A bit of survivorship bias at work here.

Criminal activity is more so a function of risk tolerance than intelligence. However getting caught is certainly a function of intelligence.

So your impression is that most criminals you read about being apprehended are people that seem to make many stupid mistakes. But this stupidity is heavily correlated with being caught, not necessarily with being a criminal.

That said there's probably also a (negative) correlation between extreme tolerance for risk and intelligence.

Most 21 year old kids will not know enough about opsec to understand that they don't know shit about opsec. If you know a little bit you might think "if I just do X, Y, and Z I'll be safe". I suspect once you learn a bit more about the area you will quite quickly decide that it's not actually possible to get away with this kind of thing once the cops are onto you.

Applying that to this scenario: evading/postponing arrest after the cops started to look into you is luck, never giving them reason to look for/into you is what could be considered skill.

Or even more specific: it became luck as soon as it became clear that there was an admin. A lot of criminals that get caught want to be notorious however and build their "street creds".

The book “The Mastermind” was about a guy who operated a nearly legal business that broke open the telemedicine industry, only to use the proceeds to fund wet works, piracy (not digital, like actually killing people and taking over vessels) and general shady stuff.

I think if you get a person who is motivated by money and power to a certain degree, they may actually prefer illegal business because there won’t be as much competition.

>Legitimite employment might not give them the needed liberty to do what they see fit.

That's true; that's why I tried to qualify it with "generally". There certainly are some very intelligent, skilled people who are capable of finding legitimate employment and instead choose to immerse themselves in the criminal underworld, for various personal reasons. In practice, though, I've found them to be pretty rare.

Even among the ones who do have a desire for ultimate liberty and who see themselves as above the law, most feel like the risks greatly outweigh the rewards. Some temporary liberty in exchange for likely many years of zero liberty in a prison cell isn't a great deal. Especially when it's so easy for them to get a comfortable, high-paying legitimate job. (Admittedly, this trade-off may differ in places outside the US, where good jobs may be scarce and criminal activity may pay very well and almost always go unpunished. Assuming one has no ethical compunction, at least. Or feels certain illegal actions are ethically justifiable, like how many hacktivists feel.)

I'll also add as a note that another potential explanation could be a criminal record. Someone may have all the necessary skills and experience, but may not be able to get one due to past criminal convictions.

Not if you have a world view that all risk is to be avoided and anyone who takes risk is a fool.

(and just to be clear, I think people with that world view are a major impediment to societal progress)

Read Crime and Punishment by Dostoevskji.

With Cloudflare registrar I would not be surprised if they were a cooperating party in this case.

https://www.cloudflare.com/media/pdf/transparency-report.pdf - and https://developers.cloudflare.com/registrar/why-choose-cloud... indicates Cloudflare retains "the registrant email on file for that domain."

WHOIS redaction is extremely useful for shielding personal information from non-governmental entities! But US government entities have full access to any data the registrar has on file, regardless of whether they provide redaction services.

Last time I bought a domain, I did "1,lol,NYC, Dubai,90210" and other nonsense in the four fields.

Is it a compulsion to use real data and then rely on registrars promise to not disclose it?

Easy way to get a domain seized is to have it not be responding to legal notices.

>Easy way to get a domain seized is to have it not be responding to legal notices.

for such a website, seizure is ultimately going to happen regardless of response so why put themselves at more risk?

It was the blind leading the blind but a lot of fun to watch.

yeah, in places like that you get banned for offering alternate perspectives like telling them it doesn't have the significance they think it has

better to just sell them infowars branded coffee mugs and move on.

Well, for those that are bright, you don't hear anything at all. So it's hard to characterize all of them.

I hear something similar on shows like Dateline about how not-bright the murderers are. Yet only about half of homicides are solved in the US every year.

I was looking over Wikipedia articles on software piracy groups of the 1980s/90s the other day and it was really interesting how many of them died to either a blatantly stupid move on the part of one of their members/leadership resulting in the whole group dropping like dominoes, or a political split when the leadership could not agree on policy (especially during a leadership changeover)

It was particularly interesting to see at least one major group collapse due to leadership getting nailed on phreaking charges, which spilled over to the entire group getting nabbed on the piracy.

A few of the brightest in the scene got out when they found an opportune time, then disappeared. At least one or two of them are CEOs in big business, if the articles are to be believed. I bet one or more are reading this now, even!

People might like him better if he didn't keep making 180-degree changes to his stance on major constitutional questions.

Whichever side of that issue you find yourself on, it's disturbing how easily he could his tune.

And the only thing that's worse for them than changing their mind is when they admit they haven't come to a decision on that yet, which is just admitting up front that they don't know as much as they should and are fallible.

It's not just that we don't expect politicians to by truthful, we disincentivize and sometimes outright punish any natural and truthful behavior that we would expect in a normal person, and force them into the mold we so like to criticize.

Also, I'm referring to a certain subset of cybercrime. The kind associated with forums like RaidForums and HackForums and LeakForums.

