Loading summary
Transcript46 lines
- [00:03]
Dina Temple Raston
From recorded future news and prx, this is click here. On the Internet, trust is often just performance. A profile picture, a username, a message that sounds believable enough. And most of the time, the people doing the deceiving are criminals. But every once in a while, the people pretending to be someone else are the police. A few years ago, Dutch investigators launched an undercover operation inside the dark web. And at first it looked like a normal takedown. But then something strange happened. Instead of shutting the site down, they stayed. From Recorded Future News and prx, this is Click Here, a show about the people making and breaking our digital world. I'm Dina Temple Raston. Today, our colleague Karen Duffin has the story of an undercover cyber operation that blurred the line between catching criminals and becoming part of the system they were trying to destroy. That's right, after the break. Stay with us. Support for Click here comes from NPR's Planet Money podcast. Curious about the economic forces shaping your daily life? The Planet Money podcast makes the economy make sense by telling stories about the people inside it. Take the wnba. Most people heard the league landed a big new collective bargaining agreement. But Planet Money went deeper inside the negotiations themselves. They found a Nobel Prize winning economist helping players make their case with something surprisingly a pie chart. Because the real fight wasn't just about bigger salaries. It was about revenue share and whether players would finally get a bigger piece of a rapidly growing business. Planet Money explained why that matters and why this deal could reshape women's sports for years to come. That's what Planet Money does. It takes ideas that sound abstract. Collective bargaining sanctions labor markets and turns them into stories that feel immediate and human. Other episodes have explored why Pokemon cards are outperforming some investments, or how Russia's economy adapted after years of sanctions and what a 750 pound restaurant robot says about the future of work. Planet Money is economics told through curiosity, surprise and great storytelling. Follow NPR's Planet Money podcast and understand how money shapes the world. Support for Click here comes from Quince. Summer always makes me rethink what I'm reaching for every day. Lighter fabrics, better materials, pieces that just feel good the moment you put them on and they look effortless. That's why I keep coming back to Quince. They focus on high quality essentials. Think breathable linen, soft organic cotton, washable silk, but without the luxury markup. It's that rare balance where everything feels elevated but still easy. Quince has beautiful everyday pieces like 100% European linen pants, dresses and tops with styles starting at $32. Their denim is soft and easy to wear, and their organic cotton sweaters are perfect for layering on cool summer night. Everything at Quint's is priced 50 to 80% less than similar brands, and Quints works directly with ethical factories and cuts out the middleman. So you're paying for quality, not brand markup. But it's not just clothing. Quint's has really become a destination for elevated essentials across home kitchen, bedding and beyond, making it easy to bring a more premium feel into everyday life. I just got a Quince bathing suit that looks like one of those expensive European brands but for a fraction of the price. Elevate your summer wardrobe. Go to quint.com clickhere and get free shipping on your order and 365 day returns. Now available in Canada too. That's Q-U-I-N-C-E.com clickhere for free shipping and 365 day returns. Quince.com clickhere.
- [04:40]
Karen Duffin
I'm Karen Duffin and you're listening to Click here. If you spend enough time around cyber investigators, you start to hear the same people come up again and again. Not just the names of hackers, but the names of the groups that fight them. And legendary among them is the Dutch National High Tech Crimes Unit.
- [05:05]
Dina Temple Raston
Together we have managed to do it again. We were able to intercept and read messages exchanged between serious criminals.
- [05:13]
Karen Duffin
They've worked some of the most complex dark web investigations in the world, cases that are hard to crack because they don't sit neatly in one country or one system or even one kind of crime. And inside that unit, there's the mix of people you might expect and some you wouldn't.
- [05:32]
Ronald Rekers
Like this guy I'm Ronald Rekes. I'm a Dutch police officer. As you can say, an old school police officer. This year, 50 years in the police
- [05:44]
Karen Duffin
force, Ronald Rekers made his way through the ranks the traditional way.
