2 min read

Comment Permalink

It would be very easy for someone to write a script that queries common first name surname combinations, or cross-references with public record/social media information, and then you're back to the original problem.

See in context

300 Murder plots are infohazards

by Chris Monteiro

13th Feb 2025

2 min read

300

Hi all

I've been hanging around the rationalist-sphere for many years now, mostly writing about transhumanism, until things started to change in 2016 after my Wikipedia writing habit shifted from writing up cybercrime topics, through to actively debunking the numerous dark web urban legends.

After breaking into what I believe to be the most successful ever fake murder for hire website ever created on the dark web, I was able to capture information about people trying to kill people all around the world, often paying tens of thousands of dollars in Bitcoin in the process.

My attempts during this period to take my information to the authorities were mostly unsuccessful, when in late 2016 on of the site a user took matters into his own hands, after paying $15,000 for a hit that never happened, killed his wife himself.

Due to my overt battle with the site administrator over this period, he grew frustrated with me, and when sending death threats and burning cars to dissuade me failed to work, it was ultimately commissioning blogs implicating me running the site that means following the murder, the police broke down my door and arrested me for allegedly running the site. I handed over my info and they obviously let me go.

In 2018 participating in a CBS documentary about the 'dark web murder', I accessed the site once again, instigating a handful of arrests in the US and Singapore, and leading to a short-lived relationship with Homeland Security Investigations and precipitating further arrests in the US.

From 2020 until recently I worked with a UK podcast company, with me funneling off the most serious murder plots and they would try and send them to local journalists and law enforcement agencies around the world, with the most successes being in the US. You can listen to 'Kill List' online.

As of 2025 now, this has lead to almost 40 convictions around the world, further more arrests and likely more in the pipeline.

With the podcast production ended, I am exhausted from these efforts. I have scraped sites, triaged records, verified addresses, cross referenced IDs, reconstructed bitcoin payments, automated reports, worked with journalists, many law enforcement agencies, private detectices and incurred both legal fees and the personal and professional opportunity-cost for the significant time and focus I have spent on this over almost 9 years now.

I have about 800 names left on the Kill List, and the financial logistics of investigating them both into developed and developing would appear insurmountable to overcome.

More people on the list I know have been brutally murdered, or died in suspicious circumstances, all because there is no international body to handle such cases effectively, unlike if I were investigating for example drug trafficking or terrorism. More people still have been murdered but I just don't know it yet, and more still will be.

This experience has been mentally and socially taxing, with even close friends unwilling or able to expose themselves to these harrowing murder plots, featuring detailed information about how, why and where people should be killed, likely knowing this information would be harmful to them, both emotionally, and the practical impact of being obligated to taking action like I have.

I have recently put up a donations link in case anyone might sponsor my further investigations, as the absence of a strong call to action from the recent podcast has left the incorrect impression that information has been disseminated to the relevant authorities and that it's in good hands.

It's not in good hands, it's just in mine, a chronically ill IT geek who is tired of doing this. And yet I remain the only person with this information that I can't ethically dump on the internet.

Any suggestions?

EconomicsForecasting & PredictionWorld Optimization

Frontpage

300

New Comment

44 comments, sorted by

top scoring

Click to highlight new comments since: Today at 12:13 PM

[-]Dagon1mo4120

Can you explore a bit more about why you can't ethically dump it on the internet? From my understanding, this is information you have not broken any laws to obtain, and have made no promises as to confidentiality.

If not true publication, what keeps you from sending it to prosecutors and police? They may or may not act, but that's true no matter who you give it to (and true NOW of you).

[-]Chris Monteiro1mo437

With regards to dumping the info on the internet, the files by definition contain extensive personal identifable information about people, names, addresses, photos, social media links often alongside allegations of their alleged crimes ranging such as infidelity, child abuse and financial fraud.

I can rarely substantiate these, and know for a fact based on the investigated cases that such allegations are often completely fabricated in order to frame the user's request for violence as more morally justified. I don't think it's fair to publish such information and allegations publicly for both the victims and my own personal liability.

