153: Bike Index

Have you ever got your bike stolen? In this episode we dive into the world of stolen bikes. Who does it and where do the bikes go? We talk with Bryan from Bike Index https://x.com/BikeIndex who investigates this. https://bikeindex.org https://bikeindex.org/about SponsorsSupport for this show comes from ThreatLocker® https://www.threatlocker.com/. ThreatLocker® is a Zero Trust Endpoint Protection Platform that strengthens your infrastructure from the ground up. With ThreatLocker® Allowlisting and Ringfencing™, you gain a more secure approach to blocking exploits of known and unknown vulnerabilities. ThreatLocker® provides Zero Trust control at the kernel level that enables you to allow everything you need and block everything else, including ransomware! Learn more at www.threatlocker.com https://www.threatlocker.com/. This show is sponsored by Flashpoint https://flashpoint.io/. As one of the largest private providers of threat intelligence, Flashpoint delivers what security teams need most: clarity. By combining cutting-edge technology with the expertise of world-class analyst teams, their Ignite platform gives organizations instant access to critical data, expertly analyzed insights, and real-time alerts —all in one seamless platform. To access one of the industry’s best threat data and threat intelligence, visit flashpoint.io https://flashpoint.io/ today.

Speaker names marked ? are inferred from speaking time and the show’s known hosts — they are not voice-verified.

• 0:00Jack Rhysider?

  I visited the Facebook campus once. It's in the Bay Area, near San Francisco, California. Yeah, I just showed up, unannounced, and walked around the place. My friend was with me and he had to pee, so we looked for a way in, but we couldn't find any way into the buildings. We were just curious what it was like inside, though. But while I was walking around the Facebook campus, I saw a bunch of bicycles painted in the Facebook blue with the Facebook logo on them. Apparently, it's a thing in Silicon Valley that tech giants like Google and Facebook have these bikes around their campus for anyone to use. For when you need to get to a meeting in another building, just hop on one of the company bikes and take it where you want. It makes it super convenient to get around their large campuses.

• 0:42Jack Rhysider?

  Well, since I was there and I saw these bikes, I decided to hop on one and go for a ride. They aren't locked or have any code or anything. They're just sitting there for anyone to use. Dozens of them are all over the campus. So I hopped on one and I rode it around, zooming down sidewalks, ripping around corners. And for a brief moment, I felt like a Facebook employee. Whizzing by other people I presumed to be employees. Nobody said anything. And I left the bike on the other side of the campus. As I spent more time in Silicon Valley, I saw more and more of these bikes all over the place. Like, people had ridden bikes from the Google campus over to the HP campus, or you'd see Facebook bikes over at the Cisco offices. The bikes were scattered all over town.

• 1:26Jack Rhysider?

  And I presume it's because people ride them from office to office. And maybe they're inside doing some meeting or something, and they'll ride back later. But the thing I couldn't understand was, this being so close to San Jose in the Bay Area, and these bikes just sitting right out front with no chain or lock? Why aren't these bikes stolen? Like, the very moment someone walks away from it? I mean, I didn't just ride one, I rode a handful. It became a thing. Every time I saw one around, I'd hop on it for a little joyride. And so if I could jump on them so easily and ride off wherever I wanted, what's stopping anyone from just stealing them all?

• 2:06Jack Rhysider?

  These are true stories from the dark side of the internet.

• 2:12Jack Rhysider?

  I'm Jack Resider. This is Darknet Diaries.

• 2:34Jack Rhysider?

  This episode is sponsored by DeleteMe. You care about your privacy, do ya? Then get yourself over to joindelete.me.com. And let me tell you why. Whatever size you think your digital footprint is, well, it's bigger. Social media, news apps, shopping, all the private data can be scraped by data brokers and sold. A few years ago, I signed up. And ever since then, they have been busy scouring the internet from my name. And then they give me reports about what they find and then start deleting stuff. Take control of your data and keep your private life private by signing up for DeleteMe. Now at a special discount for my listeners. Get 20% off your DeleteMe plan when you go to joindelete.me/darknetdiaries and use promo code DD20 at checkout. The only way to get 20% off is to go to

• 3:18Jack Rhysider?

  joindelete.me/darknetdiaries and enter code DD20 at checkout. That's joindelete.me/darknetdiaries code DD20.

• 3:34Jack Rhysider?

  This episode is sponsored by DeleteMe. You care about your privacy, do ya? Then get yourself over to joindelete.me.com. And let me tell you why. Whatever size you think your digital footprint is, well, it's bigger. Social media, news apps, shopping, all the private data can be scraped by data brokers and sold. A few years ago, I signed up. And ever since then, they have been busy scouring the internet from my name. And then they give me reports about what they find and then start deleting stuff. Take control of your data and keep your private life private by signing up for DeleteMe. Now at a special discount for my listeners. Get 20% off your DeleteMe plan when you go to joindelete.me/darknetdiaries and use promo code DD20 at checkout. The only way to get 20% off is to go to

• 4:18Jack Rhysider?

  joindelete.me/darknetdiaries and enter code DD20 at checkout. That's joindelete.me/darknetdiaries code DD20.

• 4:33Jack Rhysider?

  Content warning, since a lot of you appreciate me telling you that there are swear words, this episode has a lot of swear words in it. So maybe, I don't know, listen with headphones or whatever it is you do when swear words come on the show. You ready?

• 4:45Speaker 01

  Mm-hmm.

• 4:46Jack Rhysider?

  Um, do you, what kind of, what name should we use for you on that?

• 4:49Speaker 01

  Uh, you can call me Brian, it's okay. I don't, I'm not cool enough to have a nom de guerre.

• 4:54Jack Rhysider?

  Brian, have you ever got your bike stolen?

• 4:56Speaker 01

  I have indeed, yes.

• 4:57Jack Rhysider?

  Tell me about it.

• 4:58Speaker 01

  Uh, the, the worst one, the one that I remember with like the most pain was a Cannondale M300. It was like a mountain bike. It was one of the first I'd really spent a decent amount of money on. This is back when I was at the University of Arizona. And I had this crappy little shotgun apartment where everything was stored in the front, the shower was all the way in the back. And I came home one day and I went and took a shower and I like walk out into the front of my apartment. I'm like, something is different. Somebody had come in the front door while I was in the shower.

• 5:29Jack Rhysider?

  What?

• 5:30Speaker 01

  And rounded me and then taken the bike and taken off on the bike.

• 5:34Jack Rhysider?

  While you were showering?

• 5:35Speaker 01

  While I was showering.

• 5:36Jack Rhysider?

  How is this possible?

• 5:37Speaker 01

  I don't know, but it was, that's the one that I, that was, you know, that was one of many, but that's the one that finally like broke my brain. And, and I just, I, to this day, whenever I see like a Cannondale M300 down going around, I'm like, son of a bitch, I remember, like it really sticks with me.

• 5:53Jack Rhysider?

  I can't believe, I can't believe somebody came in your apartment to do it while you're showering.

• 5:58Speaker 01

  Yeah, that one, that one, that one hurt.

• 6:00Jack Rhysider?

  So did you try looking for that bike?

• 6:02Speaker 01

  I did.

• 6:03Jack Rhysider?

  Where'd you look?

• 6:04Speaker 01

  I mean, you look around, you physically look around. We kind of knew where the, the dodgy spots were and every single, you know, if you've ever had something like that stolen from you, uh, you know, every, anytime you're out, if you see one that's even remotely the shade of that, you're like the hair is on the back of your neck stand up and you're always like thinking like, is that it? Is that it? And you go scoop it out like, but there wasn't much. I mean, you watched, back then it was Craigslist. You watched Craigslist, you could like talk to local bike shops and you could physically just go run around looking for the damn thing.

• 6:36Jack Rhysider?

  What about the police?

• 6:37Speaker 01

  It wasn't really a thing, uh, and that was sort of like, um... You know, college towns, like, there's campus police and there's city police. And I did report it with the campus police, but it was like, and I asked somebody, it was like, so what happens if the city picks it up? They're like, oh, no, you're on your own. You have to go report to them, too. And you could see this sort of like, there were two silos, you know? There are two systems, they didn't talk to each other. This is stupid.

• 7:02Jack Rhysider?

  Brian was frustrated that there was little to no help for him. And he knew it wasn't just him who had a stolen bike. Lots of people must feel frustrated like this, too. Like, what do you do? Go to every bike and pawn shop in town? Give them the serial number and say, hey, call me if anyone tries to sell you this bike here? And then call the police and the campus police and put up posters around town? It's really hard to spread the word that your bike got stolen and here's what it looks like in case you see it. Surely, there's gotta be a better solution to this problem.