- [05:49]
Ronald Rekers
I started as a regular street cop. I've been a motorcycle police officer, community police officer, homicide detective, burglary detective, riot squad member. I'm always the guy also on the streets, the first at the scene, and I want to be there where the action is.
- [06:09]
Karen Duffin
About 10 years ago, the action started to move. The calls were still coming in, the work was still there. But more and more the action wasn't happening out on the street. It was happening in the digital world. And Ronald remembers thinking, if that's where it was going, that's where I want to go too.
- [06:30]
Ronald Rekers
I thought, what do I want to do for the next 1015 years. And cyber is the new frontier.
- [06:38]
Karen Duffin
So he made a late career pivot and applied for a job on the high tech crimes unit, a place where the crime scene didn't sit so much behind police tape, as it lived on servers inside networks and systems designed to hide who's really on the other end. And while Ronald wasn't a programmer, he thought he had a lot to offer.
- [07:01]
Ronald Rekers
My pitch was, I'm a street copper. I think I can be the connection between traditional police and the new cyber cops.
- [07:10]
Karen Duffin
Others could get into the systems, and Ronald would make sure the case held up after they got there.
- [07:17]
Ronald Rekers
It's very important, the paperwork, because without the paperwork, no conviction. If it's not on paper, it doesn't exist.
- [07:25]
Karen Duffin
And it was a few years into his new job when Ronald found himself pulled into a case that people in cyber circles are still talking about. It centered around a marketplace called Hansa, one of the largest dark web markets in Europe. In its heyday, Hansa was working with thousands of drug dealers with tens of thousands of listings. Everything from cocaine to MDMA to heroin. And as dark markets go, it was a place built to feel, well, reliable, structured, even professional. And the high tech crimes unit had been watching it for years.
- [08:07]
Ronald Rekers
Alzheimer became our child. It became our baby.
- [08:12]
Karen Duffin
And like most markets on the dark web, it wasn't supposed to be easy to find. And it definitely wasn't supposed to be easy to shut down. Until one day, the unit got an unexpected tip. Not just a username or a rumor. They had a tip about a server. And this one appeared to be connected to Hansa. Not the live site itself, but something more vulnerable. The equivalent of finding a recording of criminals playing planning their crimes. Because what they found was what's called a development server. It's the place where Hans team would plan out new features and test them before going live. In essence, the blueprints of their marketplace. And this server was sitting in the Netherlands, which meant for the Dutch unit, they had jurisdiction. They moved quickly. They reached out to the hosting company, who got them inside the server, where they installed monitoring equipment. And this allowed them to track data moving in and out in real time. And inside that data was a pathway to the holy grail. The machine running Hansa's entire marketplace, Essentially the scene of the crime. And once they got into that machine, they copied the drives, pulled the data, the full internal history of the site. Every transaction, every message. And buried in all of that, they found something even more valuable. A set of chat logs. The back and forth between Hansa members stretching back years, and this contained not just pseudonyms, but real names and in one case, a home address, which meant they weren't just inside Hansa's machines. They were close to the people running it, close enough to end it. But then they chose to do something entirely different. That's after the break. Stay with us.
- [10:30]
Dina Temple Raston
Support for Click Here comes from Servil. Every company says AI will make employees more productive, but most employees are still stuck waiting on it, waiting for app access and password resets, waiting for someone to fix a laptop issue so they can get back to work. That operational drag adds up fast, and IT teams are overwhelmed trying to keep up. Servil was built to automate that work. You describe what you want in plain English and Servl builds it for you. No complicated workflow, no consultants, just faster support and fewer tickets slowing everyone down. The platform is designed to eliminate repetitive tickets so it can focus on strategic work instead of constant firefighting. The company guarantees customers can automate 50% of it tickets. Learn more or start a free four week pilot@cerval.com clickhere that's S E R V A L.com clickhere servil.com
- [11:35]
Wise Sponsor Voice
support comes from wise the smart way to manage the currencies you need around the globe. Fed up with losing out to hidden fees? When you send your money abroad with your everyday bank? Choose the smart way Wise. You can count on the exchange rate you'd usually find on Google. No unwelcome surprises. Plus, ditch that where's my money feeling. Most transfers arrive in under 20 seconds. Join millions, saving billions on hidden fees. Be smart. Get Wise. Download the Wise app today. T's and C's apply.
