You're talking out of your ass. As a person who was born in Croatia and lived there for almost 25 years I can tell you that Croatia has been extraditing people left and right for years now.

I don't know what kind of lawless country you're imagining, but in reality Croatia is subject to EU laws, cooperates with lots of international institutions, has very strict anti-drug laws and there is no way an international criminal of DPR's profile would ever be safe there. I've seen my friends go down and get criminal records over a few grams of weed... DPR would have someone knocking on his door as soon as his cover was blown.

Ex-soviet countries would be a much safer bet as they don't seem to want to cooperate with US authorities (Snowden et al). Central America might also be a good bet, but then you risk getting killed by the cartels for undermining their business model, if they ever find out who you are.

I mentioned this in a reply below, but I'm an American who lived in Croatia for a little over a year. I lived there with a few other Americans. I'm not sure if any of this is true, but we were told Croatia has very strict anti-drug laws. We were told that if we were caught with any amount of drugs whatsoever we would be instantly deported, no questions asked. I wasn't sure if it was a "you better not do it" exaggeration warning or it was truth. Either way, once a police officer stopped a few other Americans I was living with on the street out of the blue and flat out asked them if they were carrying any drugs. I wasn't with them at the time, I only heard the story when they got home. They were obvious foreigners because they were speaking English to each other while walking down the street. I believe the officer also checked everyone's IDs and the papers we had to carry that showed we registered our address with the local police. Yes, as foreigners staying in Croatia we had to register with the local police.

This still applies. Of course it would just make them that much more pissed at you since they had to do more paperwork to nab you.

You think so? One of my college professors was jailed in Kazakhstan because he neglected to bribe one of the customs workers on his way out of the country. That professor had grown up in Kazakhstan and still managed to get screwed over by the government there -- even after he was released, he could not get his money back, as the authorities had "lost" it.

The reality is that there are benefits to living in a developed country, even the USA. I can understand why he would not have wanted to leave even though he was running SR, even with the risks of being caught.

  so many precautions

Sure, he re-used a few login names but I don't know how many people could've successfully gone without doing that over a 2.5 year period. I think it's more accurate to say he "wasn't perfectly careful" than it is to say he was careless.

The Grugq addresses this issue by recommending that one set up an entire fake persona before doing anything, and then doing all the activities "in character" as that persona. If you stay in character, then even making the types of mistakes DPR made would only lead the authorities to the persona rather than yourself.

Granted, this video didn't exist when DPR made Silk Road...

However, I'm not sure how his academic discussion about OPSEC "pimps an image" for his 0day business -- wouldn't security researchers writing 0days not really need the advice in OPSEC For Hackers since they are still acting legally?

Your own government isn't your only potential enemy.

True story: A friend of mine works for a large defense contractor. He's done a fair amount of foreign travel to support projects on foreign soil. Not clandestine projects, they are fully above board with the cooperation of the host countries, but as Kissinger said, america has no permanent friends or enemies, only interests. (Kissinger's a douche, but he's right about that)

The result of all his work travel is that he's made it onto spear-phishing lists at all kinds of national hacker groups. His employer's IT security has had to put his corporate email address in a special group that gets extra scrutiny because of all the attacks directed specifically at him.

That is the difference between a professional and an amateur. An amateur tries hard to get things done, but doesn't really pay attention to methods or details. A professional knows that methods and details matter more than knowledge... and uses best practices to get things done.

If you're running the worlds largest illegal market place, the primary goal should be security and privacy. He re-used login names by accident, or maybe even just laziness.

A simple way of avoiding the above issue is to have a "personal" computer with personal accounts and activity, and a "work" computer, with work accounts and activity. Never use the work computer at home, and never use the home computer in the same place you use the work one. There's no way to confuse identities or traffic patterns.

I think Silk Road is proof of just how good Tor is. It can protect you from governments who are trying to find you. It can even protect someone who knows nothing about programming or security.

He definitely thought he was untouchable, a clear sign of an amateur. Even after all the press touting the fact he was running a huge illegal drug market under the FBI's noses, he continued to carry on like he wasn't going to get caught. Even the most low level criminals have a healthy sense of paranoia. Even close calls will make them completely change how they do things.

Even if he took the modest steps you proposed, he could have wiped and then physically destroyed the HD, tossed into a trash bin and flee the country for a few years until things quieted down. I mean, he had plenty of money, in the most secure, untraceable form so it would've been cake to hideout for a few years or forever if need be.

