cyberattacks-and-hacks

Stephen scheduled the murder for the weekend of March 19, when Amy was going to be in Moline for a dog-training competition. But at the end of the weekend, he wrote to Yura, complaining that he hadn't yet seen any news of Amy's death. Yura explained that the hit man hadn't found the right moment to strike: “He needs to be in a position where he can hit her car to the driver door, lateral collisin [sic] to make sure she dies.” The Besa Mafia administrator seemed to sense that it was important to dogdaygod that Amy be taken out while traveling. “We are not interested in the reason for why the people are killed,” he wrote. “But if she is your wife or some family member, we can do it in your city as well,” he said, adding that his client could leave town on the appointed day. He suggested that Amy could be killed at home and agreed that her house could be burned to the ground—for an additional 10 bitcoin, or $4,100.

“Not my wife,” Stephen replied, “but I was thinking the same thing.” The next day he scraped together the money. When he transferred the bitcoin to Besa Mafia, however, his screen refreshed and he didn't recognize the 34-digit code that popped up. Panicking, he worried that the cryptocurrency he had labored so hard to acquire had now disappeared without a trace. He hastily copied the code and pasted it into a note on his iPhone, then emailed the code to Yura under the subject line “HELP!” Less than a minute later he deleted the note.

Yura wrote back seven hours later, assuring him that the transaction had gone through, but days passed and nothing happened. Over the coming weeks, Stephen's messages to Yura alternated between terse disappointment and increasingly detailed instructions. “I know her husband has a big tractor, so I suspect that he has gas cans in the garage,” he wrote, adding: “I ask that you only get her and not the dad or kid.” Like a friendly, chatroom-ready Satan, Yura responded promptly with messages reinforcing his client's basest instincts. “Yes she is really a bitch and she deserve to die,” he wrote. Ninety minutes later he added, “Please notice 80% of our hitman are gang members who do drug dealing, beatings, occasional murder.” For an additional fee, he said, dogdaygod could arrange for a more practiced killer—an ex-military Chechen sniper—to handle the job.

Stephen had spent at least $12,000 on the hit man idea. Instead of giving up or reexamining the sin he was contemplating, he appeared to become more determined. He logged onto Dream Market, a dark-web marketplace best known for selling drugs, where he could explore other methods of killing. Common sense would suggest varying usernames, but he once again appeared as dogdaygod, as if he had become the character he'd created. He would make back his loss; the payout on Amy's life insurance policy was $700,000.

In April 2016, about two months after Stephen first ordered the hit on his wife, Besa Mafia was hacked and Yura's messages with clients—including dogdaygod—were dumped in an online pastebin. The data dump revealed that users with names like Killerman and kkkcolsia had paid tens of thousands of dollars in bitcoin to have people killed in Australia, Canada, and Turkey, as well as the United States. The hit orders soon reached the FBI, which directed local field offices across the country to make contact with the intended victims named in the Besa Mafia data dump. FBI special agent Asher Silkey, who worked in the bureau's Minneapolis field office, learned that someone going by the name dogdaygod wanted Amy Allwine killed. He was tasked with warning her of the threat on her life.

On a cloudy Tuesday afternoon just after Memorial Day, Silkey enlisted the help of Terry Raymond, an officer with the local police force, and they drove to the Allwines' house. Cottage Grove is a sleepy exurb, but, like police departments around the country, the local cops had been called on to address online threats with increasing frequency. Raymond, a reserved man with angular features accented by a trim beard, had been on the force for 13 years and was the department's designated computer forensics specialist.

When Silkey and Raymond arrived, Stephen Allwine invited them inside. He told the two law enforcement officers that Amy was out, and they stood around in silence while he called her cell. Stephen struck Raymond as socially awkward, but he didn't think much of it. He'd dealt with all sorts in his work.

The officers drove back to the station, and Amy showed up soon after. They met her in the lobby, which featured an oil painting of the department's canine, Blitz, and led her to a sparsely furnished interview room. Because the FBI was handling the investigation, Raymond mostly listened as Silkey explained that someone who knew Amy's travel schedule and her daily routine wanted her dead. Amy was stunned. She was further confused when Silkey mentioned the allegation about Amy sleeping with a dog trainer's husband. She couldn't think of anyone who considered her an enemy. “If you have any activity that you find suspicious, give us a call,” Raymond said as she left.

