She posted a service listing on a platform. The listing contained her contact routing, her service category, her availability window, and a reply mechanism that connected a stranger directly to her inbox. The platform required her to provide all of it. The platform required nothing from the person responding.
Julissa Brisman was 25 and ran an independent massage therapy practice. She advertised through Craigslist, which by 2009 had become one of the primary marketplaces for independent service providers operating outside traditional employment structures. She was not making an unusual or negligent operational choice. Millions of independent operators used the same infrastructure. The platform was the storefront. Her listing was the business address.
Philip Markoff was a second-year medical student at Boston University when he began contacting service providers through Craigslist. He had no prior criminal record. He appeared in the platform's interface as any other user would, an anonymous party submitting a contact request. The platform's architecture required nothing from him before routing his inquiry to the operators he targeted. No identity verification. No credential confirmation. No screening mechanism of any kind.
When Markoff contacted Brisman through the platform, the system functioned exactly as designed. He submitted a service request. She received it. A meeting was arranged.
He went to the Marriott Copley Place in Boston. He entered her room. He shot her three times and left her dead on the floor.
He had robbed two other women he found through Craigslist in the weeks before the murder. Both attacks followed the same operational sequence. He used the platform to locate independent service providers, arranged contact through the listing mechanism, and arrived in person. The platform's contact architecture was the consistent variable across all three incidents.
What the platform collected, and what it did not use, is the infrastructure problem.
Craigslist retained contact routing data for both parties in every transaction. Markoff's routing information was in the platform's system from the moment he initiated contact with his first victim. Investigators recovered his connection through the email relay infrastructure the platform maintained for contact routing purposes, the same data architecture that could have served as an identity gate before access was established.
The verification data existed. It was never applied as a condition of access.
Brisman had no mechanism within the platform to assess who was responding to her listing. The platform's design treated the contact event as a matching function. Routing an anonymous inquiry to a small business owner providing professional services was the product. What happened after the connection was made was outside the platform's operational scope by design.
Independent service providers use platform infrastructure because it provides market reach a small business owner cannot generate without institutional backing. A solo practitioner advertising professional services through a classified marketplace is using the infrastructure available. The platform is the channel. The listing is the operational exposure point.
What the small business owner cannot evaluate from inside the listing interface is what the platform applies, or does not apply, as a condition of contact access on the other side.
The standard contact architecture for platforms of this type routes a submission from any registered or unregistered user to the service provider's inbox with no identity anchor required and no pre-access screening. The provider receives the inquiry. The inquiring party's identity is whatever they chose to present in their account or in the message itself.
This is the operational model Brisman worked within. She was not careless. She was using a platform that had designed contact access as frictionless, because friction reduces transaction volume and transaction volume is the business model.
The platform retained anonymous contact data, routing records, and session information that were useful for criminal investigation after the fact. They were not applied as protective filters before the contact event occurred. A small business owner advertising services through that infrastructure had no technical path to require identity confirmation from a contact before agreeing to meet.
The platform could have required verification before routing contact requests. It did not, because its product architecture prioritized ease of access for the person initiating contact.
That calculation is not unique to Craigslist and it did not end with the public pressure that eventually caused the platform to shut down its services section. The underlying design logic, frictionless contact routing as a feature that drives usage volume, remains the dominant architecture for independent operator platforms, service marketplaces, and classified networks. The matching function is the product. Pre-access verification creates friction. The operator absorbs the exposure.
Markoff was identified through the routing data his contacts generated in the platform's system. He was arrested, indicted, and died in custody before trial. The criminal process resolved the specific case. It did not address the infrastructure condition that made the attack sequence possible.
Every small business owner who uses platform infrastructure to generate client contact operates inside an access architecture they did not design and cannot modify. Most platforms do not distinguish between a verified account holder and an anonymous session when routing an inquiry to a service provider. The operator's listing is the exposure. The contact mechanism is the open gate.
The platform collects behavioral data, session records, contact routing history, and transaction patterns from every interaction. It retains that data according to its own retention schedule. What it does not do, by default, is apply that data as a protective filter between an anonymous party and the small business owner who just received a contact request.
Brisman's exposure was structural. She published a listing. The listing functioned as designed. Someone used it to locate her and arrange access to her physical location. The data that eventually identified her killer was sitting in the platform's systems before he arrived at that hotel.
Source: Boston Globe, New York Times, court records from Commonwealth v. Markoff, Suffolk Superior Court.
This isn't a hypothetical. This is an active, ongoing threat at your front door, and every small business owner is a target. The RuleDraft Small Business Isolation Manual gives you the precise operational blueprint to sever the link.