The police literally are unable to take this data beyond a case by case basis, and doing so requires scores of emails and phone calls between multiple specialists. As I am not a crime victim, I don't get any reference number to reuse and frankly it's a nightmare. I am still attempting bulk submissions via private detectives to get the information submitted as intelligence, but that is different to making an effective crime report.

Prosecutors, even those who have prosecuted people on the Kill List previously in my experience don't respond to my emails, even when their are victims in their same jurisdiction.

[-]Shankar Sivarajan1mo192

It would be a valuable service to point the people targeted to information about them. I'm imagining something like Have I Been Pwned, but if you don't want to post the info in cleartext, perhaps you could encrypt the information about each person with name as the key?

The way I see it, if I were on this list, I'd want to be able to find out. You keeping the information to yourself (or telling only cops who ignore the information completely) out of some sense of ethics doesn't help me very much.

[-]Chris Monteiro1mo40

I have had very random people reach out to me who have been the target of threats etc so I have looked them up.

But compared to the scope of data breaches and the ease of checking them via an email address, my 1000 names is not at that scale. I have had some very small scale investigations work commissioned off of these queries, but it's so quick and easy for me to do I have not got around to charging or doing extended investigations.

[-]whestler22d10

[-]Shankar Sivarajan21d20

Then you can charge ~a dollar per query. Or include some additional information in the key, like zip code. Or if you're sophisticated enough, if the threats include photographs, you could require anyone submitting queries to submit a photo with matching identity.

I don't believe that this information can't simply be dumped on the internet "ethically," and I don't have a good model for precisely what requirements the author has made up, so I can't offer good workarounds. If a bit of security theater is enough, my suggestion will do.

[-]AnnaSalamon1mo93

Gotcha. No idea if this is a good or bad idea, but: what are your thoughts on dumping an edited version of it onto the internet, including names, photos and/or social media links, and city/country but not precise addresses or allegations?

[-]Chris Monteiro1mo30

But how are people supposed to react to such framing? Also some orders are limited to just name / address etc, where as some plot graphic torture for weeks and months.

[-]AnnaSalamon1mo2112

I got to the suggestion by imagining: suppose you were about to quit the project and do nothing. And now suppose that instead of that, you were about to take a small amount of relatively inexpensive-to-you actions, and then quit the project and do nothing. What're the "relatively inexpensive-to-you actions" that would most help?

Publishing the whole list, without precise addresses or allegations, seems plausible to me.

I guess my hope is: maybe someone else (a news story, a set of friends, something) would help some of those on the list to take it seriously and take protective action, maybe after awhile, after others on the list were killed or something. And maybe it'd be more parsable to people if had been hanging out on the internet for a long time, as a pre-declared list of what to worry about, with visibly no one being there to try to collect payouts or something.

[-]Chris Monteiro1mo70

Publishing the whole list, without precise addresses

To identify a person internationally, a name isn't enough, you must also supply an address or social media links.

I've performed medium level OSINT on most people so I annotate a fair bit of extra info internally.

I do have tentative plans to publish a highly redacted format, such as 'A <seriousness level> plot where someone <did/didn't pay> to <kill/beat/harm> a <number of persons> of <genders> in <city/state/location + country> who appears to be <relationship-details> and <any other key details> who is can be found via <address only/social media> which <has/hasn't> been reported to <le agency/media/other>

Honestly it's depressing reading through the cases to the level I can write this up. I have the payer status, crime type, location, address, report details and social info mostly normalised, but I would have to parse all cases again to create this.

To my initial point, this is harmful to me. (And anyone)

[-]samuelshadrach1mo10

Have you tried using AI for any part of your process? (And do you have access to o1?)

[-]Chris Monteiro1mo54

My attempts of creating summaries with ChatGPT violated the content policies last I tried.

There is lots of OSINT work to do, but until I have normalised all the ID data out from the message data, I am not comfortable handing it over to OSINT specialists or their AIs.

