The Hunt for the Dark Web's Biggest Kingpin, Part 3: Alpha Male

Grant Rabenn was going to charge Cazes with running AlphaBay by March of last year. His colleague, Paul Hemesath, wanted more proof. Cazes' online activity, from email to banking, had begun to coalesce into a portrait of Cazes' entire digital existence. Cazes' daily thoughts were revealed to them in April with a level of detail they had never believed possible.

The team quickly learned that Roosh V was a kind of hypermasculine, alpha-male, pickup-artist community, as well as a hive of misogynist, alt-right racism. It had tens of thousands of registered users, men who coached one another on maximizing their sexual conquests and living an "Alpha" lifestyle.

A curious person was found on that forum. He was a member of Roosh V and went by the nameRawmeo. His love of "rawdogging" appeared to be the reason for the name. Over the course of a thousand posts, Rawmeo achieved the title of "true player" on the forum. He boasted of living large in Thailand, owning a web-hosting and design firm, and having a fortune in digital currency. The prosecutor team confirmed that Cazes was using his account to pay for a subscription to Roosh V. Rawmeo, the alpha male.

Rawmeo was different from Alpha03. Alpha02 was a dark-web leader who restricted his communications with AlphaBay's community to the bare minimum. Cazes had a full-color, tell-all persona called Rawmeo, an outlet for him to enjoy the rewards of his larger than life success, stretch out his ego, and wax poetic about his personal philosophy. He said that the person who gave the least amount of fucks would always have the upper hand.

Cazes was a prolific poster to a particular Roosh V section known as the "I-Just- Had-Sex" thread, where he described how he would often pick up Thai women and try to sleep with them. He likened the women to a juggler who keeps as many plates spinning as possible, never giving any of them so much attention as to let one fall.

His signature summed up his lifestyle and extolled the virtues of promiscuity for men and virginity for women.

Cazes believes in a strict system of SMV that could be used to determine a man's sexual fortunes. He wrote that the pillars of SMV are Fame, Looks, Money, and Game. Fame is the number one.

He explained to the Thai women that he was of a higher social class than them and that they were lucky to have his attention for a short time. He wrote that he had to let her go after she showed a strong personality. He told his fellow alphas to seek out single mothers for easy sex but not a long-term relationship. It can be good if you don't want to be a cuckold before you start the relationship. Let out a Fatherly vibe and you're in.

Cazes was fixated with the threat of false rape accusations. For someone obsessed with privacy, he boasted of his solution. He wrote that he secretly recorded every sex act with the girl. If the shit hits the fan, this is on the hard drive. Nobody will ever know that there is a video. My girls' privacy is respected.

He explained that he loved his wife and that she was pregnant with their first child. She has everything a wife needs to have: virgin, well preserved body, university degree, complete family, no LGBT in social circle, cooks for me. He said he kept a close eye on her finances, storing most of his money in cryptocurrencies, and cashing out only what he needed.

Cazes was as private minded as Rawmeo was. His philandering from his family was completely sealed off, as was his Alpha02 persona. He said he is a professional cheat. He hid the fact that he used the second home for sex. He did not want his plates to know his real name. He used separate phone numbers for his different personas' communications and bragged that he spoofed the phone carrier's code to link two numbers on the same device

He wrote that his two lives can't be linked because he has a completely different identity with his plates.

One of the agents assigned to the AlphaBay case spent more time with Rawmeo than anyone else. She was fascinated by the lurid details of his sex life and marveled at the hypocrisy of his commentary. He wrote that he didn't do web design work for social justice warriors or rent his real estate properties to gay couples for weddings because he didn't like ethics. Even if it means a loss, it's important to follow our principles.

The central task in the AlphaBay case was to trace his financial assets. He has four homes in Bangkok, his primary residence, another for his in-laws, and his mansion under renovation, as well as his two sports cars and motorcycle. She was amazed by the casual extravagance of Cazes. He mentioned in an email that he had spent $120,000 at Sirocco in the previous two months, after complaining about the service.

