“After becoming a member of the Carder.su organization, your affiant was able to move up through the ranks from being a general member to eventually becoming a reviewed vendor offering counterfeit identifications for sale,” Adams wrote in a court affidavit, “as well as being a VIP member of the organization.”
That status helped the Secret Service survive a user purge at Carder.su in late 2009, when the Russian operator of the site, known only as “Admin,” removed thousands of accounts and tightened security. Instead of being kicked to the curb with the rabble, Adams became an approved vendor. “Celtic has been verified,” wrote a moderator in December 2009. “All products offered were in perfect condition. Original laminate with holo and UV is confirmed too.”
The Secret Service tried to regulate its output by having “Celtic” take frequent, announced vacations, for days or weeks at a time. But to maintain his cover, Adams always had to return to work.
An official count isn’t available, but WIRED has tallied that the agent sold to at least 110 different customers, shipping at least 125 fake driver’s licenses, dozens of AT&T employee ID cards, and a handful of Carson City “voter identification” cards. In 2009, police departments began encountering Celtic IDs in the wild, not suspecting they were government-made.
Even as he peddled his wares, Adams continued making undercover buys of credit cards and stolen identity information. But he had to be more creative to go after competing novelty vendors – there was no legitimate reason for Celtic to purchase a driver’s license from someone else.
In April 2011, the agent used an outsourcing ploy to target a fake ID seller called “Hans Gruber” (presumably named for the villain in Die Hard). The agent emailed Gruber and asked him to handle two Florida driver’s licenses as a subcontractor. “I can’t make them ‘cause I don’t have the multispec holo for them,” he wrote. “I figured I could buy from you then sell them to the guy that wants to buy them from me.”
Gruber agreed, then vanished after the agent sent him the $400 payment in advance. Today he’s charged with an “attempt” to manufacture two fake Florida driver’s licenses.
Adams’ wheeling and dealing was the working end of Operation Open Market, but much more activity took place behind the scenes. From the start of the operation the Secret Service used Celtic’s growing contact list as grist for hundreds of search warrants, grand jury subpoenas and 2703(d) orders targeting webmail and chat accounts at Hotmail, Live.com, Gmail, Yahoo, and AOL’s ICQ service, as well as ISPs and hosting companies.
More than 230 such orders were issued before the first indictments dropped; one alone, served on Microsoft, gave the Secret Service the contents of 15 Hotmail and Live.com mailboxes.
The Secret Service even obtained an image of Carder.su’s hard drive from the U.S.-based hosting company SoftLayer, where the forum administrator unwisely placed the site for a time in 2009. And through the Justice Department, the agency sent eight Mutual Legal Assistance Treaty requests overseas to get images of servers hosting illicit content or running criminal storefronts outside the U.S.
It was the longest of long cons. The agency allowed its targets to stay free and uncharged for years, until it was ready to drop the hammer, keeping the undercover shop a closely guarded secret the whole time.
In March 2012, the government finally moved, unsealing the first batch of three indictments in a Las Vegas courthouse, and raiding and arresting 19 U.S. defendants in Nevada, California, New York, New Jersey, Michigan, Florida, Georgia, Ohio, and West Virginia. A press release announced the sweep. “The indictments and arrests in this case are yet another example of how the Secret Service continues to promote the Department of Homeland Security’s mission of providing a safe, secure and resilient cyber environment,” wrote A.T. Smith, the Secret Service’s assistant director for investigation.
The press release doesn’t mention the Secret Service’s underground storefront. Neither do the three indictments, or a fourth handed down against an additional five defendants in April.
The main indictment is noteworthy because, in addition to the usual mix of credit card fraud and false identification charges, the 39 defendants have been charged under the mob-busting RICO act – a first for a cybercrime prosecution.
Enacted in 1970 to help the FBI crack down on the mafia, the Racketeer Influenced and Corrupt Organizations Act lets the feds hold every member of a criminal organization individually responsible for the actions of the group as a whole. The losses collectively inflicted by the Carder.su members are easily enough to give every RICO defendant 20 years in prison.