A few weeks later, the Allwines installed a motion-activated video surveillance system at their home, setting up cameras at different entrances. Stephen, meanwhile, purchased a gun—a Springfield XDS 9 mm. He and Amy decided to keep it under her side of the bed. They went on a date to the shooting range.

On July 31, Amy called Silkey, distraught: Over the past week, she had received two anonymous email threats. Silkey drove over to the Allwines' house, where Stephen printed out the emails and listened while Amy explained to the agents what had happened.

The first message came from an anonymous remailer registered in Austria. It read, in part:

Amy, I still blame you for my life falling apart … I see that you have put up a security system now, and I have been informed by people on the Internet that the police were snooping around my earlier emails. I have been assured that the emails are untraceable and they will not find me, but I cannot attack you directly with them watching.

Here is what is going to happen. Since I cannot get to you, I will come after everything else that you love.

The email went on to list location information for Amy's family members, based on what the sender said was found on Radaris.com, a site that makes contact information and background reports available to subscribers. The writer also dropped details that only someone closely following Amy could know—the location of the gas meter on the Allwines' house, the fact that they had moved their RV to a new parking spot, the color of the shirt that their son had worn two days earlier. “Here is how you can save your family,” the email continued. “Commit suicide.” The writer offered various methods by which she could accomplish that end.

A week later the second anonymous message arrived, chiding her for not taking her own life: “Are you so selfish that you will put your families [sic] lives at risk?”

Amy handed over her computer, hopeful that something on it might help the agents track down her potential killer. Stephen gave the agents a laptop and his Samsung Galaxy cell phone. The FBI imaged the devices, creating a copy of their applications, processes, and files, and returned them a day or two later.

Amy gave Silkey the names of people who taught at her arena, animal owners she had worked with, her best friend. The FBI agent interviewed four of them and pulled credit reports for several contacts. Few people stood to profit from Amy's death, yet dogdaygod had paid out thousands of dollars to kill her, suggesting a personal motive. What's more, her persecutor had taken care to instruct Yura not to kill Amy's husband. Investigating a spouse would seem a logical measure. Silkey interviewed Stephen, in addition to imaging the devices, but it is not clear if he did more. The FBI has declined interview requests, and the Cottage Grove police did not have much insight into the bureau's work. Beyond bringing Raymond into the initial interview and sending him a copy of the threatening emails, the agency did not involve the local police.

Meanwhile, Amy tried to cope with the vicious threats. She enrolled in the police department's Citizen Academy, explaining on her application that she wanted to “learn about the police department, what it does, and how it works.” Sergeant Gwen Martin, who ran the course, didn't know about the threats on Amy's life, nor did Amy tell any of the other participants in the course about her worries as they practiced shooting targets and retrieving fingerprints from a Coke can. Amy asked to be assigned to the K-9 officer for her ride-along, and she was so enthusiastic about exchanging tips on dog obedience and scent training that the officer let her tag along for an extra hour or two. When the program was over, she celebrated with the rest of the group at a small graduation party.

But Amy still felt powerless. The occasional migraines she suffered became more frequent, and she had trouble remembering things. She put on a brave face when she taught class, but inwardly she worried that her aggressor might be among her dog-training crowd.

One summer night she sat outside with her sister, looking up at the stars and wondering who was responsible for the pall that had been cast over her life. Years earlier, when her sister started college, Amy sent her a note every week so she wouldn't get homesick. Now her sister returned the favor. In each note she quoted scripture.

One Saturday afternoon in November, Stephen and Amy set off for church with their son. The road cut through the floodplain east of the Mississippi River, passing yellowing farm fields, yards filled with auto parts, and wooded ravines barren of leaves. The United Church of God rented space from a local Methodist congregation in a redbrick building. There was something appropriately austere about the setting, as if through architectural restraint alone the devil could be kept at bay.

Inside the chapel, the family sat in a pew, joining men in suit jackets, women with modest hemlines, and children with freshly combed hair. Daylight flooded in through a large skylight as pastor Brian Shaw recited the New Testament's admonition against “having eyes full of adultery and that cannot cease from sin.” He spoke of Job, who trained his eyes not to look with lust at women. The cost of not following Job's lead was dear: “When we do not control our sinful natures, they control us.”

