How Bitcoin transactions were used to track down the 23-year-old South Korean operating a global child exploitation site from his bedroom
For almost three years, “Welcome To Video” was a covert den for people who traded in clips of children being sexually assaulted. There, on the darknet‘s largest-known site of child exploitation videos, hundreds of users from around the world accessed material that showed the sexual abuse of children as young as six months old.
Then it all began to unravel.
On Wednesday, the United States’ Department of Justice (DOJ) revealed how it had followed a trail of bitcoin transactions to find the suspected administrator of the site: A 23-year-old South Korean man named Jong Woo Son.
But the case is much bigger than just one man. Over the almost three years that the site was online, users downloaded files more than one million times, according to a newly unsealed DOJ indictment. At least 23 children in the US, Spain and the United Kingdom who were being abused by the users of the site have been rescued, the DOJ said in a press release. “Children around the world are safer because of the actions taken by US and foreign law enforcement to prosecute this case and recover funds for victims,” said Jessie K. Liu, an attorney for District of Columbia where the US case was filed. “We will continue to pursue such criminals on and off the darknet in the United States and abroad, to ensure they receive the punishment their terrible crimes deserve.”
In total, 337 people from at least 18 countries who used Welcome To Video have been arrested and charged, the DOJ said. And in a statement Thursday, South Korea’s National Police Agency (NPA) said 223 of them were South Korean.
Many Welcome To Video users likely thought they were untraceable.The site was on the darknet, the underbelly of the deep web which cannot be accessed by a regular browser. According to authorities, some customers paid for the explicit images of child sexual abuse in bitcoin, a digital currency that can be spent without users disclosing their true identity.But the downfall of Welcome To Video shows that bitcoin isn’t as private as some cybercriminals might have thought.
At the time, bitcoin still wasn’t a widely used payment method. The non-profit Internet Watch Foundation, which works to remove images and videos of child sexual abuse from the web, found that some of the most prolific commercial child sexual abuse sites first started accepting bitcoin as payment in 2014. According to the DOJ, Welcome To Video was “among the first of its kind to monetize child exploitation videos using bitcoin.” Bitcoin can be attractive for people hoping to slip under the radar. Bitcoin is decentralized, meaning there is no company or official bank which oversees transactions. Users store their bitcoin in a virtual account — known as a digital wallet — without having to prove their real identity, as they might for a regular brick-and-mortar bank. From about June 2015 to March 2018, Welcome To Video received at least 420 bitcoin through 7,300 transactions with users in numerous countries including the US, the UK and South Korea, the indictment released Wednesday shows. Those transactions were worth over $370,000 at the time. Some of those transactions would ultimately help bring about the site’s collapse.
How authorities brought down Welcome To Video
To get on the site at all, users had to have special software. Because Welcome To Video was hosted on the darknet, it couldn’t be accessed by browsers like Google Chrome or Safari. Users needed to download software — such as Tor — that concealed their Internet Protocol address (IP address), a unique number assigned to every device connected to the internet. But in September 2017, authorities did something simple, according to the indictment: they right-clicked on Welcome To Video’s homepage and selected “view page source.” When they did that, they discovered an unconcealed IP address. That IP address and another found in the same way October 2017 were both traced to a residential address in South Korea — Son’s alleged home. At the same time, US investigators were carrying out an undercover operation. Once in September 2017 and twice in February 2018, an undercover agent sent bitcoin to an account provided by Welcome To Video. Each time, the funds were later transferred into another bitcoin account — in Son’s name, and registered using Son’s phone number and email, US authorities alleged in the indictment.
In March 2018, authorities searched Son’s house and found the server for Welcome To Video was hosted in Son’s bedroom. Authorities also seized eight terabytes containing 250,000 sexual assault videos. In total, 45% of the videos analyzed by the National Center for Missing and Exploited Children contained images not “previously known to exist.” From there, authorities were able to track down other suspects. “(This case) involved a lot of cooperation between a lots of different people,” said Urszula McCormack, a partner at the King and Wood Mallesons law firm in Hong Kong who specializes in blockchain, the technology behind bitcoin. “Often it’s those weak links that expose the whole.”Data from the server was shared with law enforcement officials around the world, who used it to track down and prosecute customers of the site in 18 countries, according to a DOJ statement. In March 2018, Son was arrested in South Korea, and found guilty of producing and distributing child pornography, a charge that carries a possible 10 year jail term under South Korean law. In May this year, he was sentenced to 18 months in jail, South Korea’s NPA said. But Son could still face more prison time.In August of last year, Son was indicted on a number of child pornography charges in the US, including advertising child pornography which carries a possible 30 year sentence. In order for him to face those charges, Son would need to be extradited to the US — which has an extradition treaty with South Korea. He could be arrested if he travels there of his own accord. One of the reasons the US is interested in prosecuting Son is that the content was accessed in the country. CNN has reached out to the DOJ to ask if they will request an extradition. South Korean police told CNN they haven’t received an extradition request from the US — and while he’s in prison, Son cannot be affected by the US indictment.
Read more via CNN