- [12:06]
Karen Duffin
If you're struggling to keep up with all the latest innovations in tech and what they'll mean for your life, TED Tech has you covered. Get ahead of the curve with digestible downloads on some of the biggest ideas in technology, from AI and virtual reality to clean tech. Find TED Tech wherever you get your podcasts. Welcome back. I'm Karen Duffin and this is Click Here. The Dutch High tech Crimes unit had finally hacked into one of the largest dark web markets in Europe when someone on the team made a surprising suggestion.
- [12:46]
Michael (High Tech Crimes Unit)
The normal response would be like, if we can get to the server, then we can take it down and we can investigate it.
- [12:53]
Karen Duffin
This is Michael, who worked with Ronald on the High Tech Crimes unit. He felt that the normal response at takedown wasn't enough.
- [13:01]
Michael (High Tech Crimes Unit)
And the problem with that in that you get like a we call it a water bed effect where if we take it down, it will just pop up somewhere else.
- [13:10]
Karen Duffin
Push it down in one place, and the criminal activity doesn't disappear. It just moves somewhere else. Same vendors, same buyers, same system, just under a different name. And this is when the conversation began to shift.
- [13:29]
Ronald Rekers
Someone came up with the idea, let's do something different.
- [13:32]
Karen Duffin
What if, instead of shutting the market down, they quietly took it over, ran Hansa themselves? That way, they could stay long enough to map the networks, long enough to build cases, long enough to understand just how far this system reached. Not infiltrating one market, one buyer, one transaction, but the entire ecosystem.
- [13:59]
Ronald Rekers
It's going deep undercover. Go back to the movies. Donnie Brasco, tiger thing.
- [14:04]
Karen Duffin
Who he's with and who he's close to.
- [14:06]
Dina Temple Raston
They're all the top dogs now.
- [14:08]
Ronald Rekers
All of us. It was kind of a Donnie Brasco thing. Yes,
- [14:16]
Karen Duffin
As it turned out, two of the men that Dutch investigators believed were running Hansa were living in Germany. And in one of those moments that sounds almost scripted, German authorities were already investigating them. Not for Hansa, for another criminal case entirely. And that mattered because it created a rare kind of opportunity. If they coordinated with the German police and had them arrest the men on the unrelated charges, there would be a small window where the site itself might suddenly be left unattended. No goodbye message, no shutdown notice, Nothing that would alert Hansa users that something was wrong. And the Dutch investigators realized that if they moved carefully enough, they could slip into that window and quietly take control of the site before users realized that the original site managers were gone. So when German police detained the suspects, the Dutch high tech crime unit stepped in and quietly took control of Hansa. The police were now secretly running one of the largest dark web drug markets in the world.
- [15:30]
Ronald Rekers
I was excited. Yes, let's do it. Everybody was a bit stoked about it.
- [15:34]
Karen Duffin
If you were logging into Hansa that day, you wouldn't have noticed anything at all. The login page looked the same. The listings were still there. Messages kept moving through the system exactly like they had before.
- [15:46]
Ronald Rekers
Nobody noticed. The police had taken our Hansomark and full control on it at that moment.
- [15:52]
Karen Duffin
On the surface, it was business as usual. But that was just the beginning. Because taking over the market was one thing. Keeping it believable required something else entirely. Because people were logging in, orders were moving, and when things went wrong, as they often did, someone had to respond.
