Uncover - S24 E1: Hacker vs. Hacker | "Hunting Warhead"

Episode Date: February 6, 2024

Einar Stangvik is a white-hat hacker — an internet security expert with an expertise in cracking the most secure and disturbing parts of the web. He discovers a troubling phenomenon online and joins forces with journalist Håkon Høydal. It leads them to Australia, to confront two men who are running the largest child abuse site on the dark net. For transcripts of this series, please visit: https://www.cbc.ca/radio/podcastnews/hunting-warehead-transcripts-listen-1.5346693

In 2017, it felt like drugs were everywhere in the news, so I started a podcast called On Drugs. We covered a lot of ground over two seasons, but there are still so many more stories to tell. I'm Jeff Turner, and I'm back with Season 3 of On Drugs. And this time, it's going to get personal. I don't know who Sober Jeff is. I don't even know if I like that guy.

On Drugs is available now wherever you get your podcasts. This is a CBC Podcast. The following episode contains difficult subject matter. Listener discretion is advised. So I'll just start when we're in the bar, yeah? Sure, yeah. Okay, so we are... I'm in this burger bar in Sydney.

Sorry, I'm not. I'm in this burger bar in Brisbane. I'm in this... It's hard. It's super hard. Oh-ho! I think it's a difficult story to tell and perhaps also to follow because it's got so many layers in it

That's Håkon Håkon Høydal He's an investigative journalist and he's based in Oslo. You got the story about how me and Einar found the server of this site. You got the story of the police operation, and you have the story about the people behind the site itself on the darknet. Håkon writes for a paper called Verdensgang.

It's famous in Norway. Famous enough that everyone there just calls it by its initials. VG. And also you have the story about the arrest itself. So it's got several layers to it. Håkon originally broke this story. Talking about it usually isn't an issue. But for some reason, this time around, it's kind of messing with him.

Sorry, and it's also a difficult story because of the subject. It is a tough subject, for sure. But I don't think that's really the issue. Hawken's used to covering nasty subjects. What's messing with him, I think, is that he's self-conscious. He's used to telling this story from the outside. He's not used to being a character in it. And what he's telling me now is the story behind that story.

The biggest story of his career. So I'm in this burger bar in Brisbane. It's lunchtime. And it's really, really crowded. And I'm there with two other guys. Two other guys he's only just met. Håkon's trying to get a read on them, trying to size them up. John, he seemed to be like the younger one. He had blonde hair, perfect teeth, firm handshake,

and looked very, you know, rather lean and fit. And Paul, the other guy, he also, I mean, he looked like he had been doing handiwork a lot and looked like a robust guy. I mean, they both looked like he had been doing handiwork a lot and looked like a robust guy. I mean, they both looked like they've been working out. So the kind of guys you probably don't want upset, which is a problem. Because Hawkins flown all the way from Oslo to do just that. To confront them about what they've been up to.

But I was a bit surprised that they wanted to take me out to have lunch because I told them that I got some information that I need to talk to you about. So I was hoping that we could meet at an office because this wasn't some information that I wanted to share with everyone. It's the kind of information that can destroy reputations, families, lives. I'm quite nervous because we're in this open bar with a lot of other people, noisy. We have to talk quite loud to be able to hear each other. And I'm about to tell them that I know that they're the ones who are running the largest child abuse website on the darknet.

This is the story of the men who operate in the most disturbing corners of the internet. It's the story of the police who track down those men, who hunt undercover in the dark. And it's the story of the reporters who try to shed light on this hidden underworld. My name is Damon Fairless, and this is Hunting Warhead. I've just arrived in Oslo. Hi, Hauken, it's Damon. How are you? Yeah, we're in the lobby. Fantastic, great. It's the first time I'm meeting Håkon.

Hi. Hey. Finally. Hi, nice to meet you. Håkon is slim and tall. He's about 6'6", and he's in his late 40s. But there's still something boyish about him. Maybe it's his enthusiasm.

Maybe it's his unruly blonde hair. Finally you're here. Yeah, yeah. I'm here to find out more about the Australians, the guys running the largest child pornography site on the dark web. Okay, you'll have to sign in. You're visiting VG. And you're from CBC.