• 7:33Speaker 01

  So that, I mean, in a way, that bike was kind of the impetus for this whole, this whole thing. It was like, that's my origin story, right? Like, um, because this was like 98, 99, 2000-ish, like, that era. I was lucky enough to be in computer science. It was like right when, you know, text messaging, it just was still like a new, it was like, you could, you, all this techno, like, a lot of free databases were out, a lot of people were getting into web development, like, PHP was like, it was this perfect storm time of like, some schmuck like me could be like, you know what I'm gonna do? I'm gonna create a bike database for stolen bikes and I'm gonna like tackle this thing. And for once, like, all that technology was actually there. And like, anybody with half a brain could see, you know, in five years from now, the

• 8:16Speaker 01

  phones are gonna be a way to pay whatever, the internet, like, you knew, like, even if you had this crappy little website at the start. So I, I started this site called Stolen Bicycle Registry.

• 8:26Jack Rhysider?

  And what was it? What did it do?

• 8:27Speaker 01

  It literally just let you put in make, model, color, serial, add some photos, and add a description, and it was the first sort of free, open database of stolen bikes at that point. And it- I only cared about stolen. I never cared about like what happened to them before they were stolen. It was it was purely, everything in this database is stolen.

• 8:50Jack Rhysider?

  His idea is that if your bike is stolen, let him know. And he'll try to tell everyone around town that, hey, before you buy or sell or repair a bicycle, look it up in this database first. Basically, it's a place that's easy to report a stolen bike to, and one that's easy to search for stolen bikes, too. So bike shops and pawn shops started appreciating this site to be able to easily check if this bike has been reported stolen. It's kind of impossible to ask every police department in the nation if this bike is stolen. But when there's a nice, simple site online that will tell you, well, that made it easier to check. But really, is this going to work? Like, is anyone actually going to use the site to check if a bike is stolen before buying it?

• 9:31Speaker 01

  Somebody was trying to buy a bike off Craigslist and they ran the serial number and it was listed on my site.

• 9:36Jack Rhysider?

  He was able to tell the victim, hey, someone found your bike. It's for sale right now on Craigslist, look. And from there, the victim was able to go get their bike back.

• 9:44Speaker 01

  We got a recovered bike.

• 9:47Jack Rhysider?

  It worked. The site got a stolen bike back to the owner. And sure enough, not long after that happened, another stolen bike was found and recovered. This was a good idea. The site was working. This gave Brian fresh energy to work harder at spreading the word. He was pumped that he helped two people recover their bikes.

• 10:05Speaker 01

  It's pretty, it's amazing. It was pretty great. I mean, there's no money in it, but it's high karma. Like, it feels, it feels really good to just have built something that had like, people want to use and it works well.

• 10:18Jack Rhysider?

  He made it so if you found a stolen bike, you could directly contact the person who lost it.

• 10:22Speaker 01

  At that point in that site, you could just basically click a button and be like, hey dude, I've got your bike. And it would shoot an email off to the owner and it would put them in touch. I'm not going to handle every single one of these. It's, it's just like finder, meet owner, you guys work it out.

• 10:34Jack Rhysider?

  He kept the site going and was helping more and more people find their bikes. But after a while, it became a lot to keep up with. The site wasn't making any money. It was just a labor of love and he kind of needed some help.

• 10:45Speaker 01

  Yeah, so I only ever cared about stolen. And like 2013, 2012, 2013, this bike mechanic in Chicago named Seth, her, ran a Kickstarter that was sort of the opposite. He was working in bike shops and he was sick of like, you know, they sell a bunch of bikes, they get stolen, people would come back, they'd have to go through like physical paper. It just sucked. It was like a really bad process. And he was like learning Ruby and he was sort of coming at it from the other angle, which is like, let's just get these things registered the moment, like the moment I swipe your credit card and go boop on my point of sale system, like I want that bike registered. And that just solves everybody's problem. You don't have to do any work. I don't have to do any work. It just goes into this thing. So he ran, I was like, oh, that's a really

• 11:28Speaker 01

  cool idea. And then he ran a Kickstarter and raised like 50 grand. I was like, son of a motherfucker. I've been doing this for 10 years and no one's ever donated to me. Like, so I reached out to him and we met and we chatted and we just, we just realized, you know, we're working on the same thing. Like you're, you're doing the first part, which is the annoying, let's get humans to do something new part, but you're being cool about it by putting it into point of sale systems and it just makes people participate. I'm doing all the weird, nitty gritty, terrible black bag, let's chase bad guy. Like, and neither one of us really gave a shit about our other, like he didn't want to do stolen stuff and I didn't want to do pre-registration stuff. So we, we joined forces and it was just from, from day one after that, it was just, just success, success, success. And

• 12:12Speaker 01

  we just iteratively built it into a much better system.

• 12:17Jack Rhysider?

  Together, they created the website, bikeindex.org. And with the combined forces, their reach got a lot wider, which meant more people were using the site and more stolen bikes were being recovered. As people were learning about this site, they would go on there and check to see if this bike was stolen before buying it off of someone. And if there was a hit, they'd tell the bike owner, hey, I think I found your bike.

• 12:38Speaker 01

  You know, we spent like 10 years just begging people, like, please use this thing. You know, we're nonprofit, it's free. We love helping people. You love helping your customers. You know, victims love getting their bikes back. Like, everybody wins. There's no, there's no gotcha here, right? You know, like, like writing blog posts, doing prep. It was just like, you know, because it only works if a ton of people use it.

• 12:58Jack Rhysider?

  And is it specific cities or?

• 13:00Speaker 01

  Well, it's all, it's universal. It's all over the world. I mean, it's US and Canada focused, but we had, we've recovered bikes like in Australia and Belgium. There was a real tipping point though, where I want to say it was like maybe 2018, 2019, where it no longer became, "Please, please, please use the service." It became, for me, we have so much data and so much information coming our way about bad, like, I'm chasing bad guys now. I can, I can tell you, like, if you come to me and say, "I got my bike stolen in Seattle." Beforehand, it was like, "Please use Bike Index." Now, it's like, "No, these are the four motherfuckers you need to keep an eye on. Watch this, like, like, these are the bad guys in your zip code." And I know this because we've just been looking at these guys for so long.

• 13:45Speaker 01

  And we, we just had so much data about where stuff was getting stolen, where it was popping up, like, who it was popping up with, which ones were going like crossboard. It, it just switched from like, "Please use my service" to like, "I'm actually now able to discern patterns and, and do sort of like, like, I really can identify, like, some of the flows." The scenario I always tell people is like, so say somebody robs your house on Monday. By Monday night, before you can even make a police report, probably, depending on what city you're in, especially during the pandemic, all that shit is already for sale somewhere. Typically, online, it's on OfferUp, it's on Facebook Marketplace, it's on any of these other dodgy, like, sales apps.

• 14:26Speaker 01

  And, and what happens a lot is, you know, they take your computers, they take your bikes, they take, they, they take your jewelry, they take everything. And somebody is like scrolling through OfferUp and it's like, you know, "Joe Sleaze Bag 420 Bong Master 7 has all this brand new shit for sale." "I think that's your bike." So they go to Bike Index, they send in a message and says, "Hey, I was just looking at this super sketchy dude on OfferUp. He's got your bike. I think he's, it looks like he has your bike because you listed this bike and it looks unique. Like, I was thinking about buying it, but I see that might be stolen, so I just wanted to give you a heads up." And then the victim pulls up OfferUp and is like, "Oh, not like, yeah, that's my bike, but not only is that my bike, that's all my other shit. Like, this is the guy. This is the guy who robbed me. Like, this is all my stuff."

• 15:11Speaker 01

  And it's, and it's, you haven't even had time to make a police report. And over time, you start like, sometimes you get help, sometimes you don't. Sometimes you win, sometimes you lose. Sometimes the victims call the cops and the cops are like, yeah, let's go get this guy. Boom, like, everybody wraps up and wraps for dinner and it's a great day and then.

• 15:27Jack Rhysider?

  What a great, what a great feeling that must be to be like, you come home, you realize your stuff's been stolen. And you're like, oh, my gosh, oh, my gosh, what do I do? And you look at your phone and it's like, hey, I think I found it. It's like, I didn't even tell anybody.

• 15:41Speaker 01

  The crazier ones are like, so we, we've had people pop burglars before the victims knew they had been robbed.

