WEBVTT 00:00:00.000 --> 00:00:01.000 [MUSIC FADES IN] 00:00:01.000 --> 00:00:02.000 This is "In Conversation" from Apple News. I'm Shumita Basu. Today, the hunt to bring down the biggest crime lords of the dark web. 00:00:02.000 --> 00:00:03.000 [MUSIC FADES OUT] 00:00:03.000 --> 00:00:04.000 [TENSE MUSIC] 00:00:04.000 --> 00:00:05.000 On the morning of July 5th of 2017, a group of undercover agents were all posted around a quiet cul-de-sac in the outskirts of Bangkok, Thailand. 00:00:05.000 --> 00:00:06.000 One of them is pretending to be an electrician working on a wiring box on a telephone pole. Another is pretending to be a gardener. Two are pretending to shop for real estate in this house at the end of the street. 00:00:06.000 --> 00:00:07.000 That's Andy Greenberg. He's a senior writer for "WIRED." 00:00:07.000 --> 00:00:08.000 There's also a whole team of agents and prosecutors in this war room, across the city, in the Thai police headquarters, who are watching all of this on a live surveillance feed. 00:00:08.000 --> 00:00:09.000 The agents see that the target is in position… 00:00:09.000 --> 00:00:10.000 And they say it's go time. Like, let's do this. 00:00:10.000 --> 00:00:11.000 What Andy is describing here is the end of a massive international sting called Operation Bayonet. It brought down the biggest illegal marketplace on the internet, the man who was running it, and so many other bad actors. This is a classic "follow the money" story, but with a twist: How do you follow cryptocurrency transactions? 00:00:11.000 --> 00:00:12.000 See, all the bad actors on these sites saw cryptocurrency as the ultimate anonymous handshake. A digital briefcase at a drop spot. Untraceable. Now, what they weren't counting on was what could happen if someone was methodical enough to pay attention to all of your transactions, all of your movement, and start to piece together the puzzle of your identity. 00:00:12.000 --> 00:00:13.000 Bitcoin is really the opposite of untraceable. It's extremely traceable, and it's kind of like a roadmap to everybody's finances that ultimately would serve as a kind of trap for people seeking financial privacy and all sorts of criminals that persisted for years. 00:00:13.000 --> 00:00:14.000 In his new book "Tracers in the Dark: The Global Hunt for the Crime Lords of Cryptocurrency," Andy lays out how law enforcement used this kind of problem-solving to take down some of the biggest, baddest dealers on the dark web. 00:00:14.000 --> 00:00:15.000 We'll tell the whole unbelievable story of Operation Bayonet in just a bit. But first, Andy says you gotta understand how all of this hinged on a pretty big misunderstanding a lot of people have about what you can and can't know about cryptocurrencies transactions. 00:00:15.000 --> 00:00:16.000 [MUSIC FADES OUT] 00:00:16.000 --> 00:00:17.000 It almost sounds ridiculous to think that Bitcoin could be anonymous or untraceable when it is based on this thing called the blockchain. The way that Bitcoin works is that instead of sort of depending on any government or bank to guarantee and record every transaction, it's all recorded in the blockchain. This thing that is like a list of every Bitcoin transaction that's copied out to thousands and thousands of computers around the world. And the only sense in which a Bitcoin can even be said to exist, or to move, or to be spent, is because it's recorded in the blockchain. The only reason really that like, I and many other people like me once believed that Bitcoin could be anonymous anyway is because the blockchain didn't seem to contain any identifying information. It just recorded transactions between Bitcoin addresses, these long strings of indecipherable characters… 00:00:17.000 --> 00:00:18.000 Digits and numbers, right? Yeah. 00:00:18.000 --> 00:00:19.000 Right. Like 34, you know, letters and numbers, and that didn't seem to identify you. If not anonymous, it at least seemed to be pseudonymous. Like, every transaction hid behind a pseudonym for the sender and recipient. And even Satoshi Nakamoto, it's worth noting, this mysterious creator of Bitcoin, even Satoshi wrote in the first email to a cryptography mailing list, introducing Bitcoin and kind of listing its features that participants can be anonymous. So, you know, we were all really sort of set up for this mistake [CHUCKLES] or this, you know, delusion that Bitcoin could be spent anonymously. 