Hunting Warhead: Episode 1, “Hacker vs Hacker”
Articles Blog

Hunting Warhead: Episode 1, “Hacker vs Hacker”

January 14, 2020


DF: The following episode contains difficult subject matter. Listener discretion is advised. HH: So I’ll just start when we’re in the bar. Yeah? DF: Sure. Yeah. HH: Okay. So I’m in this burger bar in Sydney …Sorry I’m not. [chuckles] I’m in this burger bar in Brisbane…uhhhh…it’s hard… DF: It’s super hard HH: I think it’s a difficult story to tell. And perhaps also to follow because it’s got so many layers in it. DF: That’s Håkon. Håkon Høydal. He’s an investigative journalist. And he’s based in Oslo. HH: You got the story about how me and Einar found the server of this site. You got the story of the police operation and you got the story about the people behind the site itself on the darknet. DF: Håkon writes for a paper called Verdens Gang. It’s famous in Norway. Famous enough that everyone there just calls it by its initials, “VG. ” HH: And also then you have the story of the arrest itself. It’s got several layers.
HH: And also then you have the story of the arrest itself. It’s got several layers. DF: Håkon originally broke this story. Talking about it usually isn’t an issue. But for some reason, this time around, it’s kind of messing with him. HH: Sorry. It’s also a difficult story because of the subject… DF: It is a tough subject. For sure. But I don’t think that’s really the issue. Håkon’s used to covering nasty subjects. What’s messing with him, I think, is that he’s self-conscious. He’s used to telling this story from the outside. He’s not used to being a character in it. And what he’s telling me now is the story behind that story. The biggest story of his career. HH: So I’m in this burger bar in Brisbane. It’s lunchtime and it’s really really crowded and I’m there with two other guys. DF: Two other guys he’s only just met. Hakon’s trying to get a read on them, trying to size them up. HH: Jon, he seem to be like the younger one. He had blond hair, perfect teeth, firm handshake. And looked very rather lean and fit. And Paul, the other guy, he looked like he had been doing handiwork a lot and looked like a robust guy. I mean they both looked like they’ve been working out. DF: So, the kind of guys you probably don’t want to upset. Which is a problem. Because Håkon’s flown all the way from Oslo to do just that: to confront them about what they’ve been up to.
Which is a problem. Because Håkon’s flown all the way from Oslo to do just that: to confront them about what they’ve been up to. HH: But I was a bit surprised that they wanted to take me out to have lunch because I told them that I’ve got some information that I need to talk to you about. So I was hoping that we could meet at an office. Because this wasn’t some information that I wanted to share with everyone. DF: It’s the kind of information that can destroy reputations. Families. Lives. HH: I’m quite nervous because we were in this open bar with a lot of other people (It was) noisy. We have to talk quite loud to be able to
we were in this open bar with a lot of other people (It was) noisy. We have to talk quite loud to be able to hear each other and I’m about to tell them that I know that they’re the ones who are running the largest child abuse website on the darknet. DF: This is the story of the men who operate in the most disturbing corners of the internet. It’s the story of the police who track down those men. Who hunt undercover, in the dark. And it’s the story of the reporters who try to shed light on this hidden underworld. My name is Daemon Fairless. And this is “Hunting Warhead.” DF: I’ve just arrived in Oslo. DF: Hi Håkon? It’s Daemon. How are you? Yeah we’re in the lobby. Fantastic. Great. Bye. DF: It’s the first time I’m meeting Håkon. DF: Hakon is slim and tall. He’s about six-six. And he is in his late forties. But there’s still something boyish about him. Maybe it’s his enthusiasm. Maybe it’s his unruly blond hair.
