Case File Reading

>Welcome to the fourth /XMR/ General weekly opsec discussion!
Firstly i just wanted to mention that its been a pleasure putting these together for the /XMR/ community! The feedback received so far has been overwhelmingly positive and i look forward to continuing these sessions into the future. Thank you for taking the time to read,  and i hope you retain some useful information from it, as i know i have in the process of making them.
This weeks discussion is going to be light on original content, unfortunately i have been busier than usual, so i thought this might be a good chance to share some case files from high profile arrests, mostly based in the US. Please feel free to share any additional case documents you have as well!


>Previous weeks discussion
PGP - pastebin.com/K5uK4vvg
File Verification - pastebin.com/64jdYSua
Compartmentalization - pastebin.com/fduPVLmV
>OpsAnon's public key
pastebin.com/kiEVscyb


>Why do we care?

Having these records made available to the public is an incredibly valuable resource for us as privacy/opsec concerned users, by reading these cases over we can learn from others mistakes, and we can build a picture of the tools and tactics used by those who mean to break our opsec!

>What information can we scrape from these documents?

While sometimes these gov documents can be verbose and outside of our scope of interest, we can dissect each case into a few key questions that will relate back to our own techniques. Anyone who remembers grade school English class is familiar with the 5 W's (who, what, where, when, why), in this case, i am removing the "why" and substituting " How", since that is the real juice we are trying to squeeze out here. We can further modify this template a bit so we can extract the most useful information and ask ourselves how the circumstances in these cases relate to our own.



-Newpost-




Who - Is this case pertaining to an administrator/vendor/buyer/hacker/activist?
What - What was the reason for arrest? (drugs, fraud, activism etc)
Where - Was the person located in the same geographical area as the attacker?
When - When did it go wrong, and how long did it take to compromise the users opsec and how long after compromise was it actioned?
How - What was the mistake made that caused the initial opsec breech?

*Note: 9/10 times, opsec is broken by a breakdown in our procedure, not some very advanced, expensive NSA tier hack, opsec has to be maintained 100% of the time to remain secure, an attacker only needs to be lucky once.

>Case files

All that is left is to get to the reading, i tried to get a variety of cases representing different scenarios from DNM vendors to MFH honeypots. If you don't feel like reading DOJ filings, you can also head over to darknetlive where they give synopsis of all the current cases, unfortunately 4chins throws a spam filter to the site so i cannot link the interesting ones here directly. Take them with a grain of salt as many don't include the reference material, but it still makes for interesting reading.

>Links

https://www.justice.gov/media/1116921/dl?inline=     		      cyber task force
https://www.justice.gov/opa/press-release/file/982821/download                     alphabay
https://www.justice.gov/usao-sdny/press-release/file/1549821/download       silk road
https://storage.courtlistener.com/recap/gov.uscourts.waed.95157/gov.uscourts.waed.95157.1.0.pdf
Ronald Craig Ilg (honeypot)
https://www.courtlistener.com/docket/65017549/united-states-v-trainor/        Tax evasion