WEBVTT 00:00:00.132 --> 00:00:05.520 JACK: I better do a warning here; this episode is gonna talk about drugs and dark markets, through 00:00:05.520 --> 00:00:10.380 like, the whole episode. If you’d rather not listen to me go on and on about drugs for an hour, 00:00:10.380 --> 00:00:15.840 you might want to consider skipping this one. Also, in my hope to listen to Episode 24 first; 00:00:15.840 --> 00:00:20.880 that one’s called Operation Bayonet which goes into detail about drugs being sold on these 00:00:20.880 --> 00:00:25.560 dark markets. Now, you don’t need to listen to Operation Bayonet first but it does explain a 00:00:25.560 --> 00:00:30.480 lot of stuff and leads you up to the events before this one so it’s a good idea to pause this one, 00:00:30.480 --> 00:00:36.840 go do Operation Bayonet first, and then come back to this one. [MUSIC] 00:00:36.840 --> 00:00:40.080 You know, the internet has really brought to life a whole new userbase 00:00:40.080 --> 00:00:43.980 that traditionally was very different. For instance, stock market trading; 00:00:43.980 --> 00:00:49.200 traditionally this was a very slow system. You first needed to get extra money to invest with 00:00:49.200 --> 00:00:53.520 which was easier to get decades ago. Then you’d call your broker to buy some stocks. 00:00:53.520 --> 00:00:58.800 Then you wait for a while and sell it maybe years later. During that time, 00:00:58.800 --> 00:01:03.540 you might check the paper like every day, once a day, once a week to see how things are going 00:01:03.540 --> 00:01:08.940 because that’s all you really had access to. But the internet has made stock market trading 00:01:08.940 --> 00:01:15.360 so different. You now have up-to-the-second data on stock prices, incredible tools to help you spot 00:01:15.360 --> 00:01:20.160 potential buys and endless YouTube videos of people teaching you how to do it. Stock market 00:01:20.160 --> 00:01:26.280 trading has attracted a much younger, tech-savvy audience now, too. People are in and out of the 00:01:26.280 --> 00:01:32.400 market in just a few minutes or seconds instead of years. You can set up trading bots or scripts and 00:01:32.400 --> 00:01:38.460 get alerts when prices hit a certain amount and it’s all done without talking to a single person. 00:01:38.460 --> 00:01:41.160 The traditional drug dealer has changed, too; it used to be all 00:01:41.160 --> 00:01:45.420 done on the streets through in-person meetings which means to be a drug dealer, 00:01:45.420 --> 00:01:48.720 you probably want to be a mean-looking person that nobody wants to mess with. 00:01:48.720 --> 00:01:52.440 You’ve got to be able to hold your own if the deal goes bad and not just let someone punch 00:01:52.440 --> 00:01:58.260 you in the face and steal all your stuff. But now, you can buy and sell drugs online and the 00:01:58.260 --> 00:02:03.600 online drug dealers are a completely different group of people. The street smarts have changed. 00:02:03.600 --> 00:02:07.980 Instead of being able to defend yourself in a bad deal, that’s been replaced with knowledge 00:02:07.980 --> 00:02:13.500 of shipping and packaging. Instead of knowing how to hide from the local police patrolling the 00:02:13.500 --> 00:02:18.300 neighborhood and how to make deals in public casually without attracting any attention; 00:02:18.300 --> 00:02:24.300 all that’s been replaced with the knowledge of being anonymous online because the most important 00:02:24.300 --> 00:02:29.760 thing for an online drug dealer is that they have to know how to stay hidden from the feds because 00:02:29.760 --> 00:02:35.700 it’s not your average cop looking for you. You’ve got a huge task force of federal law enforcements 00:02:35.700 --> 00:02:42.240 around the world all trying to figure out who the top sellers are of these sites. Every move you 00:02:42.240 --> 00:02:49.140 do online is being watched by them and you’ve got to be 100% that you’re maintaining your anonymity 00:02:49.140 --> 00:02:58.500 because one wrong slip-up of revealing just a tad too much information can have severe consequences. 00:02:58.500 --> 00:03:10.020 JACK (INTRO): [INTRO MUSIC] These are true stories from the dark side of the internet. 00:03:10.020 --> 00:03:25.665 I’m Jack Rhysider. This is Darknet Diaries. [INTRO MUSIC ENDS] 00:03:25.665 --> 00:03:29.280 JACK: 00:03:29.280 --> 00:03:35.640 Us humans are addicted to opioids. We love this stuff. Doctors have been prescribing it to us for 00:03:35.640 --> 00:03:41.520 decades in the forms of oxycodone, hydrocodone, codeine, fentanyl, and morphine. I might even go 00:03:41.520 --> 00:03:45.900 so far as to say there have been wars fought over this stuff. I mean, Afghanistan exports 00:03:45.900 --> 00:03:51.900 more opium than all other countries in the world. In 2001, [00:05:00] the US invaded it. I’m sure 00:03:51.900 --> 00:03:57.720 opium played some part of that war but here’s the thing with opium; if you have some serious pain, 00:03:57.720 --> 00:04:03.120 these drugs can make you feel a lot better. But even if you take it for just five days, 00:04:03.120 --> 00:04:07.740 you have a 10% chance of becoming addicted to it. The longer you take it, the bigger chance 00:04:07.740 --> 00:04:12.420 you have of being addicted. American doctors have a problem with over-prescribing medication, 00:04:12.420 --> 00:04:18.600 so doctor’s prescriptions are a huge contributing factor to the opioid addiction. When the patient 00:04:18.600 --> 00:04:23.820 is no longer in pain and goes home from the hospital, they might start feeling sick. 00:04:23.820 --> 00:04:29.820 They might start feeling nauseous and sweating and chills, and vomiting and anxiety, and they 00:04:29.820 --> 00:04:34.500 crave their medication again. But of course, the doctor won’t give them any more so to help with 00:04:34.500 --> 00:04:39.300 their sickness they turn to the streets to look for more of the same medicine. But of course, 00:04:39.300 --> 00:04:45.480 the streets have a bigger variety of opioids and for pretty low prices, too. Of course, one of the 00:04:45.480 --> 00:04:51.600 easiest ways to buy street drugs now is online on darknet markets. It’s just much easier and 00:04:51.600 --> 00:04:58.980 convenient to buy drugs online but online darknet marketplaces are shady and secretive. They’re an 00:04:58.980 --> 00:05:04.920 online dealer’s playpen where real identities are hidden and illegal substances are everywhere like 00:05:04.920 --> 00:05:11.940 LSD, hydrocodone, meth, cocaine, heroin, fentanyl, it’s all there. These markets have both sellers 00:05:11.940 --> 00:05:18.540 and buyers. One such dark market drug dealer is named Kyle Enos. He got arrested in the UK 00:05:18.540 --> 00:05:24.360 for selling drugs on a darknet market. Here’s an interview he had with UK’s National Crime Agency. 00:05:24.360 --> 00:05:28.440 OFFICER: You’ve been arrested on suspicion of production and possession of a controlled drug 00:05:28.440 --> 00:05:32.640 of Class A. Are you responsible for the production and possession of that drug? 00:05:32.640 --> 00:05:36.540 KYLE: Production? I’ve never produced anything. I don’t – I 00:05:36.540 --> 00:05:41.460 order it from online and it comes and then I basically just distribute it. That’s it. 00:05:41.460 --> 00:05:44.880 OFFICER: What do you offer on your profile? What is offered? 00:05:44.880 --> 00:05:48.000 KYLE: Buy-one-get-one-free. I don’t produce anything. 00:05:48.000 --> 00:05:51.000 I’m not an organic chemist or anything like that. 00:05:51.000 --> 00:05:53.880 OFFICER2: With the fentanyl content in the drug there then, 00:05:53.880 --> 00:05:56.580 do you put any gloves on or any protective clothing when you do it? 00:05:56.580 --> 00:05:59.400 KYLE: Yeah, gloves, ‘cause I don’t wanna…what’s the word? 00:05:59.400 --> 00:06:01.680 I don’t want to contaminate it or anything like that. 00:06:01.680 --> 00:06:05.040 OFFICER2: What do you see are the dangers of that drug? 00:06:05.040 --> 00:06:12.000 KYLE: Well, I know it’s a strong opioid which you know, I know that is quite strong opioids. But 00:06:12.000 --> 00:06:16.080 like I said, I got a warning on my packaging. It’s a very strong do not take unless you know what it 00:06:16.080 --> 00:06:20.280 is. Like I said, it’s all measured out correctly and everything like that. I don’t mix it with 00:06:20.280 --> 00:06:26.220 anything else. It’s exactly as it’s advertised and I don’t say hey, if you’re a newbie, try it. 00:06:26.220 --> 00:06:30.960 JACK: Kyle Enos lived in Wales in the UK. He was twenty-five years old and he was selling 00:06:30.960 --> 00:06:37.320 fentanyl on AlphaBay, Hansa, and the Dream dark marketplaces. [MUSIC] Fentanyl is seriously toxic 00:06:37.320 --> 00:06:42.600 stuff one hundred times stronger than morphine and fifty times stronger than heroin. Going by 00:06:42.600 --> 00:06:47.400 the name Soviet Bear, he sold fentanyl to a hundred and sixty-eight people across the UK, 00:06:47.400 --> 00:06:56.040 the US and Europe in 2016 and ’17. Four of his customers actually died after taking it 00:06:56.040 --> 00:07:00.840 because that’s the danger of fentanyl. It’s more lethal than any other illegal street drug. 00:07:00.840 --> 00:07:10.260 Kyle was caught and arrested. On February 5th, 2018, he got sentenced to eight years in prison. 00:07:10.260 --> 00:07:13.860 For law enforcement, busting people on the darknet is a patient game of cat 00:07:13.860 --> 00:07:17.340 and mouse. The vendors, buyers, and admins of the websites are trying to 00:07:17.340 --> 00:07:21.420 keep out of the way of the feds. On the darknet, no one’s real identity is used. 00:07:21.420 --> 00:07:27.660 Everyone is known by their chosen username and these names are the only way to recognize anyone. 