SEALED I UNITED STATES DISTRICT COURT FOR THE DISTRICT OF COLUMBIA AUG - 9 2013 Clerk. U.S. District Bankruptcy Holding a Criminal Term Courts for the District of Columbia Grand Jury Sworn in May 3, 2018 UNITED STATES OF AMERICA JONG WOO SON, Defendant. Case: 1:18?cr?00243 Assigned TO Judge McFadden, Trevor N. Assign. Date 8/9/2018 Description: (B) Criminal N0. Magistrate No. 1118-0019 (GMH) Violations: 18 U.S.C. 2251(d) and (Conspiracy to Advertise Child Pornography) 18 U.S.C. 2251(d) (Advertising of Child Pornography) 18 U.S.C. 2260(b) (Production of Sexually Explicit Depictions of a Minor for Importation into the United States) 18 U.S.C. 2252(a)(2) and (Conspiracy to Distribute Child Pornography) 18 U.S.C. 2252(a)(2) (Distribution of Child Pornography) 18 U.S.C. 1956(a)(2)(A) (Laundering of Monetary Instruments) FORFEITURE: 21 U.S.C. 853; 18 U.S.C. 982; 18 U.S.C. 981 and 2253 UNDER SEAL I I The Grand Jury charges that: At times material to this Indictment: DEFINITION OF TERMS The Tor Network 1 . Tor was a computer network which anonymized Internet activity by routing a user?s communications through a global network of relay computers (or proxies), thus effectively masking the intemet?protocol address of the user. 2. An address? was a unique numeric address (used by computers on the internet) that is assigned to properly direct internet traf?c. A publically visible IP address could allow for the identi?cation of the user and his/her location. 3. To access the Tor network, a user had to install freely available Tor software, which relayed only the IP address of the last relay computer (the ?exit node?), as opposed to the user?s actual IP address. There was no practical method to trace a user?s actual IP address back through those Tor relay computers. 4. The Tor network made it possible for a user to operate a special type of website, called ?hidden services,? which used a web address that is comprised of a series of 16 algorithm- generated characters (such as ?asdlk8fs9d?ku7f?) followed by the suf?x ?.onion.? Websites, including hidden services, had system administrator(s) (also called the who were responsible for overseeing and operating these websites. Bitcoin 5. Bitcoin was one type of virtual currency that was circulated over the Internet. 6. BTC was not issued by any government, bank, or company, but rather was controlled through computer software. 7. Generally, BTC was sent and received using a BTC ?address,? which was like a bank account number and was represented by a case-sensitive string of numbers and letters. Each BTC address was controlled through the use of a unique private key, a equivalent of a password. Users could operate multiple BTC addresses at any given time, with the possibility of using a unique BTC address for every transaction. 8. BTC ?uctuated in value. As of March 5, 2018, one BTC was worth approximately $11,573.00. 9. A typical user purchased BTC from a BTC virtual-currency exchange, which was a business that allowed customers to trade virtual currencies for conventional money US. dollars, euros, etc.). 10. Little to no personally identi?able information about the sender or recipient was transmitted in a BTC transaction itself. However, virtual currency exchanges were required by US. law to collect identifying information of their customers and verify their clients? identities. 11. To send BTC to another address, the sender transmitted a transaction announcement, signed with the sender?s-private key, across the ETC network. 12. Once the sender?s transaction announcement was veri?ed, the transaction was added to the blockchain. 13. The blockchain was a decentralized, public ledger that logged every BTC transaction. 14. In some instances, blockchain analysis could reveal whether multiple BTC addresses were controlled by the same individual or entity. 15. For example, analyzing the data underlying BTC transactions allowed for the creation of large databases that grouped BTC transactions into ?clusters.? This analysis allowed for the identi?cation of BTC addresses that were involved in transacting with the same addresses. WELCOME 0 VIDEO WEBSITE The Welcome To Video Website 16. The defendant was the administrator of Welcome To Video, a Tor network-based child?pomography website, which began operating at least in or about June 2015. 17. Welcome To Video hosted and distributed image and video ?les depicting child pornography. The upload page on Welcome To Video stated: ?Do not upload adult porn.? 18. On or about February 8, 2018, Welcome To Video indicated on its download page details that its users had downloaded ?les from Welcome To Video more than a million times. 19. On or about March 5, 2018, the Welcome To Video server had over 200,000 unique video ?les, which totaled approximately eight terabytes of data. 20. Each video available for download had a title, a description (if included by the uploader), ?tags? with further descriptions of the video, and a preview thumbnail image that contained approximatelysixteen unique still images from the video. 21. The video search page of Welcome To Video listed keyword search terms and the number of videos associated with each keyword. On or about February 8, 2018, some of the top keyword search terms and the associated approximate videos included and ?incest.? a. is an abbreviation for ?preteen hardcore.? b. ?Pedo? is an abbreviation for ?pedophile.? c. ?