As they rushed toward a suburban Utah home with guns drawn, agents knew they were on to a significant figure in the Silk Road online drug bazaar — a major cocaine dealer, perhaps.
Message boards on Silk Road — the world's most popular online drug market — had been buzzing about the sale that triggered this bust. Users of the encrypted website advertised drugs, forged documents and hacking tools for sale through seemingly anonymous transactions, but a kilo of pure Peruvian cocaine was something special.
Federal authorities in Baltimore had been working for a year to breach the inner circle of Silk Road's kingpin, whom they knew only by the alias Dread Pirate Roberts. They figured that whoever agreed to accept the drugs would get them closer, but never imagined the breakthrough they were about to make.
The man hauled from his home that winter morning was Curtis Clark Green, a senior administrator with wide access to Silk Road's inner workings. Federal officials say his capture helped lead agents to Ross William Ulbricht — the man now accused of running the site — but also brought about a violent twist in what had been a straightforward drug case.
Operation Marco Polo, named after the medieval traveler who followed the Silk Road to China, ended last month in a major takedown, triggering arrests on three continents and the seizure of tens of millions of dollars in assets. Agents crept in to nab Ulbricht in a San Francisco public library, began draining online accounts connected to the site and slapped a notice over the Silk Road login screen.
"This hidden site has been seized," read the notice with images of shining special agent's badges below.
Ulbricht is due Thursday in federal court in Manhattan, where he is asking to be released while the case is pending. Ulbricht's lawyer has announced plans to contest charges that his client was Dread Pirate Roberts.
The collapse of Silk Road traces back to 2011, when it caught the attention of Homeland Security Investigations. With buyers and sellers around the globe, Silk Road seemed the perfect target for the large but little-known arm of federal law enforcement with an office in Baltimore's imposing customs house.
Court documents and interviews with authorities involved in the case describe how the inquiry grew from a Harford County drug bust into a nationwide operation that drew in the FBI and the Drug Enforcement Administration.
John Eisert, a senior HSI official in Baltimore, said the plan was to make moves that would "shake the trees," dislodge new details and lead agents closer to Dread Pirate Roberts.
FBI officials in New York later started working to break through the wall of encryption that protected Silk Road and many of its users from public exposure. But the agents in Maryland were tasked with developing informants, setting up drug busts and cutting deals with people in handcuffs.
The investigation started with a tip from one of HSI's informants. At that point the site was less than a year old, but already on course to develop into a hub for illicit online deals.
Silk Road ran on the Tor network, a system designed to hide the site's location and mask the identity of its users. Deals were done in Bitcoin, a digital currency not backed by any bank or government and difficult for law enforcement to trace.
Among the first breaks for HSI was the January 2012 arrest of Jacob Theodore George IV. The Edgewood man had been using Silk Road to sell heroin and imported Chinese methylone — a synthetic drug similar to ecstasy — under the alias "digitalink."
His arrest would be kept secret for two years until his guilty plea this month.
"Now we were on the inside," said an agent who requested anonymity to discuss an ongoing case. "It paved the way to go after other vendors."
At that point, the HSI grasped the full scope of Silk Road.
"As each day went on we realized how big this really is," Eisert said. "It was the most visited website in Tor and you don't fully grasp that the first time you sign on."
HSI began working with the Drug Enforcement Administration, which in the spring of 2012 launched an undercover operation to wheedle its way into Dread Pirate Roberts' inner circle.
Using the alias "nob," an undercover agent started chatting with Dread Pirate Roberts from the 21st floor of a downtown Baltimore skyscraper. The agent was working to gain the leader's trust while probing for details that might help uncover his true identity.
"A rapport was established very early on," said Gary Tuggle, the head of Baltimore's DEA office. "He obviously ... had a level of confidence in us and we were able to exploit that."
The operation rumbled on throughout the summer, leading to more arrests, authorities said. Not all of those charges have been made public.
Then, in December of 2012, the undercover agent made a big step. He began griping to Dread Pirate Roberts about the small-fry nature of most deals on Silk Road.
"It really isn't worth it for me to do below ten kilos," the agent wrote, according to a charging document against Ulbricht. Typical listings on the site advertised cocaine and heroin by the gram.
Dread Pirate Roberts offered to help find a buyer and set Green to work canvassing the top dealers on Silk Road, according to court documents in Green's case.