Maybe it’s his enthusiasm. Maybe it’s his unruly blond hair. HH: Finally you’re here. DF: I’m here to find out more about the Australians. The guys running the largest child pornography site on the dark-web. HH: Okay, you’ll have to sign in, you’re visiting VG. And you’re from CBC. DF: I’m also here because even though this is a crime that spans the globe, it’s also a Canadian story. HH: Okay, you first. HH: So much security. HH: Okay so this is my floor. DF: VG’s offices are four floors of clean lines, glass windows and open-concept workstations. It’s part modern newsroom, part IKEA catalogue. DF: Among other things, Håkon investigates the scariest places on the internet. Including the very worst kind of online abuse: child pornography. Håkon and I share some common ground. And some common beliefs. I’ve spent the past few years researching and writing about extremely violent men — including dangerous sexual offenders. My interest lies in understanding the deep motivations of the people who commit serious acts of violence. Essentially, what interests me is forensic psychology. It’s natural to want to turn away from uncomfortable stories. I get that. And I respect it. The problem is, you can’t change what don’t understand. And you can’t possibly understand the stories you avoid. So, like Håkon, the more I’ve come to understand just how prevalent and how destructive child pornography is the more compelled I am to cover it. As a journalist. But also as a father. That said, you don’t just wake up one morning and dive headfirst into the worst places on the internet. For Håkon, it was more of a step-by-step descent. One that began about six years ago. HH: In 2013 a colleague of mine got a tip about a website where there was…a website for revenge porn. And that it would be possible to identify some of these guys who had published these images. DF: Back in 2012 hackers across the world had started breaking into people’s iCloud accounts. iCloud was notoriously easy to crack at the time. Guys would break into women’s accounts and post their pictures on so-called revenge porn sites. And let’s be clear, “revenge porn” isn’t pornography. Nor is it revenge. It’s online abuse by anonymous trolls. Some of these women were ex-girlfriends. Some were famous. But most of them were total strangers. A lot of the pictures these guys stole were intimate and personal. So, Håkon and one of his colleagues, Julia Ingebrigtsen, published an exposé on one of these revenge porn sites. HH: It was one of the first articles about revenge porn I think. DF: The story was critical of the Norwegian police, and of the government too, for not cracking down on revenge porn, despite disproportionately high numbers of Norwegian users on these sites. HH: And that’s when I got an email a couple of weeks after that, from a man. He wrote in the email you know I’m really annoyed, I’ve been trying to get in touch with you guys at VG for a long time now. I’ve been trying to email all these different guys. And no one is answering me.
in touch with you guys at VG for a long time now. I’ve been trying to email all these different guys. And no one is answering me. And are aren’t you interested in what I’m having to offer?
I’ve been trying to email all these different guys. And no one is answering me. And are aren’t you interested in what I’m having to offer? And this guy who had this tip, this hacker, he was Einar. DF: Okay. So your first contact with Einar was through this annoyed HH – Annoying email. Yeah. EOS: My name is Einar Otto Stangvik DF: Meet Einar… EOS: The way I recall this is that I was annoyed by something they wrote that I felt was incorrect. So I sent this annoyed email to both Håkon and Julia pointing out that this is wrong, this is wrong, this is wrong. This is garbage…whatever. And I think that testifies to my general frustration at the time as well. DF: Einar is a big part of this story. He’s the hacker Håkon was talking about. Although “hacker” isn’t a term Einar’s crazy about. EOS: When I see hacker in the media that usually means just someone who breaks something down breaks in somewhere. And that isn’t the brand that I would want to have. On my persona because that’s not what I am doing. I am trying to come up with solutions. I try to build things. I try to fix things — not tear them down as such.
On my persona because that’s not what I am doing. I am trying to come up with solutions. I try to build things. I try to fix things — not tear them down as such. So I just feel it doesn’t describe me very well. It’s just imprecise. DF: But in a lot of ways, Einar is the typical hacker: hyper-focused, logical, super methodical. But he’s not all stereotypes. He’s also stylish, fit, emotionally sophisticated and highly self-aware. DF: Back when Einar sent that email to Hakon, he was working a job he couldn’t stand. EOS: I was really getting depressed with my whole career choice. What am I doing here? What is this? Why am I selling made up solutions to non-existent problems and so forth. I eventually figured that I have to do something meaningful with whatever knowledge I’d amassed up until then and so I sat down one day and read some articles and saw that well iCloud hacks that seems to be the thing now. So that sort of left a lingering feeling that well hey maybe this is something that I can do something with. DF: Einar decides to take on some of these guys. To hack the hackers. EOS: Right around Christmas 2012 I started building a system that would monitor these different sort of shady forums for newly posted images. DF: Einar’s system downloads the metadata from pictures that were being put up on revenge-porn sites. So, not the pictures themselves but the information about those pictures. File names. When the shot was taken. GPS coordinates. EOS: So through I’d say a week or so I’d amassed millions upon millions of these metadata collections… DF: That’s the haystack. But Einar’s looking for a needle. He builds another program. This one… EOS: To automatically detect which GPS locations, if found, was in Norway. DF: Most of the Norwegian photos aren’t hacked. In fact most of them are completely tame. But then Einar’s system flags something: EOS: A posting with I believe like 15 pictures from what seemed like different girls — not like totally explicit pictures but obviously privates. The same guy posting a response to another person like further down the threads said who says that the girls know that I have those photos iCloud dot dot dot dot. So it felt like I’d hit exactly the sort of posting now that I was looking for. DF: Einar creates a few user accounts, different personas. And he uses these personas to manipulate the site administrators. Eventually he gets one of them to reveal an IP address, Which Einar uses to identify the man who originally posted those 15 stolen photos. DF: Amazing. DF: Einar was running a full-fledged undercover operation entirely on his own. It’s around this time that he reads Håkon’s article on revenge porn and fires off his disgruntled email, pointing out inaccuracies in the story. EOS: Håkon was friendly in his reply and they fixed the article, I think, and he invited me over for coffee and I sat down with him and presented like the whole story…. DF: …the whole story is pretty incredible. The guy Einar identified was a 24-year-old man named Tor Johannes Helleland. Helleland was a local politician in Drammen, that’s a city in southern Norway. Also, both of Helleland’s parents are high-ranking members of Norway’s national Conservative Party. And a number of the women whose photos he had hacked were members of the youth wing of the party. So it was a political bombshell. EOS: I wrote two reports — 40, 50, 60 — I don’t know (how many) pages long detailing all of my communication with different people, the administrator, the forums and detailing my operation how I found, what I found — and what I found. Like everything. DF: Einar had shared these reports with two of the women whose photos had been stolen. He encouraged them to go to the police. They did. But the cops dismissed both cases. EOS: I tried reaching out to the police at that point and they basically said that well hey we’re not going to investigate this no matter what. So whatever, call somewhere else. DF: The police weren’t interested in pursuing the case. But Håkon…Håkon was super interested.