Cazes was watched by his supervisor and the Thai police as he entered a store to send a package of documents. After he left, the police found an application for economic citizenship in Cyprus, one of several countries where he sought to cache his wealth. The documents provided a detailed accounting of Cazes' finances, helping to track down bank andcryptocurrencies exchange accounts in Lichtenstein and Switzerland, as well as millions of dollars in real estate investments in Cyprus. She was able to find another property in Antigua and Barbuda.

As she carried out her financial tracing, she became more and more obsessed with Cazes' Roosh V persona and his personal life. She found out that his posts as Rawmeo revealed when Cazes was on the internet. If a user were active on the site, a small gray figurine on their profile would turn green. She knew she was watching Cazes in real time when she saw that figure light up next to Rawmeo.

Cazes' online behavior could be compared to his real-world behavior with the help of the online work of agents. Cazes would pick up a young woman from a 7-Eleven, take her to his bachelor pad, and then disappear. Cazes talked about the sex he had with the woman on Roosh V the next day. It was as if they could see into Cazes' private thoughts.

He took a break of his mind. Cazes kept his secret life as AlphaBay's creator under wraps. The writing on the forum displayed a deep psychological portrait. He wrote about how his parents separation had affected him in a post. Cazes said that his father was absent. I was able to see him 4 days a month because he tried to hire the best lawyers. When I was 19 months old, my mother dumped him because he was more exciting than she was.

Cazes was denied masculine experiences until he was 18 because he didn't have a chance to live with his father. These are essential male activities. Driving a motorcycle, changing a tire, using a chainsaw, approaching girls. He said that all the stuff had to be learned from the beginning.

This was the origin story of Alpha03. She read it as a self-portrait of a man overcompensating, blaming his mother for what he perceived to be his lack of masculine qualities.

Cazes had filed an official form with the government of Grenada in order to get economic citizenship. His life story was short and to the point, from skipping the second grade at his elementary school in Trois-Rivires to dropping out of college and trying to find a job.

He had worked at McDonald's part-time for a few months during his first year of college but was fired for not fitting in the group. He was fired from a Quebecois restaurant because he was eating on the job. Cazes left his job at the insurance company because of the low pay and long hours. He wrote that he was let go from his job at a Canadian telecom firm because he was not fitting in the group. One of the shareholders hated me for getting the job without a degree and I was fired when they found out that I was seeing his wife.

The agents could have taken over the market instead of arresting the admins. There was no idea what powers they might gain with one of the most active sites under their control.

It could seem almost voyeuristic to sort through the mess of Cazes' life. It was more than just a distraction. Occasionally, he would give the investigators a gem of information for their investigation.

There was a discussion in the Roosh V thread about Windows versus Mac. Cazes said that he ran Linux, the "Cadillac" of operating systems, and that he would never miss an opportunity to one-up his fellow alphas. He explained how he used Linux Unified Key Setup, a free encryption tool specific to Linux, to scramble his laptop's hard disk whenever he closed his machine. Without his phrase, the world's most powerful supercomputers wouldn't be able to crack that cipher.

This had huge implications for the team of investigators. They knew from the Silk Road case that there were three key components to a successful bust. To get evidence of their target's guilt, they would need to seize AlphaBay's server, arrest its administrator, and get his laptop.

They knew what to expect when they came for that laptop. If the FBI wanted to capture Cazes' computer, they would need to take it away while he was using it.

The challenge was that he didn't log in to AlphaBay from anywhere other than his home. It seemed that he had learned a lot from his predecessor.

Six months into the AlphaBay investigation, the team had Alpha03 in their sights. If they weren't able to lay hands on his laptop in a live, open state, his most incriminating secrets would be forever locked inside it.

A core team of AlphaBay investigators, including Rabenn, Hemesath, Miller, and the prosecutor from the Department of Justice's computer crimes unit, went to the US attorney's office in Sacramento to review the evidence. Were they going to indict Cazes?

Hemesath silently typed while the agents and prosecutors talked over piles of bank documents. Some wondered if the prosecutor was rudely doing other work or answering emails in the middle of their meeting.

Hemesath connected his laptop to a monitor on the wall and showed a graphic to the room. He had illustrated a tangle of lines and a flow chart. The lines between them indicated the connections between Chainalysis' Reactor software and traditional payments, as well as the usernames and email addresses they linked to their target. There was a name on the left. The right was occupied by Alpha03. Every line started with Cazes, branched out into the mess of his online life, and then descended on his dark-web persona.