On Sunday, Stephen woke up just before 6 am, as usual, and descended to his basement office, where he logged in to the Optanix system to start work. At noon he wandered upstairs to have lunch with Amy and their son. Amy, an avid baker, had part of a pumpkin left over from a dessert she'd made a couple days earlier, and she put it in the slow cooker on the kitchen island to roast. Soon after, she started to get woozy.

Amy's father showed up to work on a dog door he was installing in the garage. Stephen told him that Amy wasn't feeling well and was in the bedroom resting. Her father left without seeing her. Five minutes after he started driving home, Stephen called to ask his father-in-law to turn around and pick up his grandson, explaining that he wanted to take Amy to a clinic.

As dusk fell, Stephen drove to get gas, then retrieved the boy from his in-laws' house and took him to Culver's, a family-style restaurant chain. It was their Sunday night routine—dinner at Culver's while Amy led dog-training courses—and they sat in the brightly lit space eating chicken tenders and grilled cheese.

When they returned home, the boy climbed out of the minivan and ran into the house, toward his parents' bedroom. Amy's body lay in an unnatural position, blood pooled around her head. The Springfield XDS 9 mm was at her side.

Stephen called 911.

“I think my wife shot herself,” he said. “There's blood all over.”

Sergeant Gwen Martin arrived at the house a few minutes after the 911 call. When she saw Amy's body on the floor, she remembered training her in the Citizen Academy and burst into tears. Another sergeant took over, and Martin retreated to her squad car. Regaining her composure, she turned to the laptop mounted to the dash and ran a search on police calls to the residence. She was astonished to find the report that Terry Raymond had filed about the dark-web threats to Amy's life. Martin grabbed her phone and dialed Detective Sergeant Randy McAlister, who directed Cottage Grove investigations.

A baby-faced man of 47 who rode a Harley, McAlister often joined in the frequent joking around the department. He drank coffee from a mug that read “Due to the confidentiality of my job I don't know what I'm doing.” But his chipper demeanor concealed his earnestness. A decade earlier, McAlister had responded to a murder in a nearby town; a couple had been killed in their home by the woman's former boyfriend, as her children cowered nearby. The woman had previously told police that her jealous ex had contacted her in violation of a court order. Frustrated that the system had failed that woman, McAlister started a program aimed at protecting potential victims from stalking and targeted violence. When Raymond mentioned the dark-web threats Amy had received, he suggested they be compared to a database of threats kept by the FBI's Behavioral Analysis Unit; it might help them come up with a profile of a potential perpetrator. But he had no authority in the case.

Now he raced to the Allwines' home. As he entered through the garage, the aroma of roasting pumpkin, still in the slow cooker, hit his nose. This struck him as odd; people don't typically start cooking right before killing themselves. Other things about the scene were off: There were blood smears on both sides of the bedroom door. And while the mud room floor was covered with dog hair, the floor in the adjacent hall was clean.

As McAlister waited for the medical examiner and state criminal investigators to arrive, an officer drove Stephen and his son to the station. As a colleague sat with the boy in the station's break room, Raymond escorted Stephen to the same interview room where he and Silkey had met with Amy five months earlier. Raymond pulled on a pair of latex gloves and swabbed Stephen's cheek for DNA. “Are you going to get that from my in-laws?” Stephen asked.

“No, it should just be you and your son,” Raymond said. He asked Stephen to run through what he had done that day.

Stephen was cooperative, though Raymond thought his demeanor was wooden for a man who had just lost his wife. He reminded the detective that Amy had an FBI file; he said that her computer had been acting strangely. “Being in the IT industry, it's frustrating because I know how things are supposed to work in a legitimate world,” he said, adding: “I don't know anything about hacking or anything like that.”

For the next three days, investigators combed the crime scene. State technicians sprayed a chemical called luminol on the floors, then flicked off the lights. Where the luminol hit blood or cleaning solution, it glowed bright blue. The glow showed that the hallway had been cleaned; it also lit up some footprints leading back and forth from the bedroom to the laundry room.

The Cottage Grove police executed a search warrant on the house. McAlister stationed himself at the dining room table, logging evidence. Raymond descended to Stephen's basement office. Stepping through the door, he saw every surface covered with junk: file folders, tangles of cords, external drives, SD cards, a voice recorder, and a Fitbit. There were hard drives of a type that hadn't been used in nearly a decade. On Stephen's desk were three monitors and a MacBook Pro laptop—not the machine he'd given the FBI.

