# Business

Bitcoin Trail Led to an gigantic International Child-Porn Dark Net Takedown

The takedown is notable also for the investigation that enabled it, which focused not on offensive hacking efforts or surveilling encrypted communications, but on tracing bitcoin transactions.

SNS | New Delhi | October 17, 2019 12:53 pm

Bitcoin Trail Led to an gigantic International Child-Porn Dark Net Takedown

American, British and South Korean officials announced at a news briefing on Wednesday that they have busted the massive dark web child-porn site ‘Welcome to Video’. The site generated and distributed exploitative content, and had an infrastructure in place that could have supported up to a million users.

An analysis of a server, seized by South Korean authorities, revealed that the website had more than one million bitcoin addresses, signifying that the website had a capacity for at least one million users, Dawn newspaper reported. According to the report, the operation led to the rescue of at least 23 minor victims residing in the United States, Spain and the United Kingdom, who were being actively abused by the users of the site.

Advertisement

The internet-based child pornographic network was the world’s largest child sexual exploitation market by volume of content, said US Deputy Assistant Attorney General Richard Downing. The site’s operator, 23-year-old Jong Woo Son of South Korea, has already been charged and convicted by South Korean officials and is currently serving his sentence there.

Advertisement

Officials said hundreds of suspects had been charged worldwide for their alleged involvement with the largest darknet child pornography website, funded by Bitcoin. The takedown is notable also for the investigation that enabled it, which focused not on offensive hacking efforts or surveilling encrypted communications but on tracing bitcoin transactions.

The nine-count indictment was unsealed on Wednesday along with a parallel civil forfeiture action. Son has also been charged and convicted in South Korea and is currently in custody, serving his sentence in South Korea.

Authorities have also arrested 337 other users in the US states of Alabama, Arkansas, California, Connecticut, Florida, Georgia, Kansas, Louisiana, Maryland, Massachusetts, Nebraska, New Jersey, New York, North Carolina, Ohio, Oregon, Pennsylvania, Rhode Island, South Carolina, Texas, Utah, Virginia, Washington State and Washington, DC.

According to the Dawn report, some of the suspects were arrested in the United Kingdom, South Korea, Germany, Saudi Arabia, the United Arab Emirates, the Czech Republic, Canada, Ireland, Spain, Brazil and Australia.

“Darknet sites that profit from the sexual exploitation of children are among the most vile and reprehensible forms of criminal behaviour,” said US Assistant Attorney General Brian A. Benczkowski. “This administration will not allow child predators to use lawless online spaces as a shield.”

He said the US Department of Justice was working closely with partners in South Korea and around the world to rescue child victims and bring to justice the perpetrators of the abhorrent crimes. Chief of the US Internal Revenue Service’s Criminal Enforcement Don Fort told the news briefing that their agents played a key role in busting the network.

According to the indictment, agents from the IRS, HSI, National Crime Agency in the United Kingdom, and Korean National Police in South Korea arrested Son and seized the server that he used to operate a darknet market that exclusively advertised child sexual exploitation videos available for download by members of the site.

Officials seized 8 terabytes of child porn videos during the investigation and site takedown, which included more than 250,000 unique videos. Law enforcement officials and the National Center for Missing and Exploited Children are analyzing the footage to potentially identify more children and perpetrators of exploitation. Almost half of the videos seem to be previously unknown to officials.

Welcome to Video made money by charging fees in bitcoin, and gave each user a unique bitcoin wallet address when they created an account. Son operated the site as a Tor hidden service, a dark web site with a special address that helps mask the identity of the site’s host and its location. But Son and others made mistakes that allowed law enforcement to track them. For example, according to the indictment, very basic assessments of the Welcome to Video website revealed two unconcealed IP addresses managed by a South Korean internet service provider and assigned to an account that provided service to Son’s home address. When agents searched Son’s residence, they found the server running Welcome to Video.