I'm also here because even though this is a crime that spans the globe, it's also a Canadian story. You first. Okay. So much security. Okay, so this is my floor. VG's offices are four floors of clean lines, glass windows, and open-concept workstations. It's part modern newsroom, part IKEA catalog.

Yeah, this is the main place. Among other things, Håkon investigates the scariest places on the internet, including the very worst kind of online abuse, child pornography. Håkon and I share some common ground, and some common beliefs.

I've spent the past few years researching and writing about extremely violent men, including dangerous sexual offenders. My interest lies in understanding the deep motivations of the people who commit serious acts of violence. Essentially, what interests me is forensic psychology. It's natural to want to turn away from uncomfortable stories. I get that, and I respect it. The problem is, you can't change what you don't understand, and you can't possibly understand the stories you avoid. So, like Hulken, the more I've come to understand just how prevalent and how destructive child pornography is, the more compelled I am to cover it. As a journalist, but also as a father.

That said, you don't just wake up one morning and dive headfirst into the worst places on the internet. For Håkon, it was more of a step-by-step descent. One that began about six years ago. In 2013, a colleague of mine got a tip about a website where there was, well, a website for revenge porn. And that it would be possible to identify some of these guys who had published these images. Back in 2012, hackers across the world had started breaking into people's iCloud accounts.

Celebrities are being hacked. Hunger Games star Jennifer Lawrence, model Kate Upton have both been exposed. Personal photos for the world to see. iCloud was notoriously easy to crack at the time. Guys would break into women's accounts and post their pictures on so-called revenge porn sites. And let's be clear, revenge porn isn't pornography, nor is it revenge.

It's online abuse by anonymous trolls. Some of these women were ex-girlfriends. Some were famous. But most of them were total strangers. A lot of the pictures these guys stole were intimate and personal. So Hulken and one of his colleagues, Julia Ingebrigtsen, published an expose on one of these revenge porn sites. So it was one of the first articles about revenge porn, I think.

The story was critical of the Norwegian police, and of the government too, for not cracking down on revenge porn, despite the disproportionately high numbers of Norwegian users on these sites. And that's when I got an email a couple of weeks after that from a man. He wrote an email, you know, I'm really annoyed. I've been trying to get in touch with you guys at VG for a long time now. I've been trying to email all these different guys and no one is answering me. And aren't you interested in what I'm having to offer? And this guy who had this tip, this hacker, he was Einar.

Okay. Yeah. So your first contact with Einar was through this annoyed email? Annoying email, yeah. My name is Einar Otto Stangvik. Meet Einar. The way I recall this is that I was annoyed by something they wrote that I felt was incorrect.

So I sent this annoyed email to both Håkon and Julia, pointing out that this is wrong, this is wrong, this is wrong, this is garbage, whatever. And I think that testifies to my general frustration at the time as well. Einar is a big part of this story. He's the hacker Håkon was talking about. Although hacker isn't a term Einar is crazy about. Halkon was talking about. Although hacker isn't a term Einar is crazy about. When I see hacker in the media that usually means just that someone who breaks something down breaks in somewhere and that isn't the brand that I would want to have on like my persona because that's not what I'm doing I'm just I try to come up with solutions to try to build things to try to fix things not not tear them down as such.

So I just feel it doesn't describe me very well. It's just imprecise. But in a lot of ways, Einar is the typical hacker. Hyper-focused, logical, super methodical. But he's not all stereotypes. He's also stylish, fit, emotionally sophisticated, and highly self-aware. Back when Einar sent that email to Håkon, he was working a job he couldn't stand. I was getting depressed with my whole career choice. What am I doing here what is this why am i like selling

made-up solutions to to non-existent problems and so forth i eventually figured that i have to do something meaningful with with whatever knowledge i'd amassed up until then and so i sat down one day and read some articles and saw that well ic, iCloud hacks, that seems to be the thing now. So that sort of left a lingering feeling that, well, hey, maybe this is something that I can do something with. Einar decides to take on some of these guys, to hack the hackers. But like right around Christmas 2012, I started building a system that would monitor these different sort of shady forums for newly posted images. Einar's system downloads the metadata from pictures that were being put up on the revenge porn sites. So not the pictures themselves, but the information about those pictures.

