Christopher M. Janczewski, Zia M. Faruqui, Kimberly A. Reece and the W2V Team

Listen to Christopher Janczewski, Zia Faruqui and Kimberly Reece discuss their work:

Criminal investigators typically follow the money to see where it leads, but when federal agents learned about a heinous, global child pornography enterprise on the dark web, they faced a double problem. The criminal operators were extraordinarily opaque, concealing their internet protocol addresses, and they didn’t use cash, checks or credit cards but bitcoin, a cryptocurrency that hides identities of sellers and the buyers. 

A team from IRS Criminal Investigations, the Department of Justice and Homeland Security Investigations joined together in 2018 and 2019 to shut down this heinous site that exploited prepubescent children, toddlers and infants, and that boasted more than one million video downloads.  

The work of the team—led by Christopher Janczewski, a special agent with IRS Criminal Investigations, Zia Faruqui, an assistant U.S. attorney and Kimberly Reece, a criminal analyst with Homeland Security Investigations, resulted in the rescue of at least 25 abused and exploited children in the United States and abroad. The team also helped bring to justice the operation’s administrator, and more than 330 high-volume users located in 23 states and 12 countries. 

In addition, the team’s work disrupted “a vile site where users worldwide uploaded a quarter-million child pornography videos, which other users paid cryptocurrency to download and see,” said Jonathan Hooks, chief of the Justice Department’s Cyber Crimes Section. 

The seizure of more than 250,000 unique videos represented the largest haul of its kind. Children in the videos were as young as six months old. 

“The reason this case is significant is because an individual used the darknet as a mechanism to make money by selling access to child exploitation material,” said Richard Downing, a deputy assistant attorney general. “He was able to get away with it by having people to pay him in bitcoin in order to download material. 

“It was awful because it spread child exploitation material and encouraged more child exploitation materials to be uploaded to the site,” Downing added. “This website was a significant harm to society and a technological challenge for law enforcement.” 

The case began with a tip to Janczewski and his IRS colleague, Tigran Gambaryan, about the website, Welcome to Video, and its use of bitcoin in exchange for child pornography. U.S. federal agencies faced an immediate challenge: how to find the identity of the person or people involved and how to follow the cryptocurrency flows.   

Agents did so when discovering a flaw that let them get two IP addresses, which they traced to South Korea. To see how the money flowed, agents got information from a confidential source on bitcoin accounts believed to be associated with Welcome to Video addresses.  

Creating their own Welcome to Video user accounts and cloaking their identities, agents sent bitcoin payments, which ultimately led them to how the elements tied together. They traced the operation to Jong Woo Son, the 23-year-old administrator who started Welcome to Video in 2015 and kept an internet server in his bedroom, authorities said. A raid of Son’s home in South Korea and a search of the server led to hundreds of users. 

Each member of the investigative team brought unique expertise that led to the success of the takedown. 

“Chris is the virtual currency expert,” explained Steven Cagen, a special agent in charge of Homeland Security Investigations. “Kim brought all of the intelligence and target packages together to support the criminal investigative team. She took in all the user information to help identify the main targets based on the frequency they used the system. Then she sent the information to foreign law enforcement officials.  

“Zia was the face of the prosecution,” Cagen said. “He coordinated the global prosecution with law enforcement in all the foreign countries involved. There is nobody like Zia in law enforcement. There is nothing too big, and nothing he can’t do.” 

The agents received assistance from the South Korean National Police, the National Crime Agency of the United Kingdom and the German Federal Criminal Police. In addition to filing multiple indictments, the Justice Department filed a forfeiture complaint to seize cryptocurrency accounts used by 24 people in five countries, with the goal of recovering these funds for the victims of the site.  

“Children around the world are safer because of the actions taken by U.S. and foreign law enforcement to prosecute this case and recover funds for victims,” Jessie K. Liu, then the U.S. attorney for the District of Columbia, said when the case was unsealed in October 2019.    

Downing said the protection of children was pivotal for the investigative team of Janczewski, Reece, Faruqui and their colleagues. 

“Few cases are more important than in this kind of situation,” Downing said. “The law enforcement team was highly motivated to work together because there was a deep feeling of how critical it was that we not let this kind of conduct continue.” 

In 2020, the team worked with European law enforcement on a related action to shut down a site called DarkScandals. That site also accepted payment via cryptocurrency and offered customers child pornography as well as adult videos.