To “follow the money,” as officials put it in Wednesday’s press conference, law enforcement agents sent fairly small amounts of bitcoin; roughly equivalent at the time to $125 to $290 to the bitcoin wallets Welcome to Video listed for payments. Since the bitcoin blockchain leaves all transactions visible and verifiable, they could observe the currency in these wallets being transferred to another wallet. Law enforcement learned from a bitcoin exchange that the second wallet was registered to Son with his personal phone number and one of his personal email addresses.

The investigation extended beyond Son as well. Law enforcement agents worked with the blockchain analysis firm Chainalysis to map user transactions with Welcome to Video wallets and attempt to trace individuals who interacted with the site. Chainalysis says that during the three years it operated, Welcome to Video received almost $353,000 worth of bitcoin from thousands of transactions. By charting the web of Welcome to Video users’ assigned wallets and the bitcoin wallets or exchanges they used, officials identified several US-based cryptocurrency exchanges that users had gone through to pay for their Welcome to Video viewing.

(With input from agencies)

Advertisement

Related posts

NIA chargesheets two aides of BKI terrorist Lakhbir Singh in Punjab terror conspiracy case

The NIA found that Jass is an important on-ground operative of Landa and his associate Pattu Khaira, while Rana Bhai was involved in supplying weapons to members of the Lakhbir Landa gang and other gangsters.

Key ULFA-I operative involved in I-Day IED explosion in Guwahati held

The operation follows the recovery of 11 IEDs from various locations across the state on August 15, a day after ULFA-I released a statement detailing the sites where the explosives were planted.

The Kerala High Court, on Thursday, granted bail to M K Nasar, one of the individuals convicted by the special NIA court last year in the case of chopping the hands of Professor T J Joseph in 2010. A division bench comprising Justice Raja Vijayaraghavan and Justice P V Balakrishnan suspended Nasar’s sentence and granted conditional bail to him after considering his appeal against the NIA court’s conviction in the case Considering the prolonged detention and citing the potential for trial delays, the court suspended Nasar’s sentence and granted conditional bail, taking into account that some co-accused with similar allegations had already been released after serving shorter terms. The court noted that he had already spent nine years in jail and that delays in resolving appeals could justify suspending a convict’s prison term. It also observed that other accused in the case had received lesser sentences and had already been released after serving their terms. “The applicant has been undergoing incarceration, at the pre-conviction and post-conviction phases, for over 9 years. Furthermore, the fact that the accused facing the same allegations were earlier imposed a lesser term of imprisonment and have been released after having undergone the sentence is a factor that cannot be ignored. Additionally, the appeals filed by the NIA against the findings of the learned Sessions Judge are being considered in separate appeals, which have not yet been taken up. “There is also the likelihood of delay, as the prime accused has surrendered, and the learned Sessions Judge may have to take up the trial and dispose of it in accordance with the law and some of the original records may be required for that purpose. In view of these facts and circumstances, we are of the considered opinion that the sentence imposed on the applicant can be suspended pending the consideration of the appeal.” The court said The court, however, imposed strict conditions for Nasar’s bail. He is not supposed to provide a bond of Rs 1 lakh with two sureties, refrain from leaving the country without the court’s permission, avoid interfering with the trial or witnesses, and not commit similar offences while on bail The gruesome incident dates back to July 4, 2010, when Joseph, a professor at Newman College, Thodupuzha, was returning from Sunday mass with his family, members of the now-banned Popular Front of India (PFI) attacked him, allegedly in retaliation for a question paper he set, which contained a passage that they claimed insulted Prophet Mohammed was derogatory. His right hand was chopped off in this attack. Nasar was accused of playing a critical role in the attack. Investigations revealed his involvement in recruiting gang members, assigning specific tasks, collecting funds, procuring communication devices, and maintaining communication links with key conspirators.

The Kerala High Court, on Thursday, granted bail to M K Nasar, one of the individuals convicted by the special NIA court last year in the case of chopping the hands of Professor T J Joseph in 2010.