RegulationOctober 18, 2019

Bitcoin Bites Child Pornographers

Cryptocurrency transactions help agents track down child porn ring leader.

Reported by Michael Katz

IRS special agents have broken up the world’s largest child pornography website by tracking down the site’s administrator through Bitcoin transactions used to pay for access to the illegal videos and images.

“Through the sophisticated tracing of bitcoin transactions, IRS-CI special agents were able to determine the location of the Darknet server, identify the administrator of the website and ultimately track down the website server’s physical location in South Korea,” said IRS-CI Chief Don Fort in a statement. “This large scale criminal enterprise that endangered the safety of children around the world is no more.”

According to the indictment, the Welcome to Video website was a Tor network-based site and was the largest child sexual exploitation market by volume of content. Tor networks help mask an internet user’s identity by routing their communications through a global network of relay computers, or proxies, that effectively hide a user’s IP address, and thus their identity.

Although there was almost no personally identifiable information about the sender or recipient of the Bitcoins, virtual currency exchanges are required by US law to collect identifying information of their customers and verify their clients’ identities.

To send Bitcoin through the Welcome to Video site, the sender transmitted a transaction announcement that was cryptographically signed with the sender’s private key across the Bitcoin network. And when the announcement was verified, the transaction was added to the blockchain. The blockchain is a decentralized public ledger that logs every transaction, and the indictment said that analysis of the blockchain can sometimes reveal whether multiple Bitcoin addresses were controlled by the same person or entity.

Analyzing the data underlying the transactions allowed for the creation of large databases that grouped the transactions into clusters. It was this analysis that led the agents to identify Bitcoin addresses that were involved in transacting with the same address.

As a result of the detective work, a federal grand jury in Washington, D.C. indicted 23-year-old South Korean national Jong Woo Son for running the Welcome To Video website. The nine-count indictment was recently unsealed along with a parallel civil forfeiture action. Son has also been charged and convicted in South Korea and is currently in custody there serving his sentence.

More than 300 site users in the US, the UK, South Korea, Germany, Saudi Arabia, the United Arab Emirates, the Czech Republic, Canada, Ireland, Spain, Brazil, and Australia have been arrested and charged in connection with the bust.

The indictment said that in March 2018, agents from the IRS-CI, HSI, the UK’s National Crime Agency, and Korean National Police arrested Son and seized the server that he used to operate a darknet market that exclusively advertised child sexual exploitation videos available for download by members of the site.

The Justice Department said the site was among “the first of its kind to monetize child exploitation videos using bitcoin.” More than 1 million child exploitation videos were downloaded by users, each of whom received a unique Bitcoin address when creating an account on the website. An analysis of the server revealed that the website had more than one million Bitcoin addresses, signifying that the website had capacity for at least one million users.

“Sadly, advances in technology have enabled child predators to hide behind the dark web and cryptocurrency to further their criminal activity,” Alysa Erichs, acting executive associate director for Homeland Security Investigations, said in a statement. However, she added that the indictment “sends a strong message to criminals that no matter how sophisticated the technology or how widespread the network, child exploitation will not be tolerated.”