Hacker Who Sent Me Heroin Faces Charges in U.S | Hacker News Reader

Hacker Who Sent Me Heroin Faces Charges in U.S

krebsonsecurity.com

124 pointsyitchelle87 comments

One thing I'm curious about with stuff like this is how some of the information gets given to the authorities and how it's allowed to be used in court. I imagine I can't just walk into my local police station, file a report, and go "so I have this illegal copy of a database that let me illegally access someones email account that contained illegally acquired information ...". Wouldn't that be inadmissible in court even if the police did accept it and act upon it? And doesn't it expose me to potential legal problems as well?

This is a common misconception. The fourth amendment only limits the actions of the state, and case law establishes how evidence is excluded from trials. So, if I break into my neighbor's house and find child porn on his computer, that evidence is admissible in court. But if the police break into my neighbor's house without a warrant and search his computer, it isn't admissible, because it's a fourth amendment violation. But if they have a warrant to search the computer, it is admissible. If the judge who issued the warrant made a mistake and shouldn't have issued the warrant, the evidence is still admissible. This last situation also surprises people.

That makes surprisingly good sense. The more you know. :) Thanks.

Surprising that a judge doesn't make a mistake all the freaking time. The legal system is a religion, it has little basis in reason.

The judge does make mistakes all the freaking time. But in practice the system is so stacked against the defendant that this effect is negligible.

Think in terms of branches of government. The executive branch investigates crimes, and the judicial adjudicates them. The exclusionary rule is designed to punish the executive branch for abusing the Fourth Amendment. But if it's the judge that's mistaken, it's the judicial, not the executive, at fault, and the incentive behind the exclusionary principle ceases to exist.

(If it helps: the US's exclusionary rule is significantly stronger and more consistent than those of European countries, particularly the UK.)

Indeed, the problem here is too much reason (not applying the exclusionary rule when the incentives it seeks to create do not apply), and not enough religion (always applying the exclusionary rule to benefit the accused when the government makes a mistake).

Doesn't the fact that a judge's career depends on promotion by the executive branch create such an incentive?

It's more complicated than that... in order for the judge to abuse the system this way, the police would have to be acting in good faith, but still bring a groundless request to the judge, who would have to figure out that the warrant was groundless but decide to issue it anyway. That's a pretty unlikely scenario.

Here's a comic about the 4th amendment: http://lawcomic.net/guide/?p=1604

Why should there be no penalty to the judicial branch for abusing the fourth amendment?

Again, in Europe, it's considered a little weird that we have an exclusionary rule that applies to any branch of government.

But the reason is: judges aren't abusing the Fourth Amendment; they're the arbiters of it.

Only the Supreme Court can claim that; lower judges are overruled all the time (in some sense).

Makes sense that it's admissible in that case.

Would you still be able to be held legally responsible for breaking the law to get the information though? In that case, the evidence would be admissible but wouldn't you be in trouble for breaking into your neighbor's house?

Yes, you are correct.

People have been arrested when burglars stole their computer and claimed to have found "child porn" on it.

http://www.cnn.com/2011/10/06/us/california-robbery-porn-bus...

4th amendment or not, you'd think that the "rules of evidence" and the word of a burglar would lend credence to the explanation that the burglar planted it to make himself seem more respectable in the eyes of the court.

It's outrageous in this case, as reported by CNN, that the burglars were not arrested. It means you can commit any crime as long as you plant some illegal porn!

As soon as the burglars figure this out, we're all screwed!

Seems quite the loophole. So a law enforcement agency could, in theory, be able to hire private contractors that then obtain admissible evidence that would otherwise be inadmissible if the LEA did it themselves? Do I understand this correctly?

They can't employ them to do illegal things. They'd have to have some sort of plausible deniability. If they did, the private contractor would be acting as an agent of the government. If they circumvented this by creating some cover story and payments from some other sources, then they might get it into courts, but if it came to light it'd be thrown out (and the agents/agency involved would likely end up in some degree of trouble).

No, if someone is acting as an 'agent' of law enforcement, the evidence would be excluded via the exclusionary rule just the same as if the evidence was collected directly by the police themselves.

The only limitation is the government can't be responsible for gathering the information. AKA if a private eye breaks the law it's only an issue if they where directly or indirectly paid for by the government.

Which makes sense, because the sole purpose of the exclusionary rule is to punish the state for actively cheating the Fourth Amendment.

