15 ms·

A Bitcoin bust that took down the web’s biggest child abuse site

221 points by jbegley 5y ago

bigbillheck 5y ago
> He right-clicked on the page Huh, usually right-clicking is what you do for NFTs.
ktownsend 5y ago
Sorry if this is too long form for HN, but if you read the article you clearly have some patience as well. I'm surprised all the comments here seem to be solely around the technical details with blockchain and crypto. It's HN, I get the technical bent and find it interesting as well, but the human side of this one is pretty rough, and it made me appreciate that there are people -- likely sorely underpaid relative to what they'd make elsewhere -- following these (sordid) threads, often at significant emotional cost to themselves. I did appreciate the odd bits of relief like 'Bitcoin Jesus' and 'Octopus Guy': > At one point Faruqui remembers a German official asking him, as they stood in the cold outside the Seoul hotel where they were staying, how the Americans had gotten the Koreans on board so quickly. “Oh, Octopus Guy,” Faruqui had explained. “You don’t have Octopus Guy. We have Octopus Guy.” But mostly, humor aside, it made me wonder for the 1000th time if I'm making the right career and life choices myself in a comfy, well paid job where I'm probably near the top of the pyramid in terms of professional respect, working on problems that I think have reach and import in my narrow speciality ... but am I really solving the problems that matter? I'm not in advertising (thank whatever god you imagine), more in security lately, so the work isn't meaningless ... but I work with some brilliant people whose technical capacities I admire, and I wonder what would happen if a bit more of that gray matter was directed at solving some of the terrible problems described here? So much money is invested in understanding the psychology of how to force better engagement and squeeze out every last penny of hapless consumers in whatever social network. What would happen if a fraction of that went into trying to focus on influencing the people making these awful, life-destroying choices and somehow (re)sensitizing them to the costs of their actions and navigating them away from that preventatively, even if the success rate is only 1-2 percent? Or identifying victims of abuse through posting patterns to try to make sure they're potentially being flagged to receive content and help they may not be able to believe even exists? How much is invested in psychological profiling to maximize profit for the most banal advertising ends, when maybe for once some of that gray matter making those algorithms could do something positive identifying patterns indicative of abuse, beyond just the current simple fig leaf approach to pretend the owners of your social network of choice cares about your well being. I'd love to do better, and I'd take a decent pay cut if I felt I could do something for that, and maybe even get to feel a bit better as a person in this weird world as a side effect. Seems like we not only should but could do a lot more here, before this gets to the criminal investigation level.
- wmf 5y ago
  FAANGs all have child safety departments where you can get paid and do good.
  - FireBeyond 5y ago
    I have to feel that on some level, actively seeking out jobs where you review CSAM on a daily basis should be at least something of a red flag to those employers.
    - ktownsend 5y ago
      Indeed, I'd hate to be the recruiter for that. I can't imagine the kind of psychological profile you'd need for something like that. The end of the article describes the psychological cost the investigation had on the investigators who were parents themselves. But even at an algorithmic level, it seems like there are all kinds of red flags you could pull out of public posts and do a much better job of redirecting potentially victimized people to some organisations doing meaningful work to help victims. How many categories does my online profile fit in based on all my interests, and how many hundreds of bright people are wasting their lives to discern that I happen to like A + B + C and I'm in financial bracket F, with political leaning G ... to try to show me an advert I'm probably just blocking anyway.
    - wmf 5y ago
      Child safety isn't only about CSAM BTW.
duxup 5y ago
> Many of the site’s users seemed to be paying the site directly from the addresses where they’d purchased the coins, on exchanges like Coinbase and Circle, based in the United States. At least they make that part easy.
moron123 5y ago
Crypto haters: See, bitcoin is not private, it sucks. Bitcoin maxis: See, Bitcorn can't be used for crime. Everyone will see what they want.
- A4ET8a8uTh0 5y ago
  "He was taken aback by what he saw: Many of this child abuse site’s users—and, by all appearances, its administrators—had done almost nothing to obscure their cryptocurrency trails. An entire network of criminal payments, all intended to be secret, was laid bare before him." It is a weird story. On the one end, anyone using crypto by now should know, there is a trail following it ( there are means to obscure it, but a lot of ways to screw up too ). On the other, does that mean this investigation was a low hanging fruit?
  - colechristensen 5y ago
    In order to use crypto secretly you have to heavily launder your money in a way that’s not easy or guaranteed to work.. and the laundering itself is a crime which isn’t so easy to hide. People think it’s private because they are told so but actually it’s a public ledger where anyone can see what you’ve spent and associate you fairly easily by your behavior and links to not so secret crypto addresses.
    - lmeyerov 5y ago
      We've been getting increasingly involved in crypto investigation discussions, and largely: - money side is getting more anonymous, e.g., monero / tornado - ... in theory. Money crime still often using less anonymous schemes and often at exchange points, so chainanalysis-style companies still make sense, though decreasingly so IMO. A lot of the startups have shifted to verifying contracts, or providing (dubious) KYC risk scores, and interesting to consider why. - For our customer base (half of which are sec/fraud/crime teams)... what's happening is the criminal platforms + participants have broken (digital) operational security. So it is more about offchain data (app logs, ...) and sometimes combining onchain<>offchain data. So not too different from our projects tracking malware/phishing/misinformation/etc via OSINT techniques (IP addresses, unmasked metadata, ...), or detecting account takeovers on their websites - ... more new, IMO, in this space is areas like graph neural networks that have the potential to act smarter & more automatically, e.g., understanding behavior. Very early days here though, so interesting times !