00:00:19.000 --> 00:00:20.000 And what was supposed to be the promise of that? 00:00:20.000 --> 00:00:21.000 You know, who knows what Satoshi really imagined. Satoshi definitely believed in privacy. And you can see that by the fact that Satoshi, among all of Bitcoin's participants, truly has remained anonymous. Satoshi still has not ever been identified, which is kind of amazing. But for a lot of, you know, Bitcoin's early adopters, it promised a kind of safety valve from the traditional finance system with all of its inherent surveillance. I mean, every credit card transaction you make is just so easily viewed by corporations and can be grabbed by governments quite easily, too. And it seemed like Bitcoin was an antidote to financial surveillance of that kind. But it also appealed, I think, to a sense that like, this could be used to truly flout laws, like, for libertarians, but also for criminals, like, this… Just as I believed when I first saw Bitcoin, it seemed, I think, to be a kind of anarchist currency for the Internet. And that meant that you could do all the things that you do with cash in the world of both privacy-seeking behavior, but also crime. You know, this is like, essentially, these are unmarked bills in a briefcase that you can send to anyone in the world, and with all of the implications that brings with it. 00:00:21.000 --> 00:00:22.000 Now, you talk to so many people throughout the book. People who work in various law enforcement agencies in different countries, some just work for private, sort of, cyber-security companies, and they all have this common goal of trying to understand how to trace this seemingly untraceable form of currency. How do they think about unlocking that code? 00:00:22.000 --> 00:00:23.000 Well, the first person to really kind of just to check how untraceable really is this, you know, supposedly anonymous currency was Sarah Meiklejohn, a researcher at the University of California San Diego. And, you know, her intention originally was almost like anthropological. She just thought like, I wonder how many people really are using Bitcoin behind all of these like, Bitcoin addresses, these millions and millions of addresses. I wonder how many people there really are here. And so, she started to come up with tricks. First, just to kind of see how she could cluster these addresses and show that, you know, dozens or hundreds or even thousands of them belong to a single person or Bitcoin using service. But then she started to come up with more tricks to be able to kind of follow the money. And she also realized that if you could follow the money, if you could trace it from one address to the next, to the next, until, for instance, it hit an identifiable service… Maybe you identified that service even by transacting with it yourself, almost like an undercover agent. But also, if you could trace the money to a cryptocurrency exchange that could be sent a subpoena by law enforcement, very often, those exchanges, even back then, and this was in 2013, they recorded people's identifying information. In fact, they were legally required to, if they did any business with Americans. So, she very quickly realized that if you can follow this money from address to address until it hits one of these identifiable places, you can very often figure out exactly whose money this is, how they're spending it, and who they are, in a way that is sometimes even more transparent than the traditional finance system. And she, along with her co-authors, published this paper in late 2013 that, I think, sort of blew the first big hole in this myth of Bitcoin's untrace-ability. 00:00:23.000 --> 00:00:24.000 [SMOOTH GUITAR MUSIC] 00:00:24.000 --> 00:00:25.000 Law enforcement groups have long struggled to figure out ways to curb illegal online markets. The first major darknet marketplace was known as the Silk Road. At its peak, the site was generating about 300,000 dollars in sales a day, mostly in illegal drugs. Federal law enforcement managed to shut it down in 2013. 00:00:25.000 --> 00:00:26.000 There was this game of sort of whack-a-mole of different new markets sort of vying for supremacy in this online underworld. 