- Click to share on Facebook (Opens in a new window)
- Click to share on Twitter (Opens in a new window)
- Click here to share on LinkedIn (Opens in a new window)
- Click to email a friend (Opens in a new window)
(CNN) - For almost three years, "Welcome To Video" was an undercover den for people who exchanged videos of children who were sexually assaulted.
There, on the largest known video exploitation site of the deep internet (or deepweb), hundreds of users around the world accessed material that showed the sexual abuse of children up to six months of age.
Then everything started to crumble.
On Wednesday, the United States Department of Justice (DOJ) revealed how it had followed a trail of bitcoin transactions to find the site's suspicious administrator: a 23-year-old South Korean man named Jong Woo Son.
- Pope Francis denounces the “dark side” of the Internet: child pornography
But the case is much bigger than a single man. During the almost three years that the site was online, users downloaded files more than a million times, according to a recently revealed Department of Justice indictment. At least 23 children in the United States, Spain and the United Kingdom who were abused by site users have been rescued, the Justice Department said in a press release.
"Children around the world are safer because of the actions taken by US and foreign law enforcement to process this case and recover funds for victims," said Jessie K. Liu, a lawyer from the District of Columbia where it was filed. The American case. "We will continue to persecute those criminals inside and outside the dark network in the United States and abroad, to ensure that they receive the punishment their terrible crimes deserve."
In all, 337 people from at least 18 countries that used Welcome To Video have been arrested and charged, the Justice Department said. And in a statement Thursday, the South Korean National Police Agency (NPA) said 223 of them were South Koreans.
Many Welcome To Video users probably thought they could not be tracked.
The site was on the darknet, the most vulnerable part of the deep web that a normal browser cannot access. According to the authorities, some clients paid for the explicit images of child sexual abuse in bitcoin, a digital currency that can be spent without users revealing their true identity.
But the Welcome To Video drop shows that bitcoin is not as private as some cybercriminals might have thought.
- Dismantle network of child pornography by WhatsApp
What was Welcome to Video?
According to the document published on Wednesday by the Department of Justice, Welcome To Video began operating around June 2015.
The site worked like this: anyone could create a free account. Authorities say users can download the videos if they pay in bitcoins, or if they earn points when recommending new customers or uploading their own videos. According to the lawsuit, the loading page on Welcome To Video said: "Don't upload adult pornography."
At that time, bitcoin was not yet a widely used payment method. The nonprofit organization Internet Watch Foundation, which works to remove images and videos of child sexual abuse from the web, discovered that some of the most prolific commercial sites of child sexual abuse began accepting bitcoin as payment in 2014. According to the Department Justice, Welcome To Video was "one of the first of its kind to monetize videos of child exploitation using bitcoin."
Bitcoin can be attractive to people who expect to go unnoticed. The digital currency is decentralized, which means that there is no official company or bank that oversees the transactions. Users store their bitcoins in a virtual account, known as a digital wallet, without having to prove their true identity, as they would with a physical bank.
From June 2015 to March 2018, Welcome To Video received at least 420 bitcoins through 7,300 transactions with users in numerous countries, including the United States, the United Kingdom and South Korea, according to the lawsuit published on Wednesday. Those transactions were worth more than $ 370,000 at that time.
Some of those transactions would eventually help cause the site to collapse.
- The FBI accuses federal agents of stealing bitcoins during 'Silk Road' investigation
This is how the authorities knocked down Welcome To Video
To access the site, users had to have special software.
Because Welcome To Video was hosted on the darknet, browsers such as Google Chrome or Safari could not access it. Users needed to download software, such as Tor, that hid their Internet Protocol address (IP address), a unique number assigned to each device connected to the Internet.
But in September 2017, the authorities did something simple, according to the documents: they right-clicked on the Welcome To Video home page and selected “see page source”.
When they did that, they discovered a hidden IP address. That IP address and another found in the same way in October 2017 went back to a residential address in South Korea: the supposed house of Son.
At the same time, American researchers were conducting a covert operation. Once in September 2017 and twice in February 2018, an undercover agent sent bitcoin to an account provided by Welcome To Video.
Each time, the funds were subsequently transferred to another bitcoin account, in the name of Son, and registered using Son's phone number and email, the US authorities claimed in the lawsuit.
In March 2018, authorities searched Son's house and found that the Welcome To Video server was hosted in Son's room. Authorities also seized eight terabytes containing 250,000 videos of sexual assault. In total, 45% of the videos analyzed by the National Center for Missing and Exploited Children contained images that "were not known to exist before."
