National Police agents have arrested a person in Arrecife, the capital of Lanzarote, accused of buying access through cryptocurrency payments to one of the world's largest platforms for distributing pedophile material. The detainee is a Madrid resident on the island. According to a statement from the Police, they found evidence of the payments made on the website, so he was arrested and brought to justice.
In total, in this police operation, carried out throughout the country, the National Police have arrested 16 people for buying access to a child pornography platform on the dark web. The operation is part of an international investigation aimed at dismantling this important network for the distribution of pedophile material, being the largest operation ever managed by EUROPOL experts.
The Stream investigation has been coordinated by EUROPOL and led by Germany, and has been carried out in a total of 38 countries. In total, 79 people have been arrested and 1,393 have been identified. Some of the detainees not only uploaded and watched videos, but also abused minors. At the moment, the investigation is still ongoing. In Spain, it has been developed in the provinces of Alicante, Almería, Barcelona, Jaén, Las Palmas, La Rioja, Madrid, Málaga, Murcia, Orense, Seville, Tarragona, Santa Cruz de Tenerife, Valencia and Zaragoza.
The National Police carries out complex investigations in the field of the fight against child sexual exploitation, such as those carried out on the dark web, designed and conceived to hide the data of those who move within it. Among them, the TOR network stands out, an acronym for The Onion Router, which has the characteristic that, in addition to anonymizing the connection, it has a series of hidden services (such as web pages) inside, whose location and localization is very complex.
Within that effort and coordinated by EUROPOL, a page was located that served as a repository of recordings of child sexual exploitation, continuously growing due to contributions from the users themselves. It had almost two million subscribers and 91,000 videos, an amount that increased at a rate of more than three videos per hour.
To use it, it was enough to register for free, and you immediately had access to a partial and reduced quality preview of all the videos present. If a user wanted to see them in full or in higher quality, they had to purchase them through the corresponding payment, using cryptocurrencies for this. Each purchased video could be downloaded or viewed online in high quality. In addition, credits could be obtained that could then be used to purchase other videos, providing new recordings that were not already on the page or helping to classify those already present.
Platform adapted as if it were a social network
What is really new about this platform is the professionalization in terms of its design, allowing its users to create a source of social profile perfectly adapted to their criteria, as if it were a social network. Likewise, communication and contact with other users was one of its essential characteristics, the platform having a very dangerous character for the distribution of child sexual abuse material.
The German police were in charge of the main investigation and were able to locate and intervene the server where these contents were hosted, with which they had access to the data on payments made by each user. However, payments with cryptocurrencies are also designed to be anonymous, so, using sophisticated asset tracking systems, they were able to find the buyers, recovering each of the transactions until reaching the bank details of each of them.
Regarding Spain, 17 people had bought videos, and one, in addition, had uploaded one to the platform itself. According to the experience of the National Police, people who are willing to pay for these contents are one step further than the simple consumer of child sexual exploitation material, given that paying implies a greater commitment to the activity and a decrease in social inhibitions related to that crime; while the use of the TOR network already demonstrates both computer knowledge and knowledge regarding the search for child pornography, since whoever gets there has been consuming for a long time. That is why priority was given to this investigation, taking into account that this type of consumer may not have illegal content on their computers, limiting themselves to accessing the pages and clouds that they have contracted.
Once all the information from each of them was collected, and with the collaboration of the different territorial units involved, it was determined that the arrests should be made between March 10 and 14, since on that last day, once the economic investigation was completed, Germany was going to disconnect the page and replace it with an official notice.
A computer science student was the only distributor in Spain
Under the supervision and coordination of the National Police, who were also in charge of the distributor's registration, 15 entries and searches were carried out in as many homes, including the one in Arrecife. In this way, the only distributor present in Spain was arrested, a computer science student who was found, in addition to abundant child pornography, the access links to both the main page of the investigation and other child pornography pages, the payment receipts and other personal data detected.
The detainee in Alicante, who worked as a freelancer, was found with evidence of payment to the investigated page and, in addition, evidence that he was trafficking drugs. More than 700 ecstasy pills and 42,000 euros in bundles of 50 bills were seized. He was sent to prison by the judge who understood the facts. In Almería, a Moroccan citizen who had already been nationalized was arrested and a large amount of computer equipment was seized.
In Barcelona there were two different objectives, which were done on different days of the week of action. In both searches, child pornography was found on the devices, as well as evidence of the payment made. Both were brought to justice. In Arrecife (Las Palmas) another of the investigated was found, a Madrid resident in Lanzarote. Evidence of the payments made was found, so he was arrested and brought to justice. In Alfaro (La Rioja), the detainee had evidence of the payments and the apps necessary to make them. Other data also coincided, such as the email address used.
In Madrid, where there were two objectives of the investigation, one of them had abundant child pornography and evidence of the payment made, in addition to the TOR browser, so he was arrested. The other, who was not found with images, although he did have data related to the payment made, declared as an investigated person not arrested for these facts. The investigated person in Málaga had moved to La Línea de la Concepción (Cádiz). The agents moved to that town, where they managed to locate him. Although he did not have pornography at the time of the search, they did find sufficient evidence of the payment, in addition to a spontaneous recognition of the facts, so he was arrested.
A dentist was the target in Murcia, so the search was carried out both in his home and in his clinic. Abundant evidence appeared in different formats, not only of the payment, but also images of sexually exploited children that he kept on a USB memory for greater discretion. The person in charge in Orense was working in Madrid, so he was arrested on Sunday, when he was leaving with his vehicle, although he could not be searched and the material will have to be studied later. He was arrested and, after the corresponding procedures, released. The detainee in Seville used both his name and his mother's name for the payments, which was initially confusing for the investigators. Once it was clarified that the person in charge was the son and not the mother, two searches were carried out, since he used both as a residence, in which evidence of the payments and the means used to make them were found.
In Tarragona, the detected consumer was a male with a serious mental disability, which included psychosis and hallucinations. In addition to the payments, images of children generated by artificial intelligence were found. Due to his special circumstances, he was not arrested, but was heard as an investigated person not arrested.
On the island of Tenerife, an individual was found who had a multitude of child pornography in several instant messaging chats. In addition, he also used cloud storage services and payments to the platform were found. Finally, in Zaragoza, an individual was found who had a large amount of child pornography and evidence of payment through cryptocurrencies. He acknowledged the facts in his statement. As for the other searches, in Valencia the target had moved and resides in Paris, while the one in Jaén was investigated but not arrested.
The largest operation to date
Operation Stream has been the largest operation ever managed by EUROPOL experts in the fight against child sexual exploitation, and one of the most important cases that the police agency has supported in recent years. The countries that have participated in the investigation are Albania, Australia, Austria, Belgium, Bulgaria, Canada, Colombia, Croatia, Cyprus, Czech Republic, Denmark, Estonia, Finland, France, Germany, Georgia, Greece, Hungary, Iceland, Ireland, Italy, Latvia, Lithuania, Luxembourg, Malta, Netherlands, New Zealand, Norway, Poland, Portugal, Romania, Serbia, Slovakia, Spain, Sweden, Switzerland, United Kingdom and United States.
During the police intervention, more than 3,000 electronic devices have been seized globally and protection has been given to a total of 39 minors.