FedEx account didn't make sense. Over the previous sixteen months, Brill and Holdren estimated, RX Limited had delivered seventy-two million doses of painkillers to Americans. Something about RX Limited smelled illegal, and dangerous. They just weren't sure what it was yet.

The best way to figure it out, they decided, was to start making undercover buys. Brill concocted an identity, “Sarah Johnson,” arranged for a fake Minnesota ID, and bought prepaid credit cards at the nearby Mall of America. Then, on Acmemeds.com and other sites, she signed up as a customer. For an address, she used a mail drop at a FedEx store near the office. Her first order was for thirty tablets of Soma, the muscle relaxant. On the order page, she was taken to a “medical questionnaire” that the site claimed would be reviewed by a doctor. There she was asked to answer yes or no to questions like, “Is your personal healthcare practitioner aware that you are requesting this medication?” and “Have you had a physical exam in the last 12 months?” The questionnaire had a blank space for symptoms. Brill typed in “back spasms” and submitted her order. A customer service representative from the site followed up with an email, reporting that the order had been “queued” for review.

Over the next year, Brill and Holdren made dozens of such or- ders, following the same process each time. The symptoms that “Sarah Johnson” offered ranged from “back pain” to “neck” to a made-up condition they called “stratuski.” She never heard from a doctor. Each time, her order was eventually approved and shipped out, complete with a tracking number and confirmation email. When the delivery arrived, it came labeled with the name of the doctor who had written the prescription and the pharmacy that had filled it. When Brill and Holdren had the drugs tested at DEA labs, the results were always the same: RX Limited had supplied exactly what Sarah Johnson had ordered.

The investigators were getting a full picture of how RX Limited operated. The network's websites took online orders from custom- ers in the United States, who found the sites through spam emails and ordinary online searches for painkillers. Those orders were