ilamont 5y ago
For Gambaryan and Janczewski, the story was utterly typical. IRS-CI agents did shoe-leather detective work, carried guns, and made arrests, just like their FBI and DEA counterparts. But because of the IRS’s dowdy public image, they often found that fellow agents treated them like accountants. “Don’t audit me,” their peers from other law enforcement branches would joke when they were introduced in meetings. Most IRS-CI agents had heard the line enough times that it warranted an instant eye roll. Reminds me of the postal inspector who blew open the case of two foreign agents with sniper rifles and other weapons impersonating federal officers in Washington DC. The Secret Service believed their B.S. story about being DHS investigators working on J6 investigations. 4 SS agents apparently took bribes from them, including one who protects the president's wife. https://www.reuters.com/world/us/us-secret-service-places-agents-leave-over-gifts-phony-cops-2022-04-07/ https://www.reuters.com/world/us/us-secret-service-places-ag...
- jacquesm 5y ago
  That sounds like something pretty bad was brewing there. That postal inspector did better than the Secret Service, which in a normal world shouldn't be remotely possible.
  - numbsafari 5y ago
    The Secret Service has been a dumpster fire for decades.
    - ganzuul 5y ago
      By design or by incompetence?
    - jacquesm 5y ago
      Yes, but really: in a role like that accepting gifts without immediately reporting even the attempt of such gifts up the chain to ask for guidance on how to play it seems to be beyond stupid, that's not just your garden level variety of incompetence but something entirely different.
shiado 5y ago
This article is terrible honestly. Statements like "tracing a cryptocurrency that once seemed untraceable". Excuse me what? Who thought this? Idiots at three letter agencies? Pedophiles and drug dealers? Here's what the Bitcoin whitepaper itself speculated. "As an additional firewall, a new key pair should be used for each transaction to keep them from being linked to a common owner. Some linking is still unavoidable with multi-input transactions, which necessarily reveal that their inputs were owned by the same owner. The risk is that if the owner of a key is revealed, linking could reveal other transactions that belonged to the same owner." And here's an early Bitcointalk thread. Traceability was discussed and acknowledged from the very beginning. https://bitcointalk.org/index.php?topic=241 https://bitcointalk.org/index.php?topic=241
- cyral 5y ago
  Why does that make this article terrible? The criminals involved believed that Bitcoin was untraceable, as does your every day non-technical person, and the article explains how that isn't the case.
  - civilized 5y ago
    Because software engineers are the main characters of the universe and everything must be written from their perspective.
- Aaronstotle 5y ago
  Because of BTC's prominence on darknet markets, people who hadn't heard of it naively assumed it wasn't traceable. It's reasonable to assume that if you were purchasing illicit substances online, that the currency wouldn't be traceable, when it reality it was because no one really cared at the time for this new bitcoin thing. Keep in mind how most people don't read documentation for anything, let alone a whitepaper
  - werber 5y ago
    I probably am not alone, but if I hadn't wasted money on drugs a decade ago and had just kept the bitcoin I would be a rich person. No one I know read a white paper back then, we just found the Wild West, snorted, shot and popped it up
vander_elst 5y ago
Is there any real way to be anonymous while using Bitcoin and actually exchanging it to fiat currency? Are there any exchanges that are not regulated and don't require any authentication e.g. an ATM that gives you cash for Bitcoin?
- yifanl 5y ago
  Define anonymous, but you could in theory sell your wallet to someone else wholesale and they pay in cash for whatever value of bitcoin is in the wallet. It's still potentially leaky because you're relianing on the buyer to not get that traced back to you.
  - vander_elst 5y ago
    > define anonymous I guess like for several security topics: the process to find my identity is too expensive/impractical/takes too much time. I mean, we know it is possible to use brute force to crack encrypted data, it just takes a trillions of years or trillions of dollars so it becomes practically impossible.
- wmf 5y ago
  There's LocalBitcoins but it's under increased law enforcement scrutiny.
- x86_64Ubuntu 5y ago
  I think this is an old nut that's long been cracked, and the answer is no. With Anti-ML and KYC legislation, it's really difficult for any company to act like an unwitting agent, and still have access to financial system.
- kache_ 5y ago
  pay your taxes man, it's not worth it but fwiw with monero they don't know where the crypto came from. Technically, you could have mined it in the early days. So as long as you have to report on sale only and not origination, everyone can party on
- colinmhayes 5y ago
technonerd 5y ago
>He right-clicked on the page and chose “View page source” from the resulting menu. >... >He spotted what he was looking for almost instantly: an IP address. In fact, to Gambaryan’s >surprise, every thumbnail image on the site seemed to display, within the site’s HTML, the IP >address of the server where it was physically hosted: 121.185.153.64. That is indeed an opsec failure, along with using that same IP on an exchange. Which later turns out to be a computer aka the abuse website in the guys apartment.
- Kadin 5y ago
  Well, he only ended up doing 6 months in jail -- maybe not the strongest motivation for "OPSEC".
WaitWaitWha 5y ago
I will (continue to be) cynical. This article and many others recently[1] read like it is targeted at the non-technical general public. To be more succinct, they read like 'current crypto currency solutions like Bitcoins are all bad, and only used by bad people.' The articles are begging for a savior to step in and provide a solution; maybe the government... [1] from the same author, but he is not the only one of course: https://www.wired.com/story/hydra-market-shutdown/ https://www.wired.com/story/hydra-market-shutdown/ https://www.wired.com/story/bitcoin-seizure-record-doj-crypto-tracing-monero/ https://www.wired.com/story/bitcoin-seizure-record-doj-crypt... https://www.wired.com/story/north-korea-cryptocurrency-theft-ethereum/ https://www.wired.com/story/north-korea-cryptocurrency-theft...
werber 5y ago