File names, when the shot was taken, GPS coordinates. File names, when the shot was taken, GPS coordinates. So, through, I'd say a week or so, I'd amassed millions upon millions of these metadata collections. That's the haystack. But Einar's looking for a needle. He builds another program, this one. To automatically detect which GPS locations he found was in Norway. Most of the Norwegian photos aren't hacked. In fact, most of them are completely tame.

But then Einar's system flags something. A posting with, I believe, like 15 pictures from what seemed like different girls. Not like totally explicit pictures, but obviously private. The same guy posting a response to

another person like further down the thread said, who says that the girls know that I have those photos? iCloud, dot, dot, dot. So it felt like I'd hit exactly the sort of posting that I was looking for. Einar creates a few user accounts, different personas, and he uses these personas to manipulate the site administrators. Eventually he gets one of them to reveal an IP address, which Einar uses to identify the man who originally posted those 15 stolen photos. Einar was running a full-fledged undercover operation, entirely on his own. fledged undercover operation, entirely on his own. And it's around this time that he reads Håkon's article on revenge porn and fires off his disgruntled email, pointing out the inaccuracies in the story.

Håkon was friendly in his reply, and they fixed the article, I think, and he invited me over for coffee, and I sat down with him and presented the whole story. The whole story is pretty incredible. The guy Einar identified was a 24-year-old man named Thor Johannes Helleland. Helleland was a local politician in Drammen. That's a city in southern Norway.

Also, both of Helleland's parents are high-ranking members of Norway's National Conservative Party. And a number of the women whose photos he had hacked were members of the youth wing of the party. So it was a political bombshell. I wrote two reports, 40, 50, 60, I don't know, pages long, detailing all of my communication with the different people, the, 50, 60, I don't know, pages long, detailing all of my communication with different people, the administrator, the forums, and detailing my operation, how I found what I found and what I found. Like everything.

Einer had shared these reports with two of the women whose photos had been stolen. And he encouraged them to go to the police. They did, but the cops dismissed both cases. But I tried reaching out to the police at that point, and they basically said that, well, hey, we're not going to investigate this, no matter what, so whatever, to go somewhere else.

The police weren't interested in pursuing the case. But Håkon? Håkon was super interested. Well, I mean, I was really happy that he contacted me because I mean obviously you saw that it was a crazy story but sure no and I I remember telling the story and I felt that I managed to tell an exciting an interesting story and you seem to think that it was really interesting as well. But I'm not sure if you, if you were willing to give me your name. I mean, I don't think you

gave me your name in the first emails. I was, I suppose, somewhat afraid of being both investigated by police for coming even close to that sort of thing. I mean, I had no idea. Einar wanted to remain anonymous,

but for the story to be credible, how could Einar need to go on the for historien å være kredibel, hvorfor måtte Einar gå på rekord? Det var en stor løp. Og så fikk vi den på fronten. Ja! Super hacker. Bare noen dager senere innrømmet 24 år gamle Thor Johannes Helleland fra Drammen

at det var han som hadde gjort det. Et par dager senere ble politikeren forstått av sin politiske parti til å komme frem. Så vi publiserte en pressrelease at det var han som hadde gjort det. more than 30 girls that he'd either hacked by guessing passwords or getting to log on to their accounts on his computer and then logging their passwords. So he was notorious. He hacked left and right. Helleland had hacked the accounts of 30 young women, none of whom were under age, and he ended up serving one month in jail. VGs recently contacted Helalyn through text and email, informing him that his case is mentioned in this podcast. He hasn't replied. Helalyn's political career was over, but Halkin and Einar's working relationship?