Also "Not long after that, I secretly gained access to his forum" seems like a CFAA violation. Though law enforcement may not care to prosecute, I don't see how it's different from "I secretly gained access to an internal AT&T forum" which would likely see an average citizen facing years in prison.

'(“cc” is a reference to credit cards)' - CC (and MUXACC1) is not a reference to credit cards, it's a reference to the Tsetse Fly https://en.wikipedia.org/wiki/Tsetse_fly which spreads Sleeping Sickness - https://en.wikipedia.org/wiki/African_trypanosomiasis - for whatever reason it's part of the Russian folklore used as a metaphor for something particularly nasty.

Edit: (thanks rnovak!) apparently "cc" in thecc[dot]bz _is_ credit cards, though the CC in MUXACC1 is definitely a reference to Tsetse.

Uh, he's referring to thecc[dot]bz which is a carding forum, which literally refers to credit cards (and is extremely common[1][2]). That excerpt is also nowhere near the MUXACC1 reference.

[1] http://www.acronymfinder.com/Credit-Card-(CC).html

[2] https://books.google.com/books?id=lGC2AgAAQBAJ&pg=PT48&lpg=P...

  Payment information contained in those emails — including 
  shipping and other account information — put the happy 
  couple and their young son in Naples, Italy.

I am not at all surprised they found him in Naples. That city is a festering breeding ground for scammers, fraudsters, mafiosi, Camorra, and every kind and type of unscrupulous person. I have never hated a city I've visited so much as Naples.

But they make great pizza there...

Not really.

I agree with you there -- and the Naples Underground (old cisterns that became bomb shelters) are neat, and Pompeii is an hour away. Those, however, are the sole 3 reasons for going. I tell my friends who visit Italy that if they pass through Naples, you go to Da Michele and get 2 pizzas, check out the underground, take a daytrip to Pompeii, and then get the away from Naples asap.

What about the Museo Nazionale Romano? The Museo di Capodimonte? Castel nuovo? Gothic and Baroque churches? Art nouveau architecture? Ischia and Procida?

You clearly haven't spent nearly enough time exploring, probably because of your preconceptions.

I forgot the Museo Nazionale. There are a lot of interesting things in Naples, but many of those things can be seen in other cities. My dislike of Naples is not a preconception, it is a conception borne from experiences I had in the city.

But thank you for the ad hominem that I "clearly haven't spent nearly enough time exploring".

How is that ad hominem? I don't know anything about your nationality, background or anything else. If I said you clearly hate Naples because you're from Milan that would be ad hominem, but I've reached this conclusion from your words only.

they invented pizza there...

I was born in the US...Not to stereotype a whole city or region...but my parents grew up near Naples. A lot of their world view (and that of their napolitani immigrant friends) seems governed by a philosophy of "the world is out to scam you. Be very careful about the people you put your tust in"

Ive always found it difficult to reconcile the general optimism of American culture with their ever present wariness.

Season world traveler, and the only place I have been scammed was Naples. The waiter pulled the "show you the receipt then take it away."

I think I was out an extra 40 euro before I realized what happened.

Edit to explain the scam:

The waiter brings you the bill, and the price looks "reasonable" at first (maybe because humans are bad at money estimation). The waiter takes the bill away before you can inspect each charge and inquire. You pay and leave before realizing you were overcharged, and only as an afterthought do you realize.

What is the "show you the receipt" scam?

How does that work exactly?

Is the scam that they've added extra charges to the bill, and therefore don't want to give you time to read it?

I recently read the extraordinary Naples 44, the diary of a British intelligence officer assigned to the place after its capture by the Allies. He talks about all of those things and more, including the theft of food from the army on a massive scale. Counterintuitively he loved the place.

Well is it really surprising that people were stealing food from the US army during WWII? I would have done it if I had trouble supporting my family.

Yeah, it's a bit dangerous, but it's one of the most beautiful cities I've been to. I guess it's easy to be scammed as a foreigner, but I've spent quite some time in Naples and I've never been bothered by anyone. On the other hand that's not something I can say of a supersafe place like Paris.

That's the problem when you're being hunted; you can't slip up even once. The people chasing you can make all the mistakes they want; you have to make zero.

I've had to decide to face down evil before... I went forward and it landed people in prison. I know I did the 'right' thing, but I didn't sleep well until moving away and wiping my online identity. I salute your work and wish you the best.

This statement has very serious implications:

    According to a trusted source in the security community, that
    email account was somehow compromised in 2013. The source said
    the account was full of emailed reports from a keylogging
    device ...