Green, a heavyset 47-year-old man who walks with a cane and used the nickname chronicpain, earned his salary resolving disputes between buyers and sellers. He was also supposed to be sniffing around for potential law enforcement plots.
"Hey, I think we have a buyer for you," Dread Pirate Roberts wrote to the agent a day later. "One of my staff is sending the details."
Over the course of the next month the buyer negotiated terms, eventually agreeing to sell a kilogram of cocaine for $27,000 worth of Bitcoins, according to Green's plea agreement.
But unknown to Dread Pirate Roberts or the undercover agent, Green had gone beyond what his boss requested of him. Green agreed to work as a middleman — and his address was sent to the agent.
On Jan. 17, 2013, an undercover postal inspector delivered the brick to Green's home. It was quiet — though a neighbor recalled an unmarked white van that stood out in the neighborhood — until armed men stormed toward Green's single-story house.
Green was booked at the local jail and released, and agents began examining his computers. Green had access to other Silk Road users' messages and financial accounts — including Dread Pirate Roberts' — according to documents supporting his guilty plea.
Word of Green's arrest got back to Dread Pirate Roberts the next week. He understood that a key member of his empire was in the hands of law enforcement. It's not clear whether Green was actively cooperating — that information is sealed in court records — but Dread Pirate Roberts reached his own conclusion.
"I have to assume he will sing," he wrote later to the undercover agent, according to court documents in Ulbricht's case. The bad cocaine deal didn't disrupt their rapport.
Dread Pirate Roberts asked for help, claiming that Green had also stolen from Silk Road users before his arrest.
"I'd like him beat up, then forced to send the bitcoins he stole back," Dread Pirate Roberts wrote, according to court documents.
Then, the next day, he added: "Can you change the order to execute rather than torture?"
The request caught the agents on the case by surprise, but they agreed on a fee of $80,000 for the job.
"I don't think that we had any sort of premise early on that this guy was involved in that level of violence," Tuggle said.
By this time, Green was working with authorities to stage the plot, according to a statement Green released to reporters.
"The agents took photos as they faked my murder," Green said.
Authorities took their case to a grand jury in Baltimore and obtained a sealed indictment May 1 charging Dread Pirate Roberts with drug offenses, attempted witness murder and murder for hire. The agents had charges, but they still did not know who Dread Pirate Roberts really was.
By that point, the Maryland agents were working with the New York FBI office. The two teams began to try to figure out what they each had.
"Everyone had that little piece of the puzzle, then it was time to sit at the table and put it together," Eisert said, a process carried out in a series of conferences and phone calls.
They also continued to ratchet up pressure on Silk Road.
In May and July, authorities in Maryland announced that they had seized the assets of a company called Mt. Gox, the largest exchanger of Bitcoins, alleging that it had violated currency trading rules.
Bitcoin exchanges are a critical link between the online wealth being accumulated by Silk Road users and the real world, and the seizure was also part of a bid to smoke out Dread Pirate Roberts. Those cases are still open; Mt. Gox did not respond to a request for comment and has responded in court.
Tuggle said Dread Pirate Roberts began looking for ways to "insulate himself," and soon moved to obtain fake identity documents so he could rent servers under assumed names, according to court documents in Ulbricht case.
In July, Customs and Border Patrol intercepted documents on the way to his San Francisco home at the Canadian border, according to the charging papers.
At the end of the month, HSI agents turned up at the address and finally, they were face to face with the man they believed to be Dread Pirate Roberts.
At around the same time, the FBI made another major step forward, obtaining a complete image of a Silk Road server hosted in another country. Authorities said that image gave them a look at all messages and transactions on the site.
How the FBI tracked down the server, which should have been masked in the Tor system, and exactly how critical it was to unmasking Ulbricht are still unexplained. The FBI New York office declined to answer questions for this article.
"There are a number of theories flying around, some even include the use of [National Security Agency] exploit tools to hack into Silk Road," said Runa A. Sandvik, a researcher at the Tor Project. "I am hoping we learn more during Ulbricht's trial."
Authorities also found a LinkedIn page for Ulbricht. They wrote in the charges against him that it showed clues to his hidden life, including that he was "creating an economic simulation" believed to be Silk Road.
Ulbricht was arrested in October. Silk Road was seized and shut down, and charges were announced against a number of other users of the site.
Among them was Green, who pleaded guilty to a drug charge in Baltimore this month.
twitter.com/iduncan