00:07:27.660 --> 00:07:33.960 But not knowing anyone is what makes this a game of chance. Undercover agents lie in wait. They 00:07:33.960 --> 00:07:39.060 pay attention, they follow all the leads. If the users of the dark markets practice good operation 00:07:39.060 --> 00:07:45.300 security or OPSEC, it’ll make it extremely hard if not impossible for feds to catch them. Usually the 00:07:45.300 --> 00:07:50.880 feds have to wait for a lucky break or for someone to mess up so they can then track that user to a 00:07:50.880 --> 00:07:55.860 real person in the real world. Ross Ulbricht was the founder of Silk Road, one of the first 00:07:55.860 --> 00:08:00.240 big dark marketplaces. He was caught because he made a mistake and didn’t cover his tracks well 00:08:00.240 --> 00:08:05.160 enough. By the time he realized his mistake, it was too late. He’d been spotted by the FBI and 00:08:05.160 --> 00:08:10.800 they were onto him. Alexandre Cazes, he created another dark marketplace called AlphaBay. He, 00:08:10.800 --> 00:08:15.420 too, made a mistake and used his personal e-mail in the headers of a welcome e-mail to his website. 00:08:15.420 --> 00:08:20.640 He used the same e-mail address that was linked to his PayPal account which led the feds right to 00:08:20.640 --> 00:08:26.400 him. [MUSIC] To get into the darknet you have to use Tor. Tor is a hidden network that sits on top 00:08:26.400 --> 00:08:32.340 of the internet but only people who are on this hidden network can see what’s on Tor. On top of 00:08:32.340 --> 00:08:37.680 that, there’s a level of privacy that makes things a little more attractive. It basically hides 00:08:37.680 --> 00:08:42.240 your real IP address so you can’t be tracked. The website doesn’t know which IP address any 00:08:42.240 --> 00:08:47.100 visitor actually came from and neither does anyone monitoring the traffic onto the site. Of course, 00:08:47.100 --> 00:08:51.900 just hiding your IP is not enough to keep [00:10:00] you hidden. You need to set up a burner 00:08:51.900 --> 00:08:57.960 phone, a burner e-mail, and do things like use a secure OS like Tails or Qubes and don’t give any 00:08:57.960 --> 00:09:03.540 clues as to who you are. Like, don’t use the same browser to log into Facebook because that pretty 00:09:03.540 --> 00:09:08.520 much identifies you. When you want to buy from a darknet market, there’s another security layer 00:09:08.520 --> 00:09:13.800 you have to consider. To buy drugs, you need to tell the seller your address and then pay for it. 00:09:13.800 --> 00:09:19.020 There’s no payment screens or PayPal or debit card on the darknet. To be extra-safe, 00:09:19.020 --> 00:09:24.180 you don’t want the site admins to see the address you want things shipped to so you set up a secure, 00:09:24.180 --> 00:09:29.160 encrypted chat between buyer and seller. PGP, Pretty Good Privacy, the is usual one used. 00:09:29.160 --> 00:09:34.440 It takes an extra step to set up but it’s worth it. A buyer wants to talk to a seller. The seller 00:09:34.440 --> 00:09:40.560 posts their PGP encryption key on their profile. Then the buyer uses that key to send encrypted 00:09:40.560 --> 00:09:46.320 messages to the seller. Only the seller has the decryption key to see what was said. This makes 00:09:46.320 --> 00:09:51.960 the message really hard to read, if not impossible to read, by prying eyes. Then to pay for the goods 00:09:51.960 --> 00:09:56.880 you need to send money. While historically there used to be things like E-gold and Liberty Reserve, 00:09:56.880 --> 00:10:02.400 something is far better than that now; cryptocurrencies. Cryptocurrencies like 00:10:02.400 --> 00:10:07.200 Bitcoin are the perfect way to pay for things on the dark marketplaces. It’s easy to get, 00:10:07.200 --> 00:10:11.820 it’s legal to own, transactions are pretty quick, low fees, and it’s completely anonymous. 00:10:11.820 --> 00:10:16.920 Bitcoin is not tied to any person’s name or address or social security number. Whoever 00:10:16.920 --> 00:10:21.960 owns the private key to unlock the Bitcoin wallet is who owns that Bitcoin. These dark 00:10:21.960 --> 00:10:27.660 markets all accept Bitcoin. Sometimes other coins are accepted too, like Monero. These are virtual 00:10:27.660 --> 00:10:34.140 currencies that can be exchanged for local money. It’s perfect for this and cryptocurrencies are 00:10:34.140 --> 00:10:42.540 untraceable. Actually, wait a minute. It turns out they’re not completely that untraceable after all. 00:10:42.540 --> 00:10:48.840 Silk Road was one of the biggest dark markets ever but it was brought down by the feds in 2013. 00:10:48.840 --> 00:10:53.820 Shortly after that, new dark markets were entering the ring. The Dream Market was stood up pretty 00:10:53.820 --> 00:10:59.160 quickly and it was modeled to look and act just like Silk Road which all the other dark markets 00:10:59.160 --> 00:11:04.260 were doing the same, too. The structure followed the same trend; there were administrators and 00:11:04.260 --> 00:11:09.240 moderators to keep the site running smoothly, vendors that sold illegal goods, and buyers 00:11:09.240 --> 00:11:15.060 looking to make purchases on the quiet. But of course, this kind of website will attract the 00:11:15.060 --> 00:11:21.300 FBI in a major way. Here’s a clip from the FBI’s website explaining what darknet marketplaces are. 00:11:21.300 --> 00:11:26.940 OFFICER3: [MUSIC] On darknet marketplaces, they offer illicit goods such as drugs, 00:11:26.940 --> 00:11:31.560 guns, a hacked bank account, and credit card information. 00:11:31.560 --> 00:11:37.980 A darknet drug vendor is a little bit different than an actual street corner dealer because of the 00:11:37.980 --> 00:11:43.320 reach that they have. They have access to hundreds of thousands of buyers at a time from across the 00:11:43.320 --> 00:11:49.260 country as well as internationally. Just by taking down one darknet drug vendor, you can 00:11:49.260 --> 00:11:56.340 have the same effect as taking down a traditional mid-level sized drug-trafficking organization. 00:11:56.340 --> 00:12:00.540 JACK: You can see as darknet markets started rising in popularity, 00:12:00.540 --> 00:12:04.860 it also attracted the attention of the feds. 00:12:04.860 --> 00:12:09.840 Dream Market had a dual-rating system for its vendors. It was sort of like Amazon with star 00:12:09.840 --> 00:12:14.340 ratings from buyers. The average score from vendors was shown on the profile along with 00:12:14.340 --> 00:12:19.320 the number of positive and negative reviews they had. Build up a good sales history with satisfied 00:12:19.320 --> 00:12:25.800 customers, and they’d get a trusted vendor label, a sure sign to buyers that this is a vendor that 00:12:25.800 --> 00:12:31.860 they are safe to buy from. Dream Market also had a bug bounty system going. If anyone spotted a bug 00:12:31.860 --> 00:12:36.480 or security issue on the site, they could report it to the admins and get seventy-five bucks. 00:12:36.480 --> 00:12:41.880 At one point, AlphaBay became the most profitable dark market on Tor and Dream Market was the second 00:12:41.880 --> 00:12:48.360 biggest. But when AlphaBay went down, Dream Market stepped in as the new king of the scene. It was 00:12:48.360 --> 00:12:52.980 one of the longest-running markets in the time so sure, why not go to a long-running one which 00:12:52.980 --> 00:12:58.260 has a good reputation? This is where Kyle Enos sold drugs. You remember him at the beginning? 00:12:58.260 --> 00:13:04.740 He got arrested for selling fentanyl. The National Crime Agency in England was very unhappy about 00:13:04.740 --> 00:13:11.880 that so the NCA set up a whole operation to try to catch Kyle because they ferociously fight to get 00:13:11.880 --> 00:13:17.340 fentanyl off the drug marketplaces because of how dangerous it is. [MUSIC] It’s just really lethal 00:13:17.340 --> 00:13:22.860 and the worst part about fentanyl is that people mix it into heroin and cocaine and sell it to 00:13:22.860 --> 00:13:26.940 people who are completely unaware they’re taking fentanyl at all. It’s like, fifty times more 00:13:26.940 --> 00:13:32.160 potent than anything you think you’re taking. The reason why fentanyl gets laced into other drugs is 00:13:32.160 --> 00:13:36.240 because it’s cheaper to make so some suppliers will get some fentanyl and try to sell it off 00:13:36.240 --> 00:13:42.060 as heroin to make more money. Kyle said he sold fentanyl but simply passed it from the supplier 00:13:42.060 --> 00:13:47.880 to the buyer and didn’t try to hide what it was. Kyle was caught and arrested and is serving eight 00:13:47.880 --> 00:13:53.880 years in prison. [00:15:00] In May 2015, a new person registered an account on the Dream Market. 00:13:53.880 --> 00:14:03.480 The username was OxyMonster. Just six months after that, OxyMonster got promoted to administrator 00:14:03.480 --> 00:14:10.140 of the Dream Market. Admins are the top tiers in these markets. They have access to everything and 00:14:10.140 --> 00:14:16.740 have to be the most trusted of all. To be given such a role in just six months tells me OxyMonster 00:14:16.740 --> 00:14:22.680 was not new to the scene. No sensible site admin is going to give access to someone they knew 00:14:22.680 --> 00:14:28.500 nothing about six months ago ‘cause they could be anyone. That’s the thing about these dark markets; 00:14:28.500 --> 00:14:35.220 anyone could really be anyone, including undercover police agents. The DEA, FBI, and 00:14:35.220 --> 00:14:42.120 NCA are known to have their agents on undercover missions posing as buyers and vendors because they 00:14:42.120 --> 00:14:47.160 can use the anonymity of the dark markets to their advantage, hiding in with everyone else, 00:14:47.160 --> 00:14:54.360 watching and collecting data. In fact, in early 2016, the DEA started creeping around inside 00:14:54.360 --> 00:14:59.880 the Dream Market. They were posing as buyers and identified three vendors they were interested in. 00:14:59.880 --> 00:15:06.660 The DEA bought drugs from DigitalPossi2014, ReximusMaximus, and MethForDummies. 