investigate this no matter what. So whatever, call somewhere else. DF: The police weren’t interested in pursuing the case. But Håkon…Håkon was super interested. HH – Well I mean I was really happy that he contacted me because I mean obviously you saw that it was a crazy story. EOS: Sure. And I remember telling the story and I felt that I managed to tell an exciting and interesting story and you seemed to think that it was really interesting as well. HH: But I’m not sure if you were willing to give me your name. I mean I don’t think you… EOS: No. HH: I don’t think you gave me your name in the first emails. EOS: I was I suppose somewhat afraid of being both investigated by police for coming even close to that sort of thing. I mean I had no idea. DF: Einar wanted to remain anonymous. But, for the story to be credible, Håkon needed Einar to go on the record. EOS – It was a big, big leap. HH – Yeah. And then we got you on the front page. Yeah! EOS – Hmm yeah. Super Hacker. EOS: And a couple of days later he was forced by his political party to come forward. So he published a press release where he apologized and so forth. And the state attorney also made it clear that the police in Drammen should investigate and they did and they eventually found there were more than 30 girls that he had either hacked by guessing passwords or getting to log on to their accounts on his computer and then logging their passwords. So he was notorious. He hacked left and right. DF: Helleland had hacked the accounts of 30 young women — none of whom were underage — and he ended up serving one month in jail. VG recently contacted Helleland through text and email, informing him that his case is mentioned in this podcast. He hasn’t replied. Helleland’s political career was over. But Håkon and Einar’s working relationship? That was just getting started. EOS: I mean so you’ve probably heard of the site. DF: Yeah. Totally. EOS: And so it isn’t much of a surprise to anyone that there’s a lot of stuff… DF: Here’s stating the obvious: The web can lead you down some rabbit holes. DF: So just back up to the main menu. So yeah. If we look at the different boards we’ve got: “anime, cute, cute male, flash, weapons, auto, science and math, LGBT, pony”… DF: And those rabbit holes have rabbit holes. You had clicked on “random?” EOS: Yeah. So this board is pretty random. There are a lot of different things. DF: And those rabbit holes have rabbit holes too. Which can lead to some terrifying places. EOS: There’s different threads for…I don’t know likely someone falling onto train tracks or something. DF: Einar is showing me around 4Chan. It’s one of the sites he was monitoring when he was working on the revenge porn story. You’ve probably heard of it. It’s the internet equivalent of public washroom graffiti. Revenge porn aside, you’ll find all kinds of garbage spewed across its forums… EOS: These threads often spin into like the posting of pictures of people who wouldn’t want to be on this site And so that’s the thing people here often tread on a thin line towards what’s illegal or not… DF: Like she looks quite young. EOS: That is certainly on some line somewhere. DF: I mentioned earlier that when Einar was infiltrating the revenge porn sites, he used one of his online personas to get close to the forum’s administrator. Well, that guy ended up recruiting Einar—or Einar’s persona, because he needed help deleting the deluge of illegal images that was constantly being posted. EOS: He started talking about the problems he was facing as this revenge porn administrator and his daily business, the people who was giving him a hard time. And some of these people were people who advertised for different file hosting services where their selling point was that well on our services you can find these pictures and there would be girls where you’d understand immediately that that girl isn’t 18. She isn’t 20. She’s more like 11 or something. EOS: So I started talking to Håkon about what I saw as a problem on the clearnet and how available the child abuse material apparently was on the clearnet. DF: It’s worth understanding a few terms. EOS: So clearnet, the open web, is everything… DF: The clearnet accounts for about 10 percent of what’s on the internet. The deep web is the other 90 percent. All the stuff you can’t access through web browsers: so, password-protected pages, encrypted sites that sort of thing. There’s also the dark web—that’s part of the deep web too. But it’s also its own beast. It’s something we’ll get into more later. For now, all you need to know is that Einar had gone down enough clearnet rabbit holes to know there was a lot of child pornography squirrelled away across that 10 percent of the web we all use everyday. EOS: I started talking about this problem to Håkon in I think August or September 2013. And so we were like tossing ideas back