One of my deep background worries is how many criminals aren't caught because they don't make amateur mistakes. You always read these indictments and the perpetrator served themselves up on a silver platter. But what about all of those unsolved crimes that might simply be unsolvable!

This is FUD, but don't discount the fact that the 'easy' path to catching this criminal could be fabricated in order to hide the real, more intense, methods used by the authorities to uncover Jareh.

I don't think it's FUD at all. Evidence laundering is well documented and has judicial approval by the Roberts court...

In the jargon, this is called "parallel construction".

To your point, he worked for the NSA for 3 weeks, only 3 weeks!

So some such system detected him as a threat and he left in under a month of employment? That's wild.

Well this takes the testing of compliance with regulations to a new level though. And here I am, doing my daily and weekly chores with HoxHunt and two other Q&A websites on our compliance procedures. And these aren't intellectual questions or anything - rote memorization is what they are striving for. I wish they would just send me crypto and be done with it.

Fiat would be more useful!

Read the affidavit, this one was amateur hour.

The FBI got lucky that one of their honeypot email addresses was the inbox. And then obtained records corroborating everything, such as from Kraken.

and the access logs of the top secret material from the agency's systems.

The access logs said Dalke accessed. Kraken's logs said "there were deposits of Monero in Dalke's accounts that are the exact amounts you sent Dalke, accounting for exchange rate fluctuations". Kraken's KYC records said "here's Dalke and his addresses". The UPS store he was using for an address said "Yep, Dalke keeps a drop here". The bank account connected to Kraken said "Yep, its Dalke". The setup at Union Station in Denver was for Dalke to come there between 11:30am and 3:30pm on September 28th, the affidavit ends 1 day before that, and Dalke was arrested in that exact location the next day.

The FBI claim they got lucky…

okay, explain the parallel construction possibility?

he would have been emailing anyone and the compromised wires picked it up for the FBI to then begin their sting operation?

The FBI still had to do the work, but I think its also plausible that they have a bunch of honeypot email inboxes around. I think since they had to do all the communication as well as the transferring of funds that it's not really parallel construction, at least in any controversial way for evidence collection. They got additional evidence that doesn't need creating a rationale retroactively.

but what do you think happened here?

I’m just saying, personally, I take court documents the FBI file with a grain of salt. Given their record I think this is appropriate.

They have very questionable affidavits on their cyber and digital side

I don’t see the issue with this one to apply such a rigid stance

I don't understand what everyone is talking about here. TFA clearly says the FBI transferred the crypto to him.

Maybe he did dumb things with it, but the whole thing was a sting.

I'm more worried about all the criminals that are out there not being caught because we won't crack down on what they're doing, not really because they're some kind of masterminds.

Looking at fraud statistics the vast majority of them aren't caught.

Look at the VAT fraud in Europe, billions lost, virtually nobody arrested

https://en.wikipedia.org/wiki/Missing_trader_fraud

> Notwithstanding these measures, MTIC fraud remains a problem for the EU. As at November 2018, calculations estimating the annual costs of the fraud range from €20 billion up to more than €100 billion (depending on methodology adopted).[21] An EU Parliament study in October 2018 found that MTIC/carousel fraud is the most damaging type of cross-border VAT fraud with an estimated €50 billion losses on average per year.

France is also hemorrhaging billions through social benefits fraud, they don't even attempt to recover most of it as they don't have the manpower

https://fr.wikipedia.org/wiki/Fraude_sociale_en_France

I would be extra careful about the "billions" of social fraud in France. Wikipedia make a difference between the shortfall due to unpaid contribution (undeclared work for example) and the loss due to benefit fraud.

Different figures are given but it looks that most those "billions" are in fact shortfall and not benefit fraud.

Most criminals are never caught. There is lots more crime going on than you might think. A lot of academics and journalists present crime as 100% captured by official statistics. Prosecutors do a lot of prioritizing.

Drug crime gets a lot of attention because the statutes are written in a way that makes the crimes very easy to prove. It’s far easier to prove the elements of a drug possession charge than it is to prosecute something like fraud.

Authorities go after the lowest hanging fruit or the most visible. Targeting the most visible feeds back into peoples perception that if they commit a crime they will get caught.

The authorities are strategic in their approach but at the end of the day they are operating on finite resources.

The advantage the authorities have though is that they are playing offence. They can make plenty of mistakes and still achieve their objective.

Criminals just have to make one mistake and it can undo all the she effort they have made to mitigate risk.

Most reported crimes aren't even close to being solved.

https://www.vox.com/2018/9/24/17896034/murder-crime-clearanc...

Some of them go for awhile, but the criminal has to not slip up every single time.

But if you are going to do a crime do it once and done and you may very well get away with it.

This reminds me of a thought I had a few years ago. A Sheriff in my state was arresting for buying IT equipment using department funds (I think it was Cisco gear) and selling it on eBay and pocketing the cash. He had done this a bunch of times. As someone who works in local government and knows how things work here, my thought was instantly the following:

-> some gear get purchased bet never used/installed for a few years. Sits around gathering dust. -> Sheriff sees this, takes it home sells it on eBay. Nobody notices or cares. It wasn't being used after all. -> Sheriff finds other unused gear, takes home and sells it. -> No valuable unused gear left, so Sheriff starts buying stuff simply so he could take it home and sell it. -> At this point it is noticed. Seriff gets found out and arrested.

If it was just the first step, nobody would have noticed and the guy would have pocketed $20k or whatever, and no one in the world would have been the wiser. The auditors may have eventually discovered the piece missing, but long after any video recordings expired, and the original purchase was perfectly legit. But greed combined with stupidity got the guy arrested.

Yep. Financial crimes have you coming back for more almost every time.

Those who could resist doing it more than once probably can resist doing it at all.

OpSec isn't hard, but it's a pain in the ass. In many ways that's worse for adherence.

Indeed. This is basically the crime version of the anthropic principle.

Please just call it a selection effect.

Only explanation I can think of is dude planned to leave the country shortly and figured he'd be gone by the time he got caught so there was no point in covering it up.

Also based on the value the crypto was Monero (and he use Kraken, which is only big US exchange that converts XMR/USD pair), so he probably didn't realize even though it is difficult to directly trace where it came via the blockchain the exact unique amount deposited on KYC exchange fucked him. A naive Monero user would probably think "impossible to find where monero came or went from, so I'm safe" not realizing they're leaking out the side-channel by depositing a unique amount on a centralized exchange.

"His resume also states that he has specialized training with federal law enforcement related to digital forensics and incident response, dark web investigations..."

Lol, I suppose he's guilty of lying on his resume too!

They probably had him watch a training video or two, so it's more of an embellishment.

Might explain why the NSA fired him so fast.

Most CISSPs I interview can’t tell me the difference between the two most common types of encryption

Presumably, you mean symmetric and asymmetric? I could think of this a few ways. Granted some of the others are more than 2.

Yes. And the embarrassing part is it’s part of the study guides and covered by the certification.

saw a CISSP who didn't know the difference between a SHA256 checksum and SHA1 or even how to hash a file using openssl

I'm relatively deep in this stuff. If you asked my how to use the openssl CLI for anything other than X.509 and s_client I would fail your interview.

Yeah openssl CLI is so incomprehensible. And some parameters have to be configured using .conf files, ewww. The C API is hardly any better.

When I read the RFCs behind the stuff to write what I needed in Rust, suddenly it dawned on me: wow this stuff isn't nearly as complicated and horrible as openssl's interface makes it seem like.

I didn't expect the knowledge of the cli to do it immediately, this person didn't even know they could do it. "openssl dgst -sha256 filename". An answer that they'd need to check the man page would've been sufficient...

Would you have accepted a python solution? I typically don't do this type of stuff using raw openssl on the rare occasion I need it.

I would have accepted even the person knowing and confirming they were aware SHA1 is obsolete

Does anyone have a tutorial on using the openssl cli? It seems to barf on some inputs if it's not exactly perfect or you miss a step in the stack overflow answer.

Honestly I would expect some to be more familiar with the hashXsum tools.

I would expect that. But the lack of knowing the definitions is embarrassing

4 minutes later, someone registered that domain

Don’t mind me; just checking for any automated scripts that are watching for unregistered domains mentioned on here:

SmallPPDomainRegisterBot.com

This domain does in fact point to a potato shaped like genitalia. Either someone had $10 to spare for a laugh or the bot does exist

how would you differentiate a script from a troll?

A mystery for the ages.

SmallPP-HN-Troll.com

Troll the troll into trolling themselves?

What’s the difference in this case?

Wasn't me! But I expect my hackerman handle when you get your infra set up, anonymous registrant! :p

You should grab Hackerman31337 first. That will be worth something.

i call dibs on [email protected]

They should just redirect ForeignEmailDomain to whatever the real foreign email domain was lmao. What is it, Tutanota? ProtonMail? FastMail? Lmao

> on or about August 24, 2022, the OCE deposited approximately 0.64053413 units of the requested cryptocurrency, worth approximately $99.90 USD

Monero was worth $154 on August 24th, is a privacy crypto and .64 of that would be $99

And he worked at NSA for under a month.

I'm guessing he fell for some internal honeypot, and that led to his immediate termination and subsequent monitoring. Then he also transmitted the honeydocs and the rest.

Sure they traced the crypto but that's not how they got him.

This is interesting, I wonder if he quit or got fired. Bit of a red flag to work for the NSA and quit after a few weeks lol

As opposed to the domestic email providers that willingly hand over private info when they ask politely?

The NSA has 32,000 employees. Not everybody there is a Ramanujan...

>Guy has a background in infosec, an holds a CISSP cert, among others

Like I said...

Brilliant! Also try "ShadyForeignEmailProvider.com"

that's taken, I suggest NotShadyForeignEmailProvider.com