• 15:47Jack Rhysider?

  Wow.

• 15:48Speaker 01

  Because, like, so the one that, the one that I'm thinking about was out of Seattle. It was like a Colnago, a fairly, it was pretty, pretty high end bike for sale with this sketch ball. And it had been listed on Bike Index, but not stolen, not marked stolen. It had just been listed like years before. And the guy, the guy who, the one of the, the bike chaser who was, who was kind of chasing this thing starts looking into the guy. And it's getting more interesting and more interesting and more interesting. He's like, man, I just called this dude up. So we call this guy up and he's in Hawaii, he's on vacation. He's like, can you send me that link? So we send him that link. He's like, that's all my shit. That's like, I'm not even home. I didn't even like, call the cops, right? So he didn't even know it had been robbed. These guys had literally done it like the night before and they're just trying to get rid of the stuff as fast as they could. And that's a great feeling.

• 16:33Speaker 01

  That's a slam dunk. That like, that I could live off that for a week. You know, it's such a good, like, I have a day gig and I like my day gig, but it's not like a pretty still enriching day gig. But like, I get one or two bikes back and I'm like, I'm on cloud nine. Cause you're, you're pulling complete needles out of haystacks.

• 16:51Jack Rhysider?

  After spending a decade spreading the word, BikeIndex.org now has its own energy and momentum. It's got the critical mass it deserves to help hundreds and even thousands of people recover their stolen bikes.

• 17:03Speaker 01

  It's every bike mechanic that uses us and it's every bike shop that uses us. And it's every big brand that you, we, we basically tried to put ourselves in every place your stolen thing could wind up. Either getting serviced or try to get sold or try to get marked for sale or like, um, you know, we, we tie into this pawn search system. But like, if you, if you, if I rob you and take your bike to New York and try to pawn it, it's going to pop up because we partnered with this pawn search system. We just, we just took everybody in the cycling community and we're like, here's this free thing. Please be a node in our network. To to keep an eye out for these things and help recover these things. And this happens all the time. It's like thieves will literally get a flat and roll into a bike shop and be like, can you help me with this flat? And they're like, cool. And they just pull out their phone and like, doot doot doot, bike connects.

• 17:48Speaker 01

  Like, it's stolen. Get out of my shop. We built the thing for the community, right? Like, we're the glue guys. We're we built the thing that that every single person in this ecosystem could just, if if everybody wants to like, help with this thing, you can use this thing. We're not getting paid. We're not making money. We just wanna like, keep the bikes safe and and not let crackheads sell bikes and make thousands of dollars.

• 18:10Jack Rhysider?

  But even though they'd sometimes find stolen bikes, they couldn't always get it back. Like, for instance, calling the cops didn't work every time. Even if you could prove that that's your bike and here's the person selling it, it wasn't enough for the cops to go get your bike back for you. So the victims were telling Brian, like, man, what the hell? How do I get my bike back?

• 18:29Speaker 01

  Can't get anybody help me. It's the middle of the pandemic. Like, we're we we have no choice. We just have to let this go. And what I tell those people is always like, we didn't get him this time? We'll get that motherfucker next time. And that's where the patterns start coming in. Because what happens is the next guy that he robs, we can say, we can tell that victim, oh, you know, when you call your cops, tell him also he's associated with these other, like, the first couple people that you could, like, it just sort of builds a case on them. But it also lets us sort of surveil, like, tactics and methodologies. Like, how, you know, how soon do you post this stuff? After you rob somebody? Like, are you showing stuff in the background that betrays where you're at? Can we dig into who you are and and find some, like, um, information about, like, where you might be?

• 19:14Speaker 01

  Are you are you dumb enough to take pictures in a location that betrays your actual location? Those have been super fun, where they they say, like, they take a picture of this bike for sale in front of their house. This happened in Vancouver. And they inadvertently just put the house number in in the back of the in the back of the thing. And when they said, so we get a hold of the victim, the victim, like, calls the cops, cops call to set up a meet, and they they meet at, like, a Dairy Queen. They they wanna meet a block away.

• 19:42Jack Rhysider?

  Who's who's meeting?

• 19:43Speaker 01

  The the thief that the has the bad guy that has the bike.

• 19:46Jack Rhysider?

  Selling it.

• 19:47Speaker 01

  Is selling it, puts it online, doesn't realize that he's taking a selfie, but he's he's showed, like, his house number in the background. We tell the victim, this guy's got your stuff. The victim's like, absolutely, that's my stuff. And but so they're sort of fake baiting. This guy's like, man, I'm really interested in this bike. It looks great. I would love for my wife to come to some bullshit story, right?

• 20:09Speaker 01

  And what will happen is the seller not wanting to have you like not. He's like, oh, we'll go meet, you know, near my home. And he's like in a Walmart or some shit. But instead, what we have the victims do is go like 40 minutes early and just go right up to his front door and knock on the door and just spook him. Cause he's like, how the fuck do you know where I live? Like, but they never put, you know, they never realize. You catch them off guard. You catch them off their footing. They, you know, they haven't had time to sort of look around and see. And it just scares the shit out of them. And they typically are just like, here you go. The vast majority of them are within like 20 miles. They don't, they don't really leave the same state or city. A lot of them just get, they just get moved a couple zip codes away and they try to sell them online or fence them to their friends or.

• 20:52Jack Rhysider?

  So where's the classic places you see them for sale?

• 20:55Speaker 01

  I mean, offer up without a doubt. Fuck those guys. They're, they're just a chronic terrible. They're horrible.

• 21:01Jack Rhysider?

  Why? Why are you saying fuck those guys?

• 21:03Speaker 01

  Those guys? Cause we have tried for a decade to try to get them to care about the huge amount of stolen. We have free data. We have open data. We have this whole system. We've demonstrated to them that like, you know, your platform is abused left and right. Look at all these bad guys. This guy killed somebody in the eighties and he's selling stuff on your site. Like you, if you put something in place for bikes, like you do for cars, you assholes. Cause you have the VIN numbers so people can get a VIN fax. And it's like, some of these bikes are at 10K now and you're letting, you know, Meth Lord 472 like sell like. You just have, they have, there's no, there's just no vetting. There's just no, it's just such a rampantly abused place and it has been for so long. And they just do not care. And I know they do not care because we have interfaced with them for years, trying to get them to care.

• 21:49Speaker 01

  So that OfferUp Facebook Marketplace, and then there's a whole sort of crappy constellation of knockoffs of OfferUp that are much lesser players, but it's exactly the same idea. It's just an app where you can be like, I'm cleaning out my garage. There are a couple of physical markets, but that's fewer and far between. Like in Oakland, there's a couple of swap meets that are sort of classically known as being real, super crazy hotbeds. The vast majority of them pop up pretty close to home.

• 22:14Jack Rhysider?

  He learned there's a whole supply chain network for the stolen bike market. Like, a lot of stolen bikes are not resold by the person who steals them. They're stolen, and then they're taken to a person who can buy it off them real quick, no questions asked.

• 22:27Speaker 01

  We've had people literally like, you know, they break into an apartment building downtown. They literally just ride to the waterfront and they sell it. Like, it's been like maybe 12 minutes. We also have them like take it out, stash it, sell it the next couple of days, or ride the thing to South Portland, go to that house because that guy will give you drugs in exchange for the bike, not even converting to money, just like, here's drugs, thanks for the bike. And that's the guy that knows, you just gave me a $3,000 bike. I just gave you $30 for the drugs. I can sell this for a grand. I still win. So all those scenarios are true.

• 23:01Jack Rhysider?

  It's not just druggies selling stolen bikes, though. Some people are just naive.

• 23:05Speaker 01

  Have you ever taken the deep rabbit hole into like flipper culture? Like, are flipping?

• 23:11Jack Rhysider?

  No.

• 23:13Speaker 01

  Flipping is basically, you find an item that maybe you can buy in Portland. Let's say they're these cute little sweaters that have cats on them or something. And there's one lady who makes them in Portland. And they're really cute and they're really amazing. You're like, I want to buy 10 of those. And I spent $200 on, you can put them on Etsy and pretend they're yours and you make $2,000. And there's all these people that sort of, it's just like arbitrage is a sport. So they're like, I found these stupid doll things at Walmart for whatever, and I sold one online and I made 28 bucks on it. So there's this whole culture around flipping, buying a thing, just immediately listing it on some market because it's not on that market or whatever, making some money. Buy low, sell high. That's it. That's all flipper culture is.

