How a drug dealer’s IP was found out by package tracking | Hacker News Reader

How a drug dealer’s IP was found out by package tracking

arstechnica.com

93 pointsr72160 comments

You still don't know that's the reason he got caught. The real reason could be something else, and this is just "parallel reconstruction".

"Parallel reconstruction" means that you catch someone using an "illegal" information source. You then monitor him, wait for him to make a mistake, and then that's the "official" excuse for how you caught him.

The police who testify in the case aren't even lying, because they only have the "parallel reconstucted" evidence and not the illegal evidence that was the original lead.

Sorry to see you were downvoted. Parallel reconstruction has completely undermined my faith in what the police say was their procedure for gathering evidence.

It is abuse for someone to use "downvote" to mean "I disagree".

Inappropriate? yes.

Rude? yes.

Indicative of churlish immaturity? yes.

Abuse? Nope.

You also have to examine the evidence used. It's possible the police got lucky with Silk Road's 1 Ross Ulbricht's deleted traceable email address, but that I don't believe, and strongly believe parallel reconstruction.

The USPS logging IP addresses on a webservice they run?

Absolutely believable.

Why does it matter if this is really why he was caught? The facts are that he was caught, and there was a legal way for him to have been caught. That's why parallel reconstruction is acceptable in the first place.

>>That's why parallel reconstruction is acceptable in the first place.

That's news to me. Does anyone find parallel reconstruction acceptable in any situation whatsoever? HN gave me the impression that it's never good and a strong indicator of corruption and/or lying. Am I wrong?

All the rules of evidence ultimately stem from two goals: to discourage law enforcement officers from harassing members of the public by violating their freedoms and privacy, and to discourage law enforcement officers from unfairly or prematurely narrowing the field of suspects by focusing on the first piece of suspicious evidence they can get their hands on. (More generally: don't punish wrong guy, and do punish right guy.) But once the deterrent has failed and the evidence has been collected, you end up with a known criminal you are unable to prosecute and that's a bitter pill to swallow, especially if the criminal is very dangerous and the cops' mistake was minor. The deterrence will never be 100% effective no matter how we blindly cling to that tactic.

The ideal course of action would probably be to admit all the evidence and then prosecute both the suspect and the bad cops for their respective crimes, but that's cost-prohibitive and for minor offenses even being prosecuted in the first place is often too much punishment. So as usual we end up with the courts accruing increasingly complex justifications to strike a compromise where one is needed, but the compromise the courts manage to justify isn't always a good or sensible compromise.

The problem in our system is that, when the police break the rules and get caught, the only penalty is that the evidence is excluded. "Parallel reconstruction" lets police evade even that tiny penalty for breaking the rules of evidence.

Really, there should be some personal liability for the police when they do something illegal to catch a criminal. That change isn't going to happen.

Also, "Making and selling certain chemicals." is something that shouldn't be illegal in the first place.

Uhh no. Using illegal methods to catch bad guys is bad. So no, parallel construction isn't acceptable. At all.

Using illegal methods is bad. Catching bad guys is good. Using illegal methods to catch bad guys? That's a much more complicated question than you make it out to be.

Yeah, I'm also surprised at the amount of dislike and hatred for parallel construction as a methodology.

When it's Alan Turing and stopping the Germans from realising an Enigma message has been read by the global surveillance apparatus of the Allies and been broken, by sending out a Catalina to look for a U-Boat at just the right time, that's great and an uplifting exemplar of the way things should be.

When it's an email that's been read by the NSA surveilling Internet data, that is then used to tell the DEA to go and stop a car at just the right time to catch a cartel drug courier and murderer, that's not?

Only if they catch themselves for being bad guys as well and are fairly punishing under the laws they broke as a non-LEO related individual would've been.

No it's not. It's bad. Plain and simple. The ends do not justify the means.

I hope your reasoning is a minority sentiment.

Legalize them already. Buying and selling drugs on the "dark net" has improved the safety and quality of drugs, and reduced the violence of (street) dealing[1]. We should be encouraging more of this.

[1] Source: http://www.economist.com/news/international/21629417-busines...

Indeed. And I'd rather see a war on refined sugar than a war on drugs.

I think the only ethically justifiable war would be on antibiotics, because someone using them incorrectly could cause an outbreak of drug-resistant microbes that would also affect responsible people.

People giving themselves diabetes is sad, but it's ultimately a personal choice. (That said, I do support education, restrictions on advertising, etc., to help people make the right choices.)

