The FBI versus Tor. How people in the darknet were really caught
Silk Road, Freedom Hosting, Playpen, Operation Onymous, AlphaBay. Every time, the headlines screamed that "Tor has been broken". Every time, the truth was more interesting - and more instructive.
1 October 2013, afternoon. The Glen Park branch of the San Francisco Public Library. At a table in the science fiction section sits a 29-year-old man in a T-shirt, working on a laptop. Behind him an argument breaks out - a couple is loudly quarrelling. The man turns his head. At that very second, the woman who was just arguing grabs his open laptop and hands it to an FBI agent.
That is how the story of Ross Ulbricht, known as "Dread Pirate Roberts", ended - the creator of Silk Road, at the time the largest online drug marketplace. The argument was staged. The point was to seize the laptop before its owner could close it and trigger the encryption. It worked: the computer was unlocked, and on it were a diary, notes and the site's admin panel.
But the most interesting part of this story is not the arrest itself. The most interesting part is how the FBI got to Ulbricht in the first place.
Altoid
Silk Road had been running since 2011 as a hidden service on the Tor network. The server was supposed to be untraceable and the bitcoin payments anonymous. For two years investigators tried technical approaches. The breakthrough came from something much simpler.
Gary Alford, an investigator with the US tax authority working with the DEA, did what anyone could do: he searched old posts on the internet. He found posts from early 2011 in which someone using the nickname "altoid" was promoting a new service called Silk Road. A few months later the same "altoid" asked for technical help on a programmers' forum. And he gave an e-mail address containing his first and last name: Ross Ulbricht.
No cryptography was broken. Tor worked exactly as it should. What failed was a man who, two years earlier, before he had even started thinking about caution, had left a trace online linking his nickname to his real identity. The internet does not forget. Ulbricht was sentenced to life in prison. In January 2025 he was pardoned by President Donald Trump.
Freedom Hosting: the browser as a Trojan horse
In the summer of 2013 the FBI used a different method. The target was Freedom Hosting, a hosting company operating inside the Tor network whose servers hosted, among other things, sites with child sexual abuse material. At the end of July its operator, Eric Eoin Marques, was arrested in Dublin. The servers passed into the FBI's control.
Instead of shutting them down immediately, agents added JavaScript code to the sites. The code exploited a vulnerability in the Firefox 17 ESR browser - the same one the Tor Browser bundle was then based on. When a user visited a site, the browser sent - bypassing the Tor network - their real IP address and computer name to a server in Virginia.
The FBI calls such tools "NITs" - Network Investigative Techniques. In the language of security specialists, it is simply malware. But something else mattered: the vulnerability that was exploited had already been patched. The attack only worked on those who had not updated their browser.
Playpen: two weeks as administrator
In February 2015 the FBI seized the server of Playpen - one of the largest sites on the Tor network with child sexual abuse material. This time the agents went further than ever: for almost two weeks they ran the site themselves, from a single server in Virginia, and infected visitors' computers with their NIT.
The scale was unprecedented. According to testimony later given in court, the FBI - on the basis of a single warrant issued in Virginia - broke into more than 8,000 computers in 120 countries. The case sparked a heated legal debate. Some judges ruled that the warrant exceeded the powers of the court that issued it. In several trials the FBI preferred to drop the charges rather than reveal the code of its tool. Despite the controversy, US rules were later changed to make similar operations easier.
And again: Tor itself was not broken. What was broken was the browser on the computers of people who believed that Tor alone was enough to keep them anonymous.
Operation Onymous and the Carnegie Mellon mystery
In November 2014, Europol and the FBI announced Operation Onymous - the name was a pointed play on "anonymous". Seventeen people were arrested in 17 countries, and more than 400 hidden services disappeared from the network, including Silk Road 2.0, the successor to the original Silk Road. Its operator, 26-year-old Blake Benthall, was arrested in San Francisco.
This time the question of how it was done was more serious. A few months earlier, the Tor Project had announced that from February to July 2014 a group of relays had been operating on the network carrying out an attack known as "relay early". The relays tagged passing traffic in a way that made it possible to link a user to the hidden service they were visiting. The attack coincided with a suddenly cancelled talk by researchers from Carnegie Mellon University, who had announced a demonstration at the Black Hat conference of de-anonymising Tor users "on a budget" of around 3,000 dollars.
Later, court documents showed that information about Silk Road 2.0 users had come from a "university-based research institute" acting under a subpoena. The Tor Project reacted sharply, but above all technically: the flaw was patched and the network strengthened. Of the cases described here, this was the only one in which the Tor network itself was attacked - and the only one that led to a real improvement of it.
AlphaBay: the welcome e-mail
In July 2017, authorities in the US, Canada and Thailand shut down AlphaBay - a marketplace many times larger than Silk Road had been. Its creator turned out to be 25-year-old Canadian Alexandre Cazes, living in Bangkok. He was betrayed by a small detail from the service's first days: the e-mails sent to new users on registration and password reset contained his private address in the header - with a nickname he also used on forums and classified ad sites, and with his year of birth.
The arrest scenario resembled the one in San Francisco. Police in Bangkok lured Cazes out of his house by a ruse - reportedly under the pretext of a car crash - while his laptop remained open and logged in. A few days later Cazes died in custody. Investigators seized servers, accounts and millions of dollars in cryptocurrency.
Once again, no cryptography was broken. One e-mail address from years earlier and one unlocked computer were enough.
A pattern that repeats
Let us look at these stories together. Ulbricht was caught through an old forum post. Cazes - through an e-mail address from years before. Freedom Hosting users - through an outdated browser. Playpen users - through a browser flaw and the belief that Tor alone gave them anonymity. Only in the case of Onymous was the network itself attacked, and with relays that could be detected and removed.
This confirms what the NSA itself wrote in the documents revealed by Snowden: Tor cannot easily be broken, so everything around it is attacked. The computer. The browser. Habits. The internet's memory.
It must also be said clearly: the operations described mostly concerned the most serious crimes, and many people welcomed their results with relief. But the same techniques work on anyone. On a journalist protecting a source. On an activist in a country where criticising the authorities is a crime. On a lawyer storing a client's documents. A tool does not choose whom it attacks.
What this means for you
The lessons are simple, though they require discipline. Update everything - always and immediately. Separate identities: what you do anonymously must never touch what you do under your own name, neither today nor in the past. Do not rely on a single tool: Tor protects the path your data travels, but it will not protect the computer you send it from. If the browser is taken over and the system it runs on has access to everything, the attacker has everything.
That is why the best setups combine an anonymous network with isolation at the system level. Then even a successful attack on the browser ends in a compartment that does not know your real address, cannot see your files and is about to cease to exist.
Tor did not lose these battles. The people who lost were those who thought one tool would do all the work for them.