• 23:55Speaker 01

  But what sucks is they've gotten really into bikes. So we have these 16, 17-year-old kids who don't understand that like...

• 24:06Speaker 01

  You know, some crackhead puts a $3,000 bike on OfferUp and it's like, need to go ASAP. You know, hit me up next five hours and it's $200 and that kid's like, I'm gonna buy that for $200 because I just restored it and I can sell it for $3,000. And they just don't, they're naive enough or dumb enough that they don't care. All I know is, I spent $200 on this thing, I'm pretty damn sure I can sell it for 3K.

• 24:32Jack Rhysider?

  Time and time again, Brian would spot patterns that reveals exactly who the bike thieves are in a certain town.

• 24:38Speaker 01

  What typically ends up happening is, you get robbed, you put your bike on my system. Somebody eventually finds it and says, hey, Jack, I think I found your bike, it's with this guy. And I chime in and say, oh yeah, we've seen this guy a million times. I can't call the cops up and say, hey, XYZ, the victim has to do it. They're the ones that have suffered the crime, they're the ones with the police report number. But I can give them all this information that says, look, when you call, mention this name, tell me. Like, we can sort of give them the, the information that sort of tips it from a, we're just gonna take your report to like, oh no, we actually have warrants on that guy, let's go get him. As we found with the services, like, we, I mean, there's, I could show you dudes right now that we've, we've caught with multiple stoners and they just don't fucking care, we don't really care.

• 25:20Jack Rhysider?

  This is so frustrating to be, to be, to have all this evidence, to have all this proof that these are the guys and this is exactly where they live and all this sort of thing. And then for the cops to be like-

• 25:30Speaker 01

  Here's all their selfies with all the incriminating stuff in the background. Here's like, a giant neon sign that says, let's do crime. I mean, yeah, it's, they're, they're not smart, it's pretty, it's like fish in a barrel, but it's just really aggravating.

• 25:42Jack Rhysider?

  Why, why is there, why is there a problem here?

• 25:45Speaker 01

  I don't know. The, the answer is because there's no system in place to do anything about it.

• 25:51Jack Rhysider?

  There's a police system, there's a, there's a law system.

• 25:54Speaker 01

  Yeah, there is a police system, there is a law system. They'll all tell you, we're swamped, this lower stuff is not important. But also like, if we tip off a cop and say, this guy has hundreds of thousands of dollars of stolen shit, go get him. And they decide, yeah, he, this is a guy we actually want, he's in our, like, we're, we've actually been looking for him, let's go do a raid, let's go seize everything. He still has his OfferUp account.

• 26:15Speaker 01

  Police don't call off up and say, fuck this guy, he's a bad guy, don't let him on here. There's no, there's no mechanism there. We, we gave up. We completely just said, fuck it. It's this clear that these people are operating in bad faith. They make money off of all the stolen goods. So we just started routing every single victim to the state attorney general. We're like, file a complaint. We get thousands of people filing complaints eventually.

• 26:34Jack Rhysider?

  The service being the police?

• 26:36Speaker 01

  This fucking attorney general will get off his ass and actually do something about it. But do, do not engage with OfferUp or Facebook Marketplace or wherever your stolen stuff is listed. Do not engage with their systems because all they will do is nothing. Or maybe they'll disable account for a little while. Like we, we found a dude here selling drugs and he had a stolen bike that was taken from a cancer victim, a 65 year old cancer victim. It was a Blue Turn that I went and did a repo with some of the local guys here. And like that guy's account is still active. Like he was selling drugs on the platform and had this stolen bike. And we popped it back from him and we sent in things saying, this is a bad guy. He had this thing, he stole from a fucking cancer victim. His account's still there.

• 27:18Speaker 01

  There's no mechanism in place to take these bad guys off. And it's like, you know, I get it. There's bigger problems in the world, right? Like this is, this is a pretty much, it just sucks when you're like, we're doing them a favor, you know? It's like, you'd think you would want to take the, the arsonist, rapist, murderer, like thieving, like those super, super bad guys that we are encountering and telling you about. You'd think you'd want to do something about that. And the answer is, no, we don't.

• 27:46Jack Rhysider?

  What's crazy is when somebody reports a stolen bike to the police, the police will often say, go register your bike at bikeindex.org. But then when Bike Index tells the police like, hey, we found the thief, the police just ignore them.

• 27:59Speaker 01

  So like, we have some Canadian partners that are phenomenal and, and I, not to, not to stereotype, but they're super nice. They do their job and they're like, they're just really great and they're really engaged. They're really nice people. And then we, we deal with, you know, unnamed American cities here that just don't give a fuck. Like they just, you can't be bothered. It's it's night and day. So we do have some people and we do have some like, we do have some specific officers who are typically bike people themselves, who are like triathletes or they ride, you know, competitively or they were like downhill guys. So you get these little onesie twosies, but like organizationally, yeah, no, nobody cares.

• 28:35Jack Rhysider?

  And so this is where your service becomes even more important because it's like this is, this is vigilante shit.

• 28:42Speaker 01

  Yeah. I mean, some of it is not. Some of it is super easy. Some of it is just like, hey, this idiot kid bought your bike thinking he could make a profit off of it. We we feel fine telling you go meet up with this kid and just kind of verbally smack him around a little bit and tell him not to be an idiot. Get your bike back. But then we also advise people like, no, we looked this guy up. He murdered someone like you should let this bike go. You should. This is one that you should just take the L on and take your insurance. But like, you do not want to go meet up with this dude and knock on his front door because he killed somebody.

• 29:12Jack Rhysider?

  The way the site works is victims will put the details of their bike in the database, like the color, the description, the serial number, anything you got, photos of it are even good too. And then they'll leave the contact details, email and sometimes phone to text. If you see my bike, let me know. But the system is set up so Brian can see all the emails that get sent through the site. So he can just chime in every now and then and add anything he might know about this.

• 29:34Speaker 01

  So I'm sitting in my basement in 2020. I'm working. I'm riding out COVID. I'm kind of bored. It's a lot of time to kill in the summer of 2020. And this email comes in.

• 29:51Speaker 01

  Hello, my name is Blank. I'm a cyclist from Mexico. I'm truly sorry to inform you that your bike is in Mexico. The bike is being sold with a Facebook page and they link this Constable Mark guy. Here you will find your bike with the Fox Transfer seat post in the recent post. I hope this information helps you. I've sent lots of messages to other reports on this page. This mofo sell only stolen bikes and all are from your area. Hope you can recover.

• 30:15Jack Rhysider?

  The victim had their bike stolen in the Bay Area, which is near San Francisco, California. And his stolen bike was for sale in Mexico on Facebook. And that wasn't the only email. Brian saw five other emails from the same guy messaging different victims, letting them all know their bike was now for sale in Mexico. And this was strange for Brian. He hasn't seen these things go across the border like that before.

• 30:38Speaker 01

  You know, we've seen them go cross border every now and then, but to have five of them, like boom, boom, boom, boom, boom, all from the same place, all from the same area. And the minute we looked at this guy, it was just like it would match, match, match, match, match, match.

• 30:53Jack Rhysider?

  What he means is he looked at the guy's other listings. He had other bikes for sale too. And as Brian searched Bike Index, he found hit after hit. It wasn't just five bikes. There were a lot of stolen bikes for sale on this Facebook page, and they were all stolen from the Bay Area. So one of the people who had their bikes stolen messaged this Facebook seller in Mexico like, "Hey jerk, you have my stolen bike, give it back."

• 31:17Speaker 01

  And the seller did this thing on Facebook where you can region lock your... You can basically say, "I only want to let people in these countries be able to see my page." So this guy was like, "Crap, I've got these Americans pissed off at me." He region locked it to Mexico.

• 31:31Jack Rhysider?

  So for a while, Brian thought the guy shut the listing down because they weren't viewable anymore. But then someone got the idea to use a VPN, connect into Mexico and see if they can still see the listings. And yes, the bikes were still listed for sale. And they saw there were even more bikes listed at this point, and those were stolen from the Bay Area too.

• 31:48Speaker 01

  We were just getting our heads around like, what is this? Like, is this guy the... Is he actually coming up here and robbing these people? Is he like, like, who is this guy? Like, why does he have so many? Like, and it just kicked off this whole series of dominoes that just the next four years of my life was that's what I did.

• 32:05Jack Rhysider?

  I'm going to pause here for an ad break, but stay with us because this is where Brian locks in and gets serious.

• 32:14Jack Rhysider?