%2yo? is an abbreviation for ?2 year old.? d. ?%4yo? is an abbreviation for ?4 year old.? 22. Welcome To Video contained instructions on how these videos could be downloaded by customers. 23. Any customer could create a free account on Welcome To Video by creating a usemame and password. After the customer had an account, the customer could browse picture previews of videos depicting child pornography that were available for download. 24. To download videos from Welcome To Video, the customer redeemed ?points.? A customer could obtain points by: uploading Videos depicting child pornography; (2) referring new customers to the website; (3) paying 0.03 BTC (approximately $352.59 as of March 5, 2018) for a account, which lasted for six months and purportedly allowed unlimited downloads; and/or (4) paying for points incrementally 0.02 bitcoin for 230 points). 25. Co?conspirators who uploaded Videos to Welcome To Video would earn ?points? each time someone downloaded that video from Welcome To Video. 26. Points were not transferable to any other website or application. Once a customer sent BTC to Welcome To Video, the ETC could not be refunded or redirected. The points obtained by the payment of BTC could only be used for downloading videos. 27. Once a video was uploaded to Welcome To Video, the uploader was not able to delete the video. However, the administrator retained access to these videos. 28. Welcome To Video directed customers to particular BTC exchangers to make payments to it, including an exchanger in the United States. 29. Welcome To Video established unique BTC addresses to receive payments from each different Welcome To Video customer account. In total, Welcome To Video had set up over 1.3 million BTC addresses. 30. Law enforcement clustered thousands of unique BTC addresses together as associated with Welcome To Video. This cluster included an undercover agent?s BTC address which Welcome To Video assigned to the undercover agent when the undercover agent created an account on Welcome To Video. 31. From in or about June 2015 to on or about March 8, 2018, Welcome To Video received at least 420 BTC through at least 7,300 transactions worth over $370,000.00 at the time of the respective transactions. 32. Customers from numerous countries, including the United States, Great Britain, and South Korea, sent BTC to Welcome To Video. 33. An MD5 hash is the result of applying a complex algorithm to the ones and zeros that make up a computer ?le. For example, two identical picture ?les will have the same hash value. If you took one of the pictures and changed a single pixel, you would be changing the ones and zeros that make that computer ?le. Therefore, it would be a completely different hash value when the algorithm is applied. The hash value would not tell you how the ?le changed, only that it has changed because it resulted in a different hash value. 34. Welcome To Video would not allow a customer to upload a video that had been previously uploaded to the site. Welcome To Video enforced this by providing an MDS hash?value check for customers to compare their video(s) to other videos previously uploaded. 35. On multiple occasions, an agent acting in an undercover capacity paid BTC to Welcome To Video and downloaded child pornography video ?les from it while in Washington, DC. 36. These downloaded child pornography video ?les included pre-pubescent children, infants and toddlers engaged in sexually explicit conduct. 37. Video ?les downloaded from Welcome To Video included the following: a. File name ?[pthc] 10y Tara Blowjob Anal Riding Fuck (05min).avi" with the video tag description ?Tara Riding Fuck? depicted a child, approximately ten years old, and an adult male inserting his penis into the child?s mouth and anus. Welcome To Video customers downloaded this video 957 times; File name ?2 (2).avi? with the video tag description ?Pedo Preteen Amateur Underage? depicted a female child approximately three years old. The child is nude and bound with her legs spread apart so that her genitalia is visible. An adult male urinates on her. Welcome To Video customers downloaded this video 219 times; File name ?Rape Toddler Girl.mpg? with the video tag description ?rape toddler? depicted a female toddler, approximately two or three years old. An adult male inserted his penis inside of the anus of the female toddler. Welcome To Video customers downloaded this video 369 times; File name ?americanDadmkv? with the video tag description ?American dad all in one (toddler)? depicted an infant, approximately six months old. An adult male inserted his penis inside the mouth and anus of the infant. Welcome To Video customers downloaded this video 113 times; File name with the video tag description ?boy blow? depicted a male child, approximately ten years old. An adult male inserted his penis into the child?s mouth and anus while in a shower. Welcome To Video customers downloaded this video three times; and File name ?cum in 8yo.mpg? with the video tag description ?she whant [sic] sleep? depicted a female child, approximately