Fourth Amendment rights were violated. Thus, whatever methods used-lawful or unlawful-are beyond this Court's purview.

So, whatever the methods were -- whether it was parallel construction used to cover up NSA involvement or the FBI declaring itself above the law when operating outside the US -- the government is free to use them again and again until faced with a better legal challenge.

Filed Under: 4th amendment, doj, privacy, ross ulbricht, silk road, standing
Companies: silk road

DOJ In Silk Road Case: The FBI Doesn't Need Warrants To Hack Foreign Servers

from the prosecuting-domestically-but-kicking-down-doors-all-over-the-world dept

The government has filed another document in response to discovery requests in the Ross Ulbricht/Silk Road case. Again, it argues that there's no Fourth Amendment concerns here, so Ulbricht's legal team isn't entitled to receive any more information about how the FBI accessed the servers central to the government's case.

Assistant US Attorney Serrin Turner, speaking for the DOJ, basically states that intelligence agencies can hack into foreign servers without obtaining a warrant. If Ulbricht can't successfully argue that his rights were violated, then he can't argue for the suppression of evidence, no matter how it was actually obtained.

The government's arguments [pdf link] put Ulbricht in an uncomfortable position -- explain why he has an interest in these servers or stop challenging the government's submitted evidence.

[T]he burden is on Ulbricht to allege facts that, if proven, would establish a violation of his Fourth Amendment rights. The Horowitz Declaration manifestly fails to satisfy that burden. As a threshold matter, the declaration does not establish that Ulbricht had a reasonable expectation of privacy in the SR Server, as required for him to have standing to move for its suppression in the first place. Indeed, a declaration from a member of Ulbricht’s legal team such as Mr. Horowitz would be insufficient for this purpose anyway. To establish standing, a defendant must submit an “‘affidavit from someone with personal knowledge demonstrating sufficient facts to show that he had a legally cognizable privacy interest in the searched premises at the time of the search...’”

Ulbricht’s counsel would not have any personal knowledge of Ulbricht’s privacy interest in the SR Server; presumably, only Ulbricht would. Ulbricht’s assertion that he is not required to submit such an affidavit and that the issue of standing “must . . . be resolved through an evidentiary hearing,” (Reply Br. 18), is flatly wrong. Again, to merit a hearing, a defendant must first allege facts that, if proven at a hearing, would establish a violation of his personal Fourth Amendment rights – including facts sufficient to show the defendant had a protected privacy interest in the property searched. Without competently asserting such an interest, a defendant has no standing to bring a suppression motion at all, let alone demand a hearing on the motion.

Basically: admit the servers are yours and we can start discussing your Fourth Amendment rights. This is the DOJ asking Ulbricht to do its work for it. These servers are only allegedly Ulbricht's at this point.

Then the DOJ's lawyer moves on to say, "Actually, we don't really care what you do or don't assert. You have no Fourth Amendment rights to anything kept in that location."

Even if Ulbricht were to demonstrate that he has standing, which he plainly has failed to do, the Horowitz Declaration still would not warrant a hearing because it fails to allege facts that, if proven, would establish a violation of Ulbricht’s Fourth Amendment rights. The Horowitz Declaration nowhere alleges that the SR Server was either located or searched in a manner that violated the Fourth Amendment. It merely critiques certain aspects of the Tarbell Declaration concerning how the SR Server was located. The Horowitz Declaration fails to allege any alternative explanation of how the SR Server was located that, if proven, would establish that Ulbricht’s Fourth Amendment rights were somehow violated.

Turner dismisses claims that the NSA was involved or that illegal wiretaps were used, simply stating that the government would have turned over the applicable evidence if these accusations were true. (Which is highly doubtful -- especially in the NSA's case -- but theoretically true.) But then he goes on to say that even if hacking were involved, it simply doesn't matter.

In any event, even if the FBI had somehow “hacked” into the SR Server in order to identify its IP address, such an investigative measure would not have run afoul of the Fourth Amendment. Because the SR Server was located outside the United States, the Fourth Amendment would not have required a warrant to search the server, whether for its IP address or otherwise.

There's the message the DOJ is sending, at least in this case: if anything of yours resides in a foreign country, all protections are waived. All the government needs is to prove is that its search was "reasonable" and prompted by "legitimate governmental interests" -- not exactly the high bar the DOJ presents it as. Nothing is off-limits anywhere outside of this country. If the NSA hasn't already hoovered it up, the FBI's coming through the back door -- not exactly heartening news for citizens whose everyday lives heavily with extraterritorial entities like Internet services and cloud storage.

