Murder plots are infohazards
41Dagon
48Chris Monteiro
20Shankar Sivarajan
5Chris Monteiro
3whestler
3Shankar Sivarajan
9AnnaSalamon
3Chris Monteiro
21AnnaSalamon
7Chris Monteiro
1samuelshadrach
5Chris Monteiro
2samuelshadrach
1Chris Monteiro
1samuelshadrach
1Perhaps
7Dagon
6Vermillion
22RedMan
5Chris Monteiro
-2RedMan
19Joseph Miller
6Chris Monteiro
16Joseph Miller
7Chris Monteiro
7Joseph Miller
12jbash
7Chris Monteiro
4jbash
3Chris Monteiro
8Daniel Kokotajlo
7Chris Monteiro
13Daniel Kokotajlo
11Chris Monteiro
6Eliezer Yudkowsky
6habryka
5AnnaSalamon
6Chris Monteiro
2AnnaSalamon
4Chris Monteiro
3Emily Ravine
3Kongo Landwalker
9Chris Monteiro
1Valdes
2Archimedes
1Chris Monteiro
New Comment
Can you explore a bit more about why you can't ethically dump it on the internet? From my understanding, this is information you have not broken any laws to obtain, and have made no promises as to confidentiality.
If not true publication, what keeps you from sending it to prosecutors and police? They may or may not act, but that's true no matter who you give it to (and true NOW of you).
With regards to dumping the info on the internet, the files by definition contain extensive personal identifable information about people, names, addresses, photos, social media links often alongside allegations of their alleged crimes ranging such as infidelity, child abuse and financial fraud.
I can rarely substantiate these, and know for a fact based on the investigated cases that such allegations are often completely fabricated in order to frame the user's request for violence as more morally justified. I don't think it's fair to publish such information and allegations publicly for both the victims and my own personal liability.
The police literally are unable to take this data beyond a case by case basis, and doing so requires scores of emails and phone calls between multiple specialists. As I am not a crime victim, I don't get any reference number to reuse and frankly it's a nightmare. I am still attempting bulk submissions via private detectives to get the information submitted as intelligence, but that is different to making an effective crime report.
Prosecutors, even those who have prosecuted people on the Kill List previously in my experience don't respond to my emails, even when their are victims in their same jurisdiction.
It would be a valuable service to point the people targeted to information about them. I'm imagining something like Have I Been Pwned, but if you don't want to post the info in cleartext, perhaps you could encrypt the information about each person with name as the key?
The way I see it, if I were on this list, I'd want to be able to find out. You keeping the information to yourself (or telling only cops who ignore the information completely) out of some sense of ethics doesn't help me very much.
I have had very random people reach out to me who have been the target of threats etc so I have looked them up.
But compared to the scope of data breaches and the ease of checking them via an email address, my 1000 names is not at that scale. I have had some very small scale investigations work commissioned off of these queries, but it's so quick and easy for me to do I have not got around to charging or doing extended investigations.
It would be very easy for someone to write a script that queries common first name surname combinations, or cross-references with public record/social media information, and then you're back to the original problem.
Then you can charge ~a dollar per query. Or include some additional information in the key, like zip code. Or if you're sophisticated enough, if the threats include photographs, you could require anyone submitting queries to submit a photo with matching identity.
I don't believe that this information can't simply be dumped on the internet "ethically," and I don't have a good model for precisely what requirements the author has made up, so I can't offer good workarounds. If a bit of security theater is enough, my suggestion will do.
Gotcha. No idea if this is a good or bad idea, but: what are your thoughts on dumping an edited version of it onto the internet, including names, photos and/or social media links, and city/country but not precise addresses or allegations?
But how are people supposed to react to such framing? Also some orders are limited to just name / address etc, where as some plot graphic torture for weeks and months.
I got to the suggestion by imagining: suppose you were about to quit the project and do nothing. And now suppose that instead of that, you were about to take a small amount of relatively inexpensive-to-you actions, and then quit the project and do nothing. What're the "relatively inexpensive-to-you actions" that would most help?
Publishing the whole list, without precise addresses or allegations, seems plausible to me.