I'm not a fan or opponent of crypto, but the pervasiveness of child pornography is insane. I started doing sex work at 11 and was later human trafficked, and got a tattoo when I turned 18 near my groin, in large part to know what images and videos were of me underage. I consume and love porn, and have no shame in that, and I'm sure a lot of reposters think they are posting a barely legal image, but I have seen myself as a child online so many times in legitimate places, Tumblr, twitter, reddit, etc. This is a reality for so many people who have been abused, there was an article recently on here about MindGeek, and there efforts to make sure they didn't have child porn on their products, and the takedown of x tube and all of that change, but it's fucking hard. It's so much easier to tell if it's an 8 year old than a 15 year old, even though the trauma is similar for the victim. I don't know, I'm rambling, consume ethical pornography.
- throwra620 5y ago
- giraffe_lady 5y ago
  For a couple years around a decade ago I moderated a decent-sized but not massive subreddit and the frequency of child porn reports on there was chilling. It was every week at least. This was not at all a sexual sub, not even adjacent to porn or titillating images or anything. Reddit was more permissive than they should have been for a lot longer than they should have been and may not be representative. But even accounting for that, it really opened my eyes to how common it can be. This is also what turned me against free speech fundamentalism in the end. Every attempt at getting this addressed was shot down in the name of free speech and anti-censorship. Every time it was actually improved caused what felt like an internet-wide backlash against the changes.
  - commandlinefan 5y ago
    > shot down in the name of free speech and anti-censorship Not to defend the material in question in any way - but the people who expressed concern... were right. As soon as Reddit gave mods the tools they needed to expunge the really terrible stuff from the site, those tools were almost immediately used to ban completely unrelated conspiracy subs.
lifefeed 5y ago
If you want to read the small ruling mentioned in the last section, on the 4th amendment and the blockchain: United States v. Gratkowski, No. 19-50492 (5th Cir. 2020) https://law.justia.com/cases/federal/appellate-courts/ca5/19-50492/19-50492-2020-06-30.html https://law.justia.com/cases/federal/appellate-courts/ca5/19...
hanselot 5y ago
Animats 5y ago
Chainalysis is now working on NFT-related "rug pulls".[1] $2.8 billion in 2021. Far more money in that than in child abuse. [1] https://www.coindesk.com/markets/2021/12/17/defi-rug-pull-scams-pulled-in-28b-this-year-chainalysis/ https://www.coindesk.com/markets/2021/12/17/defi-rug-pull-sc...
- colinmhayes 5y ago
  NFTs are perfect for money laundering because 1. their value is completely arbitrary 2. The launderer can buy an artists whole collection, and legitimately sell some for more than they were bought for since everyone can see the artists NFTs are selling for huge sums 3.NFTs can pay the minter a percentage every time they're sold.
  - nyolfen 5y ago
    besides #3 this also describes the conventional art world
    - 542458 5y ago
      The conventional art world generally has more requirements in terms of reporting. Also, in the conventional art world people would be extremely suspicious if all of an artist’s works were bought up by anonymous individuals and nearly immediately turned around for significant profit - but with NFTs it’s par for the course.
    - colinmhayes 5y ago
      Except they’re easier to transport.
    - otterley 5y ago
      Yes, and?
- outsb 5y ago
  I'm probably slightly tempered from just having read this article, but curious how anyone could confidently arrive at an economic estimate of the global trade in CSAM
smokey_circles 5y ago
Bitcoin is the polar opposite of an untraceable currency. This is a strangely repeated claim. The whole point of bitcoin is trustless action. I don't have to trust you because I can verify the transaction. If anyone can verify a transaction, it's obviously traceable. I think the confusion seems from the fact that you do not need to issue a form of identity to use bitcoin. Which is how cash works too. If your intention is to turn bitcoin into fiat, you will be found out. Fiat is highly regulated, your identity is required. Unless you turned bitcoin into pure cash, which is unlikely at scale. "Ah but Monero" no. Monero requires you to trust the authors because you can't verify any of the transactions, especially the genesis blocks. Use at your own peril. Bitcoin does not in anyway attempt to mirror this. Half the value of a bank is that the bank authenticates transactions have actually happened. Bitcoin does too. Publicly. There's nothing "anonymous" about it. There's just no requirement to tie an address to a human identity, but that doesn't mean it can't be done (and you should always act like it has been done, lest the law come for you too). The idea that crytocurrencies empower criminals because they're anonymous is braindead. There's a lower barrier of entry but scams are older than Central economies are. Crypto is just the newest vehicle and getting rid of crypto will not get rid of scammers (or ransomware). For example: The Bangladeshi bank heist.
- dav_Oz 5y ago
  >The whole point of bitcoin is trustless action. I don't have to trust you because I can verify the transaction. If anyone can verify a transaction, it's obviously traceable. But you do not need everyone to verify but instead take a shortcut and just verify the proof. That's what zero knowledge proofs are all about [0]. Unfortunately a lot of people pass over these subtleties. So, I'm not exactly sure what you mean by "verify". >"Ah but Monero" no. Monero requires you to trust the authors because you can't verify any of the transactions, especially the genesis blocks. Use at your own peril. Can you elaborate on this point? By "verify" again, you simply mean a transparent blockchain where every tx and address is unambiguously visible to all. E.g. Ring signatures aren't something you need to trust the authors.[1][2] But in general, yes, at some point without being able to "verify" the whole code I have to "trust". This is true for every sufficiently large enterprise. For example there are a lot of (complicated) mathematical proofs I didn't fully go through but nonetheless used shamelessly in my mathematical modeling because I "trusted" its applications (I have learned from). [0]https://vitalik.ca/general/2021/01/26/snarks.html https://vitalik.ca/general/2021/01/26/snarks.html [1]https://eprint.iacr.org/2015/1098 https://eprint.iacr.org/2015/1098 [2]https://eprint.iacr.org/2019/508 https://eprint.iacr.org/2019/508