00:15:06.660 --> 00:15:11.400 They ordered these drugs and had them shipped to Miami where the DEA could inspect them for 00:15:11.400 --> 00:15:15.780 any clues. When they got them, they had the contents forensically tested 00:15:15.780 --> 00:15:21.900 to confirm they were narcotics. OxyMonster wasn’t one of these targeted vendors but 00:15:21.900 --> 00:15:28.680 his presence on the Dream Market was about to be noticed by law enforcement agents. [MUSIC] 00:15:28.680 --> 00:15:35.160 In January 2017, DEA agents visited the Dream Market home page and looked around. They saw 00:15:35.160 --> 00:15:39.480 there was a link to a forum called Dread. They clicked it and found themselves inside 00:15:39.480 --> 00:15:45.000 a message board for dark marketplaces. They saw this was somewhere people could go to for 00:15:45.000 --> 00:15:50.820 help and advice and it was a place where admins and moderators would help out buyers and vendors 00:15:50.820 --> 00:15:55.800 to give them tips on how to do things better or stay safe and secure on the dark web. It 00:15:55.800 --> 00:16:00.060 also seemed to be an area where any disputes between users of the site could be dealt with 00:16:00.060 --> 00:16:07.020 and sorted out. This is where the DEA agents first became aware of OxyMonster. The DEA is 00:16:07.020 --> 00:16:12.420 the Drug Enforcement Agency of the US. They combat drug trafficking both on the streets and online. 00:16:12.420 --> 00:16:17.700 They noticed OxyMonster was helping users on this forum and they also connected him to be 00:16:17.700 --> 00:16:24.060 an admin on the Dream Market. They looked back at all of OxyMonster’s posts on the forum which led 00:16:24.060 --> 00:16:30.960 back all the way to May 2015. Whoever OxyMonster was, they certainly knew a lot about drugs and 00:16:30.960 --> 00:16:40.260 how to stay hidden on the darknet. They were familiar with a lot of darknet marketplaces. 00:16:40.260 --> 00:16:46.260 One of the things that caught the agents’ eye was a post from March 2016 written by 00:16:46.260 --> 00:16:52.860 OxyMonster. It warned users any message claiming to be from mods not listing in the post. The DEA 00:16:52.860 --> 00:16:58.440 agents started watching OxyMonster on Dream Market and on the forums. What does he do 00:16:58.440 --> 00:17:05.280 on this site? How involved is he exactly? By June of 2017 it was clear that OxyMonster was 00:17:05.280 --> 00:17:09.660 selling drugs on these dark marketplaces. He was selling things like OxyContin and 00:17:09.660 --> 00:17:15.600 Ritalin which are prescription drugs. Well, I guess that explains his choice of username. He 00:17:15.600 --> 00:17:21.480 had sixty sales and got good ratings, too; positive reviews from satisfied customers. 00:17:21.480 --> 00:17:23.820 Now that he’s selling drugs on Dream Market, 00:17:23.820 --> 00:17:30.120 this has caught the attention even more of the DEA. OxyMonster is an admin to Dream Market, 00:17:30.120 --> 00:17:35.640 a senior moderator on the forum, and he’s actively selling drugs to site users. 00:17:35.640 --> 00:17:40.860 That would be enough to catch the attention of the feds. [MUSIC] Now, when you buy drugs on 00:17:40.860 --> 00:17:46.200 Dream Market, you send your Bitcoin to an escrow account. It goes to Dream Market’s wallet and then 00:17:46.200 --> 00:17:51.060 gets handed to the vendor. This is an extra layer of security so that the vendor doesn’t know what 00:17:51.060 --> 00:17:54.960 the buyer’s Bitcoin address was and the buyer doesn’t know what the vendor’s Bitcoin address 00:17:54.960 --> 00:17:59.700 was because you don’t want the feds to know your Bitcoin address because they might have 00:17:59.700 --> 00:18:05.580 ways to track it. The feds wanted more info on OxyMonster so they watched this post on these 00:18:05.580 --> 00:18:11.340 forums. There was something OxyMonster would write in the footer of each post. It said basically 00:18:11.340 --> 00:18:17.160 that if this post was helpful, please consider tipping and here’s a link to a Bitcoin address. 00:18:17.160 --> 00:18:22.860 Hm, the footer also encouraged people to check out OxyMonster’s account on TradeRoute 00:18:22.860 --> 00:18:27.300 which is another dark market. That profile confirmed he was selling drugs there too, 00:18:27.300 --> 00:18:33.120 and listed the same tip jar address. It also told feds that OxyMonster was a mod on the 00:18:33.120 --> 00:18:37.920 now-defunct Evolution dark market. This is like a flashing light for law enforcement; 00:18:37.920 --> 00:18:43.800 two profiles with links to three different markets with the same Bitcoin wallet. This 00:18:43.800 --> 00:18:47.580 is a person who’s been very active in the dark marketplace forums for two years, 00:18:47.580 --> 00:18:53.040 is an active seller on [00:20:00] multiple sites, an admin on another. He’s just asking 00:18:53.040 --> 00:18:58.020 to be followed up on and that’s the problem with these sites; you want a good reputation as 00:18:58.020 --> 00:19:05.520 a seller so buyers like you but as soon as you get one, the feds start looking for you, too. 00:19:05.520 --> 00:19:09.060 While the feds were trying to find out who OxyMonster was on Dream Market, 00:19:09.060 --> 00:19:14.340 the FBI was working with the Dutch police to take out two of Dream’s biggest competitors. 00:19:14.340 --> 00:19:19.560 [MUSIC] In 2017, AlphaBay was one of the biggest dark markets selling everything from drugs to 00:19:19.560 --> 00:19:25.560 weapons to malicious software. The FBI was watching this market for months. In July of 00:19:25.560 --> 00:19:31.740 2017 they arrested AlphaBay’s founder, Alexander Cazes, in Thailand and took the market offline. 00:19:31.740 --> 00:19:36.660 Again, this is something I covered in Episode 24. It’s a really fascinating listen so check out the 00:19:36.660 --> 00:19:41.160 episode Operation Bayonet if you want to know more because it was a pretty impressive operation the 00:19:41.160 --> 00:19:45.840 feds pulled off there. At the same time, multiple law enforcement agencies came together including 00:19:45.840 --> 00:19:52.200 Europol and the Dutch police to take down Hansa, the other darknet market. When AlphaBay and Hansa 00:19:52.200 --> 00:19:57.780 got taken down, the darknet community went into a tailspin. Vendors needed a platform to keep 00:19:57.780 --> 00:20:03.240 selling and buyers still wanted to buy drugs online. Despite all the paranoia and suspicion, 00:20:03.240 --> 00:20:09.240 users headed straight on over to Dream Market as their next dark market. OxyMonster 00:20:09.240 --> 00:20:13.440 was already registered on Dream when all this went down with AlphaBay and Hansa. 00:20:13.440 --> 00:20:18.600 It seemed it didn’t spook him at all. One month after the takedowns, OxyMonster became 00:20:18.600 --> 00:20:24.900 an official vendor on Dream Market and started shipping drugs to the US. With Hansa gone, he 00:20:24.900 --> 00:20:31.020 easily leveled up on Dream but what he didn’t know was that the DEA were watching what he was doing 00:20:31.020 --> 00:20:38.700 and trying to figure out who he really was. By August 2017, the DEA were following up on this 00:20:38.700 --> 00:20:44.700 tip jar Bitcoin wallet that OxyMonster was so keen to advertise. The idea that the feds had 00:20:44.700 --> 00:20:50.460 was to follow the money. While Bitcoin is supposed to be anonymous, if you follow it closely enough, 00:20:50.460 --> 00:20:56.880 you can sometimes figure out who owns a wallet. At least if you’re the DEA, you might be able to. 00:20:56.880 --> 00:21:02.040 A Bitcoin wallet is just a long string of numbers and letters. It’s impossible to link it to anyone. 00:21:02.040 --> 00:21:07.560 But just as dark markets have evolved, so has the technology checking out Bitcoin. 00:21:07.560 --> 00:21:12.900 [MUSIC] You see, Bitcoin is virtual but there’s a solid system underneath it, a method to make sure 00:21:12.900 --> 00:21:17.880 that there’s a public record of every transaction that passes from one person to another. That’s 00:21:17.880 --> 00:21:22.860 what’s called a block chain. There’s an army of Bitcoin miners, people out there voluntarily 00:21:22.860 --> 00:21:28.380 keeping the block chain up, so that this public database is available for everyone and up to date. 00:21:28.380 --> 00:21:35.460 But now there’s software available that analyzes Bitcoin transactions in the block chain. See, 00:21:35.460 --> 00:21:41.520 the block chain records every transaction and it’s unmutable so you can’t delete any records out of 00:21:41.520 --> 00:21:48.060 it. The software can look for links between wallet addresses and activity and how things are moved 00:21:48.060 --> 00:21:53.700 around, and any patterns, and that sort of thing. There are two tools that are used to do this; one 00:21:53.700 --> 00:21:59.820 is called Chain Analysis and the other is called Elliptical. These are the two front runners and 00:21:59.820 --> 00:22:07.460 they’re being used by the DEA, FBI, IRS, Europol, to trace Bitcoin transactions in criminal cases. 