That was just getting started. I mean, so you've probably heard of the site. Yeah, totally. So it isn't much of a surprise to anyone that there's a lot of stuff. Here's stating the obvious. The web can lead you down some rabbit holes. So just back up to the main menu. So, yeah, if we look at the different boards,

you've got anime, cute male flash weapons auto science and math lgbt a pony and those rabbit holes have rabbit holes you had clicked on random yeah so this board is pretty random there are a lot of different things and those rabbit holes have rabbit holes too which can lead to some pretty terrifying places. And there are different treads for, I don't know, likely someone falling onto train tracks or something.

Einar's showing me around 4chan. It's one of the sites he was monitoring when he was working on the revenge porn story. You've probably heard of it. It's the internet equivalent of public washroom graffiti. Revenge porn aside, you'll find all kinds of garbage spewed across its forums. These threads often spin into the posting of pictures

of people who wouldn't want to be on this site. So that's the thing. People here often tread on a thin line towards what's illegal and not. Like she looks quite young. That is certainly on some line somewhere. Yeah. I mentioned earlier that when Einar was infiltrating the revenge porn sites,

he used one of his online personas to get close to the forum's administrator. Well, that guy ended up recruiting Einar, or Einar's persona, because he needed help deleting the deluge of illegal images that was constantly being posted. And he started talking about the problems he was facing as this revenge porn administrator and his daily business, the people who was giving him a hard time. And some of these people were people who advertised for different file hosting services where their selling point was that on our services you can find these pictures and there would be girls where you'd understand immediately that that girl isn't 18.

She isn't 20. She's more like 11 or something. So I started talking to Hakon about what I saw as a problem on the clear net and how available the child abuse material apparently was on the clear net. It's worth understanding a few terms. Clear net, the open web is everything that you can find. The clear net accounts for about 10% of what's on the internet. The deep web is the other 90%. All the stuff you can't access through web browsers.

So password protected pages, encrypted sites, that sort of thing. There's also the dark web. Now that's part of the deep web too, but it's also sort of its own beast. It's something we're going to get into more later. For now, all you need to know is that Einar had gone down enough clear net rabbit holes to know that there was a lot of child pornography squirreled away across that 10% of the web we all use every day. I started talking about this problem to Håkon in, I think, August or September 2013. And so we were tossing ideas back and forth for a couple of months before we actually...

Einar was confident he could find guys downloading this stuff. Håkon was eager to jump on the opportunity. Yeah, I mean, my first reaction was, oh my god, now we will be finally able to identify these guys and then go knock on their doors and talk to them, not after they've been arrested, but while they're actually in the acts, more or less, of downloading. Around this time, VG offered Einar a full-time job, so he and Håkon got to work. The sites Einar had been monitoring all had records of the files that had been downloaded. In some cases, those records were associated with the usernames, email addresses, and IP addresses of the people doing the downloading,

meaning they could be tracked. Einar focused on files downloaded to Norwegian IP addresses. So now he and Håkon had a large batch of files they suspected were child pornography, but they had to confirm this. So we decided quite early that we can't look at these images ourselves. So we turned off image downloading. We didn't download any images ourselves on our computers. We just dealt with the file names and talked to the Norwegian NCIS,

the police, and got help from them in identifying some of the file names. They told us, you know, okay, this file name, it's regular porn. Yeah, the police. And got help from them in identifying some of the file names. They told us, you know, okay, this file name, it's regular porn. This is child abuse. So they would open them and tell you what was in them or they had a way of doing this? Yeah, they have a list, the police, of file names or files that they know already are child abuse files. And some of these files they also opened to take a look at. But that was a handful, I think. And from this small batch of files that we knew contained child abuse material, Ainar, he was able to build this filter to find other files that also contained child abuse material.

files that also contain child abuse material. In the end, Einar wound up with about 5,500 files, downloaded from about 300 Norwegian users. From there, it was straightforward internet sleuthing. Some of the people we just found by googling. It's amazing how people, they use the same email address many places, or if they use it just a couple of places, then we'd be able to track them. Or they use the same username on Skype or WhatsApp or some other platform. Some were rather easy to find, some were difficult.