eight years old. An adult male inserted his penis into the child?s anus. Welcome To Video customers downloaded this video 69 times. Object of the Conspiracy 38. Numerous co-conspirators conspired with the defendant to upload child pornography videos ?les to Welcome To Video. The co?conspirators entered into this agreement to bene?t: the defendant, who obtained illicit income as co-conspirators uploaded more videos ?les to Welcome To Video, which other customers then paid to access; and the co-conspirator uploaders, who derived points from the uploads, which they could redeem to download new video ?les from Welcome To Video. Co-Conspirator Qploaders 39. Between on or?about June 19, 2016, and or about January 16, 2017, co-conspirator ?thh6z? uploaded over 100 videos to Welcome To Video. For example: a. On or about January 16, 2017, co?conspirator ?thh6z? uploaded a video ?le entitled ?Samantha Bathroom Facial.Flv? with the tag description ?1958 Dr. Double ?les from the producer of KansasKitty? to Welcome To Video. The video began by displaying the message ?Samantha," ?5 Years Old,? and ?Bathroom Facial,? after which a nude female child approximately ?ve years old appeared. The female child was on her knees in a bathroom while an adult male masturbated and ejaculated on her face. Welcome To Video customers downloaded this video six times; and b. Included in the Videos uploaded by co?conspirator ?thh6z? were a series of videos of his approximately nine-year?old step-daughter engaged in sexually explicit conduct. For example, on or about October 19, 2016, ?thh6z? uploaded a video ?le entitled ?1797-1801 Thomas Jefferson?v? with the tag description ?KansasKitty? to Welcome To Video. The video depicted his approximately nine-year?old step-daughter nude, bent over, and with her buttocks spread apart so that her anus was visible while she inserted a dildo into her mouth. His step-daughter then inserted the dildo into her vagina. This video was downloaded by Welcome To Video customers ten times. 40. Between on or about May 2, 2016, and on or about May 11, 2016, co-conspirator ?dirtylad2kl6? uploaded four videos to Welcome To Video. For example: On or about May 3, 2016, co-conspirator ?dirtylad2k16? uploaded a video ?le entitled WA0007.mp4? with tag description ?boy man rape fuck suck? to Welcome To Video. The video depicted a male toddler between the ages of one and two years old. After an adult male touched the male toddler?s penis, the adult male inserted his penis into the male toddler?s anus. Welcome To Video customers downloaded this video 13 times. The Welcome To Video Server Was Located at Defendant?s Residence 41. On or about September 1, 2017, law enforcement reviewed the source code of Welcome To Video?s homepage, which could be viewed by right-clicking on the website and selecting ?View Page Source.? 42. In reviewing the source code, law enforcement discovered that Welcome To Video failed to conceal one of its addresses, 121.185.153.64. 43. On or about October 24, 2017, law enforcement again observed that the Welcome To Video homepage failed to conceal another one of its IP addresses, 121.185.153.45. 44. These two addresses resolved to a telecommunications provider in South Korea and were registered to an account serviced at the defendant?s residence. 45. On or about March 5, 2018, a search of the defendant?s residence revealed the server for Welcome To Video located inside of his bedroom and actively operating. The Defendant Was the Administrator of Welcome To Video 46. On or about September 28, 2017, an undercover agent in Washington, DC. sent 0.03 BTC, worth at that time approximately $124.72, to a BTC address that was provided by Welcome To Video. On or about September 30, 2017, the defendant then transferred these funds 10 to one of his BTC addresses (?Defendant?s BTC Address 47. On or about February 23, 2018, an undercover agent sent 0.03 BTC, worth at that time approximately $287.79, to a BTC address that was provided by Welcome To Video. On or about February 24, 2018, the defendant then transferred these funds to Defendant?s BTC Address 1. 48. On or about? February 23, 2018, an undercover agent sent another 0.03 BTC to a another BTC address that was provided by Welcome To Video. On or about February 24, 2018, the defendant then transferred these funds to Defendant?s BTC Address 1. 49. Defendant?s BTC Address 1 was stored in an account ending in 209A at BTC Exchange 1. The signature card at BTC Exchange 1 revealed that this wallet was in the name of the defendant, and listed his cell phone number and his email account (?Defendant?s Email Account 50. On or about December 19, 2016, BTC Exchange I emailed Defendant?s Email Account 1 a receipt for a BTC transaction involving the account ending in 209A cashing out BTC to a bank account ending in 0477. 51. The bank account ending in 0477 was held in the name of the defendant. 52. The defendant controlled at least four email accounts, all of which he repeatedly accessed from the IP address of 121.185.153.64, which was the IP address associated with Welcome To Video. 53. Beginning in at least July 2015, the defendant?s Internet browsing and search history revealed multiple searches for, and visits to, Welcome To Video. 