The officers brought their haul upstairs, then one by one handed the items to McAlister to log.

“Holy crap,” he thought as the equipment amassed. Then, “Jeez, no más.” But the devices and drives kept coming. Sixty-six in all.

Because the crime involved a local death, the Cottage Grove police took control of the investigation. Two and a half weeks after Amy died, the FBI sent over her file. When the police opened the documents, McAlister and Raymond saw—for the first time—the full Besa Mafia messages. That was when they learned that the person who wanted Amy dead went by the name dogdaygod.

By this point, Stephen was a suspect, but there was no direct evidence linking him to the murder. That his DNA was on everything was hardly remarkable; it was his house. Video from the Allwines' security system revealed nothing abnormal, though the records were incomplete. Stephen explained that he and Amy had neglected to activate the camera over the sliding glass door because their dogs were constantly going in and out. McAlister hoped the answers might be inside the devices that Raymond had lugged out of the Allwines' basement.

From the moment the Besa Mafia files appeared in the pastebin, bloggers had concluded that the site was a scam. One after another, Yura's clients complained that the hits they'd ordered hadn't been carried out. But McAlister didn't want to take anything for granted. He and Detective Jared Landkamer identified 10 other targets of Besa Mafia orders in the United States and contacted the police departments where they lived. They might get leads in their case or perhaps save other lives.

McAlister divvied up the electronic work. He sent the computers to a digital forensics specialist at a neighboring police department. Landkamer subpoenaed the Allwines' emails—and then spent many long days reading them. Raymond started by extracting data from Stephen's phones. In a windowless room lined with department-issue monitors, he deployed software that sorted the data—apps here, call logs there—and reconstructed timelines for the devices. On the phone Stephen had given to the FBI to image, Raymond found the apps Orfox and Orbot, which are used to access Tor. He also found text messages containing confirmation codes from LocalBitcoins. The FBI seemed to have either missed them or paid them little mind.

When he scanned Amy's phone, he could see that, on the day of her death, she seemed to be growing progressively more confused. At 1:48 pm she visited the Wikipedia page for vertigo. At 1:49, she typed “DUY” into Bing. Then, one minute later, “EYE.” Then “DIY VWHH.” It was as if she were desperate to understand why the room was spinning but couldn't execute a simple search.

In an interview with a state investigator, Stephen had confessed to his affair with Woodard. Raymond found a contact for “Michelle” in Stephen's phone, and when investigators questioned Woodard, she told them about the birthday lunch, when Stephen messaged that he had locked his keys in the car while buying bitcoin. Stephen's call history confirmed that he had phoned for roadside assistance that day from a Wendy's in Minneapolis. The detectives used the text message confirmation codes on Stephen's phone to find his LocalBitcoins account. That led them to his correspondence with a seller about exchanging $6,000 in cash.

In Stephen's devices, Landkamer found secondary email addresses that led to usernames he used to access Backpage and LonelyMILFS.com. That wasn't incriminating on its own, but it did suggest a motive.

While Stephen had cloaked most of his criminal activity, he did not purge his more innocuous internet search history. On February 16, a few minutes before dogdaygod first proposed killing Amy in Moline, Stephen had Googled “moline il” on his MacBook Pro. One day later, he looked up their life insurance policy. In July, shortly before Amy received the first threatening email that included addresses gleaned from Radaris, he visited the Radaris pages for Amy's family members.

Murder was rare in Cottage Grove, and the detectives, confronted with circumstantial evidence and the slipperiness of the dark web, obsessed over the case. Lying in bed one night after reading Amy's FBI file, Landkamer searched “dogdaygod” in Google. When he saw the results, he called out to his wife. The search engine had indexed some posts on Dream Market, the dark-web marketplace where drugs were sold.

Landkamer immediately texted McAlister what he'd found. McAlister fired up Tor on his personal laptop and pulled up the full threads on Dream Market. In one thread, dogdaygod asked if anyone sold scopolamine, a powerful prescription drug. McAlister had worked as a paramedic, so he knew that scopolamine was prescribed for motion sickness, but it could also make people pliable and amnesiac, earning it the nickname Devil's Breath. As he scrolled down, he came to a comment from a user who assumed that dogdaygod wanted to use scopolamine recreationally. “There is a seller,” the person wrote, “but avoid that shit mate. It's dangerous as fuck and you WILL kill someone.”