warent 5y ago
If anyone knows of any organizations to help combat child sex exploitation, please comment them here.
- WaxedChewbacca 5y ago
- warent 5y ago
  Two organizations I know of: - https://ourrescue.org/ https://ourrescue.org/ - https://www.thorn.org/ https://www.thorn.org/
stormdennis 5y ago
Since the start of the pandemic, two years, I've used cash a handful of times. People who use cash now stand out as suspicious almost. The rest of us are an open book. Privacy is dead unless we get a truly untraceable cryptocurrency that is in general use. Privacy is a right and shouldn't be taken away to supposedly make it harder for the minority to get away with crime. It doesn't because what they'll do is use mules and proxies to mask themselves creating a new layer of victims in the process. As with anti-laundering legislation, the law-abiding are the ones punished by their lives being made more difficult.
codedokode 5y ago
The article mentions extradition, so I would like to hijack this thread to disscuss that. Don't you think that extradition is something like a custom from an age of slave trade? Queens and Presidents trade their citizens like slaves. A person born in one country, protected by its Constitution, gets brought into other country where none of constitutional rights apply any more, where he doesn't know local laws and local language, doesn't have a lawyer, doesn't know his rights and where he cannot defend himself as well as in his own country. Furthermore, a crime he has commited might be punished much more strictly in that other country, for example, 20 years instead of 4 years and additionally he can be charged with crimes that are not a crime in his country and wouldn't allow to extradite him. Also, that country might not allow criminal's family to visit him in prison (the right that he had in the country of origin). How is this compatible with human rights? The proper process should be like this: if country A thinks that someone from country B has commited a crime against them then they should come to that country and prove it in a court without being able to add additional charges. This is the only way where the defendand won't be stripped of their rights. Am I missing something here and there are valid reasons why prosecution for international crime cannot be implemented like this?
- joatmon-snoo 5y ago
  Extradition is generally thought of as when a person from country A who is convicted of a crime in A flees to country B, and country B then extradites said person to country A to serve out their sentence. It's not meant to be a system to convict people incapable of defending themselves in a foreign court. Plus, there are extradition treaties: countries A and B have to _agree_ to the conditions under which A will extradite to B and under which B will extradite to A. > The proper process should be like this: if country A thinks that someone from country B has committed a crime against them then they should come to that country and prove it in a court without being able to add additional charges. Courts in country B generally have close to zero understanding of the legal minutiae of country A. Ignoring jurisdiction questions, what you're suggesting is that courts in country B have to: * understand the hierarchy of the legal system in A (what precedent is binding, what precedent is advisory), * understand what is and isn't a law (e.g. if A is a common law jurisdiction and B is not), * somehow reconcile legal procedures in A with legal procedures in B (e.g. when are you allowed to ask the judge to dismiss a case? what's an acceptable situation to ask for N more weeks for discovery? how much time is considered reasonable? who do you file paperwork with?) * somehow decide what constitutes a qualified attorney (e.g. in the U.S., every state has its own qualification process for attorneys to practice in that state, so being admitted to the bar in Colorado doesn't mean you can practice in Florida, and this also extends to the federal govt) and goodness knows what else. In general it's good to assume that if there are millions of people in a given system, there are _reasons_ (not necessarily good ones, just plausible ones) the system works that way, particularly when it's a system you have zero understanding of.
munificent 5y ago
> ... users could obtain points not just by purchasing them but also by uploading videos. ... The page also warned that uploaded videos would be checked for uniqueness; only new material would be accepted—a feature that, to the agents, seemed expressly designed to encourage more abuse of children. Rewarding for uploads + de-duping is so deeply sinister. This is a game whose primary mechanic was to pay people to go out and actively rape children. What. The. Fuck.
JasonFruit 5y ago
> IRS-CI agents did shoe-leather detective work, carried guns, and made arrests, just like their FBI and DEA counterparts. I would love to see someone attempt a Constitutional justification for the IRS's dedicated police force. That I would dearly love to see.
- legalcorrection 5y ago
  What makes you think the Constitution has anything to say on the matter? I mean, on what basis would you think the FBI is constitutional but the IRS's criminal investigations division isn't?
  - JasonFruit 5y ago
    That's an interesting position you ascribe to me on no evidence whatsoever. If you read the Constitution, there's a body in each state which is supposed to "execute the Laws of the Union", and it's not the FBI either.
    - legalcorrection 5y ago
      Almost immediately after the US Constitution came into effect in 1789, the first federal law enforcement agency, the US Marshals Service, was created. So clearly, the founding generation thought that federal law enforcement was authorized by the Constitution. Federal law enforcement is clearly justified under the necessary and proper clause. Without federal law enforcement, there is no ability to force states to comply with federal law, which the Constitution clearly requires by 1) explicitly saying that federal law is supreme over state law, and 2) prohibiting various practices by the states. Imagine a federal court having to call upon state police to enforce their subpoenas, subpoenas that may target the people who sign the state polices' checks. Or imagine the Department of Justice having to call upon the state militia to arrest a state's governor for the commission of a federal crime. I think it's pretty obvious that federal law enforcement is "necessary and proper" to the exercise of Congress's enumerated powers. There is no sovereignty without the ability to deploy violence to enforce it.
Proven 5y ago

