Catch Me If You Can

Twenty-two years since the night ShadowCrew logged off for good.

Hello there cyber fanatics!

Twenty-two years ago tonight, on October 26th, 2004, the members of the biggest carding forum on the internet were told to be online at 9 p.m. for a mandatory discussion. By midnight, 28 people had been arrested in eight states and six countries.

ShadowCrew was a forum where criminals bought and sold stolen credit cards, fake IDs and everything you need to turn those into cash. It ran for about two years, and almost every carding forum that came after it copied the way it was built.

What it really sold, more than any card dump, was trust. In a place where everyone is anonymous and half the members are thieves, ShadowCrew had a system for deciding who you could do business with. And one of the people running that system was working for the United States Secret Service.

I have spent a big part of my career watching underground forums, and this is the case I keep coming back to. Let's go.

Rate My Vendor

The ShadowCrew forum index as archived in July 2004 The front door, July 2004. A plain phpBB board, three months before the end. Screenshot via the Internet Archive's Wayback Machine.

ShadowCrew opened in or about August 2002. The government named Andrew Mantovani as a co-founder, a 23-year-old part-time student at Scottsdale Community College in Arizona who went by "Deck" and "ThnkYouPleaseDie," among other handles. Brett Johnson, who was there too, tells a different founding story, with him and two partners building it out of an older site for counterfeit documents. The two versions argue about who started it. They agree on what it turned into.

Brett Johnson, known on ShadowCrew as GOllumfun Brett Johnson, a.k.a. GOllumfun, who tells the other founding story. Today he is a public speaker on cybercrime. Photo: Business Wire.

Members traded stolen card numbers, full identity packages, forged documents, and the services around all of it: phishing, spam, and crews that turned card numbers into cash. Money moved through Western Union and digital currencies like E-Gold and WebMoney.

Now let me look at it the way I look at every criminal operation, as a company.

ShadowCrew had management, with Mantovani and a few others at the top. It had enforcement. David Appleyard, "Black Ops," a 45-year-old former mortgage broker from Linwood, New Jersey, dealt with members who cheated other members. On February 11th, 2003, he "punished" one of them by posting his real name, home address and phone numbers on the site. That was ShadowCrew's version of HR.

And it had quality control, which was the real innovation. A class of members called reviewers tested what vendors were selling before they were allowed to sell it. No good review, no shop.

ShadowCrew drawn as a company org chart: admins, enforcement, moderators, reviewers, vendors and members, with moderator CumbaJohnny reporting to the US Secret Service

It worked. On May 19th, 2004, a vendor called "Scarface" sent another member 115,695 stolen card numbers in a single transfer. By the end, the indictment counted at least 1.5 million stolen card numbers trafficked through the site (the Justice Department's first press release said 1.7 million) and more than $4 million in losses. In September 2004, a month before the end, Mantovani transferred around 18 million email accounts to another member, tens of thousands of them with full identity details attached.

The Man in the Middle

Albert Gonzalez, photographed by the US Secret Service Albert Gonzalez, a.k.a. CumbaJohnny. Moderator, informant, and later the man behind the TJX breach. Photo: U.S. Secret Service, via Wikimedia Commons.

The most interesting person on ShadowCrew was a moderator called CumbaJohnny. His real name was Albert Gonzalez.

One night in July 2003, a plainclothes NYPD detective in upper Manhattan, who was actually working on a string of car thefts, followed a young guy into an ATM lobby and watched him work through a stack of blank debit cards loaded with stolen card numbers. That was Gonzalez. There was no clever investigation behind it, just a detective who happened to be in the right place.

He was facing serious time, so he did what a lot of people in his position do. He flipped. He went back onto ShadowCrew as the same trusted moderator, and from then on he was reporting to the Secret Service's New Jersey office while helping to run the place.

You will read in a lot of places that the Secret Service paid him $75,000 a year. That number comes from a friend of his, quoted in 2010, and the Secret Service never confirmed it. His own court filing later said he was paid at least $1,200 a month. Whatever the real number was, the guy keeping the biggest carding forum on the internet running smoothly was on the government's payroll, and his job was to make sure nobody left.

This is my favourite detail in the whole case. The FBI had its own informant in the same scene, a carder called David Thomas, "El Mariachi." In 2004 his FBI handler told him never to talk to CumbaJohnny again, and Thomas understood right away what that meant. So by 2004 there were informants from two different agencies working the same scene, and at least one of them had figured out the other.