[-]samuelshadrach1mo20

Have you tried llama3? (Latest open source model, hence no moderation)

It might be worth posting a few sample tasks online so software developers can tell you whether they’re automatable or not.

[-]Chris Monteiro1mo10

I am sure there are some interesting uses of agented AIs in can configure for automated OSINT but this feels quite large a task given I am bottlenecking more in who to hand the data to rather than it being insufficiency rich.

Know any preconfigured agency menageries for something like this?

[-]samuelshadrach1mo10

I mean, I know a bunch of devs who can accurately answer "can state-of-the-art AI do task X, yes or no?" or atleast make progress towards answering it. You could put up a job description with approx salary here on lesswrong or elsewhere, I could forward it to some people.

[-]Perhaps1mo10

There are some models on HuggingFace that do automatic PII data redaction, I've been working on a project to automate redaction for documents with them. AI4privacy's models and Microsoft Presidio have been helpful.

[-]Dagon1mo72

This was my thinking as well. On further reflection, and based on OP's response, I realize there IS a balance that's unclear. The list contains some false-positives. This is very likely just by the nature of things - some are trolls, some are pure fantasy, some will have moved on, and only a very few are real threats.

So the harm of making a public, anonymous, accusation and warning is definitely nonzero - it escalates tension for a situation that has passed. The harm of failing to do so in the real cases is also nonzero, but I expect many of the putative victims know they have a stalker or deranged enemy who'd wish them dead, and the information is "just" that this particular avenue has been explored.

That balance is difficult. I philosophically lean toward "open is better than secret, and neither is as good as organized curation and controlled disclosure". Since there's no clear interest by authorities, I'd publish. And probably I'd do so anonymously as I don't want the hassle of having potential murderers know about me.

[-]Vermillion1mo64

Just dump the names so people have a chance of realising they are at risk then? Seems a lot better than just leaving it.

[-]RedMan1mo213

You're not doing anything immoral by just ignoring your archive. Working on 'spec' in public safety usually just leads to sadness. You're in a weird place where you're facing the kind of problem a mid or late career professional sees, but without social support from people who have seen this stuff before, and without easing into it like you would have in an early career. So you have the problem, but none of the emotional tools to address it.

As far as the situation specifically, making a form letter saying something like 'someone has paid x $ to do you harm through (description of the service), further details are available upon request', and sending it to as many prospective victims as you can identify, is probably as much as you can reasonably be expected to do.

Sure, local law enforcement should probably do it, you won't find everyone, and someone you do find might come back and cause you problems for "making threats", so in your situation, I probably wouldn't even bother going that far, but you seem pretty committed to doing "something". So that should be an achievable end that lets you move on emotionally.

It's hard to talk about analogous situations without saying things that are impolite. Feel free to PM me if you have questions or details you're not comfortable sharing, I've worked with "bad stuff" before, and might be able to help.

"People ask me to tell them my worst stories. I used to tell them, but as it turns out, nobody really wants to hear them" is a common sentiment.

[-]Chris Monteiro1mo50

without social support from people who have seen this stuff before

The little contact I have had with police doing darknet investigations of this nature leads me to believe they are mostly ineffective at anything international, as does last year's operation by the police against the site.

The police have presumably learnt that 'international is hard' (which it is) and chosen to accept this.

In about 50% of cases I have social media links for the victims, but that is not the same as having their emails. I am working on abstracting the contact details from the messages so I could pass it for cheap bulk osint, but it isn't that cheap when you are going after semi-hidden PII across different countries and languages with significant different postures on public records.

Per 'Kill List', I believe they got close to 0% hit rate emailing, messaging and phoning people. People only started to listen when journalists or police knocked on their doors.

The problem with local law enforcement is they don't understand the complexity (bitcoin, darknet, scam but real threat), and national law enforcement is not directly available. There is nearly always an insistence on investigating on a case-by-case, and not reusing central specialist. (The US has been a little better here, but they have state level specialists, where as most countries utilise national specialists). And local law enforcement want to do everything over phone calls and treat you as a suspect / time waster / scammer.