“Each defendant was so minimally involved with such a small portion of stuff, and they put them all together in this huge case and made it a nightmare for everyone,” says Chris Rasmussen, defense attorney for 21-year-old David “Doctor Sex” Camez.
Rasmussen argues the government is overreaching by treating membership in a criminal forum as equal to membership in a criminal gang. “It’s like if a bunch of people are on Facebook. They aren’t really working together.”
The three additional indictments against 16 other defendants charge conspiracy, trafficking in counterfeit IDs, and credit card fraud, but don’t include RICO.
Throughout the indictments, the Secret Service lurks as a silent, unnamed co-conspirator. One of the “overt acts” supporting a conspiracy charge against 48-year-old Thomas Lamb, for example, is that he “did knowingly and without lawful authority … cause others to traffic in and produce false identification documents, which were transported in the mail.” Those documents were one of Celtic’s counterfeit New York driver’s licenses, and one of his $25 AT&T employee identification cards. It was Special Agent Adams who put them in the mail.
Ditto for Lamb’s associate, Roger Grodskey, who’s charged with trafficking in a Nevada license and another AT&T card, both of them manufactured by the Secret Service agent.
IN 2009, POLICE DEPARTMENTS BEGAN ENCOUNTERING THE CELTIC IDS IN THE WILD, NOT SUSPECTING THAT THEY WERE GOVERNMENT-MADE.
Alleged rank-and-file fraudsters like Lamb and Grodskey are facing the brunt of the prosecution – they account for about half the defendants charged in Open Market, but comprise 22 of the 28 who’ve been identified and arrested.
The more valuable targets are the 27 Carder.su vendors charged with selling criminal goods and services alongside Celtic. But of these, eight are known only by their online nicknames, and thirteen others have been identified, but live in foreign jurisdictions like Ukraine, Morocco and Nigeria. Only the six unlucky enough to be based in the United States have been arrested.
At the very top level, the three defendants charged as Carder.su ringleaders are all in Russia, which doesn’t extradite to the U.S., including the site administrator, who is now believed to be running the Carder.su successor forum Carder.pro.
Even with half the defendants unaccounted for, the Open Market prosecution is straining the Nevada federal criminal justice system. The 28 defense lawyers, all from different law firms, meet periodically in the large conference room at the Federal Public Defender’s office – none of their individual conference rooms are large enough to fit them all. An outside firm was brought in just to manage the 10 terabytes of evidence in the case – emails, forum posts, computer files, and Secret Service reports. “It’s just a huge amount of discovery,” says John Momot, Jr., lawyer for Duvaughn “Mackmann” Butler. “A large amount of work.”
An early issue in the case explored how to give access to that so-called “discovery” material to the defendants in custody at the privately run Southern Nevada Detention Center in Pahrump. Earlier this year a judge ruled that they can view the evidence on an air-gapped jail computer set up for that purpose, but they aren’t allowed to print or take notes.
Some of the lawyers even feel sorry for prosecutor Kimberly Frayn. “She’s a really nice person and a good lawyer,” says Rasmussen. “If we all filed one motion her entire week would be filled up in front of a computer.”
As his time as Celtic wound down, Adams transferred from the Secret Service to DHS’ Homeland Security Investigations, a division of ICE, where he’s remained assigned to the case. He shows up at every hearing, defense lawyers say.
So far, Adams’ role as a respected seller of fake IDs hasn’t figured in the pretrial motions, but at least one defense lawyer hints it might in the future. “The issue of course is … whether or not there are issues of outrageous government conduct or issues of entrapment,” says Grodskey’s lawyer, Terrence Jackson. “This is a case that’s probably going to be in litigation for years. All I can tell you is there are issues that are going to come up in pretrial and at trial that involve that.”
Spared from all this is the original Celtic, Justin Todd Moss, who was bouncing in and out of jails and halfway houses while his Secret Service doppelgänger built a fake ID empire in his name.
In 2008, Moss was sentenced to five years probation and ordered to pay $1,422.84 in restitution. In late 2011, he was arrested in Indiana on a violation, then released in March 2012 to a halfway house. He remained there for at least a year, through April 2013, while he struggled to find employment.
Among Moss’ challenges, his probation officer noted in a report to the court, were “difficulties obtaining his identification.”