Can we not have wars on things?

Like, if someone or something else starts a war on us, we can self-defense them, but otherwise let's try to get this word out of our collective vocabulary by ceasing all the unnecessary and harmful wars we're fighting.

War is not the answer. It is the ONLY answer. See: War on (choose one: cancer, poverty, AIDS, terrorism, bullying, guns, etc). More seriously, war rhetoric reduces the idea of real war to a banality.

Perhaps the "dark net" has improved the safety of drugs by removing the violence of street dealing, but exchanging drugs without government regulation is still dangerous; most people rarely, if ever, test the drugs they receive from China and elsewhere.

When drugs are trading under names like "acid", "molly", and "ecstasy", it's almost impossible for typical users to pinpoint exactly which chemical they are about to ingest. All of the 2C's, NBOMe's, and of course LSD are typically sold under the name "acid". And when people are dosing what they assume is LSD, they might accidentally ingest 10–100 times the regular dose of another psychedelic, sold to them as "acid". While it doesn't lead to many deaths each year, safe drugs still kill people because they are unregulated and illegal.

"On May 7, 2011, in the United States, two young adults died after overdosing on Bromo-DragonFLY, which they thought was 2C-E, and several others were hospitalized during the same incident. Because they took a dosage appropriate for 2C-E, those who took the drug received, in some cases, 100x the normal dose. Both deaths followed seizures, vomiting blood, and terrifying hallucinations. Several surviving victims are reportedly still suffering from its physical effects." http://en.wikipedia.org/wiki/Bromo-DragonFLY

I believe that government regulation and legalization could solve this enormous public health issue.

This is why people use test kits and go with reputable buyers. If you use a marquis or mecke re-agent test and a good scale, you can avoid a lot of that.

And there are hundreds of thousands of people buying drugs online. There's going to be a few edge cases like that. People who take darknet LSD know to look out for nbome and other imitations.

> Perhaps the "dark net" has improved the safety of drugs by removing the violence of street dealing, but exchanging drugs without government regulation is still dangerous; most people rarely, if ever, test the drugs they receive from China and elsewhere. > When drugs are trading under names like "acid", "molly", and "ecstasy", it's almost impossible for typical users to pinpoint exactly which chemical they are about to ingest.

Of course, the obvious solution to this is to increase education and availability of testing kits.

See this article and resulting HN discussion: Inside the Deep Web Drug Lab.[1][2]

"Welcome to DoctorX’s Barcelona lab, where the drugs you bought online are tested for safety and purity. No questions asked."

[1] https://medium.com/backchannel/inside-the-deep-web-drug-lab-... [2] https://news.ycombinator.com/item?id=9275987

> Bates was arrested and taken to the Rockland Police Department, where he was interviewed. He waived his Miranda Rights ...

> ... He also consented to a search of his laptop and iPhone and gave officers the passwords to his e-mail and Skype accounts.

Poor guy. I think he should have talked to a lawyer first before doing all of that.

Never give any info to the police you don't need to if you are under any sort of investigation. They will always use it against you, it is their job.

Especially if you're actually guilty.

I watch a bunch of shows where a camera man follows the police, and see people confess all the time as soon as the officer asks "Are these your drugs under the car seat?" etc.

One time I saw someone who didn't confess, they were released the next day with no charges because they couldn't prove the owner of the drugs. Another case was someone who didn't pay for petrol at the gas station. The police caught them red handed, but they just kept saying it was an innocent mistake (obviously wasn't). Police had to let them go after they paid.

Unless of course, you really are guilty and want to be punished, don't do it.

> people confess all the time as soon as the officer asks "Are these your drugs under the car seat?" etc.

Not that I intend to ever be in this situation, but what's the proper answer? Can't lying add another charge? So, do you lie, say nothing, "plead the fifth", demand a lawyer, or something else?

Use your judgement. YMMV.

This obvious comment doesn't answer whether lying/saying nothing can add charges or not.

Say nothing except to ask for council. You cannot be charged for asking for a lawyer. Google "Don't talk to the police" and watch the first YouTube video of the lawyer and the police officer both telling you the same thing.

Heck, they should play that video for kids in middle and high school right along with their DARE and Sex Ed.

The YMMV refers to situations such as this: http://m.youtube.com/watch?v=7WEcpLi7kB4 Exercising your rights is never the easiest path but never, never let yourself be interrogated by the police. You are not required to allow yourself to be questioned, and there is absolutely no possible way being questioned can ever help you. Get a lawyer, the police can talk to them.

