How the world’s largest child porn marketplace was undone by a right-click
The South Korean operator of the world’s largest dark web child pornography file-sharing site has been indicted by US prosecutors, according to documents unsealed yesterday in federal court.
Jong Woo Son, 23, is already serving an 18-month prison sentence in South Korea on related charges. The site he allegedly ran, Welcome To Video, was accessible only on the anonymized Tor network. But the site’s administrator was sloppy. According to court filings, US investigators from ICE and the IRS simply right-clicked on Welcome To Video’s homepage, selected “View Page Source,” and instantly had what they needed.
“In reviewing the source code, law enforcement discovered that Welcome To Video had failed to conceal its server’s IP address,” says a forfeiture complaint filed this week by US authorities. The IP address was registered in Son’s name, and resolved to a server located in his bedroom. On it, authorities discovered about 250,000 videos showing children, toddlers, and infants being sexually abused. At least 23 minors were identified and rescued as a result of the investigation.
Welcome To Video’s users downloaded more than a million files totaling 8 terabytes. Top keyword search terms included “PTHC” (“pre-teen hardcore porn”); “PEDO” (“pedophile”); “2yo%” (“two-year-old); and “4yo%” (“four-year-old”).
Nearly half of those searches served images that were not previously known to authorities, prosecutors said. And this, apparently, was the point. Customers paid 0.02 Bitcoin (about $160) for “points” that were good for up to 230 downloads, or 0.03 Bitcoin (about $325-$350 at the time, now roughly $240) for points that unlocked a six-month “VIP” membership offering unlimited downloads. Users also earned points for referrals and for uploading new videos, perpetuating the cycle of abuse. (The site automatically checked each new upload and rejected duplicates.)
According to court filings in a related child pornography case, there has been a “sharp increase” in the “severity and depravity” of child pornography in the last decade. The problem is fueled by new technology that both allows for the secure storage of large numbers of files and the creation of “safe havens” where abusers and pedophiles can meet.
“This increase is reflected in the changes in the content of the images over time, as infants and toddlers are now regularly victimized by child pornography offenders and the victims are forced into more brutal and degrading sexual activity,” the filings say.
To find Welcome To Video’s customers, investigators analyzed Bitcoin transactions to identify both uploaders and downloaders, which has thus far led to the arrests of 337 users in nearly 40 countries, including 23 US states and Washington, DC. Two users committed suicide before they could be tried.
A partial list of names released by the Department of Justice, as well as case filings reviewed by Quartz, reveal that Welcome To Video’s US users included an ICE investigator, a member of the US Border Patrol, a US Air Force reservist, a senior citizen, and a previous offender in Washington, D.C. found with 455,000 hours of video downloaded from the site, or almost 52 years worth of footage.
The senior citizen
When Ernest Wagner, 70, was arrested at the end of 2018, the name of the website being investigated was still a closely-held secret. Filings in his case said only that authorities were looking into something referred to in court documents as “The Website.” The then-unnamed site was “physically located in South Korea,” according to prosecutors, and disclosure of its identity could alert further suspects to the existence of the investigation, allowing them to warn others, destroy evidence, or flee.
Wagner, a Washington State resident, allegedly uploaded 84 videos to the site of children being sexually abused. He earned points for those uploads, which allowed him to download at least 40 videos posted by other users. Investigators caught Wagner by tracing his Bitcoin transactions back to his BTC Exchange account, which he had registered under his own name.
Wagner is charged with conspiracy to distribute child pornography. He is not allowed to use the internet, travel, or associate with anyone under the age of 18 while his case is pending.
The Border Patrol agent
In December 2017, FBI agents in Texas arrested a Border Patrol agent named Paul Casey Whipple. They raided his home after the National Center for Missing and Exploited Children received a tip from “a foreign law enforcement agency” that someone had uploaded “multiple files depicting the exploitation of a minor female child,” according to court records.
The filings say investigators used metadata attached to the flagged images and videos, which showed they had been produced in Hondo, Texas between 2015 and 2017. They were then able to narrow their search to Whipple, 35, who happened to live in Hondo and was traced through his Bitcoin transactions found on the Welcome To Video server.
Whipple confessed to having produced the videos, which he shared on Welcome To Video, an FBI affidavit says.
“Whipple stated he had access to the minor child on a number of occasions, and verified the minor child is under the age of 18,” it explains.
He has been charged with sexual exploitation of children/minors, and production, distribution, and possession of child pornography, and is now in custody awaiting trial.
“The defendant’s employment as a federal border patrol officer, if anything, raises additional concerns about his ability to comply with the law or submit to authority,” says a detention motion filed by prosecutors, who argued that Whipple was too dangerous to be freed on bail.
The ICE investigator
Richard Nikolai Gratkowski joined US Immigration and Customs Enforcement (ICE) in 2008, and worked for the agency’s investigative arm, Homeland Security Investigations (HSI). FBI agents in Texas arrested Gratkowski, 40, a few weeks after Whipple’s capture.
