The refusal to wear masks, which is a trivial form of "opsec" against infection, shows what happens.

It's boring, uncomfortable, unsexy, protects you against an outcome you think is low probability, and you don't find out if you're doing it right - only if you've done it wrong, by which time it's too late.

Besides, since these terrorists had no concrete grievance, only internet radicalization, they ended up doing more cosplay than effectiveness.

A funny side note with that... there was a recent theft of $3000 worth of Crest Whitestrips in my city that got some news attention. It was 3x 40-50 year old white folks that did the theft; the woman distracted the clerk while the two men loaded up. All caught on camera. AND THEY DIDN’T WEAR MASKS.

They had every opportunity to cover up their faces in a completely socially acceptable way and didn’t. C’mon.

I guess the only people who need to whiten their teeth right now are anti-maskers.

I've also thought about this, why most terrorists are so dumb.

I think it's because if they were smart, they would realize how hard it is to get away with it. This is literally one of the few criminal acts where no expenses will be spared in catching the perps.

Also, smart people tend to do something with their life, so they are less inclined to be attracted by terrorism.

Regarding Ross, once they figured out his name, it was over for him, USBKill or not.

>I've also thought about this, why most terrorists are so dumb.

My theory is that when a terrorist does a stupid thing there are millions of dollars available, and thousands of people trained and ready, to take advantage of that stupidity.

When we do something stupid a couple people might point at us and say slightly mean things.

Everyone is stupid at least a few times a day.

Public perception about the average intelligence of any type of criminal is likely influenced by survivorship bias: https://en.wikipedia.org/wiki/Survivorship_bias

On the bright side, an attested (N=1) method for de-radicalising former terrorists has been simply hooking them up. They may be dumb, but they're not stupid: https://www.theatlantic.com/magazine/archive/2001/12/all-you...

So we must sacrifice one person to save many?

What makes you think it's a sacrifice rather than a reverse proselytization (or de-radicalization as some call it)?

Also note that criminals are the ones who failed. We don't get to see how the successful ones are. Same with terrorists.

Unlike most other crimes, a terrorist act that goes unnoticed is almost by definition unsuccessful.

Well, there's a conspicuously unoccupied middle ground between the two, but if the terrorist's goal is only to inflict harm, without necessarily revealing the reason or taking credit, they would presumably prefer their actions to look like a natural disaster, riot, (industrial/medical/etc) accident, forest fire, or other non-deliberate and/or non-planned event.

That is not terrorism though. The point of terrorism is to achieve political goals by spreading fear.

That's true by definition, sure, but that's not how governments actually use the word.

How would causing a riot not achieve political goals by spreading fear?

I dunno. I believe it's actually pretty easy to get away with lots of crime. It's just that the smart ones don't get caught.

> Also, smart people tend to do something with their life, so they are less inclined to be attracted by terrorism.

that probably plays a role. And they are perhaps more likely to consider the ethical dimension.

"Also, smart people tend to do something with their life,"

Dunno. The Unabomber had probably a higher IQ than most people on hackernews.

And on a side note: who cares about James bond? It is always the villain who makes or breaks a James bond movie. I am actually sad that Jet Lee never played the villain.

USBkill is useful if you want to prevent cops from seeing what you have saved in your porn folder. It wont stop them from tapping your facebook chats. Or bugging your basement prepper shelter. Or tracking your cellphone movements. In cases like this, whether the cops can pull anything from your harddrive doesnt change anything.

> There are really a few basic ground rules that always seem to be violated, even by those with seemingly sufficient experience, like Ross Ulbricht.

Well yes, for the people that get caught.

and then the DOJ always says "see! this proves you can't hide from us"

and everyone else on darknet is like "yeah here's the refined checklist implementation for how not to get caught and here's why" which should be like everyone's first purchase on any darknet market for $.99 and should be any vendor's primary first item for sale to gain reputation

I pretty much never see indictments that actually undermine the best practices.... you don't need to pay to understand the best practices, but it does save time to see what the tools are that implement those best practices, or understanding why some secret chat apps should be avoided versus others.

Getting caught is not just about OPSEC, but also visibility. The DOJ has limited time and resources, so will always go after the "big fish" and the cases that give them the best PR.

If you had two scenarios:

1. Great OPSEC, high profile

2. OK OPSEC, minimal profile

You're still at greater risk for scenario #1. When Ross Ulbricht did his Forbes interview and basically said "I dare the gov't to shut me down", he pretty much guaranteed they'd go to the ends of the earth to shut him down.

The only thing worse than committing multiple felonies is making the gov't look stupid or weak.

Right, you don’t want governments running half of the exit nodes looking for you, while posing as moderators, customers and running your whole website just to take you down in your ongoing crime.

But precise targeted activities that require investigation later are pretty ease to have sufficient OPSEC for.

Only correct you to say not about making the government look weak, it’s about the ego of the persons who are in leadership in those government organizations. Entirely about people and their careers and vanities and not so much about the government which belongs to us voters.

I mean if you see some dude with nothing for sale but "how to not get busted doing crimes really i promise.txt"...

More seriously, there's an element of performative deterrence in the way stuff like this gets handled. Giving people without the experience to know it's nonsense the idea they can't do dark web crimes and get caught probably cuts down on the rate of people dipping a toe into the exciting world of dark web crimes, where they can for example learn how to not get caught and then talk on the open web about how much they know I guess? What kind of opsec is that?

there is different OPSEC for different attack vectors

in the universe of dark web activities, most of them are not crimes and of the crimes most of those do not require stonewalling an eventual multi-jurisdictional state actor

there are just different OPSEC models, if we aren't talking about crimes its fine to talk on the open web about them, some of those OPSEC models would still accomplish thwarting the aforementioned threat model.

OpSec is HARD. It is a challenge for militaries, brilliant hackers and dumb criminals.

I once, just for the fun of the exercise, tried to set up an unused netbook and be as safe as possible.

It was incredibly difficult to not mess up, knowing what I know. In practice, I'd say it was usually convenience or rote behavior that caused me to 'compromise' the laptop.

It was a humbling experience, and while I had no aspirations to become a spy, it showed me how bad I'd probably be at it.

You never hear about the people who do take opsec seriously.

Criminals are not dumb, the ones you hear about are.

If you're that ambitious of a terrorist you have faceless minions to travel to internet cafes in distant locations and access the internet for you. Using Tails wouldn't do a damn thing for such a high-profile target, though; Osama bin Laden didn't have interwebs at all in Abbottabad, and the US government still dropped in for a visit.