00:22:07.460 --> 00:22:12.240 [MUSIC] See, all Bitcoin transactions are public record, visible on the block chain 00:22:12.240 --> 00:22:16.680 for anyone to see. By analyzing the block chain and following transactions and wallets, 00:22:16.680 --> 00:22:22.560 you can start to build a dossier on who owns what. For instance, there was an escrow service on Dream 00:22:22.560 --> 00:22:26.880 Market. You send your Bitcoin there to buy a drug and once the money is collected by Dream Market, 00:22:26.880 --> 00:22:31.860 the seller is notified to send the drugs. If the DEA knows the Bitcoin address of 00:22:31.860 --> 00:22:37.740 Dream Market’s escrow wallet, then they can use tools to see who’s interacting with that wallet. 00:22:37.740 --> 00:22:42.660 Now, when someone goes to withdraw their Bitcoin and turn it into local money, this is another step 00:22:42.660 --> 00:22:48.180 that law enforcement will monitor closely. See, most Bitcoin exchanges are regulated and need to 00:22:48.180 --> 00:22:54.060 comply with local law. This makes the exchange trustworthy but at the same time, it also means 00:22:54.060 --> 00:22:59.580 that law enforcement agents can issue search warrants on the exchanges to see who cashed out 00:22:59.580 --> 00:23:07.380 of certain Bitcoin wallets. You see, the DEA had a variety of ways to track some Bitcoin wallets. 00:23:07.380 --> 00:23:10.980 They were using these methods to watch what was going out of that tip jar address 00:23:10.980 --> 00:23:16.740 on OxyMonster’s posts. Now, darknet drug dealers know this and have come up with 00:23:16.740 --> 00:23:22.440 a pretty clever way to keep their cashouts more hidden; Bitcoin tumblers. Basically, 00:23:22.440 --> 00:23:25.560 it’s the same thing as taking a deck of cards and mixing them all up on the table, 00:23:25.560 --> 00:23:30.300 spreading them all over so that you can’t see which card is what. You can send your Bitcoin 00:23:30.300 --> 00:23:34.320 to a tumbler which will then break apart your money into a bunch of various transactions, 00:23:34.320 --> 00:23:39.720 mix them up a bunch with a bunch of other people’s Bitcoins, and then send you your money in a new, 00:23:39.720 --> 00:23:45.720 fresh Bitcoin wallet. The DEA has a much harder time tracking money that goes through a Bitcoin 00:23:45.720 --> 00:23:51.180 tumbler. I’m not sure if there even is a way to track this. [00:25:00] Now, Dream Market had its 00:23:51.180 --> 00:23:55.380 own basic tumbling services. I mean sure, why not? It’s doing a lot of illegal transactions. 00:23:55.380 --> 00:23:59.760 Makes sense to provide a tumbling service to help its customers be more safe and secure. 00:23:59.760 --> 00:24:06.180 But as the feds watched OxyMonster’s Bitcoin tip jar address, they noticed he was sending 00:24:06.180 --> 00:24:12.300 money directly to an exchange without using a tumbler, not even the tumbler that’s on Dream 00:24:12.300 --> 00:24:19.920 Market that he was an admin of. The feds watched and they saw that OxyMonster sent his Bitcoin to 00:24:19.920 --> 00:24:27.840 a website called localbitcoins.com. He did this fifteen times. This is an exchange not regulated 00:24:27.840 --> 00:24:33.960 by the US law. It’s based in Finland but it didn’t ask you for any ID to cash out which 00:24:33.960 --> 00:24:40.620 was what OxyMonster wanted; to be anonymous when he was getting his money. OxyMonster cashed out on 00:24:40.620 --> 00:24:47.460 his tip jar earnings. When OxyMonster cashed out at localbitcoins.com, the DEA was able to work 00:24:47.460 --> 00:24:53.520 with the authorities in Finland to get anything they could on who owned that Bitcoin address. 00:24:53.520 --> 00:24:58.860 Since this exchange didn’t have any ID for OxyMonster, the only thing the DEA was able 00:24:58.860 --> 00:25:05.160 to get was the username that was used to log into this exchange with. That was it. This 00:25:05.160 --> 00:25:11.100 was the only evidence they uncovered. OxyMonster could have used any username in the world, random 00:25:11.100 --> 00:25:20.100 digits or letters, anything. But OxyMonster made a huge mistake and chose the username Vallerius. 00:25:20.100 --> 00:25:24.660 Once the agents found this account which was called Vallerius, they set about trying to 00:25:24.660 --> 00:25:30.360 find more information. They guessed that this might be someone’s last name so they looked at 00:25:30.360 --> 00:25:37.200 social media and searched around the internet. It wasn’t long before they found a guy online named 00:25:37.200 --> 00:25:45.060 Gal Vallerius. He’s a French national with social profiles on Twitter and Instagram. Gal Vallerius 00:25:45.060 --> 00:25:51.120 was thirty-six years old and living in the Brittany region of France with his wife and child. 00:25:51.120 --> 00:25:58.080 He had French, English, and Israeli citizenship. The feds thought he might be the person behind the 00:25:58.080 --> 00:26:04.320 OxyMonster account. Agents began to compare the Dream Market posts with the posts on social media, 00:26:04.320 --> 00:26:09.240 looking for similarities in the writing. They found common words used; like for instance, both 00:26:09.240 --> 00:26:15.600 OxyMonster and Dream Market and Gal Vallerius on Twitter said ‘cheers’ a lot in their posts. Both 00:26:15.600 --> 00:26:20.160 sets of posts were sometimes written in French and used exclamation marks in the same way, too. 00:26:20.160 --> 00:26:27.240 The DEA began to strongly suspect that Gal Vallerius was OxyMonster. But they still 00:26:27.240 --> 00:26:34.500 needed solid evidence to secure the case against him. [MUSIC] One thing the DEA did discover when 00:26:34.500 --> 00:26:42.720 poking around in Gal’s social media was a slightly unusual interest; beards. That is, growing and 00:26:42.720 --> 00:26:50.760 comparing beard lengths. Gal had a long beard down to his waist and he seemed pretty proud 00:26:50.760 --> 00:26:56.760 of it. He was a competitor in the World Beard and Moustache Championships and an active member in an 00:26:56.760 --> 00:27:02.640 app called BeardWars. On his social media account he was posting that the next beard competition was 00:27:02.640 --> 00:27:09.360 in Austin, Texas on September 1st, 2017 and guess who was going? Gal was going to Austin 00:27:09.360 --> 00:27:15.780 to compete in a beard competition. When agents realized Gal was flying into the US to attend, 00:27:15.780 --> 00:27:21.660 they knew this was their chance. The DEA contacted Homeland Security Investigations and asked for 00:27:21.660 --> 00:27:27.180 their help. The plan was to detain Gal at the airport while he was going through customs. They 00:27:27.180 --> 00:27:31.140 were going to tell him this is a routine check on all digital devices that he had with him. 00:27:31.140 --> 00:27:35.580 Remember, they’d been watching Gal for months, slowly building a case that he was the guy 00:27:35.580 --> 00:27:41.580 behind OxyMonster profile on Dream Market. This airport play was a big deal and the feds had to 00:27:41.580 --> 00:27:46.020 act quick. September was fast approaching and they needed more evidence if they were going to 00:27:46.020 --> 00:27:51.720 link Gal with OxyMonster if they’re going to get this into court. This was a bit of a gamble for 00:27:51.720 --> 00:27:55.860 the fed’s part; they knew he was flying into the US for this three-day beard competition 00:27:55.860 --> 00:28:00.660 and they just assumed he was going to bring his laptop into the country with him. I mean, 00:28:00.660 --> 00:28:05.700 if he was going to be coming for a few days, maybe he’d want to tend to his dark markets 00:28:05.700 --> 00:28:11.100 and do some trading while he was away, right? I guess that’s a fair assumption. If they could 00:28:11.100 --> 00:28:15.540 get past whatever encryption and password protection he had on there, they might be 00:28:15.540 --> 00:28:20.820 able to get the evidence to prove that Gal is OxyMonster. That’s what the cops were betting on. 00:28:20.820 --> 00:28:25.920 Getting into his computer would be crucial for convicting him and it posed a real challenge 00:28:25.920 --> 00:28:31.140 to authorities so they had to come up with a plan to arrest Gal at the airport with 00:28:31.140 --> 00:28:35.700 his laptop unlocked. When we come back from the break, we’ll hear what the authorities 00:28:35.700 --> 00:28:40.920 did. [00:30:00] On August 31st, the day before the competition, Gal and his wife 00:28:40.920 --> 00:28:46.380 Yasmin flew from Paris into Atlanta International Airport in Georgia. When they came off the plane, 00:28:46.380 --> 00:28:51.360 it was just after 1:00 p.m. in the afternoon. At this point Gal had no idea the feds were onto 00:28:51.360 --> 00:28:56.580 him. They were stopped at customs and taken into a side room. The agents told them this is a routine 00:28:56.580 --> 00:29:01.020 check for US passengers flying into the country and they have to check all electronic devices 00:29:01.020 --> 00:29:06.000 for child pornography. [MUSIC] A Homeland Security agent then searched their bags. 00:29:06.000 --> 00:29:11.040 He found Gal’s Samsung laptop, an Apple iPhone, Yasmin’s iPhone, 00:29:11.040 --> 00:29:19.260 and iPad tablet. The custom agents asked Gal for his pins and passwords to access these devices. 00:29:19.260 --> 00:29:23.460 Now, you’d think anyone involved in darknet trading would be guarding those 00:29:23.460 --> 00:29:29.220 passwords with their life but Gal, still thinking this is just a routine check, 00:29:29.220 --> 00:29:36.180 handed them over. He logged into his devices and unlocked his computers for the agents. 00:29:36.180 --> 00:29:43.380 The agents left the room with his devices and didn’t come back for two hours. 