As responses from exchanges with those users’ identity information began to pour in, the team started the process of assembling more complete profiles of their targets. They began to collect the names, faces, and photos of hundreds of men—they were almost all men—from all walks of life, everywhere in the world. Their descriptions crossed boundaries of race, age, class, and nationality. All these individuals seemed to have in common was their gender and their financial connection to a worldwide, hidden haven of child abuse.
By this time, the team felt they’d pinned down the site’s Korean administrator with confidence. They’d gotten a search warrant for Son Jong-woo’s Gmail accounts and many of his exchange records, and they could see that he alone seemed to be receiving the cashed-out proceeds from the site—not his father, who increasingly seemed to the investigators like an unwitting participant, a man whose son had hijacked his identity to create crypto-currency accounts. In Son Jong-woo’s emails, they found photos of the younger man for the first time—selfies he’d taken to show friends where he’d chipped a tooth in a car accident, for instance. He was a thin, unremarkable-looking young Korean man with wide-set eyes and a Beatles-esque mop-top of black hair.
But as their portrait of this administrator took shape, so too did the profiles of the hundreds of other men who had used the site.* A few immediately stuck out to the investigative team: One suspect, to the dismay of Thomas Tamsi and his Homeland Security colleagues, was an HSI agent in Texas. Another, they saw with a different sort of dread, was the assistant principal of a high school in Georgia. The school administrator had posted videos of himself on social media singing duets, karaoke-style, with teenage girls from his school. The videos might otherwise have been seen as innocent. But given what they knew about the man’s Bitcoin payments, agents who had more experience with child exploitation warned Janczewski that they might reflect a form of grooming.
These were men in privileged positions of power, with potential access to victims. The investigators could immediately see that, as they suspected, they would need to arrest some of Welcome to Video’s users as quickly as possible, even before they could arrange the takedown of the site. Child exploitation experts had cautioned them that some offenders had systems in place to warn others if law enforcement had arrested or compromised them—code words or dead man’s switches that sent out alerts if they were absent from their computer for a certain period of time. Still, the Welcome to Video investigation team felt they had little choice but to move quickly and take that risk.
Another suspect, around the same time, came onto their radar for a different reason: He lived in Washington, DC. The man’s home, in fact, was just down the street from the US attorneys’ office, near the capital’s Gallery Place neighborhood. He happened to live in the very same apartment building that one of the prosecutors had only recently moved out of.
That location, they realized, might be useful to them. Janczewski and Gambaryan could easily search the man’s home and his computers as a test case. If that proved the man was a Welcome to Video customer, they would be able to charge the entire case in DC’s judicial district, overcoming a key legal hurdle.
As they dug deeper, though, they found that the man was a former congressional staffer and held a high-level job at a prestigious environmental organization. Would arresting or searching the home of a target with that sort of profile cause him to make a public outcry, sinking their case?
Just as they trained their sights on this suspect in their midst, however, they found that he had gone strangely quiet on social media. Someone on the team had the idea to pull his travel records. They found that he had flown to the Philippines and was about to fly back to DC via Detroit.
This discovery led the agents and prosecutors to two thoughts: First, the Philippines was a notorious destination for sex tourism, often of the kind that preyed on children—the HSI office in Manila constantly had its hands full with child exploitation cases. Second, when the man flew back to the US, Customs and Border Protection could legally detain him and demand access to his devices to search for evidence—a bizarre and controversial carve-out in Americans’ constitutional protections that, in this case, might come in handy.
Would their DC-based suspect sound the alarm and tear the lid off their investigation, just as it was getting started?