and forth for a couple of months. DF: Einar was confident he could find the guys downloading this stuff. Håkon was eager to jump on the opportunity. HH: My first reaction was “Oh my God” now we will finally (be) able to identify these guys and and then go knock on their doors and talk to them. Not after they’ve been arrested but while they’re actually in the act more or less of downloading. DF: Around this time, VG offered Einar a full-time job. So, he and Håkon got to work. The sites Einar had been monitoring all had records of the files that had been downloaded. In some cases those records were associated with the usernames, email addresses and IP addresses of the people doing the downloading. Meaning they could be tracked. Einar focused on files downloaded to Norwegian IP addresses. So now he and Hakon had a large batch of files they suspected were child pornography. But they had to confirm this… HH: So we decided quite early that we can’t look at these images ourselves. So we turned off image downloading. We didn’t download any images ourselves on our computers.
at these images ourselves. So we turned off image downloading. We didn’t download any images ourselves on our computers. We just dealt with the file names and did a lot of talked to the Norwegian NCIS. DF: The police. HH: And got help from them in identifying some of the file names. They told us you know okay this filename this is regular porn. This is child abuse. DF: So they would open them and tell you what was in them or they had a way of doing this? HH – Yeah they have a list, the police, of file names of files that they know already are child abuse files. And some of the files they also opened to take a look at. But that was a handful I think. HH: And from this small batch of files that we knew contained child abuse material, Einar he was able to built this filter to find other files that also contain abuse child abuse material. DF: In the end, Einar wound up with about 5,500 files. Downloaded by about 300 Norwegian users. From there it was straightforward internet sleuthing…. HH: Some of the people we just found by Googling It’s amazing how people use the same email address many places or if they use it just a couple of places then we will be able to track them. Or they use the same username on Skype or WhatsApp or some other platform. Some were rather easy to find. Some were difficult And we were able to identify I think it was 70 people of those users just by you know searching for their usernames looking up their email addresses — things like that. DF: Håkon knew he could get hold of these men now. But there were a few ethical considerations: HH: I mean first of all how do we contact a guy and tell him you know I know about your most terrible secret. Do we do we go to their door? If so, who is going to answer? Do they have a family? Is his wife going to answer and you know start wondering why are the journalists here? Should we call them on the phone? And also would they would they commit suicide just by knowing that we knew this? So I talked to psychologists to understand you know is this safe for the downloaders — that we contact them. And the psychologists they told us most of these guys when they are confronted with what they do, they want to talk. They are really scared but they are also grateful that they finally have an opportunity to talk to people about this. So we decided, okay we’ll find a way to contact them. [Phone-ring sound] DF: So Håkon starts making calls. HH: What I did was I found out 10 o’clock in the morning. That’s the best time because their spouse, most probably, is at work. It’s a time of day when people are alone or doing something without their family. So 10:00. That’s when I call them… DF: By now Håkon’s editors knew he and Einar were onto a big story. One of VG’s videographers, Natalie Remøe, started making a documentary about their work. HH: I called them and told them you know Hi, you know I’m Håkon from VG. I got information which I really need to present to you and I can’t talk about it on the phone but I need to meet you hopefully today or tomorrow. Can we meet outside because we need to meet outside and before I called them we had found a place — for instance, in a park. DF: Håkon’s editor at the time was a guy named Torry Pedersen——that’s his voice. Pedersen’s big worry was that one these men might get violent. He gave Håkon strict orders to do these interviews in public spaces. Einar and Natalie would hide at a distance. They’d film and take photos. And also just be ready to call the cops. Just in case things went sideways. EOS: The absurdity of that situation would be next level. I remember like hiding in the bushes and sneaking around there and trying to, on one hand, like pay attention if he’s pulled a knife on Håkon or something and also trying to photograph it. DF: How many guys did