By the way, I don't really consider this 'public' safety, as it's all based on individuals, but I guess that's a fair comparison.

[-]RedMan1mo*-2-6

What is a reasonable response to an unsolicited message saying 'someone has hired someone to harm you', with scant details on who/what/when/where?

Personally, I'd read it, and the more seriously I took it, the less likely I would be to engage with the sender, I likely would not send an acknowledgement of receipt. Any additional communication from the sender, especially a message with an 'ask' like 'help me figure out who' or 'assist me in making internet content' would be viewed as extortion.

If someone showed up at my door, I might talk to them, and if they're a cop, I'd tell the cop that I'm concerned about the vaguely threatening messages I've gotten from 'some guy in another country'.

If you don't have much information ('just a social media name'), doing more 'sleuthing' is probably totally inappropriate. The 'contractor' may or may not have done more, but either way, you're not really helping anything.

As far as law enforcement seeing you as a suspect/time waster/scammer, that's an easy one. A cyber crime office will hear you confessing to some kind of 'hacking', other offices will hear that you have no actual details (so someone unknown, is threatening someone who is also unknown, no further details? Sure ok I'll log it) and just assume you wasted their time. Calling back to ask about status as a 'helpful tipster' suggests that you're motivated by something other than a desire to inform them, and let them prioritize your information. This would likely be seen as suspicious.

Most agencies have an escalation path and can do 'international' effectively, they just have to really want to do it. In this case, from what you've told us, I totally understand why you've gotten the response you've gotten.

An online murder for hire website, where the people hiring are mostly larpers, the people taking the jobs are scammers, and the victims are basically unidentified is at best a loot pinata for someone with asset forfeiture authorities. Assuming they can actually seize the crypto.

You might have better luck tracing crypto to exchanges, passing that information to national level cybercrime squads, and asking for 10% if they can seize anything (most agencies have policies like this).

[-]Joseph Miller1mo193

How long does it take you to save one life on average? GiveWell's top charities save a life for about $5000. If you can get close to that there should be many EA philanthropists willing to fund you or a charity you create.

And I think they should be willing to go up to like $10-20k at least because murders are probably especially bad deaths in terms of their effects on the world.

[-]Chris Monteiro1mo51

It varies depending on how powerful the law enforcement agency is and whether they understand it or not, with the FBI and German Federal police being the most effective.

It's not all saving lives, often it's protecting people from stalking, physical and mental abuse, child custody disputes and the like, because in many cases (especially so with women perpetrators) they would never actually turn to violence themselves.

I have not been party to all of the journalist hard costs for local investigators, but I think they were doing at least $3,000 initially per major case, but they would go higher when it looked like this would turn into a full podcast episode. There is also a issue where cases without payment are considered less serious than those with by the police, and require more up front investigation to understand. As a result, far more of the 'payer' cases were investigated compared to the non-payer ones, at least in the US.

Sometimes such as in the US the police would then move fast, but in places like Spain the journalist had to act as a victim advocate extensively for years, and in Italy the cases collapsed on technicalities.

Frankly, beyond my personal experience, I REALLY don't want to live in a world where people can order commodity killings anonymously, as my data shows that all sorts of people would. I consider this analogous to the psychological effect that terrorism has on society, despite not being a high source of actually violence relatively speaking.

But yeah, murder is bad actually and should be given higher priority than other causes of death in my opinion.

[-]Joseph Miller1mo161

In that case I would consider applying for EA funds if you are willing to do the work professionally or set up a charity to do it. I think you could make a strong case that it meets the highest bar for important, neglected and tractable work.

[-]Chris Monteiro1mo70

Do you know anyone who could guide me through this process?

[-]Joseph Miller1mo70

DM'd

[-]jbash1mo123

Do I correctly understand that the latest data you have are from 2018, and you have no particular prospect of getting newer data?