Filed Under: 4th amendment, cfaa, doj, fbi, foreign servers, hacking, ross ulbricht, silk road
Companies: silk road

Documents Released In Silk Road Case Add More Evidence To The 'Parallel Construction' Theory

from the it's-not-HOW-we-got-it,-it's-what-we-HAVE dept

Ever since the government first declared it had located the Silk Road server linked to Dread Pirate Roberts (allegedly Ross Ulbricht) thanks to a leaky CAPTCHA, there have been questions about the plausibility of this explanation. Ulbricht's attorneys suggested it wasn't the FBI, but rather the NSA, who tracked the alleged Silk Road mastermind down. This suggested parallel construction, something federal agencies have done previously to obscure the origin of evidence and something the FBI actively encourages local law enforcement agencies to do when deploying cell tower spoofers.

Technical documents filed in response to discovery requests seem to solidify the parallel construction theory. Brian Krebs at Krebs on Security and Robert Graham at Errata Security have both examined the government's filings (the Tarbell Declaration [pdf]) and noted that what the government said it did doesn't match what's actually on display.

Krebs' article quotes Nicholas Weaver, a researcher at the International Computer Science Institute at Berkeley, who points out that where the FBI agents say they found the leak doesn't mesh with the server code and architecture.

“The IP address listed in that file — 62.75.246.20 — was the front-end server for the Silk Road,” Weaver said. “Apparently, Ulbricht had this split architecture, where the initial communication through Tor went to the front-end server, which in turn just did a normal fetch to the back-end server. It’s not clear why he set it up this way, but the document the government released in 70-6.pdf shows the rules for serving the Silk Road Web pages, and those rules are that all content – including the login CAPTCHA – gets served to the front end server but to nobody else. This suggests that the Web service specifically refuses all connections except from the local host and the front-end Web server.”

Translation: Those rules mean that the Silk Road server would deny any request from the Internet that wasn’t coming from the front-end server, and that includes the CAPTCHA.

Weaver says that FBI agents would have been served nothing at all when attempting to access the server without using Tor. The server simply wasn't leaking into the open web. The more likely explanation is that the FBI contacted the IP directly and accessed a PHPMyAdmin page.

Robert Graham's analysis of the documents notes something slightly different than Weaver, but still arrives at the same conclusion.

Brian Krebs quotes Nicholas Weaver as claiming "This suggests that the Web service specifically refuses all connections except from the local host and the front-end Web server". This is wrong, the web server accept all TCP connections, though it may give a "403 forbidden" as the result.

Even with this detail being off, the parallel construction theory still fits. Graham notes that the Tarbell Declaration (the filing that contains the official explanation of how the Silk Road server was accessed) is noticeably light on supporting documentation -- like screenshots, packet logs or code snippets.

Now that the government has been forced to hand over more technical documentation, it's original story is falling apart.

Since the defense could not find in the logfiles where Tarbell had access the system, the prosecutors helped them out by pointing to entries that looked like the following:

199.170.71.133 - - [11/Jun/2013:16:58:36 +0000] "GET / HTTP/1.1" 200 2616 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/27.0.1453.110 Safari/537.36"

199.170.71.133 - - [11/Jun/2013:16:58:36 +0000] "GET
/phpmyadmin.css.phpserver=1&lang=en&collation_connection=utf8_general_ci&token=451ca1a827cda1c8e80d0c0876e29ecc&js_frame
=right&nocache=3988383895 HTTP/1.1" 200 41724 "http://193.107.86.49/" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/27.0.1453.110 Safari/537.36"

However, these entries are wrong. First, they are for the phpmyadmin pages and not the Silk Road login pages, so they are clearly not the pages described in the Tarbell declaration. Second, they return "200 ok" as the error code instead of a "401 unauthorized" login error as one would expect from the configuration. This means either the FBI knew the password, or the configuration has changed in the meantime, or something else is wrong with the evidence provided by the prosecutors.

The NSA as the purposefully-missing link makes sense. First off, Ulbricht's back end server was located in Iceland. Graham points out basic authentication was provided by this server via Port 80. If the NSA was monitoring traffic in and out of Iceland (as it is legally able to do), it could easily have captured a password for this server.

Furthermore, the front end server (located in Germany -- also within the NSA's established dragnet) would return "forbidden" errors when accessed outside of Tor, but would not when accessing PHP files (as Weaver noted). To get to the admin page, other possibly non-NSA-related tactics could have been used. (Graham suggests a couple of different methods well within the FBI's technical grasp and abilities -- "scanning the entire Internet for SSL servers, then searching for the string "Silkroad" in the resulting webpage" or doing the same but correlating the results with traffic traveling across the Tor onion connection.) However, none of the above is suggested by Tarbell's recounting of the events. In fact, the official narrative is vague enough that almost any explanation could fit.

Tarbell doesn't even deny it was parallel construction. A scenario of an NSA agent showing up at the FBI offices and opening a browser to the IP address fits within his description of events.

