The website was called "Welcome to Video," and it was the largest child sexual exploitation marketplace on the planet.
By largest marketplace, we mean a greater volume of sexual abuse media than on any other site.
In fact, investigators seized nearly eight terabytes of data containing more than 250,000 unique videos of kids being sexually exploited. Now this is the message site visitors see:
Investigators around the globe catalog child pornography, looking for clues that can lead back to the creators or re-sellers of the content. And in this case, it appears nearly half of the videos have never been detected by law enforcement in any previous case.
This is the story of how "Welcome to Video" was busted on the secretive Dark Web.
The hunt for the heart of the child pornography marketplace
In the constant game of cat and mouse between cybercrime investigators and criminals on the Dark Web, there is a battle of anonymity versus being known.
Get known and you get busted.
Cybercriminals in this space hide behind tools like the anonymizing Tor web browser, various types of encryption, things like compromised IP addresses that point to somewhere else, and other strategies making it difficult or impossible to determine where someone is and who they are.
And the money that changes hands on the Dark Web is also difficult to trace. It consists of cryptocurrencies moving across the Blockchain.
Here is the payment page from the "Welcome to Video"website:
But in this case, that did not stop the IRS and its specialized team of investigators.
They were looking for the heart of the child porn marketplace. That heart was a computer server.
"Through the sophisticated tracing of bitcoin transactions, IRS-CI special agents were able to determine the location of the Darknet server, identify the administrator of the website and ultimately track down the website server's physical location in South Korea," said IRS-CI Chief Don Fort.
And although investigators busted hundreds around the world relating to the child porn website, it was the breadcrumbs left behind by just a few that solved this case.
The U.S. Department of Justice puts it like this:
"The complaint alleges that law enforcement was able to trace payments of bitcoin to the Darknet site by following the flow of funds on the blockchain. The virtual currency accounts identified in the complaint were allegedly used by 24 individuals in five countries to fund the website and promote the exploitation of children."
SecureWorld recently asked a federal cybercrime investigator about how the government traces cryptocurrency, but they told us that was something they could not discuss. However, you might want to read, "Yes, Your Bitcoin Transactions Can Be Tracked" for some clues.
Homeland Security Investigations (HSI) Acting Executive Associate Director Alysa Erichs puts it like this.
"Sadly, advances in technology have enabled child predators to hide behind the dark web and cryptocurrency to further their criminal activity. However, today's indictment sends a strong message to criminals that no matter how sophisticated the technology or how widespread the network, child exploitation will not be tolerated in the United States."
The mastermind: a man from South Korea
Federal officials say 23-year-old Jong Woo Son is a South Korean national and the mastermind of "Welcome to Video."
He's in jail in South Korea and was just indicted by a Federal Grand Jury in the United States, which is why this case is coming to light right now.
Child pornography customers around the world charged
The U.S. DOJ says it arrested and charged 337 of the site's users. They live in:
Alabama, Arkansas, California, Connecticut, Florida, Georgia, Kansas, Louisiana, Maryland, Massachusetts, Nebraska, New Jersey, New York, North Carolina, Ohio, Oregon, Pennsylvania, Rhode Island, South Carolina, Texas, Utah, Virginia, Washington State and Washington, D.C.
Globally speaking, local officials arrested and charged customers in the United Kingdom, South Korea, Germany, Saudi Arabia, the United Arab Emirates, the Czech Republic, Canada, Ireland, Spain, Brazil and Australia.
You might be anonymous on the Dark Web, but as this investigation shows us, you are not completely out of reach.
See the Department of Justice announcement here.
Federal officials are also trying to confiscate the mastermind's assets and use that to benefit any victims they are able to identify.