00:29:43.380 --> 00:29:48.720 Gal must have started to get nervous at some point waiting for them to return. I mean jeesh, 00:29:48.720 --> 00:29:54.240 two hours is a long time to wait for US customs to check your devices. I bet he regretted logging in. 00:29:54.240 --> 00:29:59.520 I mean gosh, what is he thinking? Now he’s stuck in a country he’s not familiar with in a side room 00:29:59.520 --> 00:30:03.840 with some customs agents. Typically, it’s hard to argue with these guys or else you might have 00:30:03.840 --> 00:30:08.820 to go back home. He was getting more worried. The longer they took, the more nervous he got. 00:30:08.820 --> 00:30:13.140 The agents told him that they were searching his computer for child porn and he knew he didn’t 00:30:13.140 --> 00:30:18.120 have any so he thought he was probably safe. He’s probably thinking that the custom agents 00:30:18.120 --> 00:30:23.220 wouldn’t be able to recognize what dark markets were or Tor or anything like that. A typical 00:30:23.220 --> 00:30:29.340 custom agent might not know what those are. But little did he know, these weren’t normal customs 00:30:29.340 --> 00:30:37.080 agents. [MUSIC] In the other room, agents logged into Gal’s laptop using his passwords and started 00:30:37.080 --> 00:30:42.540 to look around. They pretty quickly found an application on his desktop called Wallet. 00:30:42.540 --> 00:30:48.660 Inside was five hundred thousand dollars-worth of Bitcoin. Next, 00:30:48.660 --> 00:30:55.260 they found the Tor browser and what looked like login details for Dream Market. They were getting 00:30:55.260 --> 00:31:03.000 pretty excited now. This was looking good. Then they found a private PGP key labeled OxyMonster. 00:31:03.000 --> 00:31:07.500 A quick check and they confirmed this is the key that matched the key on 00:31:07.500 --> 00:31:15.180 OxyMonster’s Dream Market account. This proved that Gal Vallerius was OxyMonster. 00:31:15.180 --> 00:31:19.620 With that, the feds had enough evidence to arrest and convict him. 00:31:19.620 --> 00:31:23.640 When the agents finally returned to that little room where they were holding Gal in, they 00:31:23.640 --> 00:31:28.560 arrested him for conspiracy to distribute narcotics, operating a darknet marketplace, and 00:31:28.560 --> 00:31:33.480 money laundering. He was also given his Miranda rights. When asked about the Bitcoin they found, 00:31:33.480 --> 00:31:38.580 Gal told them he had taken money out of his bank account and just bought the Bitcoin. After all, 00:31:38.580 --> 00:31:46.860 it’s perfect legal to hold Bitcoin. After that, Gal asked for a Hebrew-speaking lawyer. 00:31:46.860 --> 00:31:52.920 The next day, a search warrant was granted for a full forensic search on Gal’s laptop and phone. 00:31:52.920 --> 00:31:58.620 The search confirmed the evidence that the agents found at the airport. Gal was in trouble. 00:31:58.620 --> 00:32:04.920 The World Beard Championships in Austin took place that day but without Gal. While his competitors 00:32:04.920 --> 00:32:11.400 were doing whatever it is you do at a beard competition, Gal and his award-winning beard were 00:32:11.400 --> 00:32:18.720 in police custody and had just been indicted for conspiracy to distribute drugs. Five months after 00:32:18.720 --> 00:32:24.600 that, in January of 2018, an announcement was made from the US Attorney General Jeff Sessions. 00:32:24.600 --> 00:32:31.080 JEFF: J-CODE. I kind of like it. By bringing together the DEA, our Safe Streets Task Forces, 00:32:31.080 --> 00:32:37.800 our drug-trafficking task forces, our healthcare fraud special agents and other assets, and the 00:32:37.800 --> 00:32:44.520 FBI, will more than double its investment in the fight against online drug [00:35:00] trafficking. 00:32:44.520 --> 00:32:48.720 JACK: [MUSIC] J-CODE stands for Joint Criminal Opioid Darknet Enforcement 00:32:48.720 --> 00:32:53.760 and was going into full effect. This was going to be the FBI’s flagship task force 00:32:53.760 --> 00:32:58.380 to take down dark marketplaces selling opioids and bring prosecutions against 00:32:58.380 --> 00:33:03.180 the administrators and vendors. While Gal sat in his prison cell awaiting trial, 00:33:03.180 --> 00:33:08.640 the FBI and Department of Justice were gearing up to investigate and identify more vendors and 00:33:08.640 --> 00:33:13.320 more markets across the darknet. With more funding, more agents, more investigations, 00:33:13.320 --> 00:33:18.360 and intelligence analysts, the dark drug marketplaces were firmly in the crosshairs 00:33:18.360 --> 00:33:24.960 of the feds. Gal was not granted bail and stayed in custody in the US. His lawyers wanted to get 00:33:24.960 --> 00:33:29.040 rid of the evidence found on his laptop at the airport. That was the stuff that would seal his 00:33:29.040 --> 00:33:34.080 fate. If they could get that thrown out, Gal would have a fighting chance. In March of 2018, 00:33:34.080 --> 00:33:39.480 seven months after his arrest, they submitted a motion to have this evidence ruled inadmissible. 00:33:39.480 --> 00:33:45.060 It said that Gal had voluntarily handed over his device passwords but he did that before being 00:33:45.060 --> 00:33:50.460 given his Miranda rights. It said he did it under false information that the agents were hunting for 00:33:50.460 --> 00:33:56.160 child porn and he didn’t give them consent to root through his files and folders looking for Bitcoin, 00:33:56.160 --> 00:34:01.680 dark web connections, and login details. While the legal process for Gal was slow moving, 00:34:01.680 --> 00:34:05.940 the new FBI J-CODE team was not hanging about. [MUSIC] On April 00:34:05.940 --> 00:34:10.500 3rd they announced the result of J-CODE’s first mission. They called it Operation 00:34:10.500 --> 00:34:16.140 Disarray. Operation Disarray’s goal was to coordinate takedown of multiple dark market 00:34:16.140 --> 00:34:21.660 vendors who were in the US. On March 30th the team had made a total of eight arrests, 00:34:21.660 --> 00:34:26.100 conducted a hundred and sixty interviews, seized numerous weapons, computer equipment, 00:34:26.100 --> 00:34:31.320 counterfeit currency, and drugs all related to darknet markets and vendors. If you go to the 00:34:31.320 --> 00:34:36.480 FBI’s website and look for Operation Disarray, you’ll see this video of them making arrests. 00:34:36.480 --> 00:34:40.500 OFFICER4: This week around the country we’re executing Operation Disarray. The 00:34:40.500 --> 00:34:44.940 FBI headquarters has sent out information and is working in coordination with field offices 00:34:44.940 --> 00:34:48.900 all over the country. We’re working with all our federal partners here involved as well to 00:34:48.900 --> 00:34:55.440 go out and both encounter customers of dark web marketplaces, dark web narcotics traffickers, 00:34:55.440 --> 00:34:59.580 as well as get the word out on the dangers of potentially what they’re purchasing. 00:34:59.580 --> 00:35:03.900 OFFICER5: You’ll see from the picture at the back of the ops plan, it is on the corner, 00:35:03.900 --> 00:35:05.090 so there’s two doors on the house. 00:35:05.090 --> 00:35:08.940 OFFICER4: This morning we’ve come out to execute two federal search warrants and 00:35:08.940 --> 00:35:13.380 an arrest warrant on an individual that’s a dark web narcotics trafficker. In particular, 00:35:13.380 --> 00:35:18.540 this trafficker is specializing in the opioid derivative of fentanyl. 00:35:18.540 --> 00:35:23.640 We meet up here to do a pre-op briefing, talk of everybody’s last-minute changes, 00:35:23.640 --> 00:35:27.180 what their assigned duties are, make sure that we’re all on the same page to make sure 00:35:27.180 --> 00:35:37.260 this all goes smoothly and it’s done safely. [SHOUTING] FBI, show your hands! Come out! 00:35:37.260 --> 00:35:41.220 We had successfully executed the search warrant and the search system themselves 00:35:41.220 --> 00:35:46.920 resulted in the seizure of both narcotics, a firearm, and numerous digital devices 00:35:46.920 --> 00:35:53.400 which may have been used to set up and facilitate this activity online. The 00:35:53.400 --> 00:35:57.660 individual is transported of course to the US Marshals and to the federal courthouse 00:35:57.660 --> 00:36:02.400 to appear before a judge. The end goal is to of course remind the end user, 00:36:02.400 --> 00:36:06.780 the end purchaser both of the dangers of the dark web marketplace and the fact that law enforcement 00:36:06.780 --> 00:36:12.060 is very cognizant of this activity and we’re going to be continuing to stay on top of it. 00:36:12.060 --> 00:36:16.320 JACK: [MUSIC] J-CODE law enforcement’s newest operation against the dark markets was in full 00:36:16.320 --> 00:36:22.320 swing. For Gal, his situation just got worse. On April 24th another charge was added to his 00:36:22.320 --> 00:36:27.480 indictment; conspiracy to commit money laundering. Now he had more charges. Gal was looking at a 00:36:27.480 --> 00:36:33.060 potential life sentence behind bars if he was found guilty. His wife desperately pleaded for 00:36:33.060 --> 00:36:37.860 him to be shown mercy but the feds weren’t budging. Along with OxyContin and Ritalin, 00:36:37.860 --> 00:36:42.660 they believed Gal Vallerius as OxyMonster was involved in the sale of methamphetamine, 00:36:42.660 --> 00:36:48.000 fentanyl, heroin, cocaine, and LSD through his roles in the Dream Market. 00:36:48.000 --> 00:36:52.860 On May 10th, 2018 the prosecution dropped their final playing card against Gal; 00:36:52.860 --> 00:36:58.560 a motion to have his past criminal history included in his trial. At this point, 00:36:58.560 --> 00:37:03.720 it all became clear. Gal was not new to the darknet or selling drugs using Bitcoin. 