you contact? HH: Ten. DF: Ten guys. And did you meet with all ten? HH: I met all of them actually. It’s the most interesting meetings I’ve had with people. I don’t think I’ll ever have more interesting meetings. DF: Why? What was so interesting? HH: I guess it’s because — one thing is I really wanted to try to understand why did they want to download child abuse material. And some of them were able to tell me that and I learned a lot really. DF: Håkon learned a lot about these men’s psychology. Specifically, he learned a lot about denial. HH: Some people said “oh I didn’t do it” — but I mean that’s just silly. come on, we know you did it. And then they told us “oh well I was searching for a movie like “Mission Impossible” and then for some reason the file turned out to be child abuse material. And then we could say no… we know that the file that you downloaded is called you know “12-Year-Old-Blowjob” for instance. It’s not Mission Impossible. It’s not something that you randomly fall into. It’s not like you know trip on your keyboard on your computer and then all of a sudden magically this website opens up and downloads some child abuse material for you. There are many steps you have to go through before these files are downloaded. I mean you have to get to register your username, your email address, everything. So through all of these steps you have the possibility to think “Is this something I really want to do?” And they have decided “yes yes yes yes — I want to do this.” So we knew that they were doing it on purpose but they tried to deny it anyway. DF: But Håkon pushed back with questions. And in the end, 7 of the 10 men he spoke with, admitted to actively seeking out child pornography. HH: For some of the guys it’s some sort of extreme sport, mental extreme sports you know how much shit can I watch? They downloaded beheadings and every kind of terrible things just to see how much their brains could deal with And you know they were either alcoholics or did drugs also. So they had this addiction problem already. DF: Did you ask them at all whether they had experienced any sexual abuse or trauma? HH: Yes. Yeah. Couple of them told me that they had probably experienced something. But the other 8 they hadn’t experienced anything. So you can’t use that as an excuse. DF: Did any of them explicitly talk about pedophilia? Being attracted to children as the main cause? HH: No, all of them told me “I’m not a pedophile.” DF: All of them said that they’re not a pedophile. HH: Yeah.
DF: All of them said that they’re not a pedophile. DF: This is a really telling detail. It says something about the nature of these men, about the state of denial they’re in. But what I want to touch on here is one particular finding for a second: Researchers at the Center for Addiction and Mental Health in Toronto have found compelling evidence suggesting that well over half of the men who look at child pornography are preferential pedophiles. That means these are men who are specifically, and often exclusively, attracted to children. So the fact none of the men Håkon interviewed admit to being a pedophile suggests a lot of them are lying. Lying to Håkon. Or lying to themselves. HH: Sorry, I just noticed that you use the term child pornography… DF: Instead of child abuse material. DF: Einar and Hakon use the term “child abuse” as in child abuse images, child abuse materials, instead of child pornography. And so do most cops and researchers. For good reason: HH: If you use the term child pornography then that’s a term describing the images as seen from the abuser’s point of view. That this image is made to sexually arouse people. But that’s not what they are. They are images of child abuse. So that’s how we need to talk about them. DF: And once you’ve seen those images, you can’t unsee them. Once they’re in your head, they can mess with you. And, this is something that’s important to keep in mind if you want to understand a little more about Einar. EOS: From early childhood until I was 19 I think I was living in a very deep woods. And so with the computer as my basically only friend. DF: When Einar is about 14 or so he takes a trip from his home deep in rural Norway to a big computer conference. Back then CD burners were the hot tech item. Einar had just bought one. It’s expensive. And so, to make back some of that money, he takes it with him to the conference and sets up shop backing up people’s hard drives EOS: And I obviously wouldn’t look through the things that people gave to me I just burned copies, burned backups, backups and I slept in a sleeping bag in my chair while I burned those CDs. DF: By the end of the week, he’s made some cash. He takes his CD burner back home with him. And also a bunch of used CDs… EOS: So I got back home and at the time I’d say like one in ten CDs or so would just be damaged some in some way.