  This episode is sponsored by Black Hills Information Security. Black Hills InfoSec loves sharing their knowledge through free webcasts, blogs, zines, comics, and courses designed for beginners and those more advanced. Through their anti-siphon training, they teach you the cybersecurity skills you need. From SOC analyst tools and methodologies to setting traps and running deception operations. It's hands-on, practical training built for people who want to advance and hone their skills. The world of cybersecurity has changed a lot in the last year, and every day seems to bring new questions about what comes next. And that's why Anti-Siphon Training is hosting a free summit on December 9th, asking, "What in the actual cyber happened in 2026?" Join experienced practitioners as they share practical lessons,

• 32:59Jack Rhysider?

  real-world experiences, and insights into the top security news of 2026. And because you're a Darknet Direct listener, they've got a little something extra waiting for you. At blackhillsinfosac.com/darknet. Go to blackhillsinfosac.com/darknet.

• 33:20Jack Rhysider?

  Brian has tuned into this guy on Facebook selling all these stolen bikes. He wants to know more.

• 33:25Speaker 01

  So we're looking at this guy, and we're looking at his webpage, and it's tons and tons and tons of bikes, but we can also see tons and tons and tons of prior sales.

• 33:33Jack Rhysider?

  Okay, so that's a Facebook marketplace?

• 33:35Speaker 01

  No, it's just a Facebook page. It is not a business page. It's just like you and I would have our own page, but it's the name of this guy's business, which is called Constellmark.

• 33:45Jack Rhysider?

  The page had thousands of posts, most of which were bicycles, and so many of them were coming back as stolen, all from the Bay Area. This was going to be a lot of data to go through.

• 33:56Speaker 01

  There was me, and there were some of the victims, and there were some people in the Bay Area that also work in stolen bikes. So we threw up like a Google Doc, and we started just sort of tracking like, here's his Facebook posts, here's his social media, here's his Instagram. Like, one of the guys was able to sneak into his Instagram by pretending to be somebody else. We now have access to that. And like, just basically getting our heads around like, who is this dude? Where does he operate? What's his name? Like, where's he advertising? Is it all stolen? Like, is it all from the same place? Like, just sort of doing some initial... And we had done a real small dossier where we took like, I think like, his first 50 bikes. And we matched like 12 or 15 of them to the Bay Area.

• 34:39Speaker 01

  And we were like, we're pretty sure the rest of these are also stolen. They're just not in bike index. But can we, we made this zip file and a Google link. We passed it around to a bunch of people in the Bay Area who like shop owners and people that run stolen bike Google groups and other people who kind of chase bad guys. And they were able to pull out more and be like, yeah, this one was from Oakland. Like, yeah, shit, this was like, they were able to get a bunch of matches we didn't know about. So it just, this, it just kept getting more and more like everything this dude has is stolen. And it, and it sort of painted this picture of like, this isn't a one off. This is like hit, hit, hit, hit, hit, hit, hit, hit. And oh, we didn't know about that one, but later on it turned out that was a hit too. Like it just, it just sort of like fleshed out the picture for us of like whoever this

• 35:23Speaker 01

  fucking dude is, he's the Kaiser Soze of stolen bikes. Cause everything he has is stolen from one place. But it is like, it draw a hundred mile radius around San Francisco. It wasn't, it wasn't just Oakland. It wasn't just Marin. It wasn't just San Jose. It was, it was Santa Cruz. It was, it was this very big footprint, which we typically, that's kind of nuts.

• 35:46Jack Rhysider?

  You sold thousands on there?

• 35:47Speaker 01

  I think, yeah, I think it was like 800 something that we clocked. The thing is, is we, we, so we looked from like 2020, 2020 on.

• 35:53Jack Rhysider?

  Yeah.

• 35:53Speaker 01

  Going back, you could see he'd been operating since 2015. But we, we basically had to say like, we can't, we can't care about this stuff. We got to care about the stuff that's current, that we can call victims right now, that we can try to get cops engaged on. We can't, but we can see all this shit. We can see how big of an operation this guy has had for so long, which is alarming.

• 36:14Jack Rhysider?

  As they start to piece this together, they're seeing that this guy sometimes lists a dozen bikes for sale a day in Mexico. And they could tie it back to there being a dozen bikes stolen in the Bay Area. So what's going on here? This guy probably isn't the one going to San Francisco, robbing people there and then taking the bikes all the way to Mexico to sell it to people there. They thought he must be the tail end of some operation. But what operation? Who are the people stealing bikes and where do they go after that? And how did they end up in Mexico? Like, is there some big ass truck driving across the border like every day loaded with stolen bikes? And they want to be careful in their investigation too, so they can have a good chance of catching the right guys. If they simply call up the Mexican police to say, hey, arrest this guy down here,

• 36:57Jack Rhysider?

  it might not stop the thefts happening in the Bay Area, or those thieves might get away. So the plan was to figure out everyone involved and to build an airtight case against them all, to hopefully get the police to take them all down at once.

• 37:08Speaker 01

  So every day I would wake up and I would, we had, we had basically archived as much as we could at that point. So what we were interested in was the new stuff, like, like what's, what's he got that's new? And that was kind of hard to tell because he's, he's, he's a very, he's very good at marketing and he's very, he'll post 10 things a day and sometimes they're repeats and it's sort of like, you see a bike that you've seen for four or five weeks that he's not getting rid of, but then this brand new one pops up and you say, okay, well, that's, that's the one we care about. That's, that's the one we haven't already tried to investigate.

• 37:40Speaker 01

  He would post a bike, we would find it in Bike Index, we would call the owner. We'd, we'd back and forth with them a little bit and say like, tell, tell me about this. Like, was this a robbery? Was there footage? Was it cameras? Was it, was anybody assaulted? Like, was this one of those, Oakland had this series of armed bike jackings where they would literally pull in front of guys on bikes with guns and say, get off the fucking bike, and rob them and take the bike and throw it in the car and leave. So some of these were violent crimes. And, and the reason we're asking is because, you know, if a bike gets stolen off the street, nobody cares. Somebody sticks a gun in your face and takes a bike, you're going to get police assistance. So we, we were trying to sort of cherry pick like, let's find the ones where there's surveillance, let's find the ones where it's high dollar, let's find the one if there was an assault. Let's, let's find the ones that you can actually pick up the phone and get somebody to care about.

• 38:26Speaker 01

  So we, we, we called, and these calls sucked because I, I could see it and I wanted to tell them about it, but I didn't want them to, you know, to do what the first guy had did, which is confront this guy and blow it up again. So I would just tell them, look, I'm with Bike Index, I think I'm looking at a picture of your stolen bike being sold online, but I want to know some more information.

• 38:44Jack Rhysider?

  I'm curious about timing. How long does it take between when a bike gets stolen and when it goes up for sale?

• 38:52Speaker 01

  We would see bikes that were stolen within, you know, like a day or two, getting advertised on this shithead's Facebook page. And, but we would see it in a visual setting that looked like America. And it's hard to explain this, not that there's like apple pie and flags in the background, but like the ground looks a certain way, the buildings look a certain way. And if you look at Mexico, like it's shitty concrete and it just, there's a feel to it.

• 39:17Jack Rhysider?

  Yeah, absolutely. I watch a lot of the geoguessers.

• 39:20Speaker 01

  Yes, yes. We would see a place that just looked like an American setting and we knew that it had only been like a day. So we're like, it's probably still in America. But then two weeks later, he'd be advertising the same bike for sale, but it would be in a very Mexican, it would be in his front lawn and it was like, viva Mexico, you know, like, like very, very obviously clear with people's fucking license plates with the, you know, the crazy different like, so it was like robbery, already appears for sale, but it's in America. Two, three weeks later, it's advertised again, but it's clearly in Mexico. Rinse, cycle, repeat.

• 39:55Jack Rhysider?

  Geoguessing is really fun. I sometimes find myself playing it for hours. Basically, it's a game where you're dropped in a random Google Street View somewhere in the world and you need to look around to try to guess where you are in the world. And I watch other geoguessers and some are insanely good. They seem to know what every mountain and river looks like in the world, but they use a lot of well-known clues, like how power poles look is different from country to country and the soil color and the types of plants and the shapes of the street signs and mile markers look different in every country. These all seem to be dead giveaways to determine where that photo was taken in the world. So while it seems strange to think a photo is American or Mexican, it's actually not. There's a lot of clues that you can use to figure it out. They tried examining the metadata

• 40:40Jack Rhysider?

  of the photos posted to Facebook too. See, when you take a photo, your camera often adds a ton of identifying information in the photo. It'll list the type of camera, the time of day it was taken, and if your camera is GPS enabled, it might include GPS coordinates in the photo's metadata. But all these photos were posted to Facebook and Facebook learned pretty quickly to scrub all the metadata out of photos to avoid stalking. So there was really nothing to look at there. Now, as Brian talked with people who were getting their bikes stolen in the Bay Area, he was telling them, hey, open a police report, but give the police my contact information, so I can show them some evidence that I'm seeing on my side.

