156: Kill List

Episode Summary

Executive Summary: The episode investigates Besa Mafia, a dark-web “hitman for hire” site that turned out to be a scam but still generated real murder solicitations and eventually real-world violence. Cybersecurity researcher Chris Montero found a major access-control flaw, extracted private messages, and helped uncover threats, solicitation plots, and failures by law enforcement to act quickly enough. The story evolves into the Kill List project, which tracks and sometimes disrupts active murder-for-hire cases worldwide.

Main Topics: Dark-web hitman sites are scams with real-world consequences (Priority: 5/5): Chris explains that most murder-for-hire websites are fake scam operations, but the people using them are often serious enough to solicit actual killings, creating a dangerous mix of fraud and violence. The Besa Mafia vulnerability and data exposure (Priority: 5/5): Chris discovered that by changing a message ID in the URL, he could access other users’ private messages on the site, revealing names, addresses, phone numbers, plans, and payments tied to murder plots. Law-enforcement response and investigative failures (Priority: 5/5): The episode highlights mixed reactions from police and the FBI: some agencies acted on the intelligence, but others failed to share information, missed warnings, or misclassified danger, contributing to a murder that might have been prevented. Kill List and proactive intervention (Priority: 4/5): Chris and journalist Carl Miller built a system to clean, categorize, and escalate new kill orders, then attempted to warn targets directly when police channels were too slow or fragmented. Ethical tension in journalism and cybersecurity (Priority: 4/5): The story wrestles with whether the team is still journalism or drifting into vigilante behavior, while arguing they were forced into direct action because formal systems were not reliable enough. The persistence and scale of the problem (Priority: 4/5): Even after arrests and site disruptions, the platform continued operating and new cases kept appearing; Chris says the problem is ongoing and that many cases may still be unresolved or missed.

Key Arguments: Dark-web hitman sites are overwhelmingly scams, but that does not make them harmless because users still submit real victim data and money for murder solicitations. A simple insecure direct object reference (changing a message ID in the URL) exposed private communications, proving that illegal does not mean secure. Law-enforcement handoffs were fragmented; important details did not reliably reach the local investigators who needed them, which can cost lives. Direct outreach to targets was often the only practical way to warn them, even though it created ethical and emotional risk for the investigators. The site operator likely made substantial money because the scam was credible enough to attract real users and because bitcoin-based operations are hard to trace. The Kill List project is valuable because it converts technical compromise into actionable intelligence that can trigger arrests and potentially save victims.

Data Points: Years of delay before interview: 7 years - Jack says he tried for seven years to get Chris Montero to talk about the case. Messages extracted from site: Over 100 messages - Chris says he downloaded and analyzed over 100 private messages from the Besa Mafia site. Victims/targets observed: Over 900 people - Chris says the Kill List has seen more than 900 people appear on the site’s kill list. Cases acted on: Hundreds - Chris says they have taken action on hundreds of cases from the list. Money paid to kill Amy Alwine: $12,000 - The FBI told Amy Alwine that someone paid this amount to have her killed. Money paid to kill a 14-year-old in New Jersey: $20,000 - Chris cites a case where someone paid this amount to have a 14-year-old boy killed. Money paid in Ron Ilg case: $50,000+ - Chris and Carl describe Ron Ilg as having put up more than this amount for a multi-step violent plan against his wife. Typical order amounts: $5,000 to $10,000 - Chris says many orders on the site were negotiated around these amounts. Timeframe of active investigation: Since 2020 - Carl says the Kill List action phase began in 2020. Access loss: 2023 - Chris says he lost access to the private messages in 2023. Operating duration of site: Since 2016 - Chris says the site has been operating and evolving since 2016. Sentence in Ron Ilg case: 8 years - Carl says Ron Ilg was convicted and sentenced to a significant prison term, described as eight years.

Pivotal Quotes: "Everyone sees him next to me and they don’t mess with me because he’s there." — Fraud-like bodyguard story (old man in Vegas): Illustrates how appearance can deter action even when the apparent protection may be fake, paralleling the hitman-site scam. "You can’t edit my wiki page. That’s not cited stuff." — Chris Montero: Chris reacts when a vandal edits his Rational Wiki article to claim Besa Mafia is real. "We had this information that Chris was passing us that was unbelievably powerful. I mean, it had the power to save lives and destroy them." — Carl Miller: Carl reflects on the ethical weight of handling active kill orders and warning targets.

Implications: The episode shows how scam infrastructure can still enable real violence, and why legal, journalistic, and technical systems must coordinate faster. It also warns that dark-web anonymity and poor security can conceal, not eliminate, urgent public-safety threats.