- [16:16]
Michael (High Tech Crimes Unit)
Lots of time, users, buyers, and vendors do not agree upon their deal. And then as a market, you have to decide who's right. So a lot of time goes into
- [16:25]
Karen Duffin
that so they did the work. They answered messages, resolved disputes, kept vendors from walking away and buyers from losing trust. And ironically, the better they did it, the more this criminal system held together. This is Sander, one of the members of the unit.
- [16:43]
Sander (High Tech Crimes Unit)
We definitely felt that we were running the market better than they were.
- [16:47]
Karen Duffin
The more smoothly things ran, the more activity flowed through the site. More transactions, more conversations. And that all meant more chances to understand how it all worked from the inside. And once they were in that position, they could do small things that looked like routine maintenance but were actually traps, like say, oops, I'm so sorry, but your account information got deleted accidentally. Could you upload it again into this little Excel document?
- [17:18]
Ronald Rekers
Because it's a Microsoft Excel document that
- [17:21]
Sander (High Tech Crimes Unit)
gives you more opportunities to hide a beacon insight. And by doing so, we could see the IP address of the computer that downloaded this pixel.
- [17:31]
Karen Duffin
And each interaction revealed a little more. A location, a device, a network. And all the while, the market kept running, which meant something else was happening. At the same time, trust was growing, not because the system was secure, but because it appeared to be. And then the operation got bigger. Another major dark web marketplace, something called AlphaBay, went down. And suddenly, thousands of users were looking for a new place to go. And many of them landed on Hansa. Traffic surged, new accounts poured in. And for a brief moment, the investigators weren't just watching one marketplace. They were watching a much larger piece of the dark web economy from the inside. They kept it going as long as they could until finally they had enough evidence and they flipped the switch. They shut Hansa down. When users tried to log in after that, they didn't find listings or even a login screen. They found a message. The site had been seized, it said, and had been under law enforcement control for weeks. A bait and then a quiet switch revealed all at once.
- [18:55]
Sander (High Tech Crimes Unit)
After the Hansa takedown, many of these vendors were so scared that they were compromised, that their identity was leaked, that they started a completely new identity on the remaining markets.
- [19:08]
Karen Duffin
And that may have been the real impact. Not the arrests, not the money, but the doubt. Because on the dark web, everything depends on a kind of shared fiction that the person on the other side of the screen is who they say they are. After Hansa, that fiction was harder to believe. And, you know, the system didn't disappear. Markets came back. They always do. But something had shifted. For a while, at least. People weren't so sure who they were dealing with. And that uncertainty was. May make people just a little more reticent to participate in these marketplaces. And that's where this kind of bait and switch lands differently. Because most of the time, deception online works against you. It pulls you in, hides what really is happening, reveals itself too late. But in this case, the deception ran the other way. It gave investigators a way in, and it let them stay there just long enough to turn the system on itself.
- [20:17]
Dina Temple Raston
That was karen duffin and this is click here. Click Here is a production of Recorded Future News and prx. Today's show was written and produced by Megan Dietre, Sean Powers, Erica Gaeda, Zach Hirsch, and Casey Georgie. It was edited by Karen Duffin and Sarah Cavedo and fact checked by Darren Ancrum. Original music is by Ben Levenston, with additional music from Blue Dot Sessions. Our staff writer is Lucas Riley, our illustrator is Megan Gough, and our sound designers and engineers are Jake Cook and Jesse Niswonger. I'm Dena Temple Raston. Thanks for listening.
- [21:16]
Wise Sponsor Voice
Support for this program comes from Recorded Future. In cybersecurity, the biggest risk isn't what can be seen, it's what gets missed. Recorded Future analyzes billions of signals to help organizations stay ahead of threats. Recorded Future Know what matters? Act first.
- [21:32]
Sander (High Tech Crimes Unit)
Looking for more of the cybersecurity and intelligence coverage you get on Click Here, Then check out our sister publication the Record from Recorded Future News. You'll get breaking cyber news from reporters in New York, Washington, London, and Kyiv, among others. And you'll see for yourself why it attracts hundreds of thousands of page views every month. Just go to the Record Media.