54. The defendant?s Internet browsing and search history also revealed multiple 11 searches relating to child pornography, BTC, and computer coding. User 123412 Was The Defendant, The Administrator 55. User ?123412? was one of the defendant?s user names on Welcome To Video. 56. On or about November 17, 2015, the defendant emailed a ?le titled ?1360201857305mp4.? The defendant uploaded this same video, with the same title (?1360201857305mp4?), to Welcome To Video via his user name ?123412.? 57. The defendant uploaded videos to Welcome To Video via his user name ?123412? with the description ?Admin Upload.? 58. The coding of Welcome To Video allowed user ?123412" to have unlimited download access to all videos on Welcome To Video. 59. The defendant uploaded approximately 779 video ?les to Welcome To Video via his user name ?123412,? all of which occurred on or about June 15, 2015. 60. One of these video ?les was entitled which depicted a pre-pubescent girl digitally penetrating her vagina. COUNT ONE 61. Paragraphs 1 through 60 are incorporated here. 62. Beginning in or about June 2015, the exact date being unknown to the Grand Jury, and continuing through on or about March 5, 2018, within the District of Columbia and elsewhere, the defendant, Jong Woo Son, did knowingly conspire with ?thh6z,? ?dirtylad2kl6,? and others known and unknown to the Grand Jury, to knowingly make, print, and publish, and cause to be made, printed, and published, a notice and advertisement, that is, a posting on Welcome To Video, seeking and offering to receive, exchange, buy, display, distribute, any visual depiction, the 12 production of which involved the use of a minor engaging in sexually explicit conduct, as de?ned in Title 18, United States Code, Section and such visual depiction was of such conduct, knowing and having reason to know that such notice and advertisement would be transported using any means and facility of interstate and foreign commerce and in and affecting interstate and foreign commerce by any means, including by computer, and such notice and advertisement was transported using any means and facility of interstate and foreign commerce, and in and affecting interstate and foreign commerce by any means, including by computer, via the lntemet. (Conspiracy to Advertise Child Pornography, in violation of Title 18, United States Code, Section 2251(d) and COUNT TWO 63. Paragraphs 1 through 60 are incorporated here. 64. Beginning in or about June 2015, the exact date being unknown to the Grand Jury, and continuing through on or about March 5, 2018, within the District of Columbia and elsewhere, the defendant, Jong Woo Son, did knowingly make, print and publish and cause to be made, printed and published, a notice and advertisement, that is, Welcome To Video, seeking and offering to receive, exchange, buy, display, distribute, any visual depiction, the production of which involved the use of a minor engaging in sexually explicit conduct, as de?ned in Title 18, United States Code, Section 225 and such visual depiction was of such conduct, knowing and having reason to know that such notice and advertisement would be transported using any means and facility of interstate and foreign commerce, and in and affecting interstate and foreign commerce by any means, including by computer, and such notice and advertisement 13 was transported using any means and facility of interstate and foreign commerce and in and affecting interstate and foreign commerce by any means, including by computer, via the Internet. (Advertising Child Pornography, in violation of Title 18, United States Code, Section 2251(d)). COUNT THREE 65. Paragraphs 1 through 60 are incorporated here. 66. Beginning in or about June 2015, the exact date being unknown to the Grand Jury, and continuing through on or about March 5, 2018, within the District of Columbia and elsewhere, the defendant, Jong Woo Son, while outside the United States, that is, South Korea, did knowingly transport, distribute, and sell any visual depiction of a minor engaging in sexually explicit conduct, that is, the video ?les on Welcome To Video, the production of which visual depiction involved the use of a minor engaging in sexually explicit conduct, intending that such Visual depiction would be imported into the United States. (Production of Sexually Explicit Depictions of a Minor for Importation Into The United States, in violation of Title 18, United States Code, Section 2260(b)) COUNT FOUR 67. Paragraphs 1 through 60 are incorporated here. 68. Beginning in or about June 2015, the exact date being unknown to the Grand Jury, and continuing through on or about March 5, 2018, within the District of Columbia and elsewhere, the defendant, Jong Woo Son, did knowingly conspire with ?thh6z,? g?dirtylad2k16,? and others known and unknown to the Grand Jury, to knowingly distribute any visual depiction using any means and facility of interstate and foreign commerce, including by 14 computer, where the visual depiction involved the use of a minor engaging in sexually explicit conduct as de?ned in Title 18, United States Code, Section and such visual depiction is of such conduct. (Conspiracy to Distribute Child Pornography, in violation of