00:00:26.000 --> 00:00:27.000 Eventually, a site called AlphaBay rose to the top, and it grew to become the biggest dark web marketplace anyone had ever seen. According to one estimate, the site was generating as much as two million dollars a day in average sales. Along with illicit drugs, you could also buy weapons, poison, even stolen data. Now, this is where the story of Operation Bayonet really starts. With this mysterious person, the creator and administrator of AlphaBay, who went by the pseudonym Alpha02. 00:00:27.000 --> 00:00:28.000 [MUSIC FADES OUT] 00:00:28.000 --> 00:00:29.000 Alpha02 initially seemed like this untouchable figure. Every law enforcement agency in the United States at least, but probably around the world, they were all looking at Alpha02 as this guy who seemed to be just a step ahead of them, and they couldn't find like, any way to identify him. And it was only in November of 2016 that this tip came into the Fresno office of the DEA, of all places. And that tip was that in AlphaBay's earliest days online, it turns out that if you signed up, not for the market itself, but for its user forums, you would get a welcome email. And for a brief period, the metadata of this welcome email included an email address: pimp_alex_91@hotmail.com. 00:00:29.000 --> 00:00:30.000 Interesting. Hotmail, huh? [INDISCERNIBLE] [CHUCKLES] 00:00:30.000 --> 00:00:31.000 Yeah. Well, you know, 2014, it's hard to, like, I don't wanna judge. 00:00:31.000 --> 00:00:32.000 I guess so. No judgment. Yeah. 00:00:32.000 --> 00:00:33.000 This is very quickly fixed on AlphaBay's user forums. But this tipster had gotten that email, held onto it for two years as AlphaBay grew into the biggest dark web market ever, and then, finally, in the fall of 2016, passed that on to DEA agents in Fresno. 00:00:33.000 --> 00:00:34.000 From there, agents began to search for where else this email address had been used. 00:00:34.000 --> 00:00:35.000 Very quickly, they found forum posts by this guy, Alexandre Cazes, who it turns out was born in 1991. Pimp Alex 91. That's, you know, 91 is his birthdate, it turns out. 00:00:35.000 --> 00:00:36.000 They learned he was French Canadian. They found his LinkedIn page, which said he was a web developer. And they saw that he had a Thai fiancé. 00:00:36.000 --> 00:00:37.000 And when they looked at her social media and her family's, they saw that Alexandre Cazes now lives in Bangkok, in Thailand. And not only that, but he now owns a Lamborghini, and a Porsche, and a villa in Phuket, in the south of Thailand. Like, not the typical stuff owned by the average web developer anyway. 00:00:37.000 --> 00:00:38.000 The signs were all there. This guy, Alexandre Cazes, appeared to fit the bill for Alpha02. But the anonymous tip, the email address… After all these years of searching for him, it seemed a little too good to be true. 00:00:38.000 --> 00:00:39.000 It just seemed like, too easy. Like, maybe this tipster was setting them up, like, maybe somebody was even trying to frame this guy, Cazes. 00:00:39.000 --> 00:00:40.000 [SYNTHWAVE MUSIC] 00:00:40.000 --> 00:00:41.000 This is where cryptocurrency tracing comes into the story. So, around the time the Fresno office got that tip, two FBI analysts in Washington were also trying to figure out a different way to confirm Alpha02's identity. 00:00:41.000 --> 00:00:42.000 They set out to do something nobody had ever done before, which was to identify a dark web drug lord through cryptocurrency tracing alone. And their idea was sort of based on this phenomenon called exit scams. 00:00:42.000 --> 00:00:43.000 An exit scam is when a market administrator steals all the money that users have in their wallets. And often, when an exit scam happens, people get spooked, and they start pulling their money off the market. These analysts realized that the one person who would never have to worry about an exit scam would be the administrator himself. In this case, Alpha02. 00:00:43.000 --> 00:00:44.000 So, they searched for the black market addresses on AlphaBay that had held the largest sums of Bitcoins and that sat unmoved, even through multiple exit scams. And then they followed those coins to a crypto exchange where the money got cashed out. 00:00:44.000 --> 00:00:45.000 Lo and behold, the holder of that account on that cryptocurrency exchange was Alexandre Cazes. By following the money, they had really proved who Alpha02 was in an incontrovertible way. They eventually followed out more than a dozen of his money trails to different cryptocurrency exchange accounts in his name and his wife's name. And there could be no question that Alexandre Cazes was running the biggest dark web drug and crime market in the world. 