00:37:03.720 --> 00:37:09.540 He was a pretty seasoned player. They found connections of him being on Silk Road, 00:37:09.540 --> 00:37:16.020 Silk Road 2, AlphaBay, Hansa, and a long list of other dark markets under the user name Gehenna 00:37:16.020 --> 00:37:21.060 which means Hell in Hebrew. They also said Gal had been a member of an online criminal 00:37:21.060 --> 00:37:27.600 forum since October 2016. But I couldn’t find any details about that. Now, remember Hansa market, 00:37:27.600 --> 00:37:33.060 right? Gal was a vendor there, too. Now, the details are not clear here because it seems it 00:37:33.060 --> 00:37:37.980 was a different username but OxyMonster was an active seller on Hansa. In fact, 00:37:37.980 --> 00:37:42.960 there were even chat logs where he was talking to the Dutch police through Hansa’s site. I don’t 00:37:42.960 --> 00:37:46.380 know how the DEA [00:40:00] made the connection that he was the same person but they did, 00:37:46.380 --> 00:37:50.400 perhaps because of a matching e-mail address or Bitcoin wallet or something. 00:37:50.400 --> 00:37:55.020 I’m not sure but it seems like the Dutch police had quite a lot of information about him when 00:37:55.020 --> 00:38:01.200 they took down Hansa. All this adding up was a huge hit to Gal. Just after that, 00:38:01.200 --> 00:38:05.520 his motion to have his laptop evidence thrown out was rejected. 00:38:05.520 --> 00:38:10.980 If Gal went to trial now, he’d be facing some very strong cases against him at this point. 00:38:10.980 --> 00:38:17.940 The evidence of illegal darknet activities was mountainous and dating back years. 00:38:17.940 --> 00:38:26.100 I guess he realized the game was up so Gal changed his plea to guilty. A month later on June 12th, 00:38:26.100 --> 00:38:32.100 he accepted a plea deal. He agreed to plead guilty to both of the charges against him in relation to 00:38:32.100 --> 00:38:37.680 selling and distributing OxyContin and Ritalin. He would also forfeit all of the Bitcoin proceeds 00:38:37.680 --> 00:38:43.020 he had amassed through his darknet activities. At the time this was agreed on in October 2018, 00:38:43.020 --> 00:38:50.400 this would have been over $700,000 worth of Bitcoin and Bitcoin cash. 00:38:50.400 --> 00:38:53.760 As Gal waited to be sentenced, the feds had to do something with all 00:38:53.760 --> 00:38:57.780 the Bitcoin that they seized from him. See, the problem with Bitcoin is, well, 00:38:57.780 --> 00:39:02.220 it’s virtual. [MUSIC] It’s not widely-accepted and really isn’t that much use to the Justice 00:39:02.220 --> 00:39:06.900 Department at all. This first came up after the arrest of Ross Ulbricht of Silk Road. 00:39:06.900 --> 00:39:12.960 The amount of Bitcoin they seized from Ross was colossal, like 170,000 Bitcoin. Under 00:39:12.960 --> 00:39:17.940 forfeiture of assets, the feds are used to getting houses or cars or boats or jewelry, 00:39:17.940 --> 00:39:23.580 physical things that they can sell for cash. But Bitcoin is entirely a different thing. It 00:39:23.580 --> 00:39:28.800 was decided that Bitcoin would be treated as an asset rather than money, so it would be handed 00:39:28.800 --> 00:39:34.860 over to the US Marshals who have responsibility for disposing of the seized assets of criminals. 00:39:34.860 --> 00:39:40.980 So, the US Marshals decided to auction the Bitcoin off. Yeah, to turn it into cash. 00:39:40.980 --> 00:39:44.100 They’d sell it off to the highest bidder. 00:39:44.100 --> 00:39:48.900 To do this, they have to be real careful they’re not selling criminally-obtained Bitcoin back to 00:39:48.900 --> 00:39:54.960 criminals. A $200,000 deposit is required and registration into the auction is required. 00:39:54.960 --> 00:39:59.640 Government-issued IDs and documents must be presented before you can bid in the auction. 00:39:59.640 --> 00:40:06.300 This worked and four auctions later between June 2014 and November 2015, the US Marshals had made 00:40:06.300 --> 00:40:12.180 sixty-six million dollars from the Silk Road Bitcoin. But then where does the money go? Well, 00:40:12.180 --> 00:40:16.320 it seems if victims of crimes were involved then some of the money goes back to compensate them, 00:40:16.320 --> 00:40:20.880 and the law enforcement agencies who worked on the case can apply to get some of the money back 00:40:20.880 --> 00:40:25.560 into their agency. So, sometimes they get some but the rest goes straight to the Department of 00:40:25.560 --> 00:40:29.640 Justice where then they apparently hand out bits to different law enforcement agencies 00:40:29.640 --> 00:40:34.260 wherever they see fit. In other words, we don’t really know where the money goes. 00:40:34.260 --> 00:40:40.140 So far, they haven’t done anything with Gal’s $700,000 in Bitcoin. Will they auction it off? 00:40:40.140 --> 00:40:44.160 Probably, but the government isn’t too keen on telling people how much Bitcoin 00:40:44.160 --> 00:40:49.080 they own. There can be huge gaps between seizing Bitcoin like they did from Gal 00:40:49.080 --> 00:40:54.180 and actually putting it to auction which is weird to me but also makes it very hard to 00:40:54.180 --> 00:41:00.000 track. We might not ever know when Gal’s Bitcoins go up for bid. Gal, of course, 00:41:00.000 --> 00:41:05.580 is never gonna see his Bitcoins again. On October 9th, 2018, in the southern district of Florida, 00:41:05.580 --> 00:41:12.060 Gal stood in front of the judge to be sentenced. He gave short answers in Hebrew and then the judge 00:41:12.060 --> 00:41:20.040 sentenced Gal Vallerius to twenty years in prison. Gal’s arrest and conviction took out a big player 00:41:20.040 --> 00:41:25.260 in the darknet drug markets. It was a win for the feds who believed they proved that the dark market 00:41:25.260 --> 00:41:31.560 vendors could be tracked and identified and that undercover operations could be very effective. But 00:41:31.560 --> 00:41:37.020 even though Gal was behind bars, Dream Market was still open for business and thriving. 00:41:37.020 --> 00:41:43.200 By January 2019 the feds were on a roll, though; [MUSIC] the FBI’s J-CODE team riding on the back 00:41:43.200 --> 00:41:48.000 of their Operation Disarray’s success, were onto their next mission. This time they called 00:41:48.000 --> 00:41:54.300 it Operation SaboTor. On January 11th agents across the US and international law enforcement 00:41:54.300 --> 00:41:59.040 agencies worked together to identify and disrupt the big players selling drugs in 00:41:59.040 --> 00:42:03.000 the dark markets. Pooling their resources and manpower, they were using everything 00:42:03.000 --> 00:42:08.940 available to them to make a serious impact. Operation SaboTor was not mucking around. A 00:42:08.940 --> 00:42:13.680 month later in mid-February, the Dream Market started to have problems. The platform became 00:42:13.680 --> 00:42:18.060 intermittently unstable. Vendors couldn’t log in. Buyers couldn’t access the website. 00:42:18.060 --> 00:42:24.240 It would work and then it wouldn’t work, and then it would work again. Mods were posting to Dread, a 00:42:24.240 --> 00:42:29.940 dark market forum, and they said that Dream Market was under a DDoS attack by hackers demanding 00:42:29.940 --> 00:42:34.680 $400,000 US dollars. But the Dream Market admin was refusing to pay and trying to find 00:42:34.680 --> 00:42:39.720 a work-around to stabilize the market. It turned out it wasn’t just Dream that was getting hit; two 00:42:39.720 --> 00:42:44.520 other leading marketplaces, Empire and Nightmare, were also getting Ddossed, too. [00:45:00] On 00:42:44.520 --> 00:42:49.860 March 26th the US Department of Justice publically announced Operation SaboTor and its results. 00:42:49.860 --> 00:42:55.980 OFFICER6: [BANGING] FBI, search warrant! During Operation SaboTor our law enforcement partners 00:42:55.980 --> 00:43:02.340 spoke with over a hundred darknet drug buyers. Approximately sixty-one darknet drug traffickers 00:43:02.340 --> 00:43:09.000 were arrested, fifty-one firearms were seized, almost three hundred kilograms of drugs, and over 00:43:09.000 --> 00:43:12.923 seven million dollars in cash and cryptocurrency was seized. [BACKGROUND TALK, COMMOTION] 00:43:12.923 --> 00:43:22.560 JACK: Hm, let’s put two and two together here for a second. The feds, the FBI, 00:43:22.560 --> 00:43:27.960 is doubling down on their fight against the sale of opioid and are actively trying to find vendors 00:43:27.960 --> 00:43:34.080 and stop them. At the same time, they just got access to OxyMonster’s computer. [MUSIC] Now, 00:43:34.080 --> 00:43:40.080 keep in mind, OxyMonster was an admin to Dream Market so I’m just assuming here 00:43:40.080 --> 00:43:45.360 but it seems like a fair assumption that this means that the FBI was probably now 00:43:45.360 --> 00:43:51.180 admins of the Dream Market. Because if I was an FBI agent on this task force, 00:43:51.180 --> 00:43:59.220 I would certainly be posing as OxyMonster who was the admin, and not show my hand. I would save all 00:43:59.220 --> 00:44:03.960 the chat logs with other admins and dealers, and I would try to get more information from 00:44:03.960 --> 00:44:09.240 other admins. I would certainly look to see if I could find out who owned Dream Market because the 00:44:09.240 --> 00:44:15.840 FBI has a keen interest in taking down this marketplace. I’m willing to bet they used 00:44:15.840 --> 00:44:22.620 their unique position here to try to take down Dream Market and the people who run the site. 00:44:22.620 --> 00:44:26.520 On that very same day that the FBI announced Operation SaboTor, 00:44:26.520 --> 00:44:32.460 a notice appeared on the front page of Dream. It told users the market would be shutting down on 00:44:32.460 --> 00:44:39.480 April 30th but it would be moving to a partner platform and it would get a new onion address. 