I guess my hope is: maybe someone else (a news story, a set of friends, something) would help some of those on the list to take it seriously and take protective action, maybe after awhile, after others on the list were killed or something. And maybe it'd be more parsable to people if had been hanging out on the internet for a long time, as a pre-declared list of what to worry about, with visibly no one being there to try to collect payouts or something.
Publishing the whole list, without precise addresses
To identify a person internationally, a name isn't enough, you must also supply an address or social media links.
I've performed medium level OSINT on most people so I annotate a fair bit of extra info internally.
I do have tentative plans to publish a highly redacted format, such as 'A <seriousness level> plot where someone <did/didn't pay> to <kill/beat/harm> a <number of persons> of <genders> in <city/state/location + country> who appears to be <relationship-details> and <any other key details> who is can be found via <address only/social media> which <has/hasn't> been reported to <le agency/media/other>
Honestly it's depressing reading through the cases to the level I can write this up. I have the payer status, crime type, location, address, report details and social info mostly normalised, but I would have to parse all cases again to create this.
To my initial point, this is harmful to me. (And anyone)
My attempts of creating summaries with ChatGPT violated the content policies last I tried.
There is lots of OSINT work to do, but until I have normalised all the ID data out from the message data, I am not comfortable handing it over to OSINT specialists or their AIs.
Have you tried llama3? (Latest open source model, hence no moderation)
It might be worth posting a few sample tasks online so software developers can tell you whether they’re automatable or not.
I am sure there are some interesting uses of agented AIs in can configure for automated OSINT but this feels quite large a task given I am bottlenecking more in who to hand the data to rather than it being insufficiency rich.
Know any preconfigured agency menageries for something like this?
I mean, I know a bunch of devs who can accurately answer "can state-of-the-art AI do task X, yes or no?" or atleast make progress towards answering it. You could put up a job description with approx salary here on lesswrong or elsewhere, I could forward it to some people.
There are some models on HuggingFace that do automatic PII data redaction, I've been working on a project to automate redaction for documents with them. AI4privacy's models and Microsoft Presidio have been helpful.
This was my thinking as well. On further reflection, and based on OP's response, I realize there IS a balance that's unclear. The list contains some false-positives. This is very likely just by the nature of things - some are trolls, some are pure fantasy, some will have moved on, and only a very few are real threats.
So the harm of making a public, anonymous, accusation and warning is definitely nonzero - it escalates tension for a situation that has passed. The harm of failing to do so in the real cases is also nonzero, but I expect many of the putative victims know they have a stalker or deranged enemy who'd wish them dead, and the information is "just" that this particular avenue has been explored.
That balance is difficult. I philosophically lean toward "open is better than secret, and neither is as good as organized curation and controlled disclosure". Since there's no clear interest by authorities, I'd publish. And probably I'd do so anonymously as I don't want the hassle of having potential murderers know about me.
Just dump the names so people have a chance of realising they are at risk then? Seems a lot better than just leaving it.
You're not doing anything immoral by just ignoring your archive. Working on 'spec' in public safety usually just leads to sadness. You're in a weird place where you're facing the kind of problem a mid or late career professional sees, but without social support from people who have seen this stuff before, and without easing into it like you would have in an early career. So you have the problem, but none of the emotional tools to address it.
As far as the situation specifically, making a form letter saying something like 'someone has paid x $ to do you harm through (description of the service), further details are available upon request', and sending it to as many prospective victims as you can identify, is probably as much as you can reasonably be expected to do.
Sure, local law enforcement should probably do it, you won't find everyone, and someone you do find might come back and cause you problems for "making threats", so in your situation, I probably wouldn't even bother going that far, but you seem pretty committed to doing "something". So that should be an achievable end that lets you move on emotionally.
It's hard to talk about analogous situations without saying things that are impolite. Feel free to PM me if you have questions or details you're not comfortable sharing, I've worked with "bad stuff" before, and might be able to help.
"People ask me to tell them my worst stories. I used to tell them, but as it turns out, nobody really wants to hear them" is a common sentiment.
without social support from people who have seen this stuff before
The little contact I have had with police doing darknet investigations of this nature leads me to believe they are mostly ineffective at anything international, as does last year's operation by the police against the site.
