You are using an older browser version. Please use a supported version for the best MSN experience.

Top TV Stories

How Investigators Busted a Huge Child-Porn Website

The Wall Street Journal. logo The Wall Street Journal. 11/26/2019 Aruna Viswanatha
a man standing in front of a window © Ross Mantle for The Wall Street Journal

The call came in while two criminal investigators for the Internal Revenue Service sat at a Bangkok airport gate in July 2017, waiting for a flight.

A confidential source they knew from past investigations was offering a tip that a new website was selling child pornography in exchange for bitcoin. The website, the source said, appeared to have popped up in the wake of shutdowns of other dark-web marketplaces for illicit goods.

Investigator Chris Janczewski and his colleague, Tigran Gambaryan, who had been involved in previous probes involving bitcoin transactions, decided to dig in to the possible financial ramifications of the matter despite the fact that child pornography was outside the IRS’s usual bailiwick. But they quickly hit a logistical roadblock: Their office, like many others, blocked access to pornographic websites.

Get news and analysis on politics, policy, national security and more, delivered right to your inbox

“This is uncharted territory for the IRS,” Mr. Janczewski said in an interview. “What do I do? Is there a special room that I am supposed to go into if I want to look at the website?” They turned for help to Department of Homeland Security investigators, since the agency had a history of dealing with child exploitation.

Within eight months the duo, along with the DHS agents and counterparts in the U.K. and South Korea, had traced the financial trail of the largest online marketplace for child pornography they had ever encountered, comprising some 250,000 different videos.

The story behind the takedown of the website Welcome to Video involved getting a lucky break with the right-click of a mouse, stumbling upon a selfie of someone holding a passport, and following electronic breadcrumbs left by bitcoin transactions.

The probe required “a new and different model than typical child-pornography cases,” said Washington-based Assistant U.S. Attorney Zia Faruqui, a prosecutor on the case. Instead of starting off with a tip about one person or a forensic exam of a single device, Mr. Faruqui said, the investigators were able to target the website, which led them to hundreds of clients and allowed them to identify even those who had downloaded videos and later deleted them from their computers.

As digital-currency movements have become a larger feature in international investigations involving everything from the purchase of illicit drugs to terrorism, IRS criminal investigators have broadened their financial expertise to tracing such transactions. The agency was involved, for example, in the 2017 takedown of the dark-net market AlphaBay, which involved the cooperation of law-enforcement agencies in more than seven countries.

This account of the probe was provided by Messrs. Janczewski and Gambaryan and the prosecutors involved in the case. Officials from the Justice Department, the IRS and Homeland Security jointly announced an indictment in the case last month, citing the involvement of Britain’s National Crime Agency and the Korean National Police in the investigation.

While the location of the website’s server was hidden via the open-source Tor anonymization service, which allows users to conceal their identities online, Messrs. Janczewski and Gambaryan discovered a possible defect in the encryption.

When they right-clicked on the images of videos on the site, they found they could examine the source code and see that the thumbnail images appeared to be coming from an internet address in South Korea. That, Mr. Janczewski said, “is not supposed to happen using Tor.”’

Meanwhile, the IRS investigators learned from their initial tipster that the U.K.’s National Crime Agency was also investigating the Welcome to Video site.

In addition, the confidential source gave them multiple bitcoin addresses and said they were associated with the website. To confirm that connection, DHS agents created Welcome to Video accounts and transferred bitcoin to those addresses. They analyzed the blockchain ledgers of those bitcoin transactions and found the funds had in fact gone to addresses grouped with the ones they had been provided.

Around that time, investigators divided their probe, with one strand focused on the website’s operators and the other on its users.

Investigators subpoenaed the bitcoin exchanges that had facilitated transactions sending funds to the addresses and secured records about who opened those digital-currency accounts.

Law-enforcement officials copied the contents of one alleged Welcome to Video user’s laptop and cellphone confiscated at the Detroit airport when he returned to the U.S. from the Philippines in October 2017, after determining he owned a bitcoin wallet that had made payments to the site, according to affidavits unsealed in Washington this month.

The website’s operator appeared to be sending funds to multiple Korean bitcoin exchanges and one U.S. exchange, according to the IRS agents and a prosecutor. Records filed by the operator upon opening his account at the U.S. exchange included a selfie of a person holding a Korean passport, the agents said.

In late February 2018, the various law-enforcement authorities working on the international probe of Welcome to Video gathered in South Korea.

Their leads, including the passport image, took them to an apartment complex outside Seoul. There they found a 22-year-old man named Jong Woo Son who lived with his parents and ran what they described as a mammoth online child pornography site, with its 250,000 videos accessible to users through what they likely thought was the anonymity of digital currency.

Mr. Son kept the server in his bedroom, the agents said. The person holding the passport in the selfie turned out to be his father, who hasn’t been accused of any wrongdoing.

Authorities took down the website in March 2018 but didn’t want to alert any of its clients still under investigation, so they created a dummy page showing a message in deliberately broken English: “We are improving the download speed through this update. You can fast download videos, and safe.”

In South Korea, Mr. Son was convicted last year and sentenced to 18 months in prison for possessing, distributing, and uploading pornographic content featuring children. His sentence is set to end in several months.

In October, the U.S. unsealed an indictment charging Mr. Son with money laundering, conspiracy and child pornography offenses, and U.S. prosecutors are seeking his extradition. Neither he nor his attorney could be reached for comment.

Having seized the server, investigators had the full roster of the website’s customers and could parcel out leads to other countries. Last month authorities in roughly a dozen countries announced arrests of more than 300 users of the Welcome to Video site, including people who held positions of authority and worked with children.

Clients arrested and charged in the U.S. included an assistant high-school principal in Georgia, a Texas-based DHS agent, and the husband of an in-home day-care operator in Kansas. All have pleaded guilty. Another DHS agent is still awaiting trial.

Authorities in the U.S. and Europe said they had rescued 23 minors being abused by users of the website, including a young girl living with one of the DHS employees. Recognizing a red fleece the girl had worn in one of the videos on the Welcome to Video site, Mr. Janczewski identified her on a GoFundMe page the employee had set up to raise the funds he said he needed to adopt her.

One other apparent consequence of the probe: the death of the alleged customer whose devices were inspected by investigators. Two days after being stopped at the airport, he emailed his sister at around 5 a.m. saying he was going to kill himself, according to an affidavit in the case, and jumped from the balcony of his Washington apartment building.

Mr. Janczewski now gives presentations to other law-enforcement agencies about the investigation, titling it with the question he said he still gets asked the most: “Why the IRS?”

Write to Aruna Viswanatha at Aruna.Viswanatha@wsj.com

AdChoices
AdChoices

More from The Wall Street Journal

The Wall Street Journal.
The Wall Street Journal.
image beaconimage beaconimage beacon