00:44:39.480 --> 00:44:45.720 This was unusual. If the feds got control of Dream, I don’t think they would move it to a 00:44:45.720 --> 00:44:51.660 whole new website with a new URL and everything. Maybe the owners figured out the feds had admin 00:44:51.660 --> 00:44:57.180 access and were just jumping ship. I don’t know, but this was a voluntary shut down of a really 00:44:57.180 --> 00:45:03.240 successful dark market. It’s not unheard of that this happens but it’s definitely unusual. What’s 00:45:03.240 --> 00:45:09.720 also strange is the message wasn’t signed with the usual PGP key which was expected from the market’s 00:45:09.720 --> 00:45:19.140 admin. But as soon as that notice went up, the DDoS attacks on Dream appeared to have stopped. 00:45:19.140 --> 00:45:24.840 Users turned once again to the dark forums to try to get some answers but there was a new problem; 00:45:24.840 --> 00:45:30.300 the Reddit dark market forum which was available on the surface net had been banned from the site. 00:45:30.300 --> 00:45:35.940 A new Reddit policy meant its content violated their rules and the subreddit had been removed. 00:45:35.940 --> 00:45:41.400 But the Dread forum was still up since it’s a forum on the darknet and more posts from mods 00:45:41.400 --> 00:45:45.780 started showing up there. They said Dream was rebuilding and would be opening again soon as 00:45:45.780 --> 00:45:51.000 a new dark market. It would be better-built and more resilient from DDoS attacks. While 00:45:51.000 --> 00:45:56.580 everyone was waiting for this new Dream Market to appear after Operation SaboTor, the feds got 00:45:56.580 --> 00:46:03.000 another win, [MUSIC] this time involving big-time vendors on Dream. Just nine days after Operation 00:46:03.000 --> 00:46:09.120 SaboTor was announced, on April 4th, three men were arrested in New Jersey. Chester, Jarrette, 00:46:09.120 --> 00:46:14.100 and Ronald had been operating two storefronts on the Dream Market under the name sinmed. 00:46:14.100 --> 00:46:19.320 Under a fake company called Next Level Research and Development, these guys had allegedly bought 00:46:19.320 --> 00:46:25.980 a powder-mixer, pill-press, a tablet-making machine. They had a DIY pill-making factory 00:46:25.980 --> 00:46:33.180 and were selling deadly fentanyl-laced heroin along with Xanax and methamphetamines. In fact, 00:46:33.180 --> 00:46:37.380 they were up there as one of the top three Dream vendors with the most amount of sales. 00:46:37.380 --> 00:46:42.060 Taking payments in Bitcoin, they were loading prepaid debit card accounts so they could use 00:46:42.060 --> 00:46:47.520 the crypto-cash at ATMs to withdraw the Bitcoin as cash. The feds believed sinmed 00:46:47.520 --> 00:46:52.680 laundered 2.3 million dollars in cryptocurrency selling them through Dream Market and using the 00:46:52.680 --> 00:46:59.160 laundering method over a two-year period. Their use of ATMs is what eventually got them caught. 00:46:59.160 --> 00:47:02.640 Chester was charged with selling controlled substances and identity 00:47:02.640 --> 00:47:08.520 theft and Jarrette and Ronald were faced with conspiracy and money-laundering charges. 00:47:08.520 --> 00:47:12.900 Right at the same time, Dream users began to report that Dream support staff were 00:47:12.900 --> 00:47:18.360 scamming vendors. They were locking down people’s accounts and asking for vendor’s passwords and 00:47:18.360 --> 00:47:23.700 recently-used Bitcoin addresses to verify their identity. If the vendor sent their password over, 00:47:23.700 --> 00:47:27.660 the password was then changed and their PGP key removed so the vendor couldn’t 00:47:27.660 --> 00:47:32.760 access their account at all. With echoes of what the feds did when they took over Hansa, 00:47:32.760 --> 00:47:38.040 this was not good news for Dream. For two months nothing happened. Dream planned on switching to 00:47:38.040 --> 00:47:43.980 a new URL but just hadn’t. Then in July a new market popped up and it was an [00:50:00] almost 00:47:43.980 --> 00:47:51.660 exact replica of Dream. It was called the SamSara market. Was this the new market that Dream mods 00:47:51.660 --> 00:47:58.800 promised? Maybe. I guess it seemed so but it was slow-going. Dream users were suspicious, 00:47:58.800 --> 00:48:04.260 with many fearing that this is just a honeypot set up by the feds to capture more vendors and buyers. 00:48:04.260 --> 00:48:12.300 But the site looks good, it works good, and began getting some traction. However, in November 2019 00:48:12.300 --> 00:48:18.600 it went offline. The site admins said they’re experiencing a massive DDoS attack and have 00:48:18.600 --> 00:48:25.440 gone offline. It’s been down for months now. It’s still down during the time of this recording. I’m 00:48:25.440 --> 00:48:31.380 not sure if it’s coming back or what. Perhaps this is another move executed by feds through 00:48:31.380 --> 00:48:37.320 J-CODE since they don’t seem to be letting up on the persistent attack on all these sites. [MUSIC] 00:48:37.320 --> 00:48:43.620 Ross Ulbricht, the founder of Silk Road, the first big dark market, he got prison for life. 00:48:43.620 --> 00:48:49.560 Alpha Bay’s founder, Alexandre Cazes, could possibly have the same charges but he’s dead 00:48:49.560 --> 00:48:56.100 now. OxyMonster was administrator, senior mod, and active vendor on Dream Market who’s now 00:48:56.100 --> 00:49:01.980 in prison for twenty years. His darknet career is over and Dream has gone down. 00:49:01.980 --> 00:49:07.860 His Bitcoin fortune has been handed over to the feds and he’ll now spend decades behind bars which 00:49:07.860 --> 00:49:13.380 makes me wonder if he’s gonna come out with the most epic beard of all time. Some prisons allow 00:49:13.380 --> 00:49:18.480 prisoners to grow beards, especially for religious reasons, but others force people to trim it back 00:49:18.480 --> 00:49:25.920 to a quarter-inch in length for security reasons. What got Gal identified and caught was because of 00:49:25.920 --> 00:49:31.380 a mistake on his part; not using a tumbler for the Bitcoin tip jar, using the same tip address 00:49:31.380 --> 00:49:38.820 in multiple places, and sending his tips to an exchange with his last name as his login. Gal was 00:49:38.820 --> 00:49:45.000 not new to dark markets. He had been around the block a long time yet he still left a trail. It’s 00:49:45.000 --> 00:49:50.460 easy to see the mistakes Gal made now but it’s not so easy to stay safe when you’re juggling dozens 00:49:50.460 --> 00:49:56.280 of accounts, hundreds of thousands of Bitcoin, and doing it for years and years and years. 00:49:56.280 --> 00:50:03.780 One or two little slip-ups is all it takes. Gal had no idea the feds were onto him and just how 00:50:03.780 --> 00:50:09.660 much they had traced back to him. The good news of this story is that some fentanyl vendors have been 00:50:09.660 --> 00:50:16.440 rooted out and stopped. This is a seriously messed up drug that has no business in any drug dealer’s 00:50:16.440 --> 00:50:21.480 hands. I know I’ve mentioned fentanyl a few times in this episode but I’m not sure you fully 00:50:21.480 --> 00:50:26.160 understand the dangers of it. Fentanyl was first prescribed by doctors, specifically if you’re 00:50:26.160 --> 00:50:31.500 suffering from some extreme pain due to cancer and there’s no other opioids that are actually working 00:50:31.500 --> 00:50:37.440 on you. The doctor might prescribe you a fentanyl patch or a lollipop but this is a potent drug. 00:50:37.440 --> 00:50:43.020 The smallest pinch of fentanyl is lethal. To give you a better idea, a typical single pill 00:50:43.020 --> 00:50:50.340 of ibuprofen is two hundred milligrams. A lethal dose of fentanyl is one milligram. That one tablet 00:50:50.340 --> 00:50:56.340 is two hundred times the lethal dose if it was fentanyl. Yes, people are dying from overdosing 00:50:56.340 --> 00:51:01.500 on prescription opioid-based drugs and if they can’t find those, they’ll find heroin and possibly 00:51:01.500 --> 00:51:08.340 overdose on that. But fentanyl is in a whole other league because it’s so potent. It’s so easy to die 00:51:08.340 --> 00:51:15.420 from which is why fentanyl has killed over 95,000 people in the last five years which is about 60% 00:51:15.420 --> 00:51:20.400 of all opioid deaths. I mean, just listen to what happened in this small town in West Virginia. 00:51:20.400 --> 00:51:26.640 REPORTER: Huntington, once a thriving industrial hub, had been crippled by years of job loss, 00:51:26.640 --> 00:51:32.100 rising crime, and 1,600 overdoses the previous year. [SIRENS] The calls 00:51:32.100 --> 00:51:36.900 started coming in at 3:21 on a warm August afternoon. In just four hours, 00:51:36.900 --> 00:51:41.640 twenty-six people had overdosed on a batch of fentanyl-laced heroin. 00:51:41.640 --> 00:51:46.560 JACK: Why is fentanyl all of a sudden the leading cause of opioid deaths? One big reason is because 00:51:46.560 --> 00:51:50.460 it’s synthetically made. Anyone can just order a bunch of it from China and get it 00:51:50.460 --> 00:51:55.440 shipped to you. From there, you can try your hand at making heroin-laced fentanyl for much, 00:51:55.440 --> 00:51:59.460 much cheaper which results in a lot of money for drug dealers. 