The police have presumably learnt that 'international is hard' (which it is) and chosen to accept this.
In about 50% of cases I have social media links for the victims, but that is not the same as having their emails. I am working on abstracting the contact details from the messages so I could pass it for cheap bulk osint, but it isn't that cheap when you are going after semi-hidden PII across different countries and languages with significant different postures on public records.
Per 'Kill List', I believe they got close to 0% hit rate emailing, messaging and phoning people. People only started to listen when journalists or police knocked on their doors.
The problem with local law enforcement is they don't understand the complexity (bitcoin, darknet, scam but real threat), and national law enforcement is not directly available. There is nearly always an insistence on investigating on a case-by-case, and not reusing central specialist. (The US has been a little better here, but they have state level specialists, where as most countries utilise national specialists). And local law enforcement want to do everything over phone calls and treat you as a suspect / time waster / scammer.
By the way, I don't really consider this 'public' safety, as it's all based on individuals, but I guess that's a fair comparison.
What is a reasonable response to an unsolicited message saying 'someone has hired someone to harm you', with scant details on who/what/when/where?
Personally, I'd read it, and the more seriously I took it, the less likely I would be to engage with the sender, I likely would not send an acknowledgement of receipt. Any additional communication from the sender, especially a message with an 'ask' like 'help me figure out who' or 'assist me in making internet content' would be viewed as extortion.
If someone showed up at my door, I might talk to them, and if they're a cop, I'd tell the cop that I'm concerned about the vaguely threatening messages I've gotten from 'some guy in another country'.
If you don't have much information ('just a social media name'), doing more 'sleuthing' is probably totally inappropriate. The 'contractor' may or may not have done more, but either way, you're not really helping anything.
As far as law enforcement seeing you as a suspect/time waster/scammer, that's an easy one. A cyber crime office will hear you confessing to some kind of 'hacking', other offices will hear that you have no actual details (so someone unknown, is threatening someone who is also unknown, no further details? Sure ok I'll log it) and just assume you wasted their time. Calling back to ask about status as a 'helpful tipster' suggests that you're motivated by something other than a desire to inform them, and let them prioritize your information. This would likely be seen as suspicious.
Most agencies have an escalation path and can do 'international' effectively, they just have to really want to do it. In this case, from what you've told us, I totally understand why you've gotten the response you've gotten.
An online murder for hire website, where the people hiring are mostly larpers, the people taking the jobs are scammers, and the victims are basically unidentified is at best a loot pinata for someone with asset forfeiture authorities. Assuming they can actually seize the crypto.
You might have better luck tracing crypto to exchanges, passing that information to national level cybercrime squads, and asking for 10% if they can seize anything (most agencies have policies like this).
How long does it take you to save one life on average? GiveWell's top charities save a life for about $5000. If you can get close to that there should be many EA philanthropists willing to fund you or a charity you create.
And I think they should be willing to go up to like $10-20k at least because murders are probably especially bad deaths in terms of their effects on the world.
It varies depending on how powerful the law enforcement agency is and whether they understand it or not, with the FBI and German Federal police being the most effective.
It's not all saving lives, often it's protecting people from stalking, physical and mental abuse, child custody disputes and the like, because in many cases (especially so with women perpetrators) they would never actually turn to violence themselves.
I have not been party to all of the journalist hard costs for local investigators, but I think they were doing at least $3,000 initially per major case, but they would go higher when it looked like this would turn into a full podcast episode. There is also a issue where cases without payment are considered less serious than those with by the police, and require more up front investigation to understand. As a result, far more of the 'payer' cases were investigated compared to the non-payer ones, at least in the US.
Sometimes such as in the US the police would then move fast, but in places like Spain the journalist had to act as a victim advocate extensively for years, and in Italy the cases collapsed on technicalities.
Frankly, beyond my personal experience, I REALLY don't want to live in a world where people can order commodity killings anonymously, as my data shows that all sorts of people would. I consider this analogous to the psychological effect that terrorism has on society, despite not being a high source of actually violence relatively speaking.