And we were able to identify, I think it was 70 people of those users, just by searching for their usernames, looking up their email addresses, things like that. Håkon knew he could get hold of these men now, but there were a few ethical considerations. I mean, first of all, how do we contact a guy and tell him, I know about your most terrible secrets? Do we go to their door? If so, who's going to answer? Do they have a family? Is his wife going to answer and start wondering why are the journalists

here? Should we call them on the phone? And also, would they commit suicide just by knowing that we knew this? So I talk to psychologists to understand, you know, is this safe for the downloaders that we knew this. So I talked to psychologists to understand, you know, is this safe for the downloaders that we contact them?

And the psychologists, they told us most of these guys, when they are confronted with what they do, they want to talk. They are really scared, but they are also grateful that they finally have an opportunity to talk to people about this.

So we decided, okay, we'll find a way to contact them. So Håkon starts making calls. So what I did was I found out 10 o'clock in the morning. That's the best time because your spouse most probably is at work. It's a time of day when people are alone or doing something without their families. So 10 o'clock, that's when I called them. By now, Håkon's editors knew he and Einar were onto a big story.

One of VG's videographers, Natalie Remo, started making a documentary about their work. I called him and told him, you know, I'm, hi, you know, I var Håkon Eddahl fra VG. Jeg fikk informasjon som jeg virkelig, virkelig må presentere til dere. Og jeg kan ikke snakke om det på telefonen, men jeg må møte dere. Håkon Eddahl, forhåpentligvis i dag eller i morgen. Kan vi møtes utenfor? For vi må møtes utenfor. Og før jeg kallte dem, hadde vi funnet et st found a place, for instance, in a park. Håkon's editor at the time was a guy named Tori Pedersen.

That's his voice. Pedersen's big worry was that one of these men might get violent. He gave Håkon strict orders to do these interviews in public spaces. Einar and Natalie would hide at a distance, they'd film and take photos, and also just be ready to call the cops, just in case things went sideways. The absurdity of that situation would be next level.

I remember hiding in the bushes and sneaking around there and trying to, on one hand, pay attention if you pulled a knife on Håkon or something, and also trying to photograph it. Yeah. In 2017, it felt like drugs were everywhere in the news. So I started a podcast called On Drugs. We covered a lot of ground over two seasons, but there are still so many more stories to tell.

I'm Jeff Turner, and I'm back with season three of On Drugs. And this time, it's going to get personal. I don't know who Sober Jeff is. I don't even know if I like that guy. On Drugs is available now wherever you get your podcasts. How many guys did you contact? Ten. Ten guys.

And did you meet with all ten? I met all of them, actually. It's the most interesting meetings I've had with people. I don't think I'll ever have more interesting meetings. Why? What was so interesting? I guess it's because one thing is I really wanted to try to understand why did they

want to download child abuse material. Some of them were able to tell me that and I learned a lot, really. Håkon learned a lot about these men's psychology. Specifically, he learned a lot, really. Håkon learned a lot about these men's psychology. Specifically, he learned a lot about denial. Some people said, oh, I didn't do it. But I mean, that's just silly. Come on, we know you did it.

And then they told us, oh, well, I was searching for a movie like Mission Impossible. And then for some reason, the file turned out to be child abuse material and then we could say no we know that the file that you downloaded is called 12 year old blowjob for instance it's not Mission Impossible it's not just something that you randomly fall into. It's not like you trip on your keyboard and all of a sudden, magically, this website opens up and downloads some child abuse material for you. There are many steps you have to go through

before these files are downloaded. I mean, you have to register your username, your email address, everything. So through all of these steps, you have the possibility to think, is this something I really want to do? And they have decided, yes, yes, yes, yes, I want to do this. So we knew that they were doing it on purpose, but they tried to deny it anyway. But Håkon pushed back with questions. And in the end, seven of the ten men he spoke with admitted to actively seeking out child pornography. For some of the guys, it's some sort of extreme sport,

mental extreme sport. You know, how much shit can I watch? They downloaded beheadings and every kind of terrible things just to see how much their brains could deal with. And, you know, they were either alcoholics or did drugs also. So they had this addiction problem already. Did you ask them at all whether they had experienced any sexual abuse or trauma? Yes. Yeah. A couple of them told me that they had probably experienced something. But at the other rate, they hadn't experienced anything.

