2021-11-17

Global child porn investigation led police to Lunenburg/Queens region — court documents

An international online sting, guided with the aid of U.S. Department of Homeland Security and Internal Revenue Service officials and targeting users of a darknet child pornography website, led investigators to search a Queens resident's home and sport utility vehicle (SUV) and the person's Lunenburg County computer business, newly released court records show.

Authorities claim a South Shore man, under the cloak of data-concealing virtual private networks (VPNs), used the digital currency Bitcoin to purchase child exploitation content from a darknet website which, like such sites, is hidden from conventional search engines and designed to be accessed via anonymous internet communications.

Details of the large-scale global investigation are detailed in court records recently released to LighthouseNOW in response to the newspaper's request for a judge to unseal documents, including search warrant applications called Informations to Obtain (ITOs), search warrants and records of what was seized during the searches.

Documents show the RCMP's internet child exploitation unit (ICE) sought and received judicial authorization in January to examine a 2018 Kia Sorento and properties in Greenfield and Bridgewater. The searches led to a 57-year-old North Brookfield, Queens County man facing accessing and possessing child pornography charges and weapons offences. Allegations concerning Vernon Lionel Bent are navigating the legal system and the matters return to a Bridgewater court in December. None of the allegations have been tested in court and he is presumed innocent. Bent has not entered a plea.

Bent's defence attorney, Alan Ferrier, is interested to learn how the prosecution intends to try and prove the reliability of information that is four years old and whether there is validity to anything beyond law enforcement's belief or opinion. The charge document alleges child sex abuse material was accessed between May and June 2017 in Lunenburg County.

"The defence is not acknowledging that the ITO is of any value whatsoever and ultimately the search that was conducted is dependent on on the validity of the search warrant," Ferrier told LighthouseNOW, "so the validity of the ITO and the search warrant has yet to be challenged."

Crown lawyer Rob Kennedy of the specialized legal unit that deals with prosecuting child porn cases in the province said it is not uncommon for there to be lulls between police being alerted to an issue and the execution of a judicially authorized warrant. Sometimes, he told LighthouseNOW, the time factor can have an affect.

"It's just the nature of the beast with this kind of stuff," Kennedy said. "There are multiple agencies communicating with each other about various things and things don't move quickly."

The search warrant records obtained by LighthouseNOW indicate "law enforcement agents" accessed the website-in-question in September 2016 and documented its contents, of which "the overwhelming majority of images and videos observed ... appear to be child pornography or child erotica," reads the ITO written by Oliver Roberts, a Mountie with the province's ICE unit. "In fact, the upload page on the website clearly mandates: 'do not upload adult porn.'."

The ITO, dated January 2021, also indicated the darknet site, the identity of which is not disclosed in the court documents, remains active. In the recent interview with LighthouseNOW, Kennedy also confirmed it is still operational.

The darknet is considered by police as hidden commercial markets selling or brokering transactions on products, such as stolen financial documents, unlicenced pharmaceuticals and contraband porn.

"This is a fairly significant investigation," Kennedy added, noting "there are others" in Nova Scotia in the crosshairs, but he declined to get into details. Interpol and police agencies across Europe, Asia and North America are involved in the multinational probe, he said.

As of fall 2020, court records obtained by LighthouseNOW indicate, "over 346 arrests in 13 countries, Canada included," have resulted from the U.S.-led probe. "In addition to these arrests there [have] also been no less than 25 children victims rescued from further hands on child sexual abuse. Charges have been brought against many of the arrested suspects globally and there are still other suspects who are awaiting sentencing or are in the forensic stage of investigation."

The court documents obtained by LighthouseNOW indicated the website, as of November 2017, contained nearly seven terabytes of data (enough to fill over 10,000 CDs), including about 118,000 unique videos available for downloading with over 11 million files downloaded by users.

Examples of downloaded files viewed, as described by police in the records, involve graphic sexual assaults of a six-month-old infant and two children ranging in age of at least two-to-eight-years-old.

"The whole thing is very much Homeland Security and South Korean police; that's where it all originated from," Cpl. Chris Marshall, a spokesman for the province's Mounties, told LighthouseNOW when asked about the RCMP involvement.

LighthouseNOW reached out to the Department of Homeland Security for comment but did not get a response.

"It wasn't until March 2020 that Homeland Security contacted the RCMP here," Kennedy explained to LighthouseNOW.

In the ITO, Roberts said that, with the use of the darknet, Bitcoin and VPNs, "it is impossible to identify the users through conventional police investigative techniques. Only when a suspect makes a mistake or police are able to gain access to darknet sites are we able to locate and identify those responsible."

The court records indicated authorities conducted an undercover purchase of so-called VIP access to the website, which assigns a unique Bitcoin address to which the user can send funds in order to obtain account privileges.

"Any user has the ability to create a free account ... by providing a username and password," it is explained in the records. "Only after the user has an account, can the user browse previews of videos that are available for download and post text ... in order to download videos from the site, however, the user must use 'points', which are allocated to users ..."

For example, users can earn points by "uploading videos depicting the sexual exploitation of children [and] referring new users .... paying for a 'VIP' account, which entitles a user to unlimited downloads [and] lasts for six months ..."

"Law enforcement uses sophisticated commercial services offered by several different blockchain analysis companies to investigate bitcoin transactions," the 22-page ITO continues. A blockchain is described in the documents as decentralized public ledger that records all Bitcoin transactions.

"These companies analyze the blockchain in an attempt to identify the individuals or groups involved with bitcoin transactions," reads the ITO. "Specifically, these companies create large databases that group bitcoin transactions into 'clusters' through analysis of data underlying bitcoin transactions. Through numerous unrelated investigations, law enforcement has found the intelligence provided by these companies to be reliable ...."

Through use of the third party blockchain analysis software, American investigators were able to link Bitcoin addresses to virtual currency exchanges, which maintain transaction records, reads the ITO. A subpoena to a U.S. Bitcoin exchanger yielded customer names and other identifiable information.

The details led police to the Lunenburg/Queens region where they believe a suspect there engaged in Bitcoin transactions with Bitcoin addresses within the website "in amounts that are consistent with payments for 'points.'"

The RCMP's ICE unit led raids in early January, targeting the suspect's personal vehicle, Lunenburg County computer business and Queens County home. Records of what was seized show 36 exhibits were catalogued by police from the home search, such as cellphones, computer tablets, notebooks, a laptop, thumb drive and memory card. Books titled Life is Beautiful and Make Your Dreams Happen were also among items seized. Police also took custody of a rifle and ammunition.

Twenty exhibits, mostly laptop and desktop computers, were seized from the business, which registry of joint stocks records indicate now has a different owner. Two sheets of paper containing usernames and passwords were taken as evidence from the SUV.

In addition, Kennedy alleges 40 image files of interest to the case were found during the searches.

The Mounties publicized the case, charges and arrest in a news release in February.