Title 18, United States Code, Section 2252(a)(2) and COUNT FIVE 69. Paragraphs 1 through 60 are incorporated here. 70. On or about September 28, 2017, within the District of Columbia and elsewhere, the defendant, ong Woo Son, did knowingly distribute any visual depiction, to include video files ?Samantha Bathroom Facial.vlf,? and ?2 using any means and facility of interstate and foreign commerce, including by computer, where the visual depiction involved the use of a minor engaging in sexually explicit conduct as defined in Title 18, United States Code, Section and such visual depiction is of such conduct. (Distribution of Child Pornography, in violation of Title 18, United States Code, Section 2252(a)(2)) COUNT SIX 71. Paragraphs 1 through 60 are incorporated here. 72. On or about February 22, 2018, within the District of Columbia and elsewhere, the defendant, Jong Woo Son, did knowingly distribute any visual depiction, to include video files ?[pthc] 10y Tara Blowjob Anal Riding Fuck a video with a foreign language title and an English description stating ?boy blow,? and ?cum in 8yo.mpg,? using any means and facility of interstate and foreign commerce, including by computer, where the 15 Visual depiction involved the use of a minor engaging in sexually explicit conduct as de?ned in Title 18, United States Code, Section and such visual depiction is of such conduct. (Distribution of Child Pornography, in violation of Title 18, United States Code, Section 2252(a)(2)) COUNTS SEVEN THROUGH NINE 73. Paragraphs 1 through 60 are incorporated here. 74. On or about the dates described, within the District of Columbia and elsewhere, the defendant, Jong Woo Son, caused the transmission and transfer, of a monetary instrument and funds, in the amounts described below, from a place in the United States, that is, Washington, DC, to or through a place outside the United States, that is South Korea, with the intent to promote the carrying on of speci?ed unlawful activity, that is, section 2252A (relating to child pornography) where the child pornography contains a visual depiction of an actual minor engaging in sexually explicit conduct, and section 2260 (production of certain child pornography for importation into the United States). 293111 On or about Date of Amount of Bitcoin Transfer Seven October 30, 2015 .13 Eight October 24, 2016 .1305 Nine September 28, 2017 .03 (Laundering of Monetary Instruments, in violation of Title 18, United States Code, Section l956(a)(2)(A)) 16 FORFEITURE ALLEGATION 1. Upon conviction of any the offenses alleged in Counts One through Six, the defendant shall forfeit to the United States any visual depiction described in Title 18, United States Code, Sections 2251, 2252, or 2260, or any book, magazine, periodical, film, videotape, or other matter which contains any such visual depiction, which was produced, transported, mailed, shipped or received in violation of Title 18, United States Code, Chapter 1 10; any property, real or personal, constituting or traceable to gross profits or other proceeds obtained from this offense; and any property, real or personal, used or intended to be used to commit or to promote the commission of this offense or any property traceable to such property, pursuant to Title 18, United States Code, Section 2253(a). The United States will also seek a forfeiture money judgment against the defendant equal to the value of any property, real or personal, constituting or traceable to gross profits or other proceeds obtained from these offenses; and any property, real or personal, used or intended to be used to commit or to promote the commission of these offenses or any property traceable to such property. 2. Upon conviction of the offenses alleged in Counts Seven through Nine of this Indictment, the defendant shall forfeit to the United States any property, real or personal, involved in these offenses, or any property traceable to such property pursuant to Title 18, United States Code, Section 982(a)(1). The United States will also seek a forfeiture money judgment for a sum of money equal to the value of any property, real or personal, involved in these offenses, and any property traceable to such property. 3. The speci?c property subject to forfeiture includes four hard drives seized on March 5, 2018 from the defendant?s residence. 17 4. If any of the property described above as being subject to forfeiture, as a result of any act or omission of the defendant: a. cannot be located upon the exercise of due diligence; b. has been transferred or sold to, or deposited with, a third party; c. has been placed beyond the jurisdiction of the Court; d. has been substantially diminished in value; or e. has been commingled with other property that cannot be divided without dif?culty; the defendant shall forfeit to the United States any other property of the defendant, up to the value of the property described above, pursuant to 21 U.S.C. 85 (Criminal Forfeiture, pursuant to Title 18, United States Code, Section 2253(a), Title 18, United States Code, Section 982(a) and Title 21, United States Code, Section 853(p)). A TRUE BILL FOREPERSON ,1 [/13 1219441; A gig-:6 11/ l/ Attorney of the United States And for the District of Columbia 18