There is a caveat to this. As the perpetrator of a crime (what and how stuff is defined as a "crime" is a different discussion), no matter how smart you (think) you are, you have to get it right every single time, in perpetuity

For law "enforcement", they only need to get it right once.

When you're doing low-level crime barely on anyone's radar, this matters little. But if you ever scale up, any mistake you may have made in the past could be used against you in the future.

There are so many ways in which you could be tracked that the safe assumption is that you won't be able to avoid it.

How do I get anonymous internet access, from inside my cave?

More serious, the "best" way to do crime, is probably doing crime no one (in your jurisdiction) bothers enough to demand police action.

Which is why most(?) cyber gangs are operating from russia, kasachstan, etc. against the west.

Also your list misses IP logging from ISPs.

> Today we were unlucky, but remember we only have to be lucky once. You will have to be lucky always

They just need to be unlucky once to go to jail.

I'm sure he wouldn't let Coinbase get away with SMS 2nd factor authentication, something I can never forgive a company to do when there's big money on the line.

I did. Excellent, captivating interview, but he repeatedly acknowledged he didn't know much about the tech stuff, and he said several incorrect technical things towards the end. I stand by my statement: I think it would've been difficult for him to get a (technical) infosec job at the time of his arrest, or now (assuming a world where he didn't have a criminal record). While listening to it, I actually thought he perfectly fit the archetype of cybercrime forum operators I'm used to coming across.

He's certainly a great social engineer, and many other technically unskilled people in the cybercrime space also are. I'm definitely not discounting that ability. A lot of it comes down to brazenness; e.g. being confident and shameless enough to impersonate a law enforcement officer over the phone. There's still a lot of skill involved in being a con artist even then - you need affability and the gift of gab and all that - but it's not necessarily the kind of skill that's transferrable to technical expertise. There are many people with expertise in both areas, but also many who are exclusive to one.

Be very careful about taking infosec celebrities at face value.

Social engineering is and always has been a core feature of black hat activities. When these people graduate from criminal activities to being keynote speakers and consultants, they take their social engineering skills and use them to build a personal brand.

In other words: You were getting socially engineered through that podcast. Building an aura around himself is his business now ( https://www.anglerphish.com/speaking-consulting ).

His story is interesting and you can't deny that he's become a great storyteller. But even he admitted that he wasn't the strongest on the technical side of things.

I always feel like the people who are involved in these illegal forums would have better OpsSec. The fact the feds got all of his electronic devices and within a few hours had plenty of damning information is always kind of shocking to me.

I guess that's the difference between the real criminals who never get caught and others who get greedy or too lazy in covering their tracks.

If I got a magic gift of $10 million in crypto but I had to start doing proper OpSec to hide everything on my devices and digital life, that would be a huge downgrade in my quality of life; it's not worth it.

Most deceptions, even comically absurd ones like “dude who has two families in different cities” do not require perfect vigilance, whereas running a cybercrime forum does. I bet success at this stuff comes from having an unusually fastidious personality more than anything else.

While you’d think bright people would be smart enough to recognize these risks and the comparatively safe, lucrative alternatives available to them, I know plenty of genuinely bright people who’ve made systematically poor decisions about how to run their lives or who have personality defects that otherwise impair their ability to succeed. And that’s even despite my social circles being heavily weighted toward people who went to good universities and hold down good jobs.

I’m sure that the ability to make sound, rational, forward-thinking life choices is correlated with intelligence, but I’m not sure how strongly.

The actor never needs to interface with anything related to their activity ever again in any way, and can only screw themselves if they deliberately tell people what they did. And even if a nameless actor does 1000 things and gets caught for only 1, because they had no name/common set of characteristics, those 1000 things cannot be tied together. They're just caught for the one thing.

So opsec is hard... if you have a big huge ego or want to maintain some kind of central infrastructure.

Anyway, yes, I know there is more to it- considering who your adversary is, the limitations of your tools, and what configurations of tools are required to raise the cost of retroactive deanonymization above the capacity of your adversary. Every adversary that exists can be outwitted with some effort, if we're talking in terms of the internet and not physical security. Then there's the can of worm that is security. . .

Legitimite employment might not give them the needed liberty to do what they see fit.

That's true; that's why I tried to qualify it with "generally". There certainly are some very intelligent, skilled people who are capable of finding legitimate employment and instead choose to immerse themselves in the criminal underworld, for various personal reasons. In practice, though, I've found them to be pretty rare.

Even among the ones who do have a desire for ultimate liberty and who see themselves as above the law, most feel like the risks greatly outweigh the rewards. Some temporary liberty in exchange for likely many years of zero liberty in a prison cell isn't a great deal. Especially when it's so easy for them to get a comfortable, high-paying legitimate job. (Admittedly, this trade-off may differ in places outside the US, where good jobs may be scarce and criminal activity may pay very well and almost always go unpunished. Assuming one has no ethical compunction, at least. Or feels certain illegal actions are ethically justifiable, like how many hacktivists feel.)