If I understand "security community" to mean law enforcement or intelligence agencies, that means they are sharing data from surveillance of private individuals with journalists.

This suggests that assurances about the security of that data and the integrity of their processes are not reliable. Who else is given this data? You may like Krebs and think it's justified, but who decides whose private data is ok to leak? What about your private data?

I'm not sure that I agree with your policework there. The "security community" here almost certainly refers to a private security researcher or firm. I can't see why it would have been a government source.

In general direct information sharing is one of the most important things in information security, but the government has its hands tied in this area in a way that private companies do not.

OP seems a bit naive, but I can't believe it given everything he's written. Of course the Fly won't send threats over mail, he knows everything he writes is being watched. I would be worried, however, that he somehow gets word to someone to exact his revenge, since he really has nothing to lose at this point.

I agree with you entirely.

Implied death threat (to him) sent to his wife from someone whom he has now gotten imprisoned who knows where he lives and confirmed it by sending a card... he seems awfully calm about all this and perhaps half-jokingly states he'll visit Fly in prison to meet him in person.

I'd be getting placed under a witness protection program (is this even applicable?) and relocate. Move somewhere that doesn't have risk of being burned down if Fly manages to contact anyone.

Anyone deep enough in the criminal scene has connections to people that can make bad things happen to other people for the right price. This isn't something I'd be posting about on a blog as if it's some sort of crime detective story... his life and his wife's life could potentially be in danger.

I doubt it, this isn't a drug cartel kingpin or mafia don we're talking about. He's just a troll.

Even low hanging fruits have connections. I think all the hush-hush on black markets creates as much danger as it creates safety in making such discussion taboo. The idea that only kingpins or the mafia have connections to hitmen is something that exists only in Hollywood media.

I guess thinking about it further, the 'good' news is that if the criminal was successful at what he did and had a couple grand to hire a hitman - he wouldn't have needed to crowdfund the heroin. So you're right in that it's more likely a small time, not-black-market-rich troll rather than someone more dangerous.

Let's not forget that getting someone in trouble and/or threatening harm/death are not the same thing as actually causing physical harm, and that is not the same as actually causing death. Just because someone is part of the underworld doesn't mean they have no qualms about ordering someone's death, and the only thing holding them back is the money.

Revenge is one of the most powerful motivators for murder and can turn otherwise good people into hot-blooded killers [0-5].

Few people would kill indiscriminately, but if you give them a powerful enough motivation? They'll have no qualms taking a life. This guy has had his life ruined, I doubt his marriage will survive this, and he'll be spending a good portion of his life in prison in a foreign country. Furthermore, he gets to be humiliated not once - not twice - but thrice by Krebs. That's a lot of motivation to get back at a guy and it would be foolish to not even entertain the thought that he may seek revenge.

I could link to hundreds if not thousands of stories about revenge killings. Hell - it's such an old motivator it's featured in many parts of Greek and Roman mythology.

Ignoring that the reason the Witness Protection Program even exists is to protect peoples' lives after they ruin a criminal's life.

[0] Possibly NSFW ; no gore but someone dies: https://www.youtube.com/watch?v=_PUE8fYxjq8

[1] http://www.theguardian.com/uk-news/2015/aug/12/ex-ira-gunman...

[2] http://www.dailymail.co.uk/news/article-3009762/Man-gets-lif...

[3] http://www.nydailynews.com/news/crime/texas-dad-accused-murd...

[4] http://www.dailypilot.com/news/tn-dpt-me-0711-van-sentencing...

[5] http://indianexpress.com/article/india/india-others/nearly-4...

I'm not saying criminals don't kill people. I'm simply making a point about assuming all criminals are the same. There are plenty of white-collar criminals that have and will cause the death of innocent people and there are plenty of violent criminals that won't purposefully cross the line to killing a person.

If for no other reason, we should be wary about stereotyping criminals because what is considered criminal is sometimes quite arbitrary and can change quite fast. How many years ago was it a felony in some states to possess more than token amounts of marijuana, or to take part in sodomy?

What I think is dangerous is confirming that he got the Xmas card. Depending how that was sent, he has confirmed that he hasn't relocated his home and that puts him in danger. If Fly wanted revenge, he wouldn't want to hire a hit on the wrong house, now would he? Confirming his family is still in that house makes it a target for a hit or arson if Fly seeks revenge.