221 points by jbegley 5y ago

> He right-clicked on the page Huh, usually right-clicking is what you do for NFTs.

Sorry if this is too long form for HN, but if you read the article you clearly have some patience as well. I'm surprised all the comments here seem to be solely around the technical details with blockchain and crypto. It's HN, I get the technical bent and find it interesting as well, but the human side of this one is pretty rough, and it made me appreciate that there are people -- likely sorely underpaid relative to what they'd make elsewhere -- following these (sordid) threads, often at significant emotional cost to themselves. I did appreciate the odd bits of relief like 'Bitcoin Jesus' and 'Octopus Guy': > At one point Faruqui remembers a German official asking him, as they stood in the cold outside the Seoul hotel where they were staying, how the Americans had gotten the Koreans on board so quickly. “Oh, Octopus Guy,” Faruqui had explained. “You don’t have Octopus Guy. We have Octopus Guy.” But mostly, humor aside, it made me wonder for the 1000th time if I'm making the right career and life choices myself in a comfy, well paid job where I'm probably near the top of the pyramid in terms of professional respect, working on problems that I think have reach and import in my narrow speciality ... but am I really solving the problems that matter? I'm not in advertising (thank whatever god you imagine), more in security lately, so the work isn't meaningless ... but I work with some brilliant people whose technical capacities I admire, and I wonder what would happen if a bit more of that gray matter was directed at solving some of the terrible problems described here? So much money is invested in understanding the psychology of how to force better engagement and squeeze out every last penny of hapless consumers in whatever social network. What would happen if a fraction of that went into trying to focus on influencing the people making these awful, life-destroying choices and somehow (re)sensitizing them to the costs of their actions and navigating them away from that preventatively, even if the success rate is only 1-2 percent? Or identifying victims of abuse through posting patterns to try to make sure they're potentially being flagged to receive content and help they may not be able to believe even exists? How much is invested in psychological profiling to maximize profit for the most banal advertising ends, when maybe for once some of that gray matter making those algorithms could do something positive identifying patterns indicative of abuse, beyond just the current simple fig leaf approach to pretend the owners of your social network of choice cares about your well being. I'd love to do better, and I'd take a decent pay cut if I felt I could do something for that, and maybe even get to feel a bit better as a person in this weird world as a side effect. Seems like we not only should but could do a lot more here, before this gets to the criminal investigation level.

wmf 5y ago
FAANGs all have child safety departments where you can get paid and do good.
- FireBeyond 5y ago
  I have to feel that on some level, actively seeking out jobs where you review CSAM on a daily basis should be at least something of a red flag to those employers.
  - ktownsend 5y ago
    Indeed, I'd hate to be the recruiter for that. I can't imagine the kind of psychological profile you'd need for something like that. The end of the article describes the psychological cost the investigation had on the investigators who were parents themselves. But even at an algorithmic level, it seems like there are all kinds of red flags you could pull out of public posts and do a much better job of redirecting potentially victimized people to some organisations doing meaningful work to help victims. How many categories does my online profile fit in based on all my interests, and how many hundreds of bright people are wasting their lives to discern that I happen to like A + B + C and I'm in financial bracket F, with political leaning G ... to try to show me an advert I'm probably just blocking anyway.
  - wmf 5y ago
    Child safety isn't only about CSAM BTW.

duxup 5y ago

> Many of the site’s users seemed to be paying the site directly from the addresses where they’d purchased the coins, on exchanges like Coinbase and Circle, based in the United States. At least they make that part easy.

moron123 5y ago

Crypto haters: See, bitcoin is not private, it sucks. Bitcoin maxis: See, Bitcorn can't be used for crime. Everyone will see what they want.

A4ET8a8uTh0 5y ago
"He was taken aback by what he saw: Many of this child abuse site’s users—and, by all appearances, its administrators—had done almost nothing to obscure their cryptocurrency trails. An entire network of criminal payments, all intended to be secret, was laid bare before him." It is a weird story. On the one end, anyone using crypto by now should know, there is a trail following it ( there are means to obscure it, but a lot of ways to screw up too ). On the other, does that mean this investigation was a low hanging fruit?
- colechristensen 5y ago
  In order to use crypto secretly you have to heavily launder your money in a way that’s not easy or guaranteed to work.. and the laundering itself is a crime which isn’t so easy to hide. People think it’s private because they are told so but actually it’s a public ledger where anyone can see what you’ve spent and associate you fairly easily by your behavior and links to not so secret crypto addresses.
  - lmeyerov 5y ago
    We've been getting increasingly involved in crypto investigation discussions, and largely: - money side is getting more anonymous, e.g., monero / tornado - ... in theory. Money crime still often using less anonymous schemes and often at exchange points, so chainanalysis-style companies still make sense, though decreasingly so IMO. A lot of the startups have shifted to verifying contracts, or providing (dubious) KYC risk scores, and interesting to consider why. - For our customer base (half of which are sec/fraud/crime teams)... what's happening is the criminal platforms + participants have broken (digital) operational security. So it is more about offchain data (app logs, ...) and sometimes combining onchain<>offchain data. So not too different from our projects tracking malware/phishing/misinformation/etc via OSINT techniques (IP addresses, unmasked metadata, ...), or detecting account takeovers on their websites - ... more new, IMO, in this space is areas like graph neural networks that have the potential to act smarter & more automatically, e.g., understanding behavior. Very early days here though, so interesting times !

