The bust of one of the biggest child porn sites, Welcome to Video, on the deep web echoed the crackdown of Silk Road, a darknet marketplace. This bust, however, was quite different from that of Silk Road, with the only thing common between them being Bitcoin, the cryptocurrency named as the go-to for dark web marketplaces by Europol earlier this month.
Speaking on the effect a bust like this would have on Bitcoin, Mati Greenspan, eToro senior market analyst, told AMBCrypto:
It has no affect. Ever since Silk Road’s Dread Pirate Roberts was busted people have know that using Bitcoin for illicit purposes is not a good idea. Nothing new here.
In this case, cryptocurrency played the most crucial part in identifying the person behind the site. The crackdown of the site was a joint effort led by IRS-CO, HSI, the NCA, Korean National Police, National Crime Agency of the United Kingdom, German Federal Criminal Police, and Department of Justice’s Office of Internal Affairs of the Criminal Division.
The bust resulted in not only unmasking the operator of the site but also the arrest of 337 site users and the rescue of at least 23 minor victims in the United States, United Kingdom, and Spain.
Welcome to Video
Welcome to Video was one of the biggest child pornography websites on the deep web, recording distribution of more than 1 million sexually explicit videos involving children as of February 2018.
The indictment released by Department of Justice stated that the website had begun operations around June 2015, hosting and distributing video files of child pornography. The website had also barred the upload of sexually explicit videos involving adults, with its upload page stating “Do not upload adult porn.”
Source: DOJ
Operation:
The only prerequisite required to access the website was a username and password. However, the site worked on a point system basis for those who wanted to download videos from the website and one of the ways to gain points was purchasing them in exchange for 0.03 Bitcoins. This was stated as “a VIP account, which lasted for six months and purportedly allowed unlimited downloads.”
These points could only be redeemable for the download of videos, with the site following a “no refund” policy. As per the document released by the Department of Justice, people from several countries including the United States, Great Britain, and South Korea, sent the mentioned BTC to the site.
The indictment read,
“Welcome to Video directed customers to particular BTC exchangers to make payments to it, including an exchanger in the United States. Welcome To Video established unique BTC addresses to receive payments from each different Welcome to Video customer account.”
This, in turn, resulted in the setting up of over 1.3 million BTC addresses, with thousands of unique Bitcoin addresses clustered by law enforcement. Notably, this also included the BTC address of an undercover agent, which was set up solely for creating an account on Welcome to Video. The undercover agent also made multiple transactions on the addresses mentioned on the website and even downloaded “child pornography video files from it while in Washington DC.”
The indictment also read,
“For in or about June 2015 to on or about March 8, 2018, Welcome to Video received at least 420 BTC through at least 7,300 transactions worth over $370,000.00 at the time of the respective transactions.”
The well-planned strategy:
Identifying the person behind the website comprised two fine ingredients: IP addresses, and Bitcoin.
IP address:
There were two instances when the operator had failed to conceal the actual IP address of the servers, another common factor between Welcome to Video and Silk Road crackdown. First was around September 1, 2017, where the actual IP address: 121.185.153.64 was revealed on the source code of the web page, which was discovered by law enforcement. The second was a month later when another IP address: 121.185.153.45 was revealed as the homepage failed to conceal it.
Both resulted in enforcement officers knocking at the door of South Korean authorities. Subsequently, it only took one quick search of the operator’s residence for the authorities to find the site’s servers inside the bedroom “actively operating.” The released report said:
“These two IP addresses resolved to a telecommunication provider in South Korea and were registered to an account serviced at the defendant’s residence.”
Bitcoin:
While the IP address gave out the location of the individual, Bitcoin transactions made on the site revealed much more. The first point in the case was the transaction of Bitcoin made by an undercover agent, 0.03 BTC sent to an address mentioned on Welcome to Video on September 28, 2017, with the transaction being closely monitored. Two days post the transactions, the authorities noted that the coins were transferred to the operator’s address, calling it ‘BTC address 1′.
This was then followed by two transactions carried out on the same day, around February 23, 2018. One of the transactions was sent to a different address, while the other was sent to the same address as that of September transaction to ‘BTC address 1′. It was later identified that address [1] ending with 209A belonged to an address registered on an exchange, which, in turn, was linked to the operator’s bank account, ending in 0477.
Notably, documents also revealed that the exchange had emailed the site’s operator in December 2016 concerning the cashing out of BTC to the said bank account, thereby revealing all personal information required to identify the individual. According to reports, it is said that the exchange in question was an American exchange; however, the name is yet to be revealed.
The indictment read,
“The defendant controlled at least four email accounts, all of which he repeatedly accessed from the IP address of 121.185.153.64, which was the IP address associated with Welcome to Video. Beginning in at least July 2015, the defedant’s Internet browsing and search history revealed multiple searches for, and visits to, Welcome to Video”
Along with this, law enforcement was able to gain access to the operator’s Internet browsing and search history, which showed “multiple searches relating to child pornography, BTC, and computer coding.”
This clampdown of the largest child porn site with the help of Bitcoin also helped in breaking down the myth that the cryptocurrency provided anonymity for users. On this, Bobby Ong, co-founder of CoinGecko said,
“Bitcoin transactions are pseudonymous; they have never been anonymous. Criminals just misunderstood the properties of bitcoin and thought it would be a good way to skirt authorities. I think with the busting of this syndicate, more people will now be aware that bitcoin is not a good use case for illicit transactions as they can be traceable by authorities using chain analytics / forensics tools. This is incredibly good for Bitcoin in the long run as it would make it less attractive to criminals and allow Bitcoin to shed off its bad image in the public view that bitcoin is only good to be used by criminals such as drug dealers in the dark web.”
As the narrative surrounding Bitcoin has slowly changed over the years, could such a crackdown imbue a positive connotation surrounding Bitcoin? Could this trickle down to law-makers and regulatory bodies changing their tune toward Bitcoin?
Mati told AMBCrypto:
“That’s tough to say. Regulations regarding technological innovation are quite hazy in the USA at the moment, especially when it come to cryptoassets.”
Sentence befitting the crime?
The Department of Justice identified the person behind the operation of the site to be a South Korean resident, Jong Woo Son. The 23-year old is currently in custody of South Korean authorities, and according to an article by Bloomberg, he was sentenced to 18 months.
The official announcement read,
“The server that he used to operate a Darknet market that exclusively advertised child sexual exploitation videos available for download by members of the site. The operation resulted in the seizure of approximately eight terabytes of child sexual exploitation videos, which is one of the largest seizures of its kind.“