I think in America I think you have the option of saying nothing. It is hard to keep your mouth closed because of the huge weight of social pressure telling you to respect the police authority.

I haven't been in this situation myself, but I imagine doing this would irritate the officers and cause you to be taken back to the police station and need to stay there at least overnight.

You can definitely say nothing, or just keep saying "I'd like to see a lawyer". An overnight stay at the police station is not a big deal compared to saying something stupid that you'll have to deal with for a lot longer.

Also something to keep in mind is that it's not illegal for cops to lie to you.

Woah, are you serious? So could they do something like 'Yes sir, I know you have Miranda rights, but since they passed <bs law> on <bs date>, if you are caught with possession of <some drug>, you no longer have the right to remain silent, and if you do, it can add up to <ridiculous amount> dollars to your charges.'

What if the guy confesses something there and then later finds out the cop was lying? Can he do something about it?

This is actually their standard line, almost verbatim. Replace XYZ law with 'lying to me is illegal' and 'if you make this hard it will much worse for you and I won't be able to help you...' It is a long and well established right for the police to use deception to gain confessions. They will Mirandize you and then convince and cajole you into waiving your rights. They do it every day, and in almost every case.

The key is to know when you have to speak and when you have to comply. Cops tend to ask a lot of questions. The ask a lot of mundane, pointless questions, fostering the idea that they are a bit stupid, then they will start hitting you with silly or contradictory questions. This is the trap springing; they are hunting for Probable Cause, or PC, and their definition of what constitutes PC is quite broad. They bog standard pig has a narrow range of goals when dealing with a suspect: get them talking, get them nervous, get them out of control. They move in pairs for a reason (and often times they group up at traffic stops): one chats you up while the other looks for anything that could be construed as PC. The nervous part is easy; a dude with a gun asking a lot of questions should make any thinking person nervous. Getting you out of control is the finish line: they want you out of the vehicle. Once you are out of the vehicle they have de facto consent to search said vehicle. A previous poster brought up "social pressure" and they are absolutely right. Embarrassment and fear are super useful when manipulating anyone.

You may be asking yorself: Classicsnoot, what is the point of all this babble? Is there an answer to the question anywhere in my future? Here it is:

Say. Nothing. Smiles and nods are absolutely enough. You are legally obligated to hand over your ID. You are NOT obligated to answer in detail. "yes", "no" and "I don't know/I'm not sure" are the script. As a very wise penguin once told me: "Cute and cuddly, boys, cute and cuddly." If Mr. Piggsly can't handle your clipped responses, he will become frustrated and agitated. A frustrated cop is a mistake prone cop. If you are male (particularly a male of color, but cops shoot white people just as often as black or brown people) DO NOT ACT IN ANY WAY THREATENING. Always ask or inform when you reach for anything. Do not explain, give reasons, or give back story. It is none of their business where you are going or what you have been doing. And finally, they will always threaten you with "a ride to the station". This is their Queen. Everybody is afraid of this, but it is actually to your advantage. They can only legally hold you for 23 hours, 59 minutes, and 59 seconds without charge. And you are not legally obligated to say a damn thing. I know this is a lot. I am available to answer specific questions should you want clarification. Here is the script:

Yes. No. I don't know. Lawyer.

Edit: IANAL. I speak from experience: stopped as driver, stopped as passenger, retrieving friends and girlfriends who have been stopped. Arrested when guilty. Arrested when innocent. Arrested while existing in the nebulous region betwixt guilty and innocent that most citizens seem to occupy. Dated a lawyer. Related to lawyer. Paid a lawyer. Supplied a lawyer.

If you're actually guilty, please do talk to the police. It will save everyone a lot of time.

Where everyone excludes you, because you will not just save time, you will _gain_ time - jail time. So, if you're guilty, only talk if you _want_ to turn yourself in/face charges.

If you don't want to face charges, don't commit the crime in the first place.

But more seriously, you will face charges anyway. And if you haven't said anything, that will only prolong the inevitable. Or is it your personal goal to get away with committing crimes?

Many routine crimes occur because the legal system diverges from sanity. And indeed it is people's goals (and the proper moral thing) to "get away" with these "crimes".

I too would love if the map matched the territory. But the map has got to be the thing to change.