Trust Me, I'm a VPN

In 2004 Gonzalez started offering members something useful: a VPN, so they could connect to the forum more safely. It came from a trusted admin, so plenty of members used it.

The Secret Service had built it, and it came with a court-ordered wiretap. BusinessWeek later described it as the first ever tap of a private computer network under a 1968 crime law. Every member who connected through it handed the government his real IP address and his traffic.

Diagram of the ShadowCrew VPN: a member connects through a gateway recommended by forum staff, and the Secret Service wiretap on that gateway captures his real IP address and traffic

Brian Nagel, the Secret Service's assistant director for investigations, later summed up the whole thing in four words: "We became shadowcrew.com."

Think about it from a member's point of view. You did the careful thing and used the security tool the forum's own staff recommended, and the careful thing is what got you caught.

Curtain Call

The investigation was called Operation Firewall, and it had started in July 2003, the same month a detective followed Gonzalez into that ATM lobby.

On the night of October 26th, 2004, about 15 agents sat in an unmarked building in Washington with a map of the United States spread across 12 screens. Gonzalez was in the room with them. ShadowCrew's admins had told members to be online at 9 p.m. for a mandatory discussion, and Gonzalez helped herd the targets into a chat session, which put everyone at a keyboard at the same moment. Then the agents moved. One suspect jumped out of a second-story window. By midnight, 28 people had been arrested in eight states and six countries.

The ShadowCrew forum as captured on November 2nd, 2004, a week after the takedown ShadowCrew as captured on November 2nd, 2004, a week after the takedown. Screenshot via Wikipedia.

Two days later, the Justice Department announced a 62-count indictment against 19 people.

The first page of the Operation Firewall indictment, United States v. Mantovani et al., District of New Jersey, October 2004 Page one of United States v. Mantovani et al. Nineteen defendants, 62 counts. Source: US Department of Justice, District of New Jersey. Mantovani pleaded guilty, and in June 2006 he got 32 months in federal prison and a $5,000 fine. In court, one defense lawyer described ShadowCrew as a disorganized message board full of immature geeks. I have seen a lot of forums, and I can tell you that description and "1.5 million stolen cards" can both be true at the same time.

And Gonzalez? He was never charged in the ShadowCrew case at all. Starting in July 2005, while he was still cooperating with the government, his crew was inside the network of TJX, the company behind TJ Maxx. Heartland Payment Systems and others came after that, the biggest card thefts of their time. On March 25th, 2010, he was sentenced to 20 years in prison for the crimes he committed while he was working for the people investigating him.

Timeline of Albert Gonzalez from 2003 to 2010: informant for the Secret Service from July 2003, the TJX intrusion from July to November 2005, then Heartland, Hannaford and 7-Eleven, arrested in May 2008 and sentenced in March 2010

Is the Admin a Fed?

ShadowCrew's fall broke the carding scene into smaller, invite-only rooms, and it left behind a reflex that never went away. Two years later the FBI did it again with DarkMarket, a forum that FBI agent Keith Mularski ran himself as "Master Splyntr" from 2006 to 2008. After that, "the admin is a fed" stopped being paranoia and became a working assumption.

FBI special agent J. Keith Mularski, who ran the DarkMarket forum undercover as Master Splyntr J. Keith Mularski, the FBI agent behind "Master Splyntr." He ran DarkMarket for two years. Photo: FBI.

And still, every forum that came after kept ShadowCrew's machinery: reviewers, vouching, escrow, reputation and a staff hierarchy. They have to. There is no other way to run a market where nobody knows anybody and everybody is a thief.

The Circle Doesn't Break

If you read my Silk Road piece, you already met two federal agents who robbed the market they were investigating. ShadowCrew is the same story from the other side: a criminal who helped run the market he was informing on, and kept committing crimes while he did it. In both cases the weak point was the person sitting at the center of the trust.

That is the part I think about most, because I build agentic systems every day. More and more of the trust online is being handed to automation: bots that vouch, escrow that runs itself, agents that decide who gets in. ShadowCrew's trust machine broke at a human who got turned. I keep wondering what it looks like when the thing everyone trusts is an agent, and someone turns that instead.

My prediction: the next big forum takedown will look a lot like this one, with someone trusted sitting on the inside for a long time before anyone notices. And the forum will be back under a new name within weeks, unfortunately.

So if you run anything that depends on trust, a vendor list, an admin team, a tool everyone was told to install, ask yourself who is sitting in Gonzalez's chair.

I hope I was able to improve 0.1% of your knowledge. Have fun, and good luck!