Later, Amy's gastric contents tested positive for scopolamine. But it was a quirk in Apple backups that provided the strongest piece of evidence. The digital forensics specialist from a neighboring department found, archived in Stephen's MacBook Pro, that a note with a bitcoin wallet address had appeared on Stephen's iPhone back in March 2016. This was 23 seconds before dogdaygod frantically wrote Yura with the same 34-digit bitcoin wallet code. Forty seconds after dogdaygod messaged Yura, the note was deleted from Stephen's phone. But deleted files don't disappear until they're overwritten by other files. Several months later, when Stephen backed up his phone to iTunes, the crucial history was preserved on his laptop.

McAlister was elated. The detectives had linked Stephen's offline persona, a church elder concerned with the propriety of dance moves, with his online ones—the philanderer and the aggrieved would-be murderer. The enticing anonymity of the dark web that nurtured Stephen's crime had given him a sense of omnipotence. He failed to appreciate that this cloak of power didn't follow him to the clear web and to the real world.

Stephen Allwine's trial lasted for eight days. County prosecutors paraded a string of colorful witnesses to the stand: the manager of the pawn shop where Stephen sold his silver, the Backpage escort in Iowa, and Woodard. McAlister held up the murder weapon in court, and in one awkward moment that would become the subject of endless jokes at the Cottage Grove police station, Jared Landkamer defined “MILF” for the court.

Prosecutors Fred Fink and Jamie Kreuser used the testimony to outline a theory: Stephen had poisoned Amy with a large dose of scopolamine, either to kill or incapacitate her. Either way, while she grew dazed and light-headed, she didn't die. So Stephen shot her with their gun in the hallway. Then he moved the body into the bedroom and cleaned up the blood. When he left to get gas and take his son to Culver's, he was careful to save the receipts.

The jury deliberated for six hours before finding Stephen guilty. On February 2, he appeared in a packed courtroom for sentencing. One by one, friends and family told the judge how much Amy had meant to them. (Amy's family declined to be interviewed.) Then Stephen rose to plead his case.

Breathlessly, he tried to refute the technical testimony about backup files and bitcoin wallets. Then he shifted to his spiritual gifts. In jail, where he had been held during the trial, he was ministering to drug addicts and child molesters. He had converted at least three nonbelievers, he said.

“Mr. Allwine,” the judge said when he had finished, “my perceptions aren't going to alter the sentence in this case. But my perception is that you're an incredible actor. That you can turn tears on and off. That you are a hypocrite and that you are cold.” He sentenced him to life without parole. (The case is headed to appeals court.) From a room adjacent to the courtroom, McAlister watched through a window with Raymond and Landkamer, taking satisfaction as the judge admonished the criminal. But the moment was not without uneasiness. McAlister saw why Stephen might not have triggered alarm bells during the FBI's dark-web investigation: Stephen and Amy appeared to have a happy relationship, with no history of violence or substance abuse. He knew that hindsight bias could color investigators' conclusions, but he also had the feeling that Amy's death might have been prevented. Threat assessment experts use a four-part checklist to determine whether an anonymous harasser is an intimate partner. Amy's harasser met all four conditions in that test: The person closely tracked her whereabouts, seemed to live nearby, knew her habits and future plans, and spoke of her with contempt or disgust.

In the months following the trial, McAlister was promoted to captain. From time to time, he offers advice to police departments dealing with dark-web crime. There were no other deaths tied back to Besa Mafia customers, but Yura reportedly started other hit-man-for-hire scam sites—Crime Bay, Sicilian Hitmen, Cosa Nostra. It was almost like Yura was the devil watching from a distance, smirking as the seeds he planted germinated and grew into full-blown evil.

All photographs by Alec Soth/Magnum Photos

Mara Hvistendahl (@marahvistendahl) is writing a book for Riverhead on a trade-secrets theft case. She wrote about China's social credit system in issue 26.01.

This article appears in the May issue. Subscribe now.

Let us know what you think about this article. Submit a letter to the editor at mail@wired.com.