As careful as some of the things he suggests are...if you're truly wanted by a state-level actor or sufficiently motivated attacker, you won't be able to hide by simply using VPN and Tor. Especially if you're running something with many transactions like AlphaBay. You would need to obfuscate quite a bit more:
- if you're using VPN traffic but most people "around" you aren't, you're a suspicious node; your ISP could easily flag you to your government. If you use wifi at a common point you're likely to be flagged and there isn't an easy way other than keeping on the move. But moving often is another anomalous event, and it's very difficult to do even for Drug Lords ( El Chapo ) or Terrorists that it behooves to do. This puts you in a sort of Zugzwang, to borrow a chess term.
- there's always leakage, for instance, in the way you talk with people in the real world. At some point you send enough communication for sophisticated frequency analysis.
- and there are other patterns of usage that could be used to identify you, like searches or even keyboard frequency on anonymized accounts can be de-anonymized by very specific markers ( ML works! ).
- off ramps for crypto aren't very good. If you're in e.g. Brazil, haha, yeah, good luck spending bitcoin or any other crypto and going unnoticed. Mixers and tumblers will eventually leak and you'll be caught.
- you're very vulnerable to social engineering by people you do business with. one slip where you stop communicating in a transactional mode of communication and that's a weak link in your armor.
In the end, the FBI only has to be right once, and you have to be right every time.