Dark web, even darker secrets
Secret Service finds notorious Oklahoma maker of bogus bills
| Orlando Sentinel
SAVANNAH, Ga. — When Secret Service Agent Matthew Britsch began trawling for major counterfeiters in the shadowy marketplaces of the dark web, he acted like any smart consumer on eBay — he studied the reviews.
Britsch knew he had struck gold when he found Billmaker, the online moniker of an anonymous counterfeiter who promised a high-quality $100 bill and a money-back guarantee. He even had a loyal fan base who praised his work and customer service with scores of positive reviews.
“Very good quality and got here quick,” one gushed.
“All passed with no issue whatsoever,” another wrote, approvingly.
“FRESH CLEAN BILLS!” agreed a third.
“Billmaker was a five-star guy,” Britsch said. “He wanted those five-star reviews to help him sell more bills. That was clearly his goal.”
The agent clicked “buy” and in September 2017 purchased four fake $100 bills for $120 in bitcoin, the online cryptocurrency.
“There are so many questions I would have liked to ask him. How did he learn to make these so well? Who taught him? Where is the bitcoin?”
a Secret Service agent who chased Daniel Johnson for a year
The counterfeits arrived on time and were as good as promised.
An analysis by Secret Service experts linked the fraudulent bills to thousands of others that had been passed with a total face value of $4.1 million. That made Billmaker the nation’s most prolific domestic counterfeiter.
Britsch’s buy sparked a nine-month investigation into the murkiest corners of the dark web, where cybersavvy criminals use online bazaars to anonymously buy and sell goods ranging from firearms and illegal drugs to fake identification and stolen cars.
“It’s all there for sale,” said Glen M. Kessler, the special agent in charge of the Secret Service’s fiveagent Savannah office. “Right in the open. But while it provides anonymity to criminals, it also provides anonymity to law enforcement. They can’t tell who they are selling to. And so we went fishing.” The Secret Service, best known for protecting presidents, was formed in 1865 to fight an epidemic of counterfeiting that was strangling the U.S. economy.
Today counterfeit U.S. bills are only a fraction of currency in circulation. Even so, the Secret Service made more than 1,580 counterfeiting-related arrests last fiscal year, seizing $204 million in phony bills. Banks and retailers collected an additional $107 million.
Once dominated by artisans who minted carefully forged greenbacks on large offset presses, domestic counterfeiters now typically rely on computers, scanners and laser printers. And some use the dark web to sell their high-quality fakes online.
The dark web’s backbone is a system called the Onion Router, known as Tor, a network of software and online connections that mask those who use it. Tor has attracted both criminal and legitimate users — political dissidents overseas, for example — seeking to avoid government surveillance.
In 2017, Kessler turned an office supply room into a hub for dark web counterfeit investigations. He had two rules: Targets had to be real players — “Not your guy printing $2,000 off on an inkjet at home,” Kessler said — and live in the United States.
“We thought it would be too difficult to catch the ones operating in South America or overseas,” he said.
Agents used the customer reviews as a guide and quickly came across Billmaker.
In addition to the bitcoinbacked guarantee, Billmaker offered free tracking of his packages through the U.S. mail.
That was a mistake. Secret Service agents were able to track Billmaker’s shipment to Britsch from the Oklahoma City area, a crucial starting clue.
They were impressed when the red-and-blue envelope arrived.
The fakes — reproductions of $100 bills phased out in 2013 in favor of a harder-to-fake currency had been printed on highquality laser printers and specialty paper. The bogus bills had a decent fake security strip. They even felt real.
Within a month, thanks to analysis by Secret Service experts in Washington, the agents knew they were chasing Daniel Johnson, a notorious counterfeiter who had been printing and passing fake bills since at least 2015. His last known address was near Oklahoma City.
Johnson, 34, was also considered dangerous. He was a firearms enthusiast and a member of the “prepper” movement, activists who stockpile food, ammunition and other supplies because they believe a nuclear war or other catastrophe is likely to occur.
Johnson had served three years in federal prison for selling pirated copies of Microsoft Office. But he was arrested again in February 2016 on counterfeiting charges.
Released on bond, he turned down a plea deal offer and vanished.