EOS: So I got back home and at the time I’d say like one in ten CDs or so would just be damaged some in some way. And my experience had been that some of the CDs that were damaged could be reused. So I went through the CDs and thought well maybe I can burn something else on the rest of it. And one of the CDs turned out to be the most nightmarish stuff that I’ve seen. I open it on my computer and like immediately what pops up is an image folder. I saw what was a kid — likely a girl who was backed down on the floor or pavement. I don’t know, from what looked like a ski pole tying the legs up and back, like exposing him/her. And that just stuck with me something fierce for like many years and I think going back into like these kinds of projects — so I have a photographic memory. My memory works I see the thumbnails now when I speak of them and going back into these projects stirs all of these old memories that you aren’t supposed to have there to begin with DF: Einar’s clenching his jaws while he’s telling me this. I believe him when he says he still sees these pictures. He looks haunted. DF: Håkon and Einar work on their story for close to a year. VG runs it as a major feature in the summer of 2015. Keep in mind VG’s the most widely-read news site in the country. It averages about two million readers a day Norway’s entire population is just over five million. So the story does what every journalist hopes their stories will do: It gets people talking. HH: I think it became at least obvious to both the public and the police that this is a real problem and that we need to deal with it. So in the last couple of years more and more local police districts have established their own task forces specifically to combat online child abuse. DF: It also got the attention of a few readers who Håkon wasn’t expecting to hear from. HH: I found it really interesting to see that also people who identified as pedophiles or other guys who were downloading child abuse images, they also found our articles important and helpful for them. Like this guy who contacted me and told me that this is the first time that anyone had been able to write about his problems in a way that he could relate to it. So he contacted me and was really frustrated because he was really worried about himself. He didn’t want to have these feeling. He didn’t want to feel these desires towards children. He didn’t want to download child abuse material but he still found that you know he did it and that he felt a desire towards children and although he told me he hadn’t done anything he was really scared about what he might do. And he had searched for help but I mean Norway is a small country and he was living in a very small community. He couldn’t couldn’t tell his doctor because everyone knows everyone there. So he was stuck with his feelings by himself. And he still is. DF: So, say you’re a social pariah. And you can’t get help or you believe you can’t. What do you do? Well, some men follow a particular path. They go down all the rabbit holes the clearnet has to offer. And eventually, they find themselves overlooking the biggest rabbit hole of all. The dark web. EOS: Many of the sites that we looked into in relation to the downloaders story were hinting at these sites on the dark web as well. So there would be links to dark web sites and mention of dark web sites on blogs and message boards. Simply put it’s an encrypted web within the web that’s designed to be hidden from surveillance, hidden from people trying to monitor what’s going on there and trying to censor the stuff that’s on there. DF: There’s a lot of mystique surrounding the dark web. But really, it’s just a bunch of hidden websites. To navigate them, you need a specialized browser called TOR. Now, there are plenty of non-sketchy, completely legal sites on TOR. Places to share photos, opinions, recipes. Places to sell and buy things, places for fan fiction and politics. None of them any more disturbing than what you’ll find on the clearnet. But then, there are plenty of disturbing sites too… EOS: If you go looking for the dark markets and try to find a hitman for hire and such you’re likely just going to lose your bitcoin.
the dark markets and try to find a hitman for hire and such you’re likely just going to lose your bitcoin. And then there obviously are the child abuse sites and various other sorts of sexual abuse sites as well, but the child abuse scene has been fairly active and thriving there for many years now. EOS: Some of the sites are dedicated to sort of self-help, how to control the urges, how to accept that you’re a pedophile but at the same time trying to curb your desires. And then they go even further in many cases and go beyond sort of opening up on their deepest darkest secrets to give descriptions of specific abuse specific things that they’ve done and also to provide, obviously, photos (and) videos of that abuse. And then there are sites that are dedicated to just enabling people. There are sites with huge collections of texts, even books, e-books on how to be a successful abuser, how to be how to hide yourself from law enforcement, how to hide yourself from your family and so forth. DF: A big part of the dark web’s appeal is that it offers these men something they can’t find anywhere else: a sub-culture of like-minded people. And it is almost entirely men, by the way. Women account for less than one percent of the people interested in child pornography. So, Einar started monitoring what was happening on the dark web. EOS: So Håkon who was reading through one of the forums on the dark web and saw a reference to the downloaders. DF: Einar’s talking about the downloaders — the ten men in the story he and Håkon had published. EOS:…and they were discussing them or describing them as clearnet losers or some such I don’t know. HH: It said more like these guys who were identified were the idiots on the clearnet. The people who are taken all the time. Darknet is still safe and sound and I’m proud to be a member of a worldwide movement of child lovers. So