00:00:45.000 --> 00:00:46.000 [MUSIC FADES OUT] 00:00:46.000 --> 00:00:47.000 So, this all culminates in this incredible scene in your book, the eventual arrest of Alexandre Cazes. Tell us what happened. How did they plan it? And of course, the important details here is that the key was to catch him in his home with his laptop, but his laptop had to be open, unlocked. His computer needed to be accessible. 00:00:47.000 --> 00:00:48.000 Well, Alexandre Cazes had learned from the story of the Silk Road. The administrator of that site, Ross Ulbricht, had his laptop grabbed out of his hands in a public library in San Francisco where he was working. And although Ross Ulbricht had a kind of encryption on that laptop where if he could have just closed the lid of the laptop, all of his secrets would've been encrypted, such that probably even the FBI would not have been able to crack them. They were able to grab his laptop open because he was working in public. And, you know, as foolish as that might sound. So, Alexandre Cazes learned that lesson and not only did he use this kind of hard disc encryption on his laptop, but he never even opened it outside of his home. So, even once they knew that Alexandre Cazes was running AlphaBay, they had this really serious challenge, which is how do we get his laptop in this open and unencrypted state when he never opens it outside of his home. 00:00:48.000 --> 00:00:49.000 Well, like anyone who is Extremely Online, Cazes wasn't just Alpha02. He hung out on other internet forums, using other usernames. 00:00:49.000 --> 00:00:50.000 He was also this other pseudonym on a pickup artist forum where he just posted like, almost obsessively about his extremely prolific sex life. He had just like, endless extramarital affairs. 00:00:50.000 --> 00:00:51.000 When Cazes used this forum, a little icon would change color, meaning that he was online, and his laptop was open and vulnerable. So, law enforcement decided they would stake out his house, wait for that icon to pop up, and then somehow get him to walk away from his laptop. Now, they just needed to figure out how to draw him out of his home. 00:00:51.000 --> 00:00:52.000 They'd gone through all sorts of different possible plans, like setting a fire in his dumpster or like, having a woman scream on the street or deliver a package to his house. 00:00:52.000 --> 00:00:53.000 [PENSIVE MUSIC] 00:00:53.000 --> 00:00:54.000 Eventually, they settle on a plan, and that's how we end up on Cazes' street in Bangkok. Remember, they were undercover agents, planted all around his home, just waiting for the signal. And when they get it, when that icon lights up, they know that he's online, and it's time to engage the plan. 00:00:54.000 --> 00:00:55.000 [KEYBOARD TAPPING] 00:00:55.000 --> 00:00:56.000 [COMPUTERIZED BEEPING] 00:00:56.000 --> 00:00:57.000 [CAR ENGINE RUMBLING] 00:00:57.000 --> 00:00:58.000 This Toyota Camry pulls onto the cul-de-sac, driven by two Thai women who are also, of course, undercover police agents. And they sort of pretend that they've just taken a wrong turn and they go down to the end of the cul-de-sac, and then do a three-point turn, and they very deliberately crash the rear bumper of their car into Cazes' front gate. 00:00:58.000 --> 00:00:59.000 [COLLISION NOISE] 00:00:59.000 --> 00:01:00.000 [METAL SCRAPING] 00:01:00.000 --> 00:01:01.000 But Cazes doesn't come out. It's his wife who comes down. Things were not going according to plan. But the undercover agent stays in character. 00:01:01.000 --> 00:01:02.000 She like, sort of flaps her arms haplessly and says that she's just learning to drive and apologizes and asks, can you please have your husband come down so I can talk to him about paying for the damage? Please let me pay for the damage. And sure enough, his wife calls up to him. 00:01:02.000 --> 00:01:03.000 [MUSIC FADES OUT] 00:01:03.000 --> 00:01:04.000 And Cazes comes down. 00:01:04.000 --> 00:01:05.000 [CUSHIONED FOOTSTEPS] 00:01:05.000 --> 00:01:06.000 [INTRIGUING MUSIC] 00:01:06.000 --> 00:01:07.000 He's like, shirtless and shoeless. 