• 41:18Speaker 01

  You know, I got a very small handful of phone calls, and it was some sergeant somewhere, some poor schmuck, who had like 800 other burglary cases. And he's like, your victim says you know where this is? And I'm like, yes, it's in La Barca, Jalisco, Mexico. And he would go, ha, ha, ha, ha. And that would be the end of that phone call, you know? And they were like, they weren't dicks, they were cordial about it. But it was like, that's gone, that's out of my league. That's like, you know, we're not Interpol. Like, it's not a huge surprise. Pretty cool service you got there, thanks for calling. And it was that for like, a fucking year.

• 41:51Jack Rhysider?

  But Brian knew it was just a numbers game. If he kept getting victims to report their stolen bikes and attach Brian's name and number, at some point, some cop who might have had their own bike stolen or something like that, would want to get this case solved. So he kept trying to get victims to get cops to call him.

• 42:11Speaker 01

  Eventually, it landed with the right, there's a guy who's pretty key in all this, a San Francisco Police burglary detective guy, who was like, your name came across my desk that you know where all these bikes are going. I have all these burglary cases, like, can you tell me about this a little bit? And that is what kicked off at least a discussion with someone who actually cared, who was like, yeah, I have an interest in knowing, like, because he was also kind of plugged into like, the bad guys in the Bay Area. And he, you know, he had an interest in like, just tell me what you see.

• 42:44Jack Rhysider?

  So he told the police everything he knew at the time. And this time, they were listening and wanted to stay in touch and continue feeding them information. And Brian kept looking for more information about the guy selling bikes in Mexico.

• 42:56Speaker 01

  He, this guy, I refer to this guy as the Osent Panada, because the minute you poke at him, like, literally, everything falls out. Uh, he's a cyclist, so his name is all over the place. One of the cycling places like lists his birthday, so he knows his birthday. Uh, he's very...

• 43:13Speaker 01

  I almost said vain, but he just posts a lot on social media. He would include a lot of interior shots of his place. He would include pictures of his cars, license plates. The way he was selling this bike, these bikes on his, on his Facebook page, or just, he would just like put up his banking numbers. Cause that's how we'd get paid. He's like, oh yeah, I'm at HSBC. Here's my routing number. Here's my phone number. Here's my WhatsApp. It was like, because he was so good at promotion, he just gave us fucking everything. And, and he, he has a construction business. So he's simul, he's like into bikes, but he's running this construction business. So there's OSINT on the construction business, the OSINT on the bike thing. He's, he's putting his phone numbers out there. He's putting his WhatsApps out there. He's, you know, blogging about his sister's store and, and it's just

• 43:58Speaker 01

  very open. If you look at something long enough and hard enough, especially for years and, and you have an interest in picking it apart and finding the little details in the background. So we would see things like,

• 44:10Speaker 01

  he had, he had like somebody bring a truckload of stuff to his, um, his house once and it was bikes. They were advertising it and they took pictures of all the bikes, but they were reflections on the windshield. So you could see the guy who drove the car. We're like, okay, who's this fucking guy? He has a lot of women sort of associated with him. He, he's, you know, he's got a wife and he's got some sisters and he's got some other, they're, they're big families. And we're like, who the hell are all these women? Like, we don't know. We just know first names. And then they went to Disneyland and they all bought shirts that said like, you know, mother, father, uncle, aunt, like, and they stood in this big family picture. And it was like, oh, thank you, you moron. He just gave me your family tree. Now we know that who these women are like, cause they have the same last name, but we don't know if it's because of a marriage or if it's because of familial.

• 44:55Speaker 01

  And then they all got in this big photo together and it was like aunt, uncle, brother, mom, like grandma. And I was like, oh, thank you. So we did a little work on that. At a certain point, we knew, okay, the way the system works, stolen in America, stashed somewhere in America, advertised in Mexico. Somebody sticks them on a truck, then they go to Mexico and eat advertising them there. And so all these pictures we were seeing in the American space, we were scrutinizing like, they would screw up and they would sort of shoot it at such an angle that you kind of see down the street. So we're like, what kind of trees are we seeing? Is this westward facing is this? And they would screw up and they would put pictures of, there's like some industrial crap,

• 45:36Speaker 01

  like paint, paint thinner, um, just, just shit that you would have in like a, like a really industrial type setting. But we were like, okay, what is this brand? Is it in Spanish? Is it, we're like, we're trying to pick apart every little detail.

• 45:48Jack Rhysider?

  So after a year of investigating this guy, they knew everything about him. His name was Ricardo Estrada Zamora. And they seemed to know a lot about what's going on in Mexico, but still very little about what's going on in the US. They could see sort of the edges and the outline of it, but not the details. They thought thieves must be stealing bikes. And then it would end up in some central place in the Bay Area where some photos were taken and the bikes would initially get listed. And then someone would run the truck of bikes down to Ricky in Mexico. And by this point, there are more victims joining the investigation, an army of helpers practically, people putting trackers on bikes and letting them get stolen to see where they'd end up. And people trying to find truckloads of bikes crossing the border, which is actually still a mystery to Brian. How did the bikes get to Mexico and how often were they driven down there?

• 46:33Speaker 01

  That's an unknown to me. I know there's a ton of services that do, so there's like, once you start digging into this, there's like a billion one little, little regional shipping, um, like there's one in Sonora, there's one in Baja, there's one in like, there's all these weird little, little regional shippers. Um, I know from having personally driven through the San Diego border, it's like, you don't even stop. It's a four lane highway that you just blow through and you're supposed to pull into the tax thing, but you don't have to. Uh, cause a lot of Americans go down to Baja, they go to Rosarito, they go to whatever. And like, I've driven that, that border through Tijuana for work and it is literally just a, you're like, do I have to stop at a check? Oh shit, I'm in Mexico. Like you just boom in like, so you see people taking stuff in there.

• 47:15Speaker 01

  Um, so I, that's, that's an unknown to me and I hope that actually comes out in this, this legal process. But, cause I do have some questions, but what, what we surmised was every two to three weeks, a truckload. And a truckload is about 15 to 20 bikes. So at one point, after watching and watching and waiting and watching and not really getting any breaks, we got one stupid break.

• 47:40Speaker 01

  He posted a bike and it was the usual thirty crop of pictures. And then one of those pictures was, and this took me a while to pick apart. When you put, when you organize things on your iPhone and you make folders. And so I have a folder that's like dogs, a folder that's like running, a folder that's like bikes, and you classify the stuff in there. If you look at it in that folder, it puts the name of the folder at the top of the phone. So we saw this weird picture that didn't look like the rest. And it looked like he had accidentally taken a screenshot of the phone, not like the picture itself. And it had a name, a very unique name at the top of that phone, of that picture, which

• 48:23Speaker 01

  meant he had a folder that had that very unique name, which meant there's probably one of his followers that has a name like that. So we looked at his followers. We found a guy with that name. That guy was located in San Jose. He ran a, I think he still runs a, like a, like a transmission shop, like a car shop. And, and the first thing I see when I open up this car shop's Facebook page is this San Jose asshole with a bunch of bikes and the same visual settings that we've been seeing in all these American ads, wondering where the hell it is.

• 49:02Speaker 01

  We see this, and, and it wasn't immediate, but it was, it was, hey, it's an industrial setting. And then we went to like Bing Maps, Google Maps, and we were looking at this like metal shitty corrugated siding. I'm like, that looks like the thing. The color's right, the setting is right, the angles are right. And then he had a bunch of interior shots of his shop. So transmissions are these big, heavy, you know, they're like the size of golden retrievers and they weigh three hundred and eighty pounds and it is big. So he has these big industrial orange racks that are made for, they're very distinct looking. They just, they're not like something you and I would have in our house, because they're big, they're meant to carry these big, heavy, scary things. They're painted this bright fire and, and like orange.