But yeah, murder is bad actually and should be given higher priority than other causes of death in my opinion.
1In that case I would consider applying for EA funds if you are willing to do the work professionally or set up a charity to do it. I think you could make a strong case that it meets the highest bar for important, neglected and tractable work.
Do I correctly understand that the latest data you have are from 2018, and you have no particular prospect of getting newer data?
I would naively guess that most people who'd been trying to get somebody killed since 2018 would either have succeeded or given up. How much of an ongoing threat do you think there may be, either to intended victims you know about, or from the presumably-less-than-generally-charming people who placed the original "orders" going after somebody else?
It's one thing to burn yourself out keeping people from being murdered, but it's a different thing to burn yourself out trying to investigate murders that have already happened.
The situation begins to seem confusing.
- At least three times over 8 or 9 years, in 2016, 2018, and 2023, and maybe more times than that, you've owned the site enough to get these data.
- The operator knows about it, doesn't want you doing it, and has tried reasonably hard to stop you.
- The operator still hasn't found a reliable way to keep you from grabbing the data.
- The operator still hasn't stopped keeping a bunch of full order data on the server.
- They haven't just stopped saving the orders at all, maybe because they need details to maximize collection on the scam, or because they see ongoing extortion value.
- They haven't started immediately moving every new order off of the server to someplace you can't reach. I don't know why they wouldn't have been doing this all along.
- Neither you nor any law enforcement agency worldwide have gotten the site shut down, at least not lastingly. Meaning, I assume, that one of the following is true--
- Neither you nor law enforcement can shut it down, at least not for long enough to matter. Which would mean that, in spite of not being able to keep you away from the hit list, the operator has managed to keep you and them from--
- Getting any data from the server that might let one trace the operator. That might be just the server's real public IP address if the operator were careless enough.
- Tracing the operator by other means, like Bitcoin payments, even though it would take really unusually good OPSEC to have not made any Bitcoin mistakes since 2016. And having people's cars torched can easily leave traces, too.
- Finding and disrupting a long-term operational point of failure, like an inability to reconstitute the service on a new host, or total reliance on a stealable and unchangeable hidden service key.
- Or both you and law enforcement have held off for years, hoping for the operator to make a mistake that lets you trace them, as opposed to just the server, but you've failed.
- Or you and/or they have held off in the hope of getting more order data and thereby warning more victims.
- Or you could shut the site down or disrupt it, but law enforcement can't figure out how. Either they haven't asked your help or you've refused it (presumably for one of the above reasons).
- Neither you nor law enforcement can shut it down, at least not for long enough to matter. Which would mean that, in spite of not being able to keep you away from the hit list, the operator has managed to keep you and them from--
- Even though you've repeatedly taken the order list, the operator is confident enough of staying untraced to keep running the site for years.
If I ran something like that and my order data got stolen even twice, I would take that as a signal to shut down and go into hiding. And if somebody had it together enough to keep themselves untraceable while running that kind of thing for 8 years, I wouldn't expect you to be able to get the list even once.
On edit: or wait, are you saying that this site acts, or pretends to act, as an open-market broker, so the orders are public? That's plausible but really, really insane...
The data is not public. I accessed it anyhow. Perhaps you want to listen to the podcast to get a fuller chronology, I have not written it up yet.
There are 800 names that need investigation+protection, presumably the more difficult ones since you probably prioritized the easier cases. How much would it cost to hire investigators to do all 800?
It varies by the country's policing capability, citizens online footprint, the history and status of the feud, the severity of the online element and language barriers as well as highly variable economies of scale such as an effective engagement with a law enforcement agency.
The only ones that have come close to this have been the FBI and the Bundespolizei (German Federal Police) where there is evidence they did at least a basic investigation of every major case based on a medium (US) and very high (Germany) public arrest and prosecution records.
I won't share exact figures as my hiring of detectives is still in the 'trial and error phase', but it cost over £1000 to work one case in Japan, and nearly that to work the one case I have in New Zealand.