I would naively guess that most people who'd been trying to get somebody killed since 2018 would either have succeeded or given up. How much of an ongoing threat do you think there may be, either to intended victims you know about, or from the presumably-less-than-generally-charming people who placed the original "orders" going after somebody else?

It's one thing to burn yourself out keeping people from being murdered, but it's a different thing to burn yourself out trying to investigate murders that have already happened.

[-]Chris Monteiro1mo70

Up to late 2023

[-]jbash1mo31

The situation begins to seem confusing.

At least three times over 8 or 9 years, in 2016, 2018, and 2023, and maybe more times than that, you've owned the site enough to get these data.
The operator knows about it, doesn't want you doing it, and has tried reasonably hard to stop you.
The operator still hasn't found a reliable way to keep you from grabbing the data.
The operator still hasn't stopped keeping a bunch of full order data on the server.
1. They haven't just stopped saving the orders at all, maybe because they need details to maximize collection on the scam, or because they see ongoing extortion value.
2. They haven't started immediately moving every new order off of the server to someplace you can't reach. I don't know why they wouldn't have been doing this all along.
Neither you nor any law enforcement agency worldwide have gotten the site shut down, at least not lastingly. Meaning, I assume, that one of the following is true--
1. Neither you nor law enforcement can shut it down, at least not for long enough to matter. Which would mean that, in spite of not being able to keep you away from the hit list, the operator has managed to keep you and them from--
  1. Getting any data from the server that might let one trace the operator. That might be just the server's real public IP address if the operator were careless enough.
  2. Tracing the operator by other means, like Bitcoin payments, even though it would take really unusually good OPSEC to have not made any Bitcoin mistakes since 2016. And having people's cars torched can easily leave traces, too.
  3. Finding and disrupting a long-term operational point of failure, like an inability to reconstitute the service on a new host, or total reliance on a stealable and unchangeable hidden service key.
2. Or both you and law enforcement have held off for years, hoping for the operator to make a mistake that lets you trace them, as opposed to just the server, but you've failed.
3. Or you and/or they have held off in the hope of getting more order data and thereby warning more victims.
4. Or you could shut the site down or disrupt it, but law enforcement can't figure out how. Either they haven't asked your help or you've refused it (presumably for one of the above reasons).
Even though you've repeatedly taken the order list, the operator is confident enough of staying untraced to keep running the site for years.

If I ran something like that and my order data got stolen even twice, I would take that as a signal to shut down and go into hiding. And if somebody had it together enough to keep themselves untraceable while running that kind of thing for 8 years, I wouldn't expect you to be able to get the list even once.

On edit: or wait, are you saying that this site acts, or pretends to act, as an open-market broker, so the orders are public? That's plausible but really, really insane...

[-]Chris Monteiro1mo30

The data is not public. I accessed it anyhow. Perhaps you want to listen to the podcast to get a fuller chronology, I have not written it up yet.

[-]Daniel Kokotajlo1mo80

There are 800 names that need investigation+protection, presumably the more difficult ones since you probably prioritized the easier cases. How much would it cost to hire investigators to do all 800?

[-]Chris Monteiro1mo70

It varies by the country's policing capability, citizens online footprint, the history and status of the feud, the severity of the online element and language barriers as well as highly variable economies of scale such as an effective engagement with a law enforcement agency.

The only ones that have come close to this have been the FBI and the Bundespolizei (German Federal Police) where there is evidence they did at least a basic investigation of every major case based on a medium (US) and very high (Germany) public arrest and prosecution records.

I won't share exact figures as my hiring of detectives is still in the 'trial and error phase', but it cost over £1000 to work one case in Japan, and nearly that to work the one case I have in New Zealand.

In somewhere like India I would get a far cheaper day rate, but you often have to retain lawyers (and likely bribes) and other costs to get things done there. Yet in countries like US, Canada and Europe, instead of corruption you have the complex bureucracy of even reporting these effectively.