The problem with this approach is that you need to never use the wrong computer for the wrong thing. You can help yourself somewhat by setting up different window colors / desktop backgrounds / etc, but what happens when you go visit your great aunt for thanksgiving and forget to pack both laptops? What happens when your work laptop breaks, and you desperately need to update the site to deal with some issue?

A more reliable approach would be to have one computer with two accounts (or if you like technically sophisticated approaches, use a mandatory ACL system), one for work one for personal things. Set up each account with noticeably different colors / themes, so that you are less likely to accidentally use the wrong account for the wrong thing. If you forget/damage your laptop, you have less of a temptation to use the wrong computer.

I am sure that Truecrypt fans will point out that hidden volumes work equally well, though the extra effort required is something of a stumbling block in my opinion (and I am not a big fan of hidden volumes to begin with).

One PC, two accounts, breaks for some things, like Flash cookies, etc.

The other alternative is running a "clean" VM inside the "dirty" machine. But that's again likely to cause issues.

I guess you want to pick names that have lots of false positives when searching. But of course you can't ping google to check. Is there a known mechanism for this? I guess the old dice + newspaper to pick a phrase?

Maybe I'm too sensitive about this since nobody in the history of the known universe has the same name that my parents picked, so any hits in search engines are never about anyone else. Unique usernames function the same way.

I think that's right. I got my first modem in 1985 and been on the Internet since the start of the 90s. I never re-use user names between sites, frequently delete my accounts and start with fresh ones.

I've started recently using random word generators to generate common words to use as usernames.

Whenever I want a username that isn't associated with any internet persona of mine, I look around on big forums for names and start googling them. I think the best is to find one that's a character in some obscure book/story, and then pick another character from that story - thank Wikipedia for having this type of info for all sorts of things. Best is something odd enough that it isn't likely to be taken already, but still common enough that the search results for it are too noisy to see a few forum posts.

But then, it depends a lot on what you're trying to hide, and who you're trying to hide it from. Keeping bored teenagers on 4chan from finding your home address and keeping whole departments of the FBI from tracking you down are whole different ballgames.

Actually, part of me would like that to catch on for pseudo-anon usernames, so I'm not quite as trackable between accounts.

Ideally I guess I'd come up with a few dozen random name systems, and hop between them for each account... such a hassle.

a) He's Ross "Patsy" Ulbricht

or

b) He wanted to be caught, and set some mighty precedents.

or...

c) He's sloppy.

Living in San Francisco might have allowed him in hide in plain sight. Who is going to suspect a 20-somthing year old who lives in San Fran of running a multi million dollar drug business. He doesn't attract attention to himself, especially from his family and friends who are most likely to report any suspicious behavior of his to authorities. If he moved overseas and started buying mansions in cash, a red flag somewhere might have gone off. His family might start asking questions he didn't have the answers to. After all, the unabomber was only caught because of the suspicions of his sister in law and brother.

He might have thought of himself as immune to being found out, so it didn't occur to him to move. He was content where he was, and just stayed. Getting caught didn't even come to mind, because he was so confident in himself. He obviously was confident.

You actually have to convert them to cash first.

And that process becomes increasingly more difficult as you go from selling 1 to 10 to 100 to 1000 BTC.

At each step you lose more and more of your anonymity and safety...

Because you can't open up a MtGox account and offer 10k BTC to then cash out anonymously, nor create a localbitcoins account and use meatspace for this large amount without possibly getting robbed or killed.

Not to mention some of those transactions can be traced back via the chainblock after-the-fact, creating more problems for you as now the FEDs know it's SR related.

And that even does not bring up the fact that large transactions can easily cause BTC prices to go down dramatically, since the majority of upticks are based on small transactions that are fraudulently gaming the system.

I imagine DPR basically had little to no money and a lot of BitCoins he could not sell.

My guess would be that if he had this type of btc, he'd begin to work on establishing reliable, trustworthy in-person communicants to perform his big transfers. Perhaps another reason why SF was an important place for him to be. It'd also be intelligent to bring some muscle along to the transfer.

>Not to mention some of those transactions can be traced back via the chainblock after-the-fact, creating more problems for you as now the FEDs know it's SR related.