So you can't use death as an excuse. Did any of them explicitly talk about pedophilia, being attracted to children as the main cause? No. All of them told me I'm not a pedophile. All of them told me that, all of them told me I'm not a pedophile. All of them told me that. All of them said that they're not a pedophile. Yeah. This is a really telling detail.

It says something about the nature of these men, about the state of denial they're in. But I want to touch on one particular finding for a second. Researchers at the Center for Addiction and Mental Health in Toronto have found compelling evidence suggesting that well over half of the guys who look at child pornography are preferential pedophiles. That means that these are men who are specifically and often exclusively attracted to children. These are men who are specifically and often exclusively attracted to children. So the fact that none of the men Håkon interviewed admit to being a pedophile suggests a lot of them are lying. Lying to Håkon or lying to themselves.

Sorry, can I just, I just noticed sometimes when you use the term child pornography. Instead of child abuse material. Yeah. I know in Hakon you use the term child abuse, as in child abuse images, child abuse materials, instead of child pornography. And so do most cops and researchers. For good reason. child pornography, then that's a term describing the images as seen from the abuser's point of view. That this is images made to, you know, sexually arouse people. But that's not what they are. They are images of child abuse. So that's how we need to talk about them. And once you've seen those images, you can't unsee them. Once they're in your head, they can mess with you.

And this is something that's important to keep in mind if you want to understand a little more about Einar. From early childhood until I was 19, I think, I was living in the very deep woods. And so with the computer as my basically only friend. When Einar was about 14 or so, he takes a trip from his home deep in rural Norway to a big computer conference. Back then, CD burners were the hot tech item. Einar had just

bought one. It's expensive. And so to make back some of that money, he takes it with him to the conference and he sets up shop backing up people's hard drives. And I obviously wouldn't look through the things that people gave to me. I just burned copies, burned backups, backups, backups. And I obviously wouldn't look through the things that people gave to me. I just burned copies, burned backups, backups, backups. And I slept in a sleeping bag in my chair while I burned those CDs. By the end of the week, he's made some cash. He takes the CD burner back home with him and also a bunch of used CDs. So I got back home and at the time, I'd say like one in 10 CDs or so would just be damaged in some way. My experience had been that some of the CDs that were damaged could be reused.

So I went through the CDs and thought, well, maybe you can burn something else on the rest of it. And one of the CDs turned out to be the most nightmarish stuff that I've seen. I open it on my computer and like immediately what pops up is an image folder. I saw what was a kid, likely a girl, who was like back down on the floor or pavement, I don't know, with what looked like a skiing pole tying the legs up and back, like exposing him, her. That just stuck with me, something fierce, for like many years. And I think going back into like these kind of projects, that starts, so I have a photographic memory, my memory works.

I can like, I see the thumbnails now when I speak of them. And going back into these projects stirs all of these old memories that you aren't supposed to have there to begin with. I know he's clenching his jaws while he's telling me this. I believe him when he says he still sees these pictures. He looks haunted. How can a Niner work in their story for close to a year?

VG runs it as a major feature in the summer of 2015. Now keep in mind, VG is the most widely read news site in the country. It averages about 2 million readers a day. Norway's entire population is just over 5 million. So the story does what every journalist hopes their stories will do. It gets people talking. I think it became at least obvious to both the public and the police that this is this is a real problem and that we need to deal with it. So in the last couple of years more and more local police districts have established their own task forces specifically to combat online child abuse.

It also got the attention of a few readers who Håkon wasn't expecting to hear from. But I found it really interesting to see that also people who identified as pedophiles or people, other guys who were downloading child abuse images, they also found our articles important and helpful for them. Like this guy who contacted me and told me that this is the first time that anyone had been able to write about his problems in a way that he could relate to it. So he contacted me and was really frustrated because he was really worried about it himself. He didn't want to have these feelings. He didn't want to feel these desires towards children. He didn't want to download child abuse material, but he still found that, you know, he did it