it was really a middle finger to our work and you know just fuck you and you won’t be able to find us. And so we took that as a challenge. Okay. You claim that we can’t identify and we can’t take you, just because you’re on the darknet? Let’s see if we can do that. DF: So, Einar and Håkon get clearance from their editors to start tracking some of the dark web users. Einar creates a few different user accounts on different child abuse sites. He’s configured his browser settings so he’s not actually able to see any of the images. But he can read all the text on these pages all the comments about the images, diatribes, confessions. And in reading this stuff, he gets a lay of the land. Who the players are. He identifies three or four of the biggest, most popular sites. And among these, one stands out. EOS: Child’s Play seemed to be the biggest of them. DF: Child’s Play. The site has over a million registered user profiles. Einar starts keeping tabs on the site. He focuses on messages posted by Norwegian users. And almost immediately he discovers something awful. EOS: We identified a Norwegian who was he was bragging about abusing a younger boy. DF: I’ve read the post Einar’s talking about. I’ll spare you the details but the guy admitted to abusing an 11-year old. In part by promising the kid a toy. A very specific toy. The guy went by a unique user name on Child’s Play. Håkon quickly found someone with an almost identical username on Skype and Facebook. On the Facebook page there was a photo of that same, very specific toy mentioned on the Child’s Play post. It was circumstantial evidence. But it was enough. Håkon and Einar had an ethical obligation. HH: So we had to take that to the police because he was this was ongoing abuse. DF: The police took the information and started an investigation. Einar and Håkon now knew they could successfully hunt for users on the dark web. But users are small game. Håkon and Einar were after larger prey. DF: So you were interested in finding out who ran these sites, the administrators. Child’s Play was this growing beast on the darknet. How did you identify the administrator of Child’s Play? What did you know about him? HH: What we knew about the administrator on Child’s Play was his name. Well, not his name, his username which was Warhead. DF: Warhead? HH: Yeah. That’s the only thing we knew about him. DF: And you wanted to go after him? HH: Yeah. EOS: I’ve never been uncertain that we could unmask people on the darkweb. I mean it’s all about effort. It’s all about how much time you’re willing to spend on it. Anyone (and) everyone can be unmasked if you’re willing to put the time and resources into it that’s required. That’s at least my experience. DF: Einar starts investing the time and resources. Child’s Play was run off a modified version of some common open-source software. The kind clearnet hosting sites use too. Meaning Einar had a set of blueprints to work with. EOS: And luckily I mean for us and for law enforcement, people don’t often know exactly how to fiddle with it to make it really secure. So I just pretty quickly came up with a couple of ideas of how I could potentially poke some more information out of those sites. DF: So, Einar starts poking and prodding, looking for weaknesses. HH: It was January 5th. 2017. When I get a message from Einar We just had Christmas holidays and it was late in the evening and I remember I was at home folding clothes. Einar tells me just very matter of fact — just writes well I think I’ve identified the site of the server of Child’s Play. DF: Einar had located the server at a hosting facility in Sydney, Australia. A place called Digital Pacific. HH: And I’m, “My God! How is that possible?” It shouldn’t be possible. It is impossible to do that. That’s the entire meaning of the dark web, that you’re not supposed to be able to track down the location of the servers. It should be impossible. DF: Were you incredulous? Did you not believe him or did you? HH: Sure. Of course I believed him (laughs). As I said he can do whatever he wants online. So I mean I’m really amazed that he was able to do that but still not surprised because when he when he sets his mind onto something he does it. It might take some time but he does it. Yeah. He had just done some magic. DF: That “magic” involved reading the hosting software’s source code in its entirety. And that’s how he found a weakness: Like many websites, Child’s Play allowed you to upload an image to your user profile. Einar noticed that if that image originated from somewhere on the clearnet, then the Child’s Play software would reach out and look for it. Meaning the site would send a brief signal from its hiding place on the dark web. The signal was traceable. And it contained information about the server’s IP address. HH: Child’s Play wasn’t the only server that Einar had been able to identify or to locate. He had also located one in France and one in Germany, two other child abuse websites on the darknet using the same technique that he had used to locate the server in Australia. DF: Neither the German nor the French leads came through. So he focused on the Australians. HH: It took me a couple of weeks to get in touch with this Australian guy and he was, “Sure. Come Monday.” and it was Thursday here in Norway. So I was of course I was wondering is Child’s Play put there on this server by someone in this company? I mean we didn’t know — who are the people behind? Who is Warhead? What will happen if we alert the company or the owner or anyone else at the company about what’s on this server? Will they delete it? I felt like I couldn’t give too much information about it at all to the owner or to anyone there until I met them face-to-face. DF: So you bought some plane tickets. HH: Yes HH: It’s January 20th and it’s a blizzard in Oslo. That morning when I’m walking up to the bus stop to take the bus to the airport — so I’m really struggling with a suitcase in the snow and wind and it’s terrible weather. And while I’m walking I get a phone call from the police