00:51:59.460 --> 00:52:04.920 But can I switch gears here and just rant for a second? Yeah, people are making huge bank 00:52:04.920 --> 00:52:11.460 off the sale of fentanyl. I’m mad about it because they’re doing it recklessly. The US government has 00:52:11.460 --> 00:52:16.920 tried to make policies to make sure doctors only prescribe fentanyl to patients who really need it, 00:52:16.920 --> 00:52:21.540 to patients who have pain so severe that no other opioids work anymore. But the group 00:52:21.540 --> 00:52:27.780 that controls this regulation is McKesson, one of the largest drug distributors. They 00:52:27.780 --> 00:52:33.120 didn’t control the distribution of fentanyl very well. They made it easy for doctors to prescribe. 00:52:33.120 --> 00:52:38.640 This mismanaged program resulted in major fentanyl manufacturers like Johnson & Johnson 00:52:38.640 --> 00:52:44.280 and Cephalon to go nuts encouraging doctors to prescribe fentanyl. [00:55:00] These companies 00:52:44.280 --> 00:52:49.440 made hundreds of millions of dollars from that single drug which resulted in many deaths and 00:52:49.440 --> 00:52:55.020 addictions and deaths from addictions. Things got so bad that both Cephalon and Johnson & Johnson 00:52:55.020 --> 00:53:00.000 were investigated by the US government and fined massive amounts. Johnson & Johnson 00:53:00.000 --> 00:53:06.000 faced a multi-billion-dollar lawsuit for misrepresenting the dangers of opioids to doctors. 00:53:06.000 --> 00:53:11.820 Cephalon was hit with a 250-million-dollar lawsuit for trying to turn fentanyl into a routine pain 00:53:11.820 --> 00:53:17.100 management drug. These are the legal fentanyl makers and pushers making huge amounts of money 00:53:17.100 --> 00:53:22.440 from these drugs in reckless ways and illegal ways. But in my opinion the worst of these drug 00:53:22.440 --> 00:53:27.720 makers was Insys. Listen to this clip from NBC News that explains the trouble they got into. 00:53:27.720 --> 00:53:32.220 REPORTER2: Five top drug company executives have been found guilty in a bribery case involving the 00:53:32.220 --> 00:53:37.680 opioid fentanyl. The multi-billionaire founder of Insys Therapeutics and four 00:53:37.680 --> 00:53:43.200 other top execs convicted of racketeering. Prosecutors say their scheme involved bribes, 00:53:43.200 --> 00:53:47.580 kickbacks, even lap dances for physicians who prescribed 00:53:47.580 --> 00:53:51.300 large amounts of the company’s fentanyl spray to patients who did not need it. 00:53:51.300 --> 00:53:55.500 JACK: You see this? This is bad. The legal drug dealers have gotten 00:53:55.500 --> 00:54:00.930 scores of people addicted to fentanyl who had no business taking fentanyl. 00:54:00.930 --> 00:54:05.160 REPORTER2: Sarah Fuller didn’t have cancer. She was plagued with chronic neck and back 00:54:05.160 --> 00:54:11.220 pain from two car accidents but her doctor, Vivienne Matelon, actually brought an Insys 00:54:11.220 --> 00:54:16.020 sales rep to an appointment. Fourteen months after she started taking Subsys, 00:54:16.020 --> 00:54:20.760 Sarah was found dead on her bedroom floor. What killed your daughter? 00:54:20.760 --> 00:54:29.040 DEBORAH: Well, technically fentanyl. But a drug company who couldn’t care less about a human life. 00:54:29.040 --> 00:54:34.320 JACK: A court case against Insys went on for a while and ultimately resulted in a 00:54:34.320 --> 00:54:42.300 fine of 225 million dollars which actually bankrupted Insys. But with the company fined, 00:54:42.300 --> 00:54:49.200 prosecutors then went after top executives. John Kapoor, being the CEO and founder of Insys, was 00:54:49.200 --> 00:54:54.660 the main target. He was found guilty for getting doctors to over-prescribe fentanyl to patients 00:54:54.660 --> 00:55:02.340 who had no business taking it, all so Insys and John Kapoor could make more money. [MUSIC] 00:55:02.340 --> 00:55:07.440 One of the pieces of evidence that came up in John Kapoor’s court case was this music video. 00:55:07.440 --> 00:55:08.340 RAPPER: I love titrations, yeah, that’s not a problem. I got new patients 00:55:08.340 --> 00:55:13.134 and I got a lot of ‘em. 00:55:13.134 --> 00:55:15.009 JACK: I’ll just let you listen to the first verse. 00:55:15.009 --> 00:55:20.700 RAPPER: If you wanna be great, listen to my voice. You can be great but it’s your choice. A Bean, 00:55:20.700 --> 00:55:27.720 Z Real back again. 2015, let me begin. Insys Therapeutics, that is our name. We’re raising 00:55:27.720 --> 00:55:33.660 the bar and we’re changing the game. To be great, it takes a decision. To be better than 00:55:33.660 --> 00:55:39.600 the competition. VIP service like they’ve never seen, going deeper than Dan in the submarine. 00:55:39.600 --> 00:55:45.300 Build relationships that are healthy, got more docs than Janelle’s got selfies. What we built 00:55:45.300 --> 00:55:50.880 here can’t be debated. Shout out to Kapoor for what you’ve created. While the competition just 00:55:50.880 --> 00:55:53.994 making noise, we’re making history ‘cause we’re great by choice. I love titrations… 00:55:53.994 --> 00:56:01.200 JACK: VIP service like you’ve never seen? Shout out to Kapoor? I got new patients and 00:56:01.200 --> 00:56:05.520 I got a lot of ‘em? It goes onto say how well they treat their reps. They 00:56:05.520 --> 00:56:10.080 even have a rapping fentanyl spray bottle who goes onto say that other 00:56:10.080 --> 00:56:14.640 fentanyl drugs are like prescribing Xylitol which is just a sweetener. 00:56:14.640 --> 00:56:17.659 RAPPER: This ain’t no fight at all. If you’re trying to ball, 00:56:17.659 --> 00:56:19.946 I’ll substitute you like you was Xylitol. Beast. 00:56:19.946 --> 00:56:25.980 JACK: Strangely enough, the guy inside the fentanyl spray bottle in the music video was 00:56:25.980 --> 00:56:35.640 an executive at Insys also and he got in trouble for this too and was found guilty. So, John Kapoor 00:56:35.640 --> 00:56:43.241 was found guilty for racketeering. Just last week in January 2020, we heard what his sentencing was. 00:56:43.241 --> 00:56:47.580 REPORTER3: [MUSIC] The highest-ranking drug company executive convicted in the opioid 00:56:47.580 --> 00:56:53.340 crisis is headed to prison but the sentence is not harsh enough for some who say he got 00:56:53.340 --> 00:56:59.520 away with murder. A judge sentenced Insys Therapeutics founder John Kapoor to five and 00:56:59.520 --> 00:57:05.460 a half years for his role in bribing doctors to prescribe the powerful pain killer Subsys. 00:57:05.460 --> 00:57:15.060 JACK: [MUSIC] OxyMonster is serving twenty years in prison for selling opioids on the Dream Market. 00:57:15.060 --> 00:57:20.820 Kyle Enos is serving eight years for selling fentanyl to a hundred and sixty-eight people, four 00:57:20.820 --> 00:57:27.360 of which died from his drugs. Billionaire John Kapoor, founder of Insys, who was found guilty for 00:57:27.360 --> 00:57:32.340 influencing doctors to over-prescribe fentanyl to patients who didn’t need it – oh, and the 00:57:32.340 --> 00:57:38.220 court records show the FDA estimates that eight thousand people died from taking the fentanyl 00:57:38.220 --> 00:57:47.640 spray that Insys produced. That guy got five and a half years in [01:00:00] prison. [MUSIC] 00:57:47.640 --> 00:57:51.420 Wouldn’t it be weird if OxyMonster and John Kapoor ended up as cell mates? 00:57:51.420 --> 00:57:57.480 It’s just interesting to see these two drug dealers, both guilty for unethically selling 00:57:57.480 --> 00:58:02.820 the same drug but they’re both locked up for two totally different reasons. 00:58:02.820 --> 00:58:07.560 Oh, and I should add here that it’s been a week since John Kapoor has been sentenced to five and 00:58:07.560 --> 00:58:12.840 a half years in prison and guess what? He hasn’t gone to prison yet. He’s still home because he’s 00:58:12.840 --> 00:58:17.580 trying to get a suspension of the sentence until his appeal is completed which might be 00:58:17.580 --> 00:58:24.840 months or a year away. Hm, but you know what? John Kapoor is seventy-six years old right now 00:58:24.840 --> 00:58:31.320 so if he serves five and a half years in prison, he’s gonna get out when he’s eighty-two years old. 00:58:31.320 --> 00:58:35.100 What bothers me still is that these huge pharmaceutical companies who manufacture 00:58:35.100 --> 00:58:39.180 and distribute fentanyl recklessly are some of the biggest makers for 00:58:39.180 --> 00:58:43.920 Naloxone and Suboxone which are the drugs used to treat opioid addiction. 00:58:43.920 --> 00:58:51.360 These companies are making billions and billions and billions now by selling drugs to treat this 00:58:51.360 --> 00:58:57.600 opioid crisis that they had a hand in creating. To me, this is the worst part of the opioid epidemic; 00:58:57.600 --> 00:59:04.080 is that these major drug manufacturers let the genie loose. They recklessly got us addicted and 00:59:04.080 --> 00:59:11.880 are now making big money off the aftermath of it all. You probably know somebody who’s died 00:59:11.880 --> 00:59:19.380 from fentanyl. Prince, Tom Petty, Mac Miller. They all died from an overdose of fentanyl. 00:59:19.380 --> 00:59:30.780 They didn’t know they were taking too much. They weren’t trying to die. It wasn’t their fault. 00:59:30.780 --> 00:59:32.640 Fuck fentanyl and everything about it. 00:59:32.640 --> 00:59:42.420 JACK (OUTRO): [OUTRO MUSIC] Hey, Darknet Diaries is now on the darknet. What do you think of that? 00:59:42.420 --> 00:59:54.120 You can visit us there at uka5ybpmh3u54dkv.onion. This show is created by me, the original 00:59:54.120 --> 01:00:00.360 mini-mind, Jack Rhysider. This episode was written by the dark mouse, Fiona Guy, audio editing by the 01:00:00.360 --> 01:00:06.120 font-conscious Damienne, sound design by the merry Andrew Meriwether. Theme music is by the bubbling 01:00:06.120 --> 01:00:12.480 Breakmaster Cylinder. Even though I get downvoted every time I say it, this is Darknet Diaries.