Graham calls the declaration from Special Agent Tarbell "gibberish" (and points out that Ulbricht's opsec "sucks"). Ulbricht's legal team is still pushing for the government to explain why its declaration doesn't match the details it's handed over during discovery. A new filing by his attorney, Joshua Horowitz, isn't much kinder, calling the declaration "implausible." [pdf link] The presiding judge has given the government until the end of Monday to respond to Horowitz's filing… if it wants to. [pdf link]

Defendant has submitted a declaration from Joshua Horowitz in support of his motion and request for an evidentiary hearing.

If the Government has any response to the factual statements (and/or relevance of the factual statements) asserted therein, it should file such response by C.O.B., October 6, 2014 (if possible).

The government may not feel compelled to respond. A filing from earlier in September (but added to the docket on Oct. 1st) suggests it's pretty much done discussing Ulbricht's "NSA boogeyman." [pdf link]

In light of these basic legal principles, the Government objects to the September 17 Requests as a general matter on the ground that no adequate explanation has been provided as to how the requested items are material to the defense. Most of the requests appear to concern how the Government was able to locate and search the SR Server. Yet the Government has already explained why, for a number of reasons, there is no basis to suppress the contents of the SR Server:

(1) Ulbricht has not claimed any possessory or property interest in the SR Server as required to establish standing for any motion to suppress;
(2) the SR Server was searched by foreign law enforcement authorities to whom the Fourth Amendment does not apply in the first instance;
(3) even if the Fourth Amendment were applicable, its warrant requirement would not apply given that the SR Server was located overseas; and
(4) the search was reasonable, given that the FBI had reason to believe that the SR Server hosted the Silk Road website and, moreover, Ulbricht lacked any expectation of privacy in the SR Server under the terms of service pursuant to which he leased the server.

Particularly given these circumstances, it is the defendant’s burden to explain how the contents of the SR Server were supposedly obtained in violation of the defendant’s Fourth Amendment rights and how the defendant’s discovery requests are likely to vindicate that claim. The defense has failed to do so, and the Government is unaware of any evidence – including any information responsive to the defense’s discovery requests – that would support any viable Fourth Amendment challenge. Instead, the defense’s discovery requests continue to be based on mere conjecture, which is neither a proper basis for discovery nor a proper basis for a suppression hearing.

The response document notes that it has already responded with several documents, won't be responding to a host of other requests, but most tellingly, says the government is "not aware" of any supporting documentation for Agent Tarbell's declaration. (As noted by Robert Graham, the declaration as written is "impossible to reconstruct," with the lack of technical details being a large part of that.)

5. The name of the software that was used to capture packet data sent to the FBI from the Silk Road servers.

Other than Attachment 1, the Government is not aware of any contemporaneous records of the actions described in paragraphs 7 and 8 of the Tarbell declaration. (Please note that Attachment 1 is marked “Confidential” and is subject to the protective order entered in this matter.)

6. A list of the “miscellaneous entries” entered into the username, password, and CAPTCHA fields on the Silk Road login page, referenced in the SA Tarbell’s Declaration, at ¶ 7.

See response to request #5.

7. Any logs of the activities performed by SA Tarbell and/or CY-2, referenced in ¶ 7 of SA Tarbell’s Declaration.

See response to request #5.

8. Logs of any server error messages produced by the “miscellaneous entries”referenced in SA Tarbell’s Declaration.

See response to request #5.

9. Any and all valid login credentials used to enter the Silk Road site.

See response to request #5.

10. Any and all invalid username, password, and/or CAPTCHA entries entered on the Silk Road log in page.

See response to request #5.

11. Any packet logs recorded during the course of the Silk Road investigation, including but not limited to packet logs showing packet headers which contain the IP address of the leaked Silk Road Server IP address [193.107.86.49].

See response to request #5.

Parallel construction matters, but the government claims it doesn't. It will probably continue to declare it a non-issue so long as the courts agree that Ulbricht's Fourth Amendment rights weren't violated. Ulbright's Fourth Amendment defense is admittedly a disaster, making claims that have nearly no chance of holding up under judicial scrutiny. The Silk Road indictment is a lousy test case for challenging parallel construction.

But parallel construction spills over into purely domestic investigations where Fourth Amendment rights are supposedly guaranteed. As long as the "expectation of privacy" isn't violated -- according to the government's definition of what does and doesn't enjoy this "expectation" -- the origin of the evidence isn't really up for discussion, according to the government's own filing. And what the government says here is that what was ultimately obtained matters more than how it was obtained. Parallel construction covers up invasive surveillance and investigative tactics, providing courts with evidence that looks clean but was illicitly gathered.