who has been investigating the Norwegian that we were able to identify a couple of months earlier when we first started this research. DF: This is the guy who was bragging about abusing a kid? HH: Right. This policewoman — she would just inform me that yesterday they had arrested this man and because of this there was a young child who would get a better life. DF: Wow. HH: Yeah. DF: How were you feeling? HH: I don’t cry very often but I did then. DF: A little over 24 hours later, Håkon lands in Sydney and makes his way to Digital Pacific, the hosting facility. HH: They had offices very close to the opera house in a high-rise there. DF: It’s a typical server farm: nondescript office space; and rooms with row after row of server stacks AK: So this is our data centre. We have about 2000 servers in this facility here. DF: Håkon’s got a meeting with the company’s owner. AK: The internet. This is where the cloud lives. DF: A guy named Andrew Koloadin. HH: You were saying this is where the cloud is? AK: This is where the cloud is. Yes. HH: And this is where the darknet is also? DF: Håkon’s not sure what to expect. HH: So I went there and I told him that that we are investigating child abuse child abuse websites on the darknet and that we had found that one of the main websites was stored on the server that they had and that I needed them to told to tell me who had rented the server because they were probably the people who were running the website and the administrators. DF: How did he react? HH: I had prepared a long speech. If he denies if he says this, I will say this. I had really prepared this talk with him. AK: I felt like he thought I was running the operation. You’ve got to admit that you had that in you as well when you first came, right? You thought you had caught the criminal. DF: Turns out Håkon didn’t need that speech. Koloadin tells Håkon to pull up a chair. HH: He said I’m just as interested as you in knowing who this is and to get to the bottom of this and come sit beside me and we’ll take a look and at who has rented the server. DF: Were you kind of surprised? HH: Yeah absolutely. I mean are you kidding me? So he pulled up the some files and we looked took a look at it together. It’s a customer registry, I guess, and he could see that this server had been rented since 2014. And then we saw some messages by the customer… DF: Customer service? HH: Yes. Customer service because they thought that this person who was renting the server was a bit peculiar. They couldn’t find out his identity. So this customer service person he wrote in a message “sketchy looking I.D. has been submitted and customer is withholding information towards their projects.” So the customer service guy he had seen this and thought you know ‘Okay. Something fishy is going on here.’ ‘Who is this guy who wants to rent this server?’ ‘And why do they want to rent it?’ So he sent a message and he tried to call this guy but he didn’t answer. And the same day, they get an email from the people who wants to rent this server. And it says, “You can contact Mr. Paul Griffiths at the Task Force Argos as he will verify the validity of our presence.” And that’s when we knew who these people were. DF: And who were they? HH: Task Force Argos. They are worldwide celebrities sort of in the law enforce community. DF: They’re cops? HH: Yeah they’re cops. It’s the police. I had gone down to Australia to find out who Warhead is and all of sudden I find out that Warhead is the police. DF: Håkon and Einar had stumbled on a major undercover operation. Which brings us back to the guys in the hamburger joint: Jon and Paul. DF: So you’re in Brisbane. HH: I’m in Brisbane. DF: It’s hot. HH: It’s hot and I’m waiting to meet some police officers. I mean they definitely look like police officers with their white shirts and their ties, the way they’re walking. They feel very confident, you can see that they’re confident and they know what they’re doing DF: Were you intimidated at all? HH: Not by them. But I was a bit surprised that they wanted to talk to me and wanted to take me out to have lunch outside the police headquarter because I told them that I got some information that I need to talk to you about. So I was hoping that we could meet at an office inside the headquarter. DF: So you guys went out for lunch then? HH: We went for lunch to this noisy burger bar. I was looking around me and (thought) is this the place where I’m going to have to tell them that we know what they’re doing? And that’s what I had to do. HH: So finally they ask me why I’m here. Why do I want to talk to them? I tell them that I know that they are the ones who are running this website. And Paul, one of the guys he just turns purple and quiet. And Jon, the other guy, he turns completely white and gets real stiff and upright and stern and says we’re not going to discuss this anymore until I know how you have found this information, how you know it was us. DF: “Hunting Warhead” is written and produced by Chris Oke and me, Daemon Fairless. The series is co-produced by Håkon Høydal and Associate Producer, Mickal Aranha. Sound design by Cesil Fernandes. Emilie Quesnel is our digital producer. Original Music by Olivia Pasquerelli. The Senior Producer of CBC Podcasts is Tanya Springer. And our Executive Producer is Arif Noorani. “Hunting Warhead” is a co-production of CBC Podcasts and the Norwegian newspaper VG. DF: Coming up on Hunting Warhead… HH: Now we knew that Warhead — he’s the police so we could track their this operation from our computers sitting here in Norway. DF: But the police didn’t create the site. HH: So that’s when he found one article about three men charged in Virginia. MALE VOICE: It was just sort of one loud bang then all I could hear were dogs barking and people just screaming in terror.

Only registered users can comment.

  1. Can you use actors in some parts please getting hypnotized by the digital . So despicable these sickos. Thanxxx for your work.

Leave a Reply

Your email address will not be published. Required fields are marked *