From there, the authorities were able to locate other suspects. "(This case) involved a lot of cooperation between many different people," said Urszula McCormack, a partner at the King and Wood Mallesons law firm in Hong Kong that specializes in blockchain, the technology behind bitcoin. "It is often those weak links that expose the whole."
Server data was shared with police officers worldwide, who used it to track and prosecute site customers in 18 countries, according to a Justice Department statement.
In March 2018, Son was arrested in South Korea and found guilty of producing and distributing child pornography, a charge that carries a possible 10-year prison sentence under South Korean law. In May of this year, he was sentenced to 18 months in jail, the South Korean NPA said.
But Son could still face more time in prison.
In August last year, Son was charged with several counts of child pornography in the United States, including advertising for child pornography that carries a possible 30-year sentence.
In order to face those charges, Son would need to be extradited to the United States, which has an extradition treaty with South Korea. Or he could be arrested if he travels there of his own accord. One of the reasons why the United States is interested in prosecuting Son is that the content was accessed from that country.
CNN has contacted the Department of Justice to ask if they will request an extradition. South Korean police told CNN that they have not received a request for extradition from the United States, and while in prison, Son cannot be affected by the accusation in the United States.
The defects in bitcoin
While bitcoin has a reputation among the general public for being secret, the reality is a bit different.
Each time bitcoin is transferred, the details of the operation are recorded in a publicly available permanent ledger, said Yihao Lim, senior analyst at the cybersecurity firm FireEye. Therefore, it is possible to see what an individual does, even if you cannot see his or her identity in the real world.
There are other holes in the ability of bitcoin to maintain anonymity. In the United States, virtual currency exchanges, the platforms where people can buy and sell bitcoins with real money are required by law to verify the real-world identities of their customers. Developed countries are increasingly adopting these measures.
All this means that bitcoin is not really anonymous, it is a pseudonym. For the authorities, the difficulty is not seeing the transactions, but linking the bitcoin account with the real-world person behind them, Lim said.
There are ways for bitcoin users to remain under the radar. But in general, the authorities are catching up.
During 2018, the tools that can analyze bitcoin transactions have been developed at a high level, said McCormack of the Hong Kong law firm. “People (in the past) did not know that this was a possibility. I think that many people these days are not aware of the sophistication of these tools and how much they can extract from the patterns, ”he said.
Lim said it was a public misunderstanding that using bitcoin was safe. "Yes, they have succeeded in being anonymous at first, but the police have already caught up."
What happens now
Despite the bitcoin security breaches, some inexperienced cybercriminals will probably continue to use it, Lim said. After all, this is not the first high profile case in which bitcoin has helped capture a suspect. During the 2015 trial of the creator of the Silk Road site, a digital market that allowed users to trade drugs illegally, prosecutors showed they had tracked millions of dollars in bitcoins to the founder's personal laptop.
- Judge sentences life imprisonment to Ross Ulbricht, the founder of 'Silk Road'
"Many cybercriminals are still poorly informed," Lim said of the criminal underworld. "They are out there to make quick money, they didn't do their homework enough."
As for experienced cybercriminals, many had already switched to other cryptocurrencies, Lim said.
But people who have used bitcoin in the past could be located at any time. Because the public book that records bitcoin transactions is immutable, there is no way to eliminate evidence of past business. When it comes to the Welcome To Video case, Lim expects more people connected to the site to be caught.
In a second court document published on Wednesday, the US authorities argued that 24 bitcoin accounts should be sanctioned before the authorities, claiming they were used "to fund the website and promote the exploitation of children." Some of the accounts were also used to make transactions in other darkweb sites, such as Silk Road and Evolution, where users can buy drugs and stolen information.
In the press release on Wednesday, the Justice Department said it planned to recover the illicit funds and return them to the victims of the crime.
"Children are our most vulnerable population, and crimes like these are unthinkable," said interim executive director of National Security Investigations, Alysa Erichs, in a statement.
“(The) accusation sends a strong message to criminals that no matter how sophisticated the technology is or how widespread the network is, child exploitation will not be tolerated in the United States
"Our entire judicial system will stop at nothing to avoid these heinous crimes, safeguard our children and provide justice to all."
How to get help: In the US In the US, contact RAINN by calling their national sexual assault hotline 24/7 at +1 800 656 4673 or chat with a member of their staff. In the United Kingdom, call the National Society for the Prevention of Cruelty against Children at 0800 808 5000 or visit their website. You can find more resources to protect children from sexual abuse in Darkness to Light.
- CNN Sophie Jeong contributed to this Seoul report
Child pornography