00:01:07.000 --> 00:01:08.000 He's assessing the damage, and then he sees that one of the undercover agents from down the street has put on a police vest and is running towards him. 00:01:08.000 --> 00:01:09.000 [RUNNING FOOTSTEPS] 00:01:09.000 --> 00:01:10.000 As soon as Cazes sees this, he understands exactly what is happening. He realizes that he needs to get back to his laptop, that he's left it open. He goes into fight or flight mode. He spins around and tries to run in through his gate. 00:01:10.000 --> 00:01:11.000 [RUNNING FOOTSTEPS, HEAVY BREATHING] 00:01:11.000 --> 00:01:12.000 Multiple agents close in on him and take him down. Meanwhile, another agent runs into his home. He's studied the floorplans; he knows it by heart. 00:01:12.000 --> 00:01:13.000 [RUNNING FOOTSTEPS, HEAVY BREATHING] 00:01:13.000 --> 00:01:14.000 [THUD] 00:01:14.000 --> 00:01:15.000 [RUNNING FOOTSTEPS] 00:01:15.000 --> 00:01:16.000 He takes the steps two at a time. 00:01:16.000 --> 00:01:17.000 [DOOR CLICKS] 00:01:17.000 --> 00:01:18.000 He rushes into the master bedroom, and he sees it. The laptop. It's open, unencrypted. 00:01:18.000 --> 00:01:19.000 [MUSIC FADES OUT] 00:01:19.000 --> 00:01:20.000 And he says over the police radio: Officers, we have the laptop. Celebrations breakout in the war room. And they've essentially pulled off this impossible bust. 00:01:20.000 --> 00:01:21.000 [OMINOUS MUSIC] 00:01:21.000 --> 00:01:22.000 Cazes is arrested and taken to a jail cell at the Thai police headquarters. 00:01:22.000 --> 00:01:23.000 A week later, just before he's set to be extradited to the United States, Cazes is found dead in that jail cell. The investigators who pulled off the sting were crushed. Yes, they had the laptop, but Cazes' death meant that they lost a big potential source of more information. Both U.S. and Thai law enforcement say that he died by suicide. 00:01:23.000 --> 00:01:24.000 His defense attorney, his mother, both strongly believe that he was killed. I tried to investigate this, and I went as far as like, I got a coroner's report that is inconclusive. I ultimately could not solve that mystery. 00:01:24.000 --> 00:01:25.000 [INVESTIGATIVE MUSIC] 00:01:25.000 --> 00:01:26.000 Now, stay with me, because the story doesn't actually end there. It gets even bigger. Incredibly, this operation didn't only bring down the largest dark web marketplace, it also brought down the second largest. 00:01:26.000 --> 00:01:27.000 That's because, at the same time as American law enforcement and the Thai police were homing in on AlphaBay, the Dutch police, just by coincidence, happened to be closing in on another huge drug market called Hansa. Since 2016, the Dutch police had identified some of Hansa's administrators, quietly arrested them, and taken over their accounts. 00:01:27.000 --> 00:01:28.000 [MUSIC FADES OUT] 00:01:28.000 --> 00:01:29.000 So, once the Dutch hear about the AlphaBay impending takedown, they'd made this plan with the Americans that how about you take down AlphaBay just as we take over Hansa and run it in secret? And then, once you tear AlphaBay offline, once you seize this market and take it off the dark web, all of its refugees, all of the drug dealers and buyers will just flood to the second biggest market, which we will control. And that is exactly what they did. 00:01:29.000 --> 00:01:30.000 [CHUCKLES] Wow. 00:01:30.000 --> 00:01:31.000 Amazingly, it worked. And so, all of Hansa's users, and refugees, and dealers flooded into Hansa, where the Dutch police were in control. They had become the bosses of that market and they had kind of sabotaged all of its safeguards so that they could identify thousands of those users. They even did like extremely devious things, like trick drug dealers into downloading files that would then ping out their locations that would send their, like, home addresses, essentially, to the Dutch police. And thousands of really major dark web dealers were then identified this way. 00:01:31.000 --> 00:01:32.000 [TENSE MUSIC] 00:01:32.000 --> 00:01:33.000 Operation Bayonet ultimately took down both of these markets at the same time and led to hundreds of arrests, the seizure of hundreds of pounds of drugs, along with millions of dollars in cash and cryptocurrency. 00:01:33.000 --> 00:01:34.000 It succeeded at sewing a huge amount of distrust and paranoia into the dark web community. I mean, if you can't trust that even the administrators of a dark web market are not undercover agents… 00:01:34.000 --> 00:01:35.000 …then who can you trust? 00:01:35.000 --> 00:01:36.000 Sure. 00:01:36.000 --> 00:01:37.000 Andy says this was in many ways the beginning of a golden age of cryptocurrency tracing. Shortly after this operation, some of the same investigators went on to take down a child exploitation site on the dark web, arresting more than 300 men around the world and rescuing 23 child victims. 00:01:37.000 --> 00:01:38.000 And in just the last few years, U.S. law enforcement has carried out the first, second, and third biggest seizures, not only of cryptocurrency, but of money of any kind in the Department of Justice's history. But, like all things on the internet, when one forum shuts down, another eventually pops up in its place. 00:01:38.000 --> 00:01:39.000 [MUSIC FADES OUT] 00:01:39.000 --> 00:01:40.000 The dark web markets are back and certainly doing hundreds of millions of dollars in black market deals. Actually, as I was just finally able to sort of finish reporting out all the details of Operation Bayonet and this crazy takedown of AlphaBay, AlphaBay resurrected itself, you know, and the second in command of the site, known as DeSnake, relaunched AlphaBay. And it is once again, by some measures, the biggest market on the dark web, even though it's still just a fraction of the size of the original. 00:01:40.000 --> 00:01:41.000 Do you believe that there is such a thing as an untraceable crypto, or is it just a question of sort of staying one step ahead of everyone who's trying [LAUGHS] to crack the code? 00:01:41.000 --> 00:01:42.000 It's a super interesting and difficult question, and to be fair, I once believe that Bitcoin was untraceable. So, you know… 00:01:42.000 --> 00:01:43.000 Yeah. 00:01:43.000 --> 00:01:44.000 …don't believe anything I say, basically. But I think that this cat-and-mouse game is continuing more even than many cryptocurrency users believe. AlphaBay only allows the use of this more privacy preserving cryptocurrency called Manero that's designed to be truly untraceable, in the way that people once believe the Bitcoin was. And yet, you know, there was a case earlier this year in which 4.5 billion dollars was traced to this alleged money laundering couple in New York City. And you can see in the IRS's documents that were published, along with the criminal charges, that part of the money was transferred to Manero, and yet, the IRS continued to follow it. Bitcoin was created, as I said, as a kind of antidote to financial surveillance in some ways. And the fact that it turned out to be the opposite of that, that it in fact, set this trap for people seeking privacy is not entirely a good thing. You know, when I was writing this book, of course, you know, I did wanna write it in some ways as like a true crime detective story, but I also didn't wanna leave people with the impression that this is like a simple cops-and-robbers story. Like, there are good reasons to want financial privacy and to want to escape financial surveillance for journalists and dissidents and activists and repressive regimes. And the fact that cryptocurrency has not offered them that kind of necessary privacy is dangerous and is not like, a happy outcome. And when I discovered that Sarah Meiklejohn, the person who invented so many of these cryptocurrency tracing techniques that have now ended up in the hands of law enforcement in many cases, she feels quite ambivalent about that. 00:01:44.000 --> 00:01:45.000 Mm. Her concern being that it could be misused by law enforcement agencies? 00:01:45.000 --> 00:01:46.000 I think she has really valid concerns about the ways that cryptocurrency tracing could be used by governments around the world in lots of ways, including a kind of slippery slope into, perhaps, like, tracking sex work in exchange for cryptocurrency or other things. I mean, Sarah never said this, but I could imagine people paying for abortions in a post-Roe world with cryptocurrency and thinking that that was a way to evade law enforcement in a really legitimate way. And yet, they could be traced. And so, I think Sarah Meiklejohn, and I too have, you know complicated feelings about the fact that yes, you can trace cryptocurrency to catch all of these really serious criminals, but it is a form of financial surveillance with all of the ethical implications that brings with it. 00:01:46.000 --> 00:01:47.000 [MUSIC FADES IN] 00:01:47.000 --> 00:01:48.000 You can read Andy Greenberg's book, out now, called "Tracers in the Dark: The Global Hunt for the Crime Lords of Cryptocurrency," on Apple Books. You can find a link on our show notes page. 00:01:48.000 --> 00:01:49.000 [MUSIC FADES OUT]