Even if Fly was not already a criminal - merely a troll - there are now seeds of revenge planted. He doesn't need to have been a criminal or done any criminal actions for him to want to seek revenge. People who are seeking revenge can be dangerous - to deny that is to ignore millenniums of history proving otherwise. While it has been pointed out this wasn't Krebs first and likely won't be his last - and that he's likely accustomed to such things. The danger is still there.

I am not trying to argue "because he is criminal, he will try to kill" I am saying "because he may seek revenge, he may try to kill". This has nothing to do with his criminality - and my bringing up his criminal behavior was more trying to shed light on "anyone can hire a hitman. they just need money and enough motivation to want someone dead." because it's a commonly held belief that only the rich and powerful (kingpins, political leaders, etc.) have connections or can hire hitmen.

The motivation aspect is covered by "revenge" and "need enough money" can be covered by "criminal activity".

Anyways, I'm done here. I hope he stays safe and I hope his confirming he got the Xmas card doesn't bring him or his wife/family(?) into harm.

I was responding specifically to:

> I guess thinking about it further, the 'good' news is that if the criminal was successful at what he did and had a couple grand to hire a hitman - he wouldn't have needed to crowdfund the heroin. So you're right in that it's more likely a small time, not-black-market-rich troll rather than someone more dangerous.

There's a couple ways to interpret that. One is that he didn't have money because he crowdsourced his scheme, which I think is fallacious on a few levels (e.g. maybe he crowdsourced it because it was a community rep thing, and he wanted to be seen organizing it). The other is that he only sent the heroin because he didn't have the money to hire the killer which he would have if he had the money, which is how I read it. Perhaps you meant the former. but my replies were meant to address the latter. I don't disagree with any of your replies, but they are non-sequiturs to mine, likely because we are arguing separate things.

Enough people get swatted (waste of money, some people can die, etc) that you can't just write it off, either. Krebs has been swatted before, too.

These criminals are not stealing all these credit cards for fun. It's to make money. They have money. Obviously they can throw $200 at someone just to troll him. They could pull together more if they really decided it was necessary. Money talks.

Online organized crime has been going on for over a decade, and Krebs has been covering it for that long too. He's quite well known in the online criminal underworld. If a well-resourced and ruthless criminal wanted Krebs dead, it would have already happened.

Instead the high-end criminals seem to be mostly amused and flattered by the coverage from Krebs. They even give him email interviews sometimes. They know he can't really do anything to stop them. He's just a writer.

It's generally only the new or small-time folks, who get their egos bruised, that try to harass him. These folks are generally cowards and not rich or well-connected anyway.

Just because it hasn't happened yet doesn't mean it won't happen in the future. Reporters have died in the past from reporting on dangerous things. Here's a few: https://en.wikipedia.org/wiki/List_of_journalists_killed_in_...

As someone else has pointed out, you don't have to be some high up gangster to hire a hitman. Or even just show up and shoot someone.

It is most definitely organized crime. It's just a new model that people are not quite up to speed on, yet.

Krebs is a security investigative reporter. He has had many threats and written about them before. I am sure he is taking some precautions. That said, I don't envy him or the danger of his job--but that's something a lot of reporters just live with.

It might help readers to know Krebs is the security investigative reporter; he is probably the single most important reporter in the world on this particular beat.

A really interesting thing that isn't mentioned in the article, and I don't know that I've got all the facts right: is he being extradited to the U.S. for these crimes, while having never set foot in the country? Does that freak anyone else out?

"I say to you againe, doe not call up Any that you can not put downe"

This sounds like advice never to begin farming.

As a farm boy who grew up on a wheat farm, at the end of the season after harvesting the wheat that we had "brought up" in the spring or the previous winter, we would plow the remainder under, bringing it down again.

There are people who will tell you that agriculture was just a giant mistake on the part of some enterprising hunter-gatherers, since it locked all of humanity in to agriculture forever.

so I began looking through databases of hacked carding and cybercrime forums

Where does one acquire these databases? Genuinely curious...

Credit card data is stolen all the time. Card skimmers, cell phones, cameras, just writing it down while working somewhere, pulled out of compromised email accounts, etc etc the list goes on. Criminals then upload them and sell that data online.

Read through Kreb's archive, he has screenshots and more info. If I remember correctly one was on the clearnet but required some sort of verification before you got access.

I've been a fan of Krebs for a while. He get's a lot of access and information from other hackers (that were pissed at another hacker) or security analysts. Gotta give him props though, he taught himself a lot, including learning Russian

I think one of his best features is his follow through too. Real good journalistic nose for following a lead.