Filed Under: captcha, christopher tarbell, doj, fbi, investigation, parallel construction, ross ulbricht, silk road
Companies: silk road

Judge Not Impressed By Ross Ulbricht's 'But Bitcoin Isn't Money' Defense

from the wanna-try-that-again dept

Ross "Dread Pirate Roberts" Ulbricht's attorneys had recently seized on some debate within the US government over whether or not Bitcoin was actually money to try to sneak through a loophole to get out of the money laundering charges against him. As you may recall, the IRS recently declared that virtual currency was more akin to equity/property than money. And Ulbricht's lawyers hoped that distinction might help. It did not. The judge clearly wasn't buying it:

[T]he defendant alleges that he cannot have engaged in money laundering because all transactions occurred through the use of Bitcoin and thus there was therefore no legally cognizable "financial transaction." The Court disagrees. Bitcoins carry value - that is their purpose and function - and act as a medium of exchange. Bitcoins may be exchanged for legal tender, be it U.S. dollars, Euros, or some other currency. Accordingly, this argument fails.

Later in the ruling, the judge goes even further:

In fact, neither the IRS nor FinCEN purport to amend the money laundering statute (nor could they). In any event, neither the IRS nor FinCEN has addressed the question of whether a "financial transaction" can occur with Bitcoins. This Court refers back to the money laundering statute itself and case law interpreting the statute.

It is clear from a plain reading of the statute that "financial transaction" is broadly defined.... It captures all movements of "funds" by any means, or monetary instruments. "Funds" is not defined in the statute and is therefore given its ordinary meaning.

While this was the headline argument, many of the other arguments that Ulbricht's lawyers made were more important -- focusing on the nature of Ulbricht merely setting up the marketplace, and not being liable for how it's used. Judge Katherine Forrest is, once again, not impressed. It's worth pointing out here, that Section 230 liability protections do not apply to criminal behavior, so that particular out wasn't ever really on the table. But the general concept of intermediary liability is clearly tied up in this case. In particular, here, Ulbricht argued that there was no "conspiracy" since he wasn't "conspiring" with users of Silk Road, just setting up the marketplace. The court notes that Ulbricht appeared to be much more involved than just merely running an open market:

Ulbricht argues that his conduct was merely as a facilitator - just like eBay, Amazon, or similar websites.6 Even were the Court to accept this characterization of the Indictment, there is no legal prohibition against such criminal conspiracy charges provided that the defendant possesses (as the Indictment alleges here) the requisite intent to join with others in unlawful activity.

Moreover, in this case, the charges in the Indictment go further than Ulbricht acknowledges. The Indictment alleges that Ulbricht engaged in conduct that makes Silk Road different from other websites that provide a platform for individual buyers and sellers to connect and engage in transactions: Silk Road was specifically and intentionally designed for the purpose of facilitating unlawful transactions. The Indictment does not allege that Ulbricht is criminally liable simply because he is alleged to have launched a website that was - unknown to and unplanned by him - used for illicit transactions. If that were ultimately the case, he would lack the mens rea for criminal liability. Rather, Ulbricht is alleged to have knowingly and intentionally constructed and operated an expansive black market for selling and purchasing narcotics and malicious software and for laundering money. This separates Ulbricht's alleged conduct from the mass of others whose websites may - without their planning or expectation - be used for unlawful purposes.

In other words, it's one thing to set up a marketplace. It's another thing to set up a marketplace with the specific intent of using that marketplace to enable criminal behavior. I'm still a little troubled by the possible implications of this -- and even how it might be read back towards cases like the ridiculous lawsuit against Tor we were just discussing. Overall, though, it seems clear that the court isn't going to let Ulbricht off easy. There appears to be some level of guilt-by-association in this latest ruling, some of which may lead to interesting legal challenges down the road, but it's pretty clear that Ulbricht has a long legal road in front of him -- meaning that it's actually likely he'll work out some sort of plea deal rather than continue to fight.

Filed Under: bitcoins, conspiracy, dread pirate roberts, money laundering, ross ulbricht, secondary liability, silk road
Companies: silk road

US Marshals Have A Classic CC/BCC Error And Reveal Bidders For Silk Road's Bitcoins

from the protecting-your-privacy dept

Oh those wacky US Marshals. As you may have heard, they recently began to auction off the Bitcoins seized when Silk Road was shut down (though, some may argue it's a little early given that the trial over the site hasn't happened yet). However, the US Marshals then pulled off one of the oldest email errors around, including the list of possible bidders in the "cc:" field instead of the "bcc:" field. This is like a 1990s-era mistake. The Marshal Service has apologized, noting that the email was just sent to people who had emailed in questions about the auction (so, not necessarily bidders), but it still seems like a pretty big faux pas.

Filed Under: auction, bitcoin, bitcoins, email, privacy, silk road, us marshals