Getty
The largest dark web child pornography site in the world has been taken down. That was the word today from the U.S. Attorney’s Office for the District of Columbia, the Justice Department’s Criminal Division, the IRS Criminal Investigation (IRS-CI), and U.S. Immigration and Customs Enforcement’s Homeland Security Investigations (HSI), together with the National Crime Agency of the United Kingdom and Republic of Korea at a joint press conference announcing arrests and forfeitures.
According to the IRS-CI, agents became aware of Welcome to Video, the largest child sexual exploitation market by volume of content, because of their work on previous dark web marketplaces. The dark web, also referred to as “Darknet,” refers to content that you don’t typically access through regular internet browsing activities.
IRS-CI was able to trace bitcoin transactions on the site to people all over the world who were uploading and downloading this material, as well as find the location of the site administrator. By analyzing the blockchain and de-anonymizing bitcoin transactions, the agency was able to identify hundreds of predators around the world – even though those users thought that they could remain anonymous.
As a result of the investigations, Jong Woo Son, 23, a South Korean national, was indicted by a federal grand jury in the District of Columbia for operating the site. Son has also been charged and convicted in South Korea and is currently in custody in South Korea. The operation resulted in the seizure of approximately 7.5 terabytes of child pornography videos, the largest of its kind: that’s more than 10,000 CDs full of imagery that are no longer in the hands of child pornographers. The images, which are being analyzed by the National Center for Missing and Exploited Children (NCMEC), contained over 250,000 unique videos; 45% of the videos contain images that have not been previously known to exist.
According to the indictment, on March 5, 2018, agents from the IRS-CI, HSI, National Crime Agency in the United Kingdom, and Korean National Police in South Korea arrested Son and seized the server that he used to operate a Darknet market which advertised child sexual exploitation videos. The site, Welcome To Video, offered these videos for sale using the cryptocurrency bitcoin: the site boasted over one million downloads of child exploitation videos by users.
The website is among the first of its kind to monetize child exploitation videos using bitcoin. Here’s how it worked: each user received a unique bitcoin address when the user created an account on the website. Those accounts could be used to pay to download the videos. An analysis of the server revealed that the website had more than one million bitcoin addresses, signifying that the website had the capacity for at least one million users.
The data from the seized server was shared with law enforcement agencies around the world. This has resulted in leads sent to 38 countries. In addition to Son, 337 site users residing in 23 states (Alabama, Arkansas, California, Connecticut, Florida, Georgia, Kansas, Louisiana, Maryland, Massachusetts, Nebraska, New Jersey, New York, North Carolina, Ohio, Oregon, Pennsylvania, Rhode Island, South Carolina, Texas, Utah, Virginia, and Washington State) and Washington, D.C. ,as well as the United Kingdom, South Korea, Germany, Saudi Arabia, the United Arab Emirates, the Czech Republic, Canada, Ireland, Spain, Brazil and Australia have been arrested and charged. Two users of the Darknet market committed suicide after the execution of search warrants.
IRS-CI
The complaint alleges that law enforcement was able to trace payments of bitcoin to the Darknet site by following the flow of funds on the blockchain. The virtual currency accounts identified in the complaint were allegedly used by 24 individuals in five countries to fund the website and promote the exploitation of children. An unsealed forfeiture complaint seeks to recover these funds as part of efforts to assist victims of the crime.
In addition to arrests and seizures, the operation is also responsible for the rescue of at least 23 minor victims residing in the United States, Spain and the United Kingdom, who were being actively abused by the users of the site.
“Children around the world are safer because of the actions taken by U.S. and foreign law enforcement to prosecute this case and recover funds for victims,” said U.S. Attorney Jessie K. Liu. “We will continue to pursue such criminals on and off the Darknet in the United States and abroad, to ensure they receive the punishment their terrible crimes deserve.”
“Through the sophisticated tracing of bitcoin transactions, IRS-CI special agents were able to determine the location of the Darknet server, identify the administrator of the website and ultimately track down the website server’s physical location in South Korea,” said IRS-CI Chief Don Fort. “This large-scale criminal enterprise that endangered the safety of children around the world is no more.”
Chief Fort noted that some might call it an odd pairing for the IRS to work on this type of investigation. But, he explained “our unique and singular focus in following the money made this a logical next step after playing key roles in dismantling Silk Road, BTC-E, Mt Gox and other crimes perpetrated in the shadows of the dark web.”
He further explained, “Our agency’s ability to analyze the blockchain and de-anonymize bitcoin transactions allowed for the identification of hundreds of predators around the world.”
Whether the funds are fiat or virtual, Chief Fort said, “IRS-CI’s expertise is in tracing money all around the world.” Today, IRS-CI is the only federal agency that devotes 100% of resources to investigating financial crimes. IRS-CI is also the only agency with jurisdiction over federal tax crimes. (For more about IRS-CI, click here.)
Chief Fort had an additional message for criminals around the world. “You used to hide by laundering your money through shell companies around the country, but we traced you. You took your money offshore and hid around the world, but we found you. You went on the dark web thinking that your actions were anonymous, but they weren’t, and we again found you. You now deal in crypto-currency, again thinking this will make you anonymous, but our agents have once again proved that there is nowhere you can hide.” He added, “We will not stop in our pursuit.”