Brian Krebs has done this once or twice, so he's built a collection of resources already making it a lot easier for him.

A simple answer would be there is more to onion sites and 'the dark web' than just the Silk Road.

Not to simplistically vilify an entire city but Naples is a horrible, horrible place.

It's interesting to see the moral ambiguity in this, in the comments and in the article itself. Perhaps the comment with the rarest insight of empathy is the one by Matthew B.:

"The people who conduct this type of crime often think of it as justified. After all, Americans are rich aren’t they? How could it hurt them to lose some money? We are poor, if they won’t share, we’ll just take it. We will make them share!

They think of it as a game. A lucrative game in which they get to win over and over again. Even those of them who may be kind to their friends and even generous with those they love, don’t really see their victims as people. Not being a member of their group makes the rest of us not quite human.

This type of tribal thinking isn’t as uncommon as you might want to believe. I’ve seen it here in the US over and over during my lifetime. Most people who suffer from it don’t consider themselves evil. They just consider the rest of us their lawful prey.

We tend to feel otherwise. Thanks for the great work Brian."

What I find a bit crass is the sensationalistic complete disclosure of identity employed - going all the way to the classical mugshot. All of this will certainly not help for Fly's later reinsertion, say, when he decides to get a job in IT. And I'm not playing devil's advocate here, it just seems to me that the author is pushing aside his inner moral voice in order to write a more viral article. Justice is taking care of prosecuting the criminal, but let's push him further down if it can attract some pageviews. I suppose I'm simply being bitter about journalism, though.

You are complaining that Krebs doxxed a credit card scammer who tried to frame him for dealing heroin?

Framing someone for dealing heroin is criminal and morally terrible. The guy's certainly paying and going to prison for it, and for his other crimes. This is justice doing its job.

The question that I'm trying to ask is whether public shaming, especially to such a large audience, is really a civilized response. The consequences are also devastating, and reduce the possibilities of getting a second chance at life, something that I strongly believe in.

The real world isn't Reddit. There is no "no-doxxing" rule in reality.

Pierre isn't complaining that a "rule" has been broken. He's asking about the future benefit or harm to society caused by the public shaming.

If 'Fly' isn't going to be put to death (I don't think you are arguing for that?), there's a likelihood that someday he will emerge from jail and be expected to re-enter society. Pierre's question is whether the treatment of 'Fly' now puts the world in a better or worse position at that future point.

I think it's a legitimate concern, although I think the 'public shaming' is going to have much less impact than the years spent in foreign jail living only among other criminals. It doesn't strike me as likely that he will be in a position to re-enter society having seen the flaws of his ways.

If he's going to successfully re-enter society, one would imagine he would have to actually be ashamed of what he's done.

> whether public shaming, especially to such a large audience, is really a civilized response.

This concept is also often referred to by it's more common name: "journalism"

I've been pondering this distinction lately. We recognize that doxxing, etc. are Definitely Bad Things but that's exactly what journalists have always done.

It's a matter of degree and intent, of course, but there's an awfully blurry line in-between.

The difference between "doxxing" and "journalism" can indeed get blurry every once and awhile[0], but it's usually not that hard to figure out.

Journalism is newsworthy and has the intention of informing people in the public interest, doxxing is typically not newsworthy or in the public interest and has the intention of harassment or intimidation.

[0] http://nymag.com/thecut/2015/07/gawker-slammed-for-story-out...

It's not like the prosecution would've been secret if only Krebs had kept his mouth shut. The indictment and eventual verdict are public, and probably Google-able. It will show up in criminal records searches, just like it would for anyone else who had been at the sharp end of the justice system.

At worst Krebs raised the guy's profile a bit. But when he gets out of prison in 20 or 30 years it won't make much difference.

Public shaming this isn't some naughty child in a cute 50's Norman Rockwell painting

More than likely it's pour encourager les autres.

After all, they messed with his family by sending the flower arrangement to his door. A public warning not to mess with him would seem to be appropriate.

> All of this will certainly not help for Fly's later reinsertion, say, when he decides to get a job in IT.

Maybe he should find a career that's less likely to offer tempting access to other peoples' private information next time?

Theoretically, that shipment of heroin could have ruined his and his wifes life for good.

I dunno, he picked a fight and lost, and besides that carders are just generally scummy. If it were some kid who was only guilty of breaking into corporate/government systems for the heck of it, then I could see your point.

Reply on news.ycombinator.com