“All Department of Homeland Security employees are held to the highest standards of behavior and ethics,” ICE said in a statement at the time. “While ICE does not comment on personnel matters, the agency is fully cooperating with the FBI and the Department of Homeland Security’s Office of Inspector General (OIG) regarding this issue.”
Gratkowski, who has since been fired and sentenced to 70 months in federal prison, thought he had covered his tracks by using Bitcoin and Tor. However, Gratkowski used his own bank account and government ID to buy the Bitcoin. Like the others, investigators used these transactions to identify Gratkowski after seizing the Welcome To Video server.
“As a trained federal agent, with a demonstrated ability with and awareness of technical methods to avoid detection, the Defendant poses a heightened risk to minor victims,” says a detention order filed last year. “The evidence also shows that recent life stressors have contributed to escalating dangerous behavior, and the added stress of this prosecution will likely escalate things further.”
In 2010, Gratkowski was part of a raid team that executed a search warrant on the wrong house, resulting in an innocent man being shot in the shoulder by an agent with an assault rifle.
The Air Force reservist
In August 2018, investigators interviewed Brian James LaPrath, a US Air Force veteran and reservist living in San Diego, California. LaPrath, 34, told agents that he had been viewing child pornography since he was 12.
“The defendant explained that he would use a Virtual Private Network service to anonymize accessing such sites,” says a court filing in LaPrath’s case. “The defendant stated he sought counseling approximately two years ago from his pastor and from a trained medical professional. The defendant explained that he reached out for assistance because he knew that it was wrong to view child pornography.”
LaPrath explained that he would always “shred” the videos he downloaded off of Welcome To Video, and never saved any of the files for more than a few hours.
“Defendants appear to be like any other law-abiding citizen—they work, worship, and have the support of their families,” says a separate filing in the LaPrath case. “Their crimes against children, and the reasons they commit them, have been hidden from colleagues, friends, and loved ones. Despite that fact, the perpetrator’s private crime is a horrific one, and offenders must be held accountable for the damage they have done.”
LaPrath had set up his Bitcoin exchange account in his own name, which made it easy for law enforcement to track him down. LaPrath pleaded guilty to one count of international money laundering, and is now serving 18 months in federal prison.
The hoarder
When federal agents showed up at Nicholas Allen Stengel’s Washington, DC home in March 2018, his wife at first refused to let them in. Once cops showed her the search warrant authorizing them to be there, she complied and said Stengel was inside.
But Stengel wouldn’t come out. Agents searched the apartment, and found Stengel in the bathroom, standing in the tub, holding a knife.
“Law enforcement immediately observed that Stengel had multiple deep lacerations to both of his wrists and his neck and observed that he had lost a lot of blood,” says the warrant application. “Stengel was assisted out into the living room so he could receive immediate medical aid.” He was then taken to the hospital for “life-saving medical treatment.”
Investigators discovered 6,884 video files and 805,457 image files depicting child pornography on various devices belonging to Stengel. He later admitted to downloading videos from the Welcome To Video website totaling 455,000 hours in length—more than a half-century’s worth of footage, as noted by NBC News. Like the others, investigators traced Stengel through Bitcoin transactions found on Welcome To Video’s server in South Korea.
Ongoing harm
As a filing in another of the dozens of related cases says, children who are forced to participate in pornography “are harmed initially during the production of images, and the perpetual nature of child pornography distribution on the Internet causes significant additional harm to victims.” Kids who have been exploited this way “live with persistent concern over who has seen images of their sexual abuse,” it explains.
When such images and videos are shared on platforms such as Welcome To Video, it “validates and normalizes the sexual abuse of children” and “contribute[s] to the further production of child pornography and, in the process, to the sexual abuse of children.”
Penalties, as the defendants have now discovered (or will soon), are severe. When Gratkowski, the former ICE agent, is released, he will be required to submit to random polygraph testing, install monitoring software on any computer he uses, and allow his probation officer to randomly search all of his devices. He will not be allowed to associate with any child under the age of 18 without being supervised by an adult specifically approved in writing by authorities, and will be prohibited from living within 1,000 feet of a school (colleges and universities included), playground, public housing complex, or within 100 feet of a public swimming pool or video arcade.
While some of those swept up in the Welcome To Video case have already been sentenced, others, like Paul Casey Whipple, the ex-Border Patrol agent, have not. But if there was any doubt about Welcome To Video’s intentions, the upload page stated clearly: “Do not upload adult porn.”
“Children around the world are safer because of the actions taken by US and foreign law enforcement to prosecute this case and recover funds for victims,” US Attorney Jessie Liu said in a statement. “We will continue to pursue such criminals on and off the darknet in the United States and abroad, to ensure they receive the punishment their terrible crimes deserve.”
Sign up for the Quartz Daily Brief, our free daily newsletter with the world’s most important and interesting news.
More stories from Quartz:
