US Law Enforcement Traces Bitcoin Transfers to Nab ‘Largest’ Child Porn Site

A U.S. federal grand jury indicted a South Korean citizen for operating the largest child porn site by volume, where visitors spent millions of dollars worth of bitcoin to pay for the illegal content.

Jong Woo Son, 23, the owner of the Welcome to Video (WTV) site has also been charged and convicted in South Korea and is currently in custody serving his sentence there, the Department of Justice said.

The DOJ said 337 site users, including law enforcement officers, from 22 U.S. states and 11 countries around the world were arrested.

The operation resulted in searches of residences and businesses of 92 individuals in the U.S. The investigation has also led to the rescue of at least 23 minor victims residing in the U.S., Spain and the U.K., who were actively being abused by the users of the site.

WTV offered these videos for sale using bitcoin, rather than simply sharing the videos and images over a chat forum. According to the indictment, the site claimed more than a million downloads of child exploitation videos by its users.

Each user received a unique bitcoin address to create an account on the website. An analysis of the server revealed that the website had more than one million bitcoin addresses, signifying that the website had capacity for at least one million users.

A forfeiture complaint was also unsealed today.  Law enforcement was able to trace payments of bitcoin to the Darknet site by following the flow of funds on the blockchain. Separately, Chainalysis said it was their Chainalysis Reactor software used to analyze the blockchain transactions.

The virtual currency accounts identified in the complaint were allegedly used by 24 individuals in five countries to fund the website and promote the exploitation of children.  The forfeiture complaint seeks to recover these funds and, ultimately through the restoration process, return the illicit funds to victims of the crime. Chainalysis Reactor transaction activity graph showing the flow of funds in and out of the WTV address.

Chainalysis said that with the site’s listed bitcoin address, IRS Criminal Investigation and Homeland Security Investigations were able to use Chainalysis Reactor to analyze transaction activity and build a graph showing the flow of funds in and out of the WTV address.

Know Your Customer (KYC) processes enabled many of the exchanges involved to provide investigators copies of identification, addresses, and other relevant transactions associated with those accounts. In cases where that was insufficient, account information combined with open source intelligence and standard investigative techniques were enough to identify users.

Chainalysis said in a statement: “We want to enable an entire economy powered by cryptocurrency, but sites like WTV destroy the public’s faith in the technology and slow down adoption in the legitimate economy. Fighting against them is a step in the right direction.”

Assistant Attorney General of the Justice Department’s Criminal Division, Brian Benczkowski, said: “Darknet sites that profit from the sexual exploitation of children are among the most vile and reprehensible forms of criminal behavior. This Administration will not allow child predators to use lawless online spaces as a shield.”

Speaking at a press conference on Wednesday, U.S. Attorney for the District of Columbia Jessie K. Liu said: “Our message for those who produce, distribute and receive child pornography is clear: you may try to hide behind technology, but we will find you, and we will arrest and prosecute you.”

On March 5, 2018, agents from the U.K., and Korean National Police in South Korea arrested Son and seized the server that he used to operate a Darknet market that exclusively advertised child sexual exploitation videos available for download by members of the site.

The operation resulted in the seizure of approximately eight terabytes of child sexual exploitation videos, which is one of the largest seizures of its kind. The website was also among the first of its kind to monetize child exploitation videos using bitcoin.

The images contained over 250,000 unique videos, and 45 percent of the videos currently analyzed contain new images that have not been previously known to exist.

  The Indicted

The DOJ said that two WTV users in the Washington, D.C. area committed suicide after being served search warrants. In that metropolitan area, five search warrants were executed and eight people were arrested for conspiring with the administrator of the site, as well as for being its users.  

Among the 36 Americans named in the indictment, at least three were federal law enforcement employees who had been arrested earlier in this long-term investigation.

Former U.S. Navy Petty Officer Don Edward Pannell, II, 32, of Harvey, Louisiana, was arrested in April and plead guilty in August. Pannell was assigned to Fleet Readiness Center Mid-Atlantic Detachment, New Orleans, and was also identified via his bitcoin use.

HSI computer forensic examiners found more than 1,000 images and 125 videos depicting the sexual victimization of children on Pannell’s home-built tower computer. The images and videos depicted pre-pubescent girls, including toddlers, engaged in sexual acts with adults.

Pannell faces five to 20 years in prison, up to a life term of supervised release, and a $250,000.00 fine, as well as registering as a sex offender. U.S. District Judge Greg G. Guidry will sentence him on Dec. 17.

Former HSI agent Richard Nikolai Gratkowski, 40 at the time, was sentenced in May to 70 months in federal prison on child pornography charges. The investigation showed that Gratkowski, in San Antonio, received hundreds of videos of pre-pubescent children engaged in a variety of sexual acts and had also bought access with cryptocurrency.

U.S. Border Patrol Agent Paul Casey Whipple was arrested, also, in San Antonio in December, 2017, for producing and sharing child pornography over the site. FBI agents determined the videos were produced in Hondo, TX, going back to 2015.

Image via DOJ

———

UPDATE (16th October 18:00 UTC): Updated to include coverage from a press conference on Wednesday and more information on those indicted, including former law enforcement officers.