• 49:49Speaker 01

  And similarly, we had seen one other photo fuck up in a crop of one of the bikes that was advertised in America. They shot instead of putting it against a wall and shooting it so it was sort of blank and you couldn't see anything, they put it up against this like completely weird looking orange industrial rack that had this metal thing on it that I did not realize at the time was a transmission. But once you started looking, it was like boom, boom, like same guy, same visual settings, same corrugated walls, same color scheme. He's got all these bikes. We found pictures of him with the Mexican kingpin guy like having lunch in San Jose. Here we are riding at Allen Park. It was just domino, domino, domino, domino, domino. That was his guy.

• 50:35Jack Rhysider?

  This was the US contact that was collecting and staging stolen bikes before loading them up and sending them to Mexico. Finally, the US side of the operation was revealing itself. They even had someone go to the site at 2:00 AM to verify this is the place that all the US photos are coming from.

• 50:50Speaker 01

  This is our guy. This is the guy. This is, this is where they're going. This is where they're being kept. This is where they're being packaged. This is where they're being photographed. We don't know what happens in between the other two, but this is, this is his guy. And 40 minutes later, he had realized what he had done and he removed that one single photo from his listing. So it's just this tiny window of time that if I had not eaten my bagel faster that morning and not logged in at that exact point, not just if my day had panned out any differently, I probably would have missed it. Cause we were in the middle of talking about it. We were, we were excited. We're on Slack, we're talking about like, this is the guy I was trading. And we go back and like, oh yeah, go here. He has this picture and they go back and reload it and they reloaded it and that picture was gone, but I had already screenshot it.

• 51:35Speaker 01

  So it was, it was this very small, very lucky, like, like complete OSINT win, right? Like complete, just human error. Look at it long enough, somebody's going to trip up and he did.

• 51:45Jack Rhysider?

  Well, this new piece of information was absolutely something the California police could work with.

• 51:50Speaker 01

  They executed a search warrant on that guy in San Jose, found everything they were expecting to find. Uh, and according to the indictment, also like 206 grand in a bag. Um, so they found bikes packaged up for sale. They found, I think they listed nine specific bikes or something like that. They, they caught them completely red handed. I was, it was sort of a slam dunk. We think yay, go us, awesome. Like, and that, this is where this story kind of bifurcates. Cause now you have this guy in San Jose who's fucked. The case got kicked up to the FBI, I think because of the cross-border nature of the crime, or maybe because of the money, but it went into federal hands, not, not local SFPD hands.

• 52:33Speaker 01

  So now it becomes a federal case and you can read the indictments and they're bananas. But the second sort of winding path is it does not even touch this guy in Mexico. He just switches his supply to San Diego. He's got another one of those guys somewhere else.

• 52:47Jack Rhysider?

  Oh, what? How is this operation still going on? Ricky Zamora was still getting stolen bikes, but now they're getting sourced from San Diego. Looking back at all the stolen bikes Ricky was selling before, none of them were coming from San Diego before. So whatever is going on here now is a new operation and US police don't have a way to arrest him in Mexico. And for some reason, they can't get him kicked off Facebook either. So the operation still goes on. Now with bikes being stolen from San Diego.

• 53:15Speaker 01

  So we do exactly the same exercise, but we do it in San Diego and we don't get any traction whatsoever. They, they tighten up at that point. They realize blank wall, blank setting, no slip-ups, no OSINT mess-ups. We try for four months to get police there involved and including like sending them Excel sheets of like, here's the $90,000 worth of bikes that we see that he has. Here are the police report numbers for your jurisdiction. Here are the victim names. Can you please subpoena Facebook? Just do your job. And we just, we just never got any traction. It just never happened. And then we saw his focus. This is where I absolutely lost my shit. We start seeing bikes from Bend, Oregon. We start seeing bikes from Salem, Oregon. I start seeing bikes from Portland.

• 54:01Jack Rhysider?

  Brian lives in Portland, Oregon, a very bike-friendly city. And since Brian is so involved with the bike scene, he has a lot of cyclist friends. And now he's seeing some of his friends or people his friends know as becoming victims in this investigation. Is there a new operation somewhere in Portland, in his backyard?

• 54:19Speaker 01

  I start seeing bikes with stickers of bike shops that I have friends at, that I've been to, that I've bought bikes from. There was a victim that lost a titanium Linsky that I talked to her a little bit, and it wound up with this prick in Mexico, and I friended her on Facebook. We have friends in common.

• 54:37Jack Rhysider?

  I have a question about San Francisco still. When these guys got busted there, did that result in fewer bikes getting stolen?

• 54:45Speaker 01

  The way it works is there's all these burglary crews in the Bay Area, and they're typically younger guys that are run by an older captain. Captain's got the car, he handles the money, he does the recon. And they just run around robbing shit. They're not robbing just for bikes, they're robbing for whatever. So they're robbing stores, they're robbing homes, they're robbing businesses, they're robbing commercial, they're robbing... They're just burglars, that's what they do. They're not targeting any specific thing. But they know, okay, so we've done our robbing, we're back in our Alibaba's caves, you know, which is some shitty hotel that they're renting with all their stolen stuff in it. If you get jewelry, it goes to this guy. If you get guns, we fence it with this guy. If you get electronics, we fence it over here. And if you get bikes, you go to this guy. That's the guy that we found.

• 55:30Speaker 01

  So it was multiple different burglary crews, whose job is not go get bikes, it's just go steal whatever the hell you can steal, and we'll put it on the black market. But if they had bikes, this is the guy that they went to. We actually had some fucking hilarious surveillance where like, we actually, one of these guys scales a fence, drops down the other side of the fence, and he stands up and he brushes himself off, and he makes the sign of the cross as a good luck charm, and then he goes in and robs the house, all caught on camera. But we would see, it's fat guy, short guy, little guy, it's 101 different dudes, and it's not the dude that is running this transmission shop. So we, and we had some other means by which we pieced some of this together.

• 56:15Jack Rhysider?

  So the bike thieves had to just find a different place to sell their bikes to, and they can continue their operation. And it sounds like they were just a bunch of random burglars who all knew that if they had bikes, they could just sell it to this guy real quick. Another pipeline of stolen bikes they saw pop up during this time was between Colorado and Juarez, Mexico. Apparently, there were thieves in Colorado who would steal bikes and then ship them to Juarez to sell. But this was a totally different group compared to what Brian was tracking with the San Francisco and San Diego thieves.

• 56:44Speaker 01

  At one point... Ricky Estrada Zamora, kingpin of the La Barca fencing operation, is now listing bikes from guys that I see in Juarez that I know are bad guys that are that are involved in this sort of Colorado pipeline. Meaning, his supply went from Bexar to San Diego to Oregon, all the way back to Colorado through these guys in Juarez. So, so the way this manifested was, I was talking to a guy in Colorado who got robbed. I'm like, yeah, there's these like five dicks down in Juarez that sell a lot of stolen. I'm like, oh, look, he's got it. Here's your bike. Call your guy and this is a bad guy. And he's a, I know that he's a bad guy. And it's this very specific setting that he takes a picture of them in, Moro Centwork. And here's his name.

• 57:29Speaker 01

  We were trying to get Laredo PD to give a shit about him. But like, just, just like, go. Here's your information packet. Like, good, good luck. And I open up Ricky's page and I'm looking at the same photo because he's like doing consignment sales. He's, he's using these guys. So it's like, he's, his reach is, is amazing. Like, I really hand it to the guy. He's, he's got an endless well of supply. So it now, as we sit here, you know, October 17th of 2024, the vast majority of what he's sourcing is Colorado. It's all coming out of Colorado because there's just endless supply there.

• 58:09Jack Rhysider?

  It's frustrating that the biggest seller of stolen US bicycles has been operating since 2015 without getting into any trouble. The FBI indictment only listed the name of the US guy who owned the transmission shop. It didn't list Ricky Zamora's name in it at all. It just says, "An unindicted co-conspirator in Mexico." The Mexican authorities haven't arrested him. He continues to sell stolen bikes on Facebook. After the FBI published their indictment, Wired published an article telling the story as well. And shout out to Christopher Solomon, the reporter for Wired, for doing such a great job on that story.

• 58:47Speaker 01

  And then other outlets, LA Times, NPR's Planet Money, it got a lot of coverage. And at every step of the way, we thought surely, at some point now, someone in Facebook will get it together and just nuke this guy's page. Surely after a federal indictment, this will stick a fork in this guy. No, surely after a Wired article, no. Surely after the LA Times, no. Surely after Planet Money, no. Maybe fucking Dark Knight Diaries will do it. Like, my god, but like...

