As responses from exchanges with those users identity information began to pour in, the team started the process of assembling more complete profiles of their targets. They began to collect the names, faces, and photos of hundreds of menthey were almost all menfrom all walks of life, everywhere in the world. Their descriptions crossed boundaries of race, age, class, and nationality. All these individuals seemed to have in common was their gender and their financial connection to a worldwide, hidden haven of child abuse.
By this time, the team felt theyd pinned down the sites Korean administrator with confidence. Theyd gotten a search warrant for Son Jong-woos Gmail accounts and many of his exchange records, and they could see that he alone seemed to be receiving the cashed-out proceeds from the sitenot his father, who increasingly seemed to the investigators like an unwitting participant, a man whose son had hijacked his identity to create crypto-currency accounts. In Son Jong-woos emails, they found photos of the younger man for the first timeselfies hed taken to show friends where hed chipped a tooth in a car accident, for instance. He was a thin, unremarkable-looking young Korean man with wide-set eyes and a Beatles-esque mop-top of black hair.
But as their portrait of this administrator took shape, so too did the profiles of the hundreds of other men who had used the site.* A few immediately stuck out to the investigative team: One suspect, to the dismay of Thomas Tamsi and his Homeland Security colleagues, was an HSI agent in Texas. Another, they saw with a different sort of dread, was the assistant principal of a high school in Georgia. The school administrator had posted videos of himself on social media singing duets, karaoke-style, with teenage girls from his school. The videos might otherwise have been seen as innocent. But given what they knew about the mans Bitcoin payments, agents who had more experience with child exploitation warned Janczewski that they might reflect a form of grooming.
These were men in privileged positions of power, with potential access to victims. The investigators could immediately see that, as they suspected, they would need to arrest some of Welcome to Videos users as quickly as possible, even before they could arrange the takedown of the site. Child exploitation experts had cautioned them that some offenders had systems in place to warn others if law enforcement had arrested or compromised themcode words or dead mans switches that sent out alerts if they were absent from their computer for a certain period of time. Still, the Welcome to Video investigation team felt they had little choice but to move quickly and take that risk.
Another suspect, around the same time, came onto their radar for a different reason: He lived in Washington, DC. The mans home, in fact, was just down the street from the US attorneys office, near the capitals Gallery Place neighborhood. He happened to live in the very same apartment building that one of the prosecutors had only recently moved out of.
That location, they realized, might be useful to them. Janczewski and Gambaryan could easily search the mans home and his computers as a test case. If that proved the man was a Welcome to Video customer, they would be able to charge the entire case in DCs judicial district, overcoming a key legal hurdle.
As they dug deeper, though, they found that the man was a former congressional staffer and held a high-level job at a prestigious environmental organization. Would arresting or searching the home of a target with that sort of profile cause him to make a public outcry, sinking their case?
Just as they trained their sights on this suspect in their midst, however, they found that he had gone strangely quiet on social media. Someone on the team had the idea to pull his travel records. They found that he had flown to the Philippines and was about to fly back to DC via Detroit.
There were suitcases still not fully unpacked from the trip. The man had ordered a pizza the night before, and part of it remained uneaten on the table.
This discovery led the agents and prosecutors to two thoughts: First, the Philippines was a notorious destination for sex tourism, often of the kind that preyed on childrenthe HSI office in Manila constantly had its hands full with child exploitation cases. Second, when the man flew back to the US, Customs and Border Protection could legally detain him and demand access to his devices to search for evidencea bizarre and controversial carve-out in Americans constitutional protections that, in this case, might come in handy.
Would their DC-based suspect sound the alarm and tear the lid off their investigation, just as it was getting started?
Read the rest here:
Inside the Bitcoin Bust That Took Down the Webs Biggest Child Abuse Site - WIRED