Image: © kkolosov/Stock.adobe.com
Investigators discovered that the website’s server had been briefly misconfigured, revealing a number of public IP addresses that were traced to a system hosted in a South Korean home.
On Wednesday (16 October), a 23-year-old South Korean man identified as Jong Woo Son was named by the US Department of Justice (DoJ) as the administrator of a website called Welcome to Video. The DoJ has described this website as the largest marketplace of child abuse videos on the dark web.
Around 337 other site users across the world have been arrested following the DoJ’s bust of the website, which was online from June 2015 to March 2018. According to authorities, at least one of these arrests has been made in Ireland.
Authorities from the US, Britain, South Korea and other countries said that they have rescued at least 23 victims of child sexual exploitation whose images were sold or exchanged on Welcome to Video.
Assistant attorney general Brian A Benczkowski of the DoJ said: “Dark net sites that profit from the sexual exploitation of children are among the most vile and reprehensible forms of criminal behaviour.
“Today’s announcement demonstrates that the Department of Justice remains firmly committed to working closely with our partners in South Korea and around the world to rescue child victims and bring to justice the perpetrators of these abhorrent crimes.”
De-anonymising bitcoin transactions
While the site was live on the dark web’s anonymous Tor network, it hosted almost 8TB of footage. The DoJ seized around 200,000 videos of children, toddlers and infants from the site, which were bought and sold using bitcoin. Users paid 0.03 bitcoin for download rights or earned credits by uploading new child-abuse material.
Don Fort, chief of IRS criminal investigations in the US said that the agency managed to trace the purchasers of exploitative images by de-anonymising Tor browsing data and cryptocurrency transactions.
Users on the site had been instructed to use unique email addresses for bitcoin transactions, and it is estimated that 1m different bitcoin wallets were affiliated with the site.
US government agents and police partnered with blockchain analytics outfit Chainalysis to track down the individual users by monitoring the transfer of bitcoin from the site to various exchanges and wallets.
Authorities in the US have criticised anonymous services such as Tor and cryptocurrencies that are commonly used for these platforms.
US attorney general Richard Downing said: “Operators of anonymisation services like Tor must ask themselves whether they are doing their part to protect children and make their platform inhospitable to criminals.
“Society must decide whether it will accept these lawless online spaces, whether American taxpayers should fund them, or whether we will instead demand that providers act to prioritise protecting children from online predators.”
Tracing it back to South Korea
The investigation began after the arrest of Cambridge graduate Dr Matthew Falder, a geophysicist who admitted to 137 offences relating to the exploitation of children. Falder is now serving a 25-year prison sentence in the UK.
The UK’s National Crime Agency discovered a link to the Welcome to Video website during their investigation into Falder. A global investigation was then launched.
Fort explained how the US investigation was led to South Korea: “Through the sophisticated tracing of bitcoin transactions, IRS criminal investigation special agents were able to determine the location of the dark net server, identify the administrator of the website and ultimately track down the website server’s physical location in South Korea.”
As detailed by The Register, investigators were lucky to find that the Welcome to Video server was briefly misconfigured, revealing a number of public IP addresses which were traced to a system hosted at Son’s home by South Korean authorities.
It is not clear whether Son, who is now serving an 18-month prison sentence in South Korea on charges related to the possession and sale of images of child sexual abuse, will be extradited to the US. In the US, he is charged with nine counts related to the creation and distribution of child sex abuse images, as well as money laundering.
It is estimated that during the duration of the website’s existence, Son made at least $370,000 in bitcoin from the exploitative operation. The US government is attempting to recover any money made by Son and other users of the site.
Fort concluded: “This large-scale criminal enterprise that endangered the safety of children around the world is no more. Regardless of the illicit scheme, and whether the proceeds are virtual or tangible, we will continue to work with our federal and international partners to track down these disgusting organisations and bring them to justice.”