In somewhere like India I would get a far cheaper day rate, but you often have to retain lawyers (and likely bribes) and other costs to get things done there. Yet in countries like US, Canada and Europe, instead of corruption you have the complex bureucracy of even reporting these effectively.
Appriasing these case is something I am actively working on, so I can publish this info to capture the interest of people from those countries.
It sounds like you are saying it should cost <$50,000 to get all 800 cases taken care of. How many lives do you think this would save in expectation? Based on what you said above, maybe like 5? So that's $10,000/life, not bad eh? And if it's more than 5 in expectation then this is really cost-effective. (And if it's less, it's still somewhat cost-effective compared to most charities.)
Yes, but it's probably closer to saving maybe 25 lives, and saving 500 people from stalking/abuse/etc
What about this is supposed to be an infohazard rather than just private info? It doesn't seem like either a cognitohazard, negatively-valued information (movie spoilers), or a socioinfohazard / exfohazard (each individual prefers to know themselves but prefers society not to know).
As I understood the title, the point was to indicate that the author is tired of this, and while maybe they were able to help some people, knowing this information has come at great emotional and social cost to them, wishing (in at least some sense hinted at in the title) that they had never encountered this information.
So at least as played at in the title, it would fall into the “negatively-valued information” bucket.
Not really. Journalists spent months doing this via phone, email and messages and were ignored.
Also, there are literal 'I am a hitman hired to kill you, pay me money to stop' scams that exist.
Maybe some of those who received the messages were more alert to their surroundings after receiving it, even if they weren't sure it was real and didn't return the phone/email/messages?
I admit this sounds like a terrible situation.
Maybe, but I have been contacted by people who have received the scam email before.
It's true that some people reached out AFTER the podcast aired, only then taking it seriously. I am partially able to leverage it for credibility also.
Ultimatey significant effort is required to contact people, and then further more to provide a full context, risk assessment, after which they typically require support taking the issue through multiple law enforcement agencies, that is if they don't turn to violence themselves which has happened in at least one occasion:(
Have you contacted INTERPOL? Why did it fail? Seems like it is their job to take such cases.
What do you think about running a trusted team of volunteers? Shifting from managing cases by your own hands to managing a non-profit investigation organisation and its public image and recognition.
Interpol (and Europol) doesn't work for the public, only for incumbent law enforcement agencies.
Europol took explicit credit for one case, https://www.europol.europa.eu/media-press/newsroom/news/dark-web-hitman-identified-through-crypto-analysis but that was actually overturned in the Italian courts years later.
Attempts by the podcast team to route cases from the UK through to Interpol and other countries yielded no results, likely due to the game of 'telephone' such referrals go through. One case in India ended up informing the would-be-killer about his plot being discovered.
I would of course work with volunteers, but the work is stressful and brings you into contact with people unsafe situations and hostile and skeptical law enforcement. I guess it's akin to being a social services worker. My limited attempts to do this has not yielded results.
'I'll help!'
<shares email of local police station>
Exposing this information gives ammunition to ruin lives, and it has. I remain anxious about sharing it with people who's trustworthiness I can't vouch for.
I felt like I should share my uninformed two cents.
- Interpol seems like a promising lead, if you can get the right person at Interpol to understand the situation. I am not saying this is easy, but maybe you can get an email to be sent on your behalf on the right mailing lists (alumnis of some relevant school maybe?).
- Other comments suggested getting funding from EA and that sounds fitting to me. But there is probably someone in EA that can connect you with Interpol directly. Maybe you can request to send a broad email on top of requesting funding.
Are there any NGOs that might be able to help? I couldn't find any that were a great fit but you could try contacting the CyberPeace Institute to see if they have any recommendations.
I've looked! The only one that comes close I am aware of is https://globalinitiative.net/ with whom I have been trying to engage for some time. There appears to be more money to study crime and do things like victim support than any money to fight crime.
If I were to speculate, policing agencies would not like the existence of non state-aligned policing agencies, being considered like mercenaries, private detectives, vigellantes and hacktivists.
Any body who could appear sufficiently legitimate in the eyes of the law would be subsumed into the system by definition I reckon.
Curated and popular this week