ilamont 5y ago

For Gambaryan and Janczewski, the story was utterly typical. IRS-CI agents did shoe-leather detective work, carried guns, and made arrests, just like their FBI and DEA counterparts. But because of the IRS’s dowdy public image, they often found that fellow agents treated them like accountants. “Don’t audit me,” their peers from other law enforcement branches would joke when they were introduced in meetings. Most IRS-CI agents had heard the line enough times that it warranted an instant eye roll. Reminds me of the postal inspector who blew open the case of two foreign agents with sniper rifles and other weapons impersonating federal officers in Washington DC. The Secret Service believed their B.S. story about being DHS investigators working on J6 investigations. 4 SS agents apparently took bribes from them, including one who protects the president's wife. https://www.reuters.com/world/us/us-secret-service-places-agents-leave-over-gifts-phony-cops-2022-04-07/ https://www.reuters.com/world/us/us-secret-service-places-ag...

jacquesm 5y ago
That sounds like something pretty bad was brewing there. That postal inspector did better than the Secret Service, which in a normal world shouldn't be remotely possible.
- numbsafari 5y ago
  The Secret Service has been a dumpster fire for decades.
  - ganzuul 5y ago
    By design or by incompetence?
  - jacquesm 5y ago
    Yes, but really: in a role like that accepting gifts without immediately reporting even the attempt of such gifts up the chain to ask for guidance on how to play it seems to be beyond stupid, that's not just your garden level variety of incompetence but something entirely different.

shiado 5y ago

This article is terrible honestly. Statements like "tracing a cryptocurrency that once seemed untraceable". Excuse me what? Who thought this? Idiots at three letter agencies? Pedophiles and drug dealers? Here's what the Bitcoin whitepaper itself speculated. "As an additional firewall, a new key pair should be used for each transaction to keep them from being linked to a common owner. Some linking is still unavoidable with multi-input transactions, which necessarily reveal that their inputs were owned by the same owner. The risk is that if the owner of a key is revealed, linking could reveal other transactions that belonged to the same owner." And here's an early Bitcointalk thread. Traceability was discussed and acknowledged from the very beginning. https://bitcointalk.org/index.php?topic=241 https://bitcointalk.org/index.php?topic=241

cyral 5y ago
Why does that make this article terrible? The criminals involved believed that Bitcoin was untraceable, as does your every day non-technical person, and the article explains how that isn't the case.
- civilized 5y ago
  Because software engineers are the main characters of the universe and everything must be written from their perspective.
Aaronstotle 5y ago
Because of BTC's prominence on darknet markets, people who hadn't heard of it naively assumed it wasn't traceable. It's reasonable to assume that if you were purchasing illicit substances online, that the currency wouldn't be traceable, when it reality it was because no one really cared at the time for this new bitcoin thing. Keep in mind how most people don't read documentation for anything, let alone a whitepaper
- werber 5y ago
  I probably am not alone, but if I hadn't wasted money on drugs a decade ago and had just kept the bitcoin I would be a rich person. No one I know read a white paper back then, we just found the Wild West, snorted, shot and popped it up

vander_elst 5y ago

Is there any real way to be anonymous while using Bitcoin and actually exchanging it to fiat currency? Are there any exchanges that are not regulated and don't require any authentication e.g. an ATM that gives you cash for Bitcoin?

yifanl 5y ago
Define anonymous, but you could in theory sell your wallet to someone else wholesale and they pay in cash for whatever value of bitcoin is in the wallet. It's still potentially leaky because you're relianing on the buyer to not get that traced back to you.
- vander_elst 5y ago
  > define anonymous I guess like for several security topics: the process to find my identity is too expensive/impractical/takes too much time. I mean, we know it is possible to use brute force to crack encrypted data, it just takes a trillions of years or trillions of dollars so it becomes practically impossible.
wmf 5y ago
There's LocalBitcoins but it's under increased law enforcement scrutiny.
x86_64Ubuntu 5y ago
I think this is an old nut that's long been cracked, and the answer is no. With Anti-ML and KYC legislation, it's really difficult for any company to act like an unwitting agent, and still have access to financial system.
kache_ 5y ago
pay your taxes man, it's not worth it but fwiw with monero they don't know where the crypto came from. Technically, you could have mined it in the early days. So as long as you have to report on sale only and not origination, everyone can party on
colinmhayes 5y ago

technonerd 5y ago

>He right-clicked on the page and chose “View page source” from the resulting menu. >... >He spotted what he was looking for almost instantly: an IP address. In fact, to Gambaryan’s >surprise, every thumbnail image on the site seemed to display, within the site’s HTML, the IP >address of the server where it was physically hosted: 121.185.153.64. That is indeed an opsec failure, along with using that same IP on an exchange. Which later turns out to be a computer aka the abuse website in the guys apartment.

Kadin 5y ago
Well, he only ended up doing 6 months in jail -- maybe not the strongest motivation for "OPSEC".