The gun wasn't smoking. They would have to catch Cazes with his hands on the keyboard. These were not coincidences, he was no patsy.

The team from a dusty city in the Central Valley had found Alpha02 and were ready to take him down. They didn't know that a small group of police in a small country 5000 miles to the east would help expand their operation.

Around the same time that spring, in a long, black, four-story office building flanked by forest and highway in the leafy central Netherlands town of Driebergen, a secret began to spread among the Dutch National Police.

The FBI discreetly told the Dutch that they might need their cooperation to surveil and seize an AlphaBay server in their country after being tipped off to AlphaBay's Netherlands address.

One group of Dutch agents got the news that the US was going to bust the dark-web market. The site they were looking for was growing quickly into the world's second- largest dark-web market. They wondered if there could be an opportunity to make this happen.

The Dutch National Police's Driebergen office formed a team of investigators to look into the dark web drug market called Hansa. Hansa had thousands of vendors and thousands of listings for narcotics. The Dutch investigation into Hansa started with a tip from a security firm. There is a Hansa server in a Dutch data center. The main server that was running Hansa's market was not found and the machine that was left vulnerable was an older machine. Bitdefender didn't reveal how it spotted the server's protected address.

When the Dutch set up a wiretap on that computer, they discovered that the administrators had connected to it from another Dutch server, along with four others in Germany. The German federal police helped them seize all the machines. Hansa's sensitive data was found by the Dutch police when they took possession of the server. The source code of the market, a collection of usernames and passwords, and a database of all the market's transactions were included.

The Hansa database listed only the names of the site's users, and each of those users' connections to the site had been obscured by the internet anonymity service. The identities of Hansa buyers and sellers weren't known to the investigators. The data contained a huge chat log between the two administrators of Hansa. This was a huge collection of messages. They mentioned their full legal names in some of the conversations. His home address was revealed by one of the people. The 30-year-old was based in the German city of Siegen, while the 31 year-old was in Cologne.

Two Dutch investigators pored over the data at a desk on the second floor of the Driebergen police building after the server seizure. One investigator was an agent for the Dutch National Police and the other was a technical adviser to the Dutch prosecutor. The highly sensitive information was on the screen before them. How could they take advantage of this windfall?

Andersen- Roed thought of the two administrators' PGP keys and said that they could impersonate the two German admins and write messages on dark-web forums. They could take on the role of administrators.

The two men were talking more seriously as they discussed the idea of being impersonated. When law enforcement busted a dark-web market, a new one would come to replace it. A game of whack-a-mole was going on.

One man said that we should be able to do more with this than just taking the marketplace down. We should do something different in this circumstance.

The idea of becoming Hansa's bosses was no laughing matter. The investigators secretly took over the market instead of arresting the admins. With one of the most active sites on the dark web under their control, there was no telling what powers they would gain to identify Hansa's users.

The psychological blow to the community would be very bad if they revealed their sting operation.

Sharing their idea with the rest of their team at the Dutch National Police, and then the German federal police who had helped seize the server, the two Dutch investigators learned of another fortunate break. Not for the massive drug market they had created, but for a book piracy site, the Germans were on the trail of the two suspected Hansa admins.

The Dutch police were able to use this to their advantage. When the Germans arrested the men for book piracy, the Dutch could stealthily slip into their places and run Hansa with minimal publicity or disruption. The head of the Dutch National High Tech Crime Unit said that they could use the arrest. To become the administrators ourselves, we had to get rid of the real ones.

The plan faced a fundamental problem as it began. The cops had seized Hansa's German server. They found a text file that appeared to show the addresses of the market's central, still- active server in Germany. The admins appeared to have moved them to a data center that was unknown to them. He said that it was a blow.

The Dutch cops might have simply cut their losses and given the Germans the go-ahead to arrest Hansa's administrators, then charge them with running a massive drug market for which they had plenty of evidence. They decided to double down on their plan to take over. They had to find the admins and the server that had gone missing.

They spent the next few months looking for any clues that could lead them back to the trail. It was only in April of last year that they got another lead. It came from the internet.