• 59:16Jack Rhysider?

  He still has his Facebook page going.

• 59:17Speaker 01

  Yeah, he's selling yesterday. He's still listing bikes. He's still making a profit. No one has touched him. He posted, there's this, I can send you a screenshot of it. He posted this big blanket denial that was sort of like, are you familiar with the term DARVO? It's the deny accused, reverse victim offender. He basically said like, "This journalist in Wired gets five dollars every time someone reads the article. He's made millions of dollars. It's completely fucking unhinged. It makes no sense." But it's basically like, he denies everything. He says it's bullshit, but he provides no proof. And all these people that were showing up in his comments saying, "Well, what about this bike?" And it was stolen. He just deletes them. He just whitewashes the whole thing. So, you know, we, like, I get it. I can't buy a cruise missile and take this dude out. I can't, I'm not Rambo. I'm not gonna go down there.

• 1:00:02Speaker 01

  He's gonna do what he's gonna do. I just, we just wanted him to stop, right? We wanted him to not have a platform that actively turns a blind eye to this guy being the most colossal fencing dick of all time, making millions of dollars. And we know that because we clocked it. We just thought, you know, and we had many conversations. We tried the stupid Facebook reporting, which does nothing. Because a lot of the bike index people are in the Bay Area, they work, they know a lot of Meta people. They ride with them. We had personal contacts, personal friends. Our shtick has always been, we can find a cyclist that we can talk to in this organization. We're simpatico. You, me, you, me, same, same. We're all friends. That's how we get shit done.

• 1:00:44Speaker 01

  And every single person that we talked at, either officially or unofficially, was just like, we are completely incapable of doing anything about this. There is no mechanism in play. Or they would say something like, I put it up the chain internally, thanks. And it was, it was not only Meta, it was companies that have been picked up by Meta that are now part of the Meta fold. It was, I had an engineer, I, I sort of ranted about this in one of my talks, who was basically, you know, I had this long back and forth with this guy. Here's my proof, here's my Excel sheets, download a zip file, here's a fucking indictment, like, like, proof, proof, proof, proof, proof, proof, can you please just kick this guy off your platform? And he said, no. And I said, why? And he's like, I'm like, what, is the bar really that high?

• 1:01:27Speaker 01

  He's like, yes. And I'm like, then I don't understand. Does he have to shoot someone in the face? Like, what, what's it gonna take? And we sort of got, you know, we were cordial, but we were like, sort of talking about the problem. And, and it was like, he's like, you know, we have all this AI-generated crap, we have these cell phone, we have people, like, like, there's just so much fraud, there's just so much badness, like, we're really hoping to tackle this with artificial intelligence. And I was like, fuck you, buddy. Like, we're giving you actual priceless intel, like, intelligence that is backed by proof, that is backed by indictments, that is backed by screenshots, that is backed by, like, I could put you on a conference call with 150 victims right now. I'm giving you actual intelligence, just do your job. And he's like, well, we're really hoping to tackle this with AI. And it's,

• 1:02:11Speaker 01

  it's, it's an insult, you know, it's just, it's just a complete joke. Nobody's driving that bus.

• 1:02:15Jack Rhysider?

  Hasn't Google, because Google has all these bikes on campus, and Facebook has all these guys, and you could just borrow them and, and use them and leave them. Um, haven't, why don't these guys just get wiped out, like, every day that they do?

• 1:02:26Speaker 01

  They do. We've actually talked to some of those corporate, uh, systems, that there's, they're run through, I'm not gonna go down this rabbit hole, but, uh, other companies that have the same thing in play, they do, they get half their fleet stolen.

• 1:02:38Jack Rhysider?

  So you'd think, oh, hey, you know all those bikes that just got stolen from your campus?

• 1:02:42Speaker 01

  Yeah.

• 1:02:43Jack Rhysider?

  This is the guy on your page that's reselling them?

• 1:02:47Speaker 01

  They would care.

• 1:02:48Jack Rhysider?

  At least, yeah, I, I know.

• 1:02:49Speaker 01

  You know, like, I, I say this a lot, like, on the list of bad things that we could be sitting here talking about Facebook, ranging from psychological manipulation, illegal data, you know, voter manipulation, child sexual abuse, drug dealing, that like, bikes is pretty low on that, on that totem pole, right? Like, like, I, and I get that.

• 1:03:14Jack Rhysider?

  Bike Index has recovered over $27 million worth of bicycles, which means they recovered around 15,000 stolen bicycles. And it continues to serve as a wonderful tool to help people when no one else seems to want to help. And personally, I think it's a great place to practice OSINT skills. I went on OfferUp in my area and saw which bikes were for sale, and I tried to go on BikeIndex.org to see if any of them matched. Cereals often aren't listed in the listing, but as your eyes adjust to the place, you start to notice things. Listings with sketchy-looking photos, descriptions lacking specifics, or if the description says "missing battery" or "missing key", it's kind of a clue. And you take the description of the bike and see if you can find a similar bike on Bike Index. I spent an hour doing this, and I found a bike that I thought was a match.

• 1:04:00Jack Rhysider?

  It was the same color, same model, same year. And the seller said they bought it at an auction and don't know anything about the bike. So I emailed the victim, but they wrote back and said, "Nah, that one's not exactly mine." He had some way of identifying it, I guess. But there is something exciting about this process of bike hunting. The reward is you could help someone find their stolen bike, which is a great feeling. And all the info is out there. It's just up to someone to go find it. And it helps your community if you stop a bike thief in your area. And you could take this to another level, too, and start looking at other listings that user might have and try to pinpoint exactly where they are or who they are and see if they're selling a ton of stolen stuff. You might find a bunch of other stolen bikes and learn about that person's identity. Facebook stalking a bike thief is a wild ride.

• 1:04:43Jack Rhysider?

  If you want to get into OSINT and like a challenge, this is a fertile space. Try to search Facebook Marketplace, Craigslist, or OfferUp for bikes for sale and then cross-reference that with Bike Index. And you might help someone recover their own bike. And while this story's about bicycles, it could easily be about stand-up paddleboards or guitars or anything that's high-value, which has a serial number. And I'm not sure if those sites exist, but if they don't, someone needs to make one. It's still incredible to have this sort of reputation that you've done all this good in the world.

• 1:05:13Speaker 01

  It is a zero billion dollar a year industry. It is not putting food on the table. Karmically, it feels really good.

• 1:05:19Jack Rhysider?

  Yeah.

• 1:05:19Speaker 01

  But it is exhausting and I got super burned out. And at the end of the day, like, you know, this guy's still doing his thing. So did I really change anything? Yes or no?

• 1:05:28Jack Rhysider?

  Oh, and if you're wondering what's a good bike lock to keep your bike safe these days? Brian says it doesn't even matter. If a thief wants it, they'll get it.

• 1:05:35Speaker 01

  They either use a giant pry bar to pop the lock or like down here in Portland, you'll see those blue, there's tubes that they're called staple racks. They're just the racks that go in the ground. They don't even bother with a bike lock. They cut the rack in two.

• 1:05:48Jack Rhysider?

  What?

• 1:05:49Speaker 01

  Because the rack steel is only that thin. So you can basically go to Home Depot and get a tool or a saw that just goes right through the rack. So they don't bother defeating a lock. They don't defile it. They just cut, they just go down a line of the racks, go move the tube, pull the bike out, throw it in the truck.

• 1:06:08Jack Rhysider?

  So I guess the advice is to really just take your bike with you wherever you go. Like, some apartments have bike rooms where it's in a parking garage somewhere and they tell you, hey, store your bike in there. But even there, that's not safe because at 2:00 AM, thieves could break into the bike room and spend hours unloading bikes and cutting locks. Because sometimes those bike rooms are so far deep in the parking garage or so far away that they can make as much noise as they want and nobody will hear it. So parking your bike inside your home or apartment is the best option. But even there, it's not entirely safe. The current situation sucks. And all I can say is fuck bike thieves.

• 1:06:53Jack Rhysider?

  Thanks to Brian Hatz for sharing this story with us. Bikeindex.org is a nonprofit and ran by volunteers. So if you think it's a good service, maybe donate to them to show your appreciation. This episode was created by me, the Spoke Joker, Jack Lee Sider. Our editor is the Ghost Rider, Tristan Ledger. Mixing by Proximity Sound. Intro music by The Mysterious Breakmaster Cylinder. What do Linux users and cyclists have in common? They both worry about drivers. This is Darknet Diaries.