Hansa Market

~ the obituary ~

for about a month in the summer of 2017 the third biggest drug market on the internet was, in practice, a dutch government service. the login page did not change and the escrow still paid out. what changed was who was reading the database.

hansa was running on tor by 2015, one of the markets that grew into the space silk road left behind when it was seized in 2013. it sold what those places sold. it ran the machinery those places ran, with funds held in escrow until a buyer confirmed delivery and a public rating hanging off every vendor. by 2017 it sat third in the world by size, behind alphabay and behind dream.

the end of it was arranged in a specific order. dutch investigators got a lead in 2016 and traced the servers to lithuania in april 2017. german police arrested the two administrators on 20 june, one man of thirty in siegen and one of thirty-one in cologne. the dutch pushed their own copy of the site live the same day and started answering as the operators. on 4 july alphabay stopped responding. its buyers and sellers, assuming an exit scam, moved to the largest thing still standing.

i have nothing personal to put next to this and no reason to pretend otherwise. the part i can actually speak to is the engineering, because for one month a police force operated a live consumer product with a hostile user base, and did it well enough that nobody noticed.

~ the case file ~

~ the mistake ~

the whole thing rested on housekeeping. the administrators had left old irc logs sitting on a development server, and those logs carried their full names along with a home address for one of them. a security firm found that development copy and the lead reached europol in 2016. after that it was patience and bitcoin tracing until the hosting company in lithuania turned up.

there is a lesson buried in that which has nothing to do with drugs. the anonymity of these systems was never really about tor. it was about whether the people running them could stay disciplined for years without one careless file. two years was long enough for that to fail.

~ the month it belonged to the police ~

what the dutch did with their month is the part worth remembering. they logged every password in plaintext, on the reasonable assumption that people reuse them. they rewrote the built-in pgp tool so it kept a readable copy of each message before encrypting it. the feature that stripped location data out of vendor photographs was changed to record that data first, then the photo database was wiped so vendors would helpfully upload everything again. an excel file circulated to bigger sellers phoned home with real ip addresses when opened.

they let roughly 27,000 transactions go through to build the evidence, and passed around 10,000 delivery addresses outside the netherlands to europol. then on 20 july the seizure banner went up. the announcement was deliberately loud, because the point by then was not the site.

~ what it left behind ~

police had taken markets down before and the markets had always come back within weeks. bayonet aimed at something slower. every vendor who had used hansa during that month had to assume they were already in a file, and every buyer had to assume the next market was also a trap. that suspicion did more damage to the category than any single seizure.

it wore off, the way suspicion does. new markets opened, the old cycle resumed, and hansa is now a footnote inside the alphabay story rather than a name people recognize on its own. it deserves better as a case study. it is the only shutdown i can think of where the product kept shipping features for a month after it died.

@}-->--

              )
             (_)
            .-'-.
            |   |
            |   |
            |   |
            |   |
          __|   |__   .-.
       .-'  |   |  `-:   :
      :     `---'     :-'
       `-._       _.-'
           '""""""

« previous  ·  random  ·  next »