As far as I remember, McAfee shared an iPhone photo with location metadata when he was in Belize, so American authorities were able to track him down.

The Silk Road founder had some sort of PHP coding error which led police to his San Francisco location. That is, you could simply visit the Silk Road home page and his location leaked.

So yeah criminals aren't better at SecOps. They're just more reckless than most people...