Alleged drug trafficker John McKernan is the subject of today’s satirical OpSec review. A witness says that John is a self-described autist who “rides his bike here to the store.” According to video evidence he dressed for the part. The story begins (if you’re going to accept the FBI as the sole perspective character for this particular tale) when a darknet vendor called KingofKeys caught the attention of our friends at the FBI. After buying drugs from KingofKeys twice, investigators noticed a funny coincidence: the flat-rate envelopes used in both cases were purchased from the same place! Let’s see where that leads…

Alleged offense

Distributing a mixture and substance containing fentanyl

Overview

Both of the pre-paid envelopes led back to a printing and shipping solutions provider for retail customers called PostNet. It appears that an employee at this specific PostNet branch says he knew who sent the two packages in question. In an email sent to law enforcement, the employee said the following:

Now I think going into the local PostNet in the first place was a mistake. But let’s say for a moment that it’s unavoidable for whatever reason. When you go into said PostNet you should do your best to be as normal and forgettable as possible. From the description it sounds like Johnny was a memorable character. He gave the store unnecessary personal information like that he’s autistic. This is a great way to help someone remember you when the police come asking about unusual customers. Don’t be an unfriendly asshole to the normies you deal with, but don’t give them nickname ammo either. On top of that it sounds like the store didn’t verify the name and emails of the people using their services, but Johnny gave them the real details anyway.

The complaint mentions that one of the seized packages contained materials with fingerprints that matched McKernan. It doesn’t mention how the police already had his prints at this point.

I’m not a lawyer, but McKernan sounds pretty screwed by this point. It may be hard to explain his prints being on the package (it may not be hard for all I know!) Either way investigators weren’t done. They conducted an undcover purchase from Johnny so that they could spy on him afterwards. On June 15 an FBI officer contacted Johnny’s alleged Signal account asking for the status of the order. At 2:45 PM EDT the account responded “I’m heading there right now it goes out in 45 mins.”

At 3:07 PM EDT the witness from PostNet sent investigators two pictures, one of Johnny as he was dropping a package off, and one of the package he had come to the store with.

At 3:12 PM EDT the Signal account allegedly belonging to McKernan sent a picture of a shipping label to the FBI, which appears to be the same label that the witness had sent.

On June 21st a packaged arrived at the address provided by law enforcement. It contained 85 pills that tested positive for fentanyl. The FBI then conducted two more undercover buys, building up more evidence before finally filing a criminal complaint and arrest warrant on September 6, 2022. From current court filings it appears that a plea deal is being worked out.

tl;dr

The GOOD: If I’m trying to be nice, Mr. McKernan had a few good half-measures. Getting his prepaid USPS materials from a 3rd party was a step in the right direction, he just didn’t go far enough with it.

The BAD: His real name and email were associated with his shipping labels. There was a layer of abstraction thanks to using PostNet, but as this case shows, it’s a thin layer and best and will not protect you against persistant LE.

The UGLY: If, for whatever reason, you have to interact with someone who may later be a witness, DO NOT stand out. Dress like a schmuck, be boring and comment about something innocuous like the weather. Don’t be someone super memorable like the autistic guy who rides his bike to the store.