Appriasing these case is something I am actively working on, so I can publish this info to capture the interest of people from those countries.

[-]Daniel Kokotajlo1mo120

It sounds like you are saying it should cost <$50,000 to get all 800 cases taken care of. How many lives do you think this would save in expectation? Based on what you said above, maybe like 5? So that's $10,000/life, not bad eh? And if it's more than 5 in expectation then this is really cost-effective. (And if it's less, it's still somewhat cost-effective compared to most charities.)

[-]Chris Monteiro1mo100

Yes, but it's probably closer to saving maybe 25 lives, and saving 500 people from stalking/abuse/etc

[-]AnnaSalamon1mo52

Can you notify the intended victims? Or at least the more findable intended victims?

[-]Chris Monteiro1mo60

Not really. Journalists spent months doing this via phone, email and messages and were ignored.

Also, there are literal 'I am a hitman hired to kill you, pay me money to stop' scams that exist.

[-]AnnaSalamon1mo20

Maybe some of those who received the messages were more alert to their surroundings after receiving it, even if they weren't sure it was real and didn't return the phone/email/messages?

I admit this sounds like a terrible situation.

[-]Chris Monteiro1mo40

Maybe, but I have been contacted by people who have received the scam email before.

It's true that some people reached out AFTER the podcast aired, only then taking it seriously. I am partially able to leverage it for credibility also.

Ultimatey significant effort is required to contact people, and then further more to provide a full context, risk assessment, after which they typically require support taking the issue through multiple law enforcement agencies, that is if they don't turn to violence themselves which has happened in at least one occasion:(

[-]Emily Ravine10d30

If you have people in eastern canada, I have direct LE there and can maybe help you.

[-]Kongo Landwalker1mo31

Have you contacted INTERPOL? Why did it fail? Seems like it is their job to take such cases.

What do you think about running a trusted team of volunteers? Shifting from managing cases by your own hands to managing a non-profit investigation organisation and its public image and recognition.

[-]Chris Monteiro1mo50

Interpol (and Europol) doesn't work for the public, only for incumbent law enforcement agencies.

Europol took explicit credit for one case, https://www.europol.europa.eu/media-press/newsroom/news/dark-web-hitman-identified-through-crypto-analysis but that was actually overturned in the Italian courts years later.

Attempts by the podcast team to route cases from the UK through to Interpol and other countries yielded no results, likely due to the game of 'telephone' such referrals go through. One case in India ended up informing the would-be-killer about his plot being discovered.

I would of course work with volunteers, but the work is stressful and brings you into contact with people unsafe situations and hostile and skeptical law enforcement. I guess it's akin to being a social services worker. My limited attempts to do this has not yielded results.

'I'll help!'

Exposing this information gives ammunition to ruin lives, and it has. I remain anxious about sharing it with people who's trustworthiness I can't vouch for.

[-]Valdes18d10

I felt like I should share my uninformed two cents.

Interpol seems like a promising lead, if you can get the right person at Interpol to understand the situation. I am not saying this is easy, but maybe you can get an email to be sent on your behalf on the right mailing lists (alumnis of some relevant school maybe?).
Other comments suggested getting funding from EA and that sounds fitting to me. But there is probably someone in EA that can connect you with Interpol directly. Maybe you can request to send a broad email on top of requesting funding.

[-]Archimedes1mo20

Are there any NGOs that might be able to help? I couldn't find any that were a great fit but you could try contacting the CyberPeace Institute to see if they have any recommendations.

[-]Chris Monteiro1mo10

I've looked! The only one that comes close I am aware of is https://globalinitiative.net/ with whom I have been trying to engage for some time. There appears to be more money to study crime and do things like victim support than any money to fight crime.

If I were to speculate, policing agencies would not like the existence of non state-aligned policing agencies, being considered like mercenaries, private detectives, vigellantes and hacktivists.

Any body who could appear sufficiently legitimate in the eyes of the law would be subsumed into the system by definition I reckon.

Moderation Log

Curated and popular this week