WaitWaitWha 5y ago

I will (continue to be) cynical. This article and many others recently[1] read like it is targeted at the non-technical general public. To be more succinct, they read like 'current crypto currency solutions like Bitcoins are all bad, and only used by bad people.' The articles are begging for a savior to step in and provide a solution; maybe the government... [1] from the same author, but he is not the only one of course: https://www.wired.com/story/hydra-market-shutdown/ https://www.wired.com/story/hydra-market-shutdown/ https://www.wired.com/story/bitcoin-seizure-record-doj-crypto-tracing-monero/ https://www.wired.com/story/bitcoin-seizure-record-doj-crypt... https://www.wired.com/story/north-korea-cryptocurrency-theft-ethereum/ https://www.wired.com/story/north-korea-cryptocurrency-theft...

werber 5y ago

I'm not a fan or opponent of crypto, but the pervasiveness of child pornography is insane. I started doing sex work at 11 and was later human trafficked, and got a tattoo when I turned 18 near my groin, in large part to know what images and videos were of me underage. I consume and love porn, and have no shame in that, and I'm sure a lot of reposters think they are posting a barely legal image, but I have seen myself as a child online so many times in legitimate places, Tumblr, twitter, reddit, etc. This is a reality for so many people who have been abused, there was an article recently on here about MindGeek, and there efforts to make sure they didn't have child porn on their products, and the takedown of x tube and all of that change, but it's fucking hard. It's so much easier to tell if it's an 8 year old than a 15 year old, even though the trauma is similar for the victim. I don't know, I'm rambling, consume ethical pornography.

throwra620 5y ago
giraffe_lady 5y ago
For a couple years around a decade ago I moderated a decent-sized but not massive subreddit and the frequency of child porn reports on there was chilling. It was every week at least. This was not at all a sexual sub, not even adjacent to porn or titillating images or anything. Reddit was more permissive than they should have been for a lot longer than they should have been and may not be representative. But even accounting for that, it really opened my eyes to how common it can be. This is also what turned me against free speech fundamentalism in the end. Every attempt at getting this addressed was shot down in the name of free speech and anti-censorship. Every time it was actually improved caused what felt like an internet-wide backlash against the changes.
- commandlinefan 5y ago
  > shot down in the name of free speech and anti-censorship Not to defend the material in question in any way - but the people who expressed concern... were right. As soon as Reddit gave mods the tools they needed to expunge the really terrible stuff from the site, those tools were almost immediately used to ban completely unrelated conspiracy subs.

lifefeed 5y ago

If you want to read the small ruling mentioned in the last section, on the 4th amendment and the blockchain: United States v. Gratkowski, No. 19-50492 (5th Cir. 2020) https://law.justia.com/cases/federal/appellate-courts/ca5/19-50492/19-50492-2020-06-30.html https://law.justia.com/cases/federal/appellate-courts/ca5/19...

hanselot 5y ago

Animats 5y ago

Chainalysis is now working on NFT-related "rug pulls".[1] $2.8 billion in 2021. Far more money in that than in child abuse. [1] https://www.coindesk.com/markets/2021/12/17/defi-rug-pull-scams-pulled-in-28b-this-year-chainalysis/ https://www.coindesk.com/markets/2021/12/17/defi-rug-pull-sc...

colinmhayes 5y ago
NFTs are perfect for money laundering because 1. their value is completely arbitrary 2. The launderer can buy an artists whole collection, and legitimately sell some for more than they were bought for since everyone can see the artists NFTs are selling for huge sums 3.NFTs can pay the minter a percentage every time they're sold.
- nyolfen 5y ago
  besides #3 this also describes the conventional art world
  - 542458 5y ago
    The conventional art world generally has more requirements in terms of reporting. Also, in the conventional art world people would be extremely suspicious if all of an artist’s works were bought up by anonymous individuals and nearly immediately turned around for significant profit - but with NFTs it’s par for the course.
  - colinmhayes 5y ago
    Except they’re easier to transport.
  - otterley 5y ago
    Yes, and?
outsb 5y ago
I'm probably slightly tempered from just having read this article, but curious how anyone could confidently arrive at an economic estimate of the global trade in CSAM

smokey_circles 5y ago

Bitcoin is the polar opposite of an untraceable currency. This is a strangely repeated claim. The whole point of bitcoin is trustless action. I don't have to trust you because I can verify the transaction. If anyone can verify a transaction, it's obviously traceable. I think the confusion seems from the fact that you do not need to issue a form of identity to use bitcoin. Which is how cash works too. If your intention is to turn bitcoin into fiat, you will be found out. Fiat is highly regulated, your identity is required. Unless you turned bitcoin into pure cash, which is unlikely at scale. "Ah but Monero" no. Monero requires you to trust the authors because you can't verify any of the transactions, especially the genesis blocks. Use at your own peril. Bitcoin does not in anyway attempt to mirror this. Half the value of a bank is that the bank authenticates transactions have actually happened. Bitcoin does too. Publicly. There's nothing "anonymous" about it. There's just no requirement to tie an address to a human identity, but that doesn't mean it can't be done (and you should always act like it has been done, lest the law come for you too). The idea that crytocurrencies empower criminals because they're anonymous is braindead. There's a lower barrier of entry but scams are older than Central economies are. Crypto is just the newest vehicle and getting rid of crypto will not get rid of scammers (or ransomware). For example: The Bangladeshi bank heist.

dav_Oz 5y ago
>The whole point of bitcoin is trustless action. I don't have to trust you because I can verify the transaction. If anyone can verify a transaction, it's obviously traceable. But you do not need everyone to verify but instead take a shortcut and just verify the proof. That's what zero knowledge proofs are all about [0]. Unfortunately a lot of people pass over these subtleties. So, I'm not exactly sure what you mean by "verify". >"Ah but Monero" no. Monero requires you to trust the authors because you can't verify any of the transactions, especially the genesis blocks. Use at your own peril. Can you elaborate on this point? By "verify" again, you simply mean a transparent blockchain where every tx and address is unambiguously visible to all. E.g. Ring signatures aren't something you need to trust the authors.[1][2] But in general, yes, at some point without being able to "verify" the whole code I have to "trust". This is true for every sufficiently large enterprise. For example there are a lot of (complicated) mathematical proofs I didn't fully go through but nonetheless used shamelessly in my mathematical modeling because I "trusted" its applications (I have learned from). [0]https://vitalik.ca/general/2021/01/26/snarks.html https://vitalik.ca/general/2021/01/26/snarks.html [1]https://eprint.iacr.org/2015/1098 https://eprint.iacr.org/2015/1098 [2]https://eprint.iacr.org/2019/508 https://eprint.iacr.org/2019/508

warent 5y ago

If anyone knows of any organizations to help combat child sex exploitation, please comment them here.