I disagree. If you want to use civil disobedience as a tool for changing bad laws, you have to be willing to accept the punishment for disobeying those laws. Otherwise you're not an activist, just an asshole.

If you'd rather not be punished for breaking a bad law, that's fine too. Just lobby for it to be changed without violating the law, like the rest of us.

I'm not talking about civil disobedience, but simply living your life without dwelling on someone else's proscriptions for it.

> like the rest of us

False appeal to a nonexistent herd. People living your viewpoint are actually in the minority. Many people do drugs, and most people speed.

As I said, I too would like actions to better line up with laws. But in our society of victimless "crimes", the answer isn't to insist that people need to follow the abstract model harder, but to fix the model to line up with reasonable people's behavior. And this is not the moral responsibility of people who simply wish to live their life, but of those who are creating this system of rules and calling it justice. To think otherwise is to believe that individuals should be servants of their government.

Nobody's claiming the answer is to simply accept bad laws along with the good ones. That's absurd. It should be pretty obvious that the only sensible answer is to get rid of the bad laws. We're just talking about what to do in the interim, since that process is not going to be instantaneous - scoff at whichever laws you personally disagree with, break those laws and accept the preposterous consequences as a form of protest, or follow them even though they're stupid. If you don't see the first option as a recipe for chaos, I don't know what else to say to you.

Sure it's a recipe for chaos, but that chaos should be blamed on the people who made the unreasonable laws in the first place. "Stop snitching" isn't the problem, it's a symptom.

Or instead of playing a blame game, perhaps we can try to be good people and improve society.

We're both trying to be good people and improve society, which is why we're debating a moral code to live by.

Correctly assigning blame is an important part of diagnosing a problem. Otherwise, being free from scrutiny, the responsible party keeps right on creating problems.

Anecdote time: In my younger days, I was once stupidly walking down the street with a cup full of something I should not have been walking down the street with. It was late - only my girlfriend and I were on the street. Seeing a police car turning the corner in my direction, I panicked and tossed the cup. He must have saw this because he goes lights and sirens, and holds me for 45 minutes on the side walk while he asks me the all the guilt-admitting questions he can conjure. He was really desperate. At one point, he even attempted to breathalyze the ground where the cup was. It was a silly situation. I received a littering fine. Moral of the story: don't show your hand, and don't do stupid things.

Makes for an interesting metadata privacy case. Presumably you keep click'n ship data forever, you find a 'bad' package, and back track the IP that was checking on it, and then every other package that IP tracked. It looks like they covered their bases with the possibility of a dynamic IP issue.

The weird thing is the temporal 'big data' thing. like keeping face id fingerprints over time at various places, and when a person's face is identified as one of interest then going back in time to see where their face appeared. Or their license plate, or their cell phone IMEI, or any number of random bread crumbs which are now dirt cheap to store for ever and ever.

> methylone (also known as "molly")

I don't think that is generally true.

its not. MDMA is molly. methylone is MDMC

How the hell are these people using the Dark Net to buy drugs, then not using Tor or a vpn when checking websites to track their drugs?

I would expect a tracking check from a TOR exit node to be a "clue". Might even be grounds for reasonable suspicion (would need a judge/case law to know for sure). Which is enough to isolate a package for a drug sniff. Though for international shipments I don't think the postal service/border folks need to meet a reasonable suspicion standard for a sniff.

I guess the take away is... never check your parcel's tracking details.

Is there any indication that a hidden service marketplace was used to buy this?

It struck me from this article how thoroughly the USPS and investigators practiced due diligence and did their homework during the course of the investigation. They went through the proper procedures for opening the package and made sure their Comcast records checked out. If you must use techniques like data mining to look for suspicious activity this is how it should be done.

This is just plain old bad opsec.

> Once they located Bates’ IP address, they may have checked to see if it had been used to search for other packages. But in the affidavit, United States Postal inspector Stephen Dowd seems to imply that this link happened in a more automated fashion. As he wrote, "The USPS database reflected that an individual using a computer or other device with IP address 75.67.6.214 accessed the USPS Track 'n Confirm website to track the progress of both the Florida Parcel and Bates Parcel #1."

Is it just me, or does this just sound like a simple query in a relational database? Don't see anything special here...

If you are going to buy or sell drugs online, at least figure out how to cover your tracks.

Deliveries is pretty good ... http://junecloud.com/

Deliveries still contacts the USPS's website...

Reply on news.ycombinator.com