The administrators had thousands of messages to each other, and a few of them mentioned the payment system. When the Dutch police fed those addresses into Chainalysis' Reactor software, they were able to see that the transactions led to an account on BitPay. There was a middleman in this case. BitPay's Netherlands office was subpoenaed by the Dutch after it was discovered that the admins had funneled bitcoins into the service to rent server space.

A group of Dutch investigators flew to the capital ofLithuania to explain their plan to the police. Petra Haandrikman is a chief inspector for the Dutch police who became team leader for their Hansa operation. She remembers them asking if she wanted to do what. They agreed to work together. Hansa's infrastructure was the focus of the Dutch detectives.

The Dutch learned of the US investigation into AlphaBay around that time. They had a discussion about what it might mean for their own operation.

The takeover idea was the most daring undercover operation to ever target the dark web drug world. They might be able to push their luck a little further.

A delegation from the US AlphaBay investigation team arrived at the airport in the city of the Netherlands' North Sea coast on the morning of May 1st. They stopped for breakfast in an underground cellar after their red-eye flight.

Hemesath used the time to assemble a list of potential names for their AlphaBay operation. He told the group his list of operations, which included the ones with the use of the internet. Some of these were just kind of unfortunate. All of Hemesath's submissions were turned down by the sleep deprived group. They came up with a pun that combined elements of the name AlphaBay with the idea of the net they were tightening around it.

The group arrived at Europol headquarters a few hours later in a fortress-like brick building. They were going to present their progress to a group of agencies. A kind of UN General Assembly of dark-web snoops, the team sat down in a huge conference room with tables for each delegation and microphones.

The purpose of the meeting was to prevent agencies from stepping on each other's toes. The Americans thought they had AlphaBay's server and administrator within reach. Cazes was going to be indicted under seal in a matter of days and they were going to work with the Thai police to arrest him.

The Dutch delegation spoke after a brief coffee break. The technical adviser to the Dutch prosecutor's office hastily told prosecutors about the Americans' presentation after making a proposal. He said that the Dutch police were prepared to arrest the administrators of Hansa and take control of the market with the help of the German federal police.

The Americans were close to taking down AlphaBay. The Dutch technical adviser had a suggestion.

He explained that the Americans needed to wait for the Dutch takeover of Hansa before they could take down AlphaBay. They wouldn't make an official announcement of their victory until after Alpha02's server had been seized. The dark web's users would flood the dead market if all went according to plan.

After the Dutch had a chance to spy on the internal workings of the dark-web economy, they would announce their Hansa and AlphaBay operations at the same time. The Dutch technical adviser described the sting operation as a one- two punch.

The eyes looked at the table. Ali remembers her excitement at the plan. The prosecutor was excited about the risks and rewards. Is this legal? Was it in line with the law?

The complexity the Dutch were adding to their AlphaBay operation made Paul Hemesath uneasy. Law enforcement had taken control of a dark web site in the past. The Australian Federal Police ran a site called the Love Zone for six months in the year 2014). The Love Zone was a controversial case. Law enforcement engaged in the same crime as they were investigating in order to get deeper into the underground community.

The Dutch were suggesting doing something similar for the second biggest online narcotics market. There were no precedents for it.

Hemesath says, "This was the first monkey being shot into space."

He wondered if it was a littlepie in the sky, as he put it. It was difficult to coordinate among the agents in the US. The Dutch, Germans, half a dozen US agencies, and the Thais were going to coordinate.

The coincidence of these two investigations was amazing. They could try something like this again.

Who knows if this will happen, to time this and to count on it. Hemesath wondered. Let's see if we can get it done.

Next week, the team discovers a crucial vulnerability in Cazes and uses a secret technique to find AlphaBay's main server. The investigators have an encounter with their target just as the operation is heating up.

This story is an excerpt from the upcoming book, Tracers in the Dark: The Global Hunt for the Crime Lords of Cryptocurrencies.

We might earn a commission if you buy something using links. Our journalism is supported by this. You can learn more.

Reymundo Perez III is the author of the chapter illustrations.

The photo was obtained from the same source as the one pictured.

The November 2022, issue contains this article. Don't forget to subscribe now.

We want to know what you think about this article. Send a letter to the editor towired.com