In February 2017, a federal grand jury indicted him on charges of counterfeiting and growing marijuana.
Johnson was so angry at the justice system that his lawyer, M. Michael Arnett, worried he might resort to violence if arrested. Arnett said he consulted legal ethics experts before he passed a warning to federal prosecutors.
“I was concerned he was not going to be taken alive if officers tried to arrest him, and that toll would be higher if they were not forewarned,” Arnett said.
With that danger in mind, agents in Savannah returned to the dark web in October 2017 to buy more counterfeit bills.
But the marketplace had disappeared. Billmaker’s online trail went cold. Marissa Elliott, a university student and bartender in Norman, Okla., met Johnson when he took a seat at her bar in June 2017 and she caught his “big blue eyes” lingering on her.
Tall and muscular, he was also quiet and reserved. He didn’t even offer his name. But the bartender checked his driver’s license before serving him a beer and saw he was Ross Moore, 36, from Florida.
It was lies.
They soon started dating. They celebrated his fake birthday that July and moved in February 2018 into a converted shed in Noble, about 30 miles south of Oklahoma City. The tiny house was hidden in dense woods.
A talented artist, Johnson rendered hand-drawn portraits of relatives and friends. He initially said he worked in information technology and had attended college, majoring in psychology.
Elliott found a Harvard diploma and ID card in a drawer; she didn’t know they were fakes. the first of many
Johnson never used credit cards or wrote checks. He explained to Elliott that he relied on cash because he was an investor in a marijuana business that was prohibited from using banks.
He told her he had been divorced, which was true, and that a screen-saver photo of a young girl on his computer was of his niece, which was false. It was his daughter.
As the months passed, Johnson suffered frequent nightmares and spent time on strange conspiracy websites.
Elliott believed his stress stemmed from secret work he claimed he had done for the government.
“He told me he had seen horrible things,” she said.
When they drove to a cabin where he was preparing for the demise of society, he insisted she put her cellphone in a Faraday bag, a shielded satchel that blocks electronic signals, so they couldn’t be tracked.
In the late spring of 2018, he bought tickets so Elliott and her mother could take a bucket-list vacation in Thailand. They spoke daily by phone. But one morning in May, he seemed distant and distracted.
“It was like he was in a rush to get someplace,” she said. was The Secret closing in.
After falling off the map, Billmaker had popped up on other dark web marketplaces.
In January 2018, agents bought four fake $100 bills from him. They did it again in April.
Working with agents in Oklahoma City, the Savannah squad narrowed its hunt to around Norman, about 20 miles away.
U.S. postal inspectors studied Johnson’s tracking numbers and examined dozens of bags of mail. They discovered he had mailed his packages from blue post boxes across the parking lot from the Norman Police Department. Service After several weeks of surveillance, federal agents determined Johnson was driving a black Ford F-250 pickup. It was registered to Ross Moore of Florida, a real person who had reported his identity had been stolen.
Johnson had bought the truck for $58,000 in cash.
Agents traced him to an apartment in Norman, where he probably collected mail and supplies; a house in the Oklahoma City suburb of Yukon, which was his main counterfeiting plant; and his secluded home in Noble.
As he drove out of his gravel driveway in Noble on May 17, 2018, a 10-car convoy of federal and local law enforcement officials led by the U.S. Marshals Service closed in, sirens blaring.
Johnson swerved to the shoulder, hopped out and began firing an AR-15 rifle.
A gunbattle raged for nearly a minute before Johnson was killed. No agents were injured.
Searching the house in Yukon, agents found about $300,000 in fake $100 bills, lined up and hanging to dry in neat rows.
Agents also seized several computers protected by encryption, which the Secret Service has not been able to crack.
“There are so many questions I would have liked to ask him,” said Wesley Gillespie, a Secret Service agent who chased Johnson for a year. “How did he learn to make these so well? Who taught him? Where is the bitcoin?”
Investigators may clue.
When they searched Johnson’s body, they found a computer thumb drive jammed in an ankle holster. The device contained 50 screen grabs of text messages.
Agents suspect it is a digital key to unlock a bitcoin or computer vault. Even so, they concede they may never crack the counterfeiter’s dark web of secrets. have a