WaxedChewbacca 5y ago
warent 5y ago
Two organizations I know of: - https://ourrescue.org/ https://ourrescue.org/ - https://www.thorn.org/ https://www.thorn.org/

stormdennis 5y ago

Since the start of the pandemic, two years, I've used cash a handful of times. People who use cash now stand out as suspicious almost. The rest of us are an open book. Privacy is dead unless we get a truly untraceable cryptocurrency that is in general use. Privacy is a right and shouldn't be taken away to supposedly make it harder for the minority to get away with crime. It doesn't because what they'll do is use mules and proxies to mask themselves creating a new layer of victims in the process. As with anti-laundering legislation, the law-abiding are the ones punished by their lives being made more difficult.

codedokode 5y ago

The article mentions extradition, so I would like to hijack this thread to disscuss that. Don't you think that extradition is something like a custom from an age of slave trade? Queens and Presidents trade their citizens like slaves. A person born in one country, protected by its Constitution, gets brought into other country where none of constitutional rights apply any more, where he doesn't know local laws and local language, doesn't have a lawyer, doesn't know his rights and where he cannot defend himself as well as in his own country. Furthermore, a crime he has commited might be punished much more strictly in that other country, for example, 20 years instead of 4 years and additionally he can be charged with crimes that are not a crime in his country and wouldn't allow to extradite him. Also, that country might not allow criminal's family to visit him in prison (the right that he had in the country of origin). How is this compatible with human rights? The proper process should be like this: if country A thinks that someone from country B has commited a crime against them then they should come to that country and prove it in a court without being able to add additional charges. This is the only way where the defendand won't be stripped of their rights. Am I missing something here and there are valid reasons why prosecution for international crime cannot be implemented like this?

joatmon-snoo 5y ago
Extradition is generally thought of as when a person from country A who is convicted of a crime in A flees to country B, and country B then extradites said person to country A to serve out their sentence. It's not meant to be a system to convict people incapable of defending themselves in a foreign court. Plus, there are extradition treaties: countries A and B have to _agree_ to the conditions under which A will extradite to B and under which B will extradite to A. > The proper process should be like this: if country A thinks that someone from country B has committed a crime against them then they should come to that country and prove it in a court without being able to add additional charges. Courts in country B generally have close to zero understanding of the legal minutiae of country A. Ignoring jurisdiction questions, what you're suggesting is that courts in country B have to: * understand the hierarchy of the legal system in A (what precedent is binding, what precedent is advisory), * understand what is and isn't a law (e.g. if A is a common law jurisdiction and B is not), * somehow reconcile legal procedures in A with legal procedures in B (e.g. when are you allowed to ask the judge to dismiss a case? what's an acceptable situation to ask for N more weeks for discovery? how much time is considered reasonable? who do you file paperwork with?) * somehow decide what constitutes a qualified attorney (e.g. in the U.S., every state has its own qualification process for attorneys to practice in that state, so being admitted to the bar in Colorado doesn't mean you can practice in Florida, and this also extends to the federal govt) and goodness knows what else. In general it's good to assume that if there are millions of people in a given system, there are _reasons_ (not necessarily good ones, just plausible ones) the system works that way, particularly when it's a system you have zero understanding of.

munificent 5y ago

> ... users could obtain points not just by purchasing them but also by uploading videos. ... The page also warned that uploaded videos would be checked for uniqueness; only new material would be accepted—a feature that, to the agents, seemed expressly designed to encourage more abuse of children. Rewarding for uploads + de-duping is so deeply sinister. This is a game whose primary mechanic was to pay people to go out and actively rape children. What. The. Fuck.

JasonFruit 5y ago

> IRS-CI agents did shoe-leather detective work, carried guns, and made arrests, just like their FBI and DEA counterparts. I would love to see someone attempt a Constitutional justification for the IRS's dedicated police force. That I would dearly love to see.

legalcorrection 5y ago
What makes you think the Constitution has anything to say on the matter? I mean, on what basis would you think the FBI is constitutional but the IRS's criminal investigations division isn't?
- JasonFruit 5y ago
  That's an interesting position you ascribe to me on no evidence whatsoever. If you read the Constitution, there's a body in each state which is supposed to "execute the Laws of the Union", and it's not the FBI either.
  - legalcorrection 5y ago
    Almost immediately after the US Constitution came into effect in 1789, the first federal law enforcement agency, the US Marshals Service, was created. So clearly, the founding generation thought that federal law enforcement was authorized by the Constitution. Federal law enforcement is clearly justified under the necessary and proper clause. Without federal law enforcement, there is no ability to force states to comply with federal law, which the Constitution clearly requires by 1) explicitly saying that federal law is supreme over state law, and 2) prohibiting various practices by the states. Imagine a federal court having to call upon state police to enforce their subpoenas, subpoenas that may target the people who sign the state polices' checks. Or imagine the Department of Justice having to call upon the state militia to arrest a state's governor for the commission of a federal crime. I think it's pretty obvious that federal law enforcement is "necessary and proper" to the exercise of Congress's enumerated powers. There is no sovereignty without the ability to deploy violence to enforce it.

Proven 5y ago