Obviously, all bitcoins obtained from this type of activity should automatically go through a thorough, trustworthy mixer, perhaps even one that the btc owner wrote himself.

Both narcotics trafficking and murder-for-hire are things for which the US has been known to send armed agents -- or actual military -- into foreign countries without coordination with the local government to capture people to be brought back to the US for trial.

> Even just hopping the border to Mexico would've required them to get international cooperation and extradite him.

No, it wouldn't. See, e.g., United States v. Alvarez-Machain, 504 U.S. 655 (1992)

You think Croatia or Kazakhstan don't have anti drug laws? You think they have stricter rules about police, law enforcement, or picking people up off the streets? You think those countries have nicer prisons and less corrupt judges and cops than USA?

It's not just cash. It's political favours, foreign aid, trade deals, international bodies etc.

my bets would be either Yugoslavia

Well that country doesn't exist any more, it broke up. Some of the former Yugoslavia are in the European Union (Croatia, Slovenia). The rest want it. "Oh sorry, we can't let you in/let you in the eurozone/let you in schengen until you abide by international law and extradite these people!". This has happened before, with war crimes, and generals in the Yugoslav wars.

For two, there is no extradition treaty between the U.S. and Croatia. For three, the only reason I listed Croatia was because it is so often referenced as a place to flee if the U.S. government is after you:

http://nakedlaw.avvo.com/crime/how-to-rob-a-bank-and-flee-th...

http://www.policymic.com/articles/48417/where-is-edward-snow...

http://www.dailyfinance.com/2013/06/11/best-countries-no-ext...

Hopefully that's enough - I invite you to use Google to decrease the level of your incredulity in regard to Croatia being a haven to hide from the U.S. It might not be the best place but a lot of people seem to think it is.

Don't give me silly articles. I am an American who has lived in Croatia and I'm pretty familiar with how the average Croatian views the United States, and I am pretty confident in my experience that they would have no problem handing him over even without a formal treaty. There is literally no reason to not do it.

http://daily.tportal.hr/211771/Ukrainian-hacker-wanted-in-US...

http://www.croatiantimes.com/news/General_News/2012-08-31/29...

American and Croatian police have worked together to arrest Ukrainian hacker Sergei Litvinenko in Croatia, reports Croatian radiotelevision.

Litvinenko was wanted by US federal police for fraud he had committed in the United States. The federal courts had issued a warrant for his arrest and he was caught in Croatia earlier this week.

There is literally no reason why they wouldn't extradite such a highly valued criminal to the US, formal treaty or not. The ties between the two countries are too strong.

You don't see them extraditing Snowden, do you? Regardless, despite your lack of tact you claim to know more about Croatia than I do and you dismiss web citations that claim to know more than you so it's pointless to discuss further.

If you did, you would find the last one points to this PDF on the US Dept of State Website: http://www.state.gov/documents/organization/71600.pdf which is CHAPTER 209--EXTRADITION of CRIMES AND CRIMINAL PROCEDURE.

That lists Yugoslavia which isn't even a country anymore, but has a note

\1\ For the successor States of Yugoslavia, inquire of the Treaty Office of the United States Department of State.

Croatia is a successor States of Yugoslavia, however, I originally ignored that because I thought I'd have to contact the State Department. Then I decided to see if that info is published. Alright, Lets check out the Treaty Office of the United States Department of State.

Here's the Treaties in Force list.

http://www.state.gov/documents/organization/202293.pdf

Under Croatia it lists

JUDICIAL ASSISTANCE CROATIA — INVESTMENT Agreement on enhancing cooperation in preventing and combating serious crime. Signed at Washington February 16, 2011. Entered into force August 19, 2011. TIAS

That's pretty vague, but there is some agreement there.

If USA wants you in Croatia or virtually any Balkan or third world country not slaved to China /Russia, you will be placed in a private FBI jet in no time.

Maybe he's like me.

There are plenty of countries that would scoff at extraditing him for this simple fact of not having a treaty. Even countries that we do have a treaty with would've locked up extradition in the courts for years because he's facing life imprisonment for making a website and a bunch of other garbage they found on his servers:

http://www.latimes.com/business/la-fi-ulbricht-hearing-20131...

If convicted, Ulbricht could be sentenced to life in prison.

They're also charging him with paying to have someone killed merely based on chat logs. They even said there's no evidence anyone was killed or frankly any evidence at all other than the chat logs.

Let me translate that Russian for you: "We'll trade you Snowden for Poteyev."

Given there are so many independently wealthy people living in San Francisco, it must have its charm.

Edit: Edited city

I'm pretty sure he wasn't relying on his physical location to protect him.

[1] http://www.dailytelegraph.com.au/news/nsw/ross-william-ulbri...

In small countries with no culture of westerners living there long term he'd stand out like a sore thumb. In dictatorial countries they'd think he was a CIA operative and be tailed. Oh, and upon capture he'd be beaten until he told them every little secret, bitcoin passwords included.

So good old USA was better and SF is probably the best way for a guy "acting weird" and staying online all the time to hide. He should have retired a year ago. It's a like playing in a casino, you're bound to lose long term

It does however look like you have a pretty big list to work with: https://en.wikipedia.org/wiki/Extradition_law_in_the_United_...

I happen to be from Croatia and currently live in a less then touristy part of central America and guess what? While us western white folks aren't exactly saturating the local landscape, there are more than enough travelers/students/business people from the US and other Anglo countries here long term for us not really get considered that big of a deal.

Same rules apply to many other places I've been. There's lots of travel happening in the world these days and foreigners in developing countries are hardly a big wonder.

Ulbricht could have easily moved to a dozen different countries in central america, south america or eastern europe and southeast asia and comfortably stayed anonymous in any of them.

http://overlapmaps.com/print.php?defaultZoom=2&defaultLat=39...

"You'd think" is often true when "you'd be correct to think" isn't.

Survivor Bias.

The criminals that do all of the obvious smart things are much less likely to get arrested. The ones that do get arrested, are disproportionately the ones that did something not-smart. The the larger the quantity and (not-)quality of their mis-steps, the more likely they are to be the one you read about for being arrested.

Living in SF seems like a fairly reasonable mistake--it's simple confidence that you won't be caught.

Some of their mistakes may go unnoticed for a long period of time, but in the long run, just one mistake is all it takes for everything to come undone.

One of my goals is to put myself in a situation to live comfortably on the North Shore of Oahu in the future, because that's where I want to be.

I've always had a pull away, out into a large unpopulated area and it makes complete sense that some people have the opposite. The hustle and bustle can have it's allure and with that many different people around, things are always interesting. It's night that gets me. I love stepping out into a clearing on a star filled night with no noise besides the bugs and my own feet in the leaves.

* dirty

* traffic

* a great deal of self-important wannabes

* _astronomical_ cost of living compared to "less desirable" environs like Denver, Omaha, Salt Lake, Dallas, or other large mid/mountain west localities

* family unfriendliness, as the chic "millennial" crowd despises children

* bad politics that impact everyday life (gun ownership, etc.) and high tax rates

and there are many other reasons to _not_ want to be in one of those hotspots.

Surprising as it may seem to some of you, there are cool and interesting people everywhere.

(The last actually fits in (b), but for a different attitude than the others.)

And the person in question is at least of the generation, and arguably of the attitude referred to in those other than the last, so its a pretty unconvincing list of why you'd think that person wouldn't want to live there.

The subject of the article obviously was at least semi-content living in SF, as he definitely had the means to depart if he wanted to do so. My list is meant more as a general reply to "why wouldn't someone want to live in one of those places?" It may just be my background of living in several different places, but personally I have a difficult time grasping why people assume that LA, SF, NY, or Chicago are the only reasonable places to live.

And, places do not have to be dirty, crowded, or high-traffic just because a lot of people want to live there. If things are designed reasonably and the populous behaves reasonably, traffic should continue to flow, there should be adequate personal space, and thoroughfares and public places should be clean and satisfactory.

No man is an island. The people you surround yourself with matter.

I agree that dependent on the level of immersion necessary, serious improv practitioners may find places that aren't the cities you listed restrictive, but there are well-attended improv troupes in other areas.

This I agree with wholeheartedly, which is why, despite having grown up in California, I'm not currently living there and have no plans to move back in the terribly near future.

However, I think all of the other things in your list can also be found nearly everywhere. It all depends on your perspective and your desires.

For what it's worth, from someone who has a great deal of experience living in many different cities, including San Francisco, it's a perfectly serviceable place to live. It is slightly inflated at the moment due to the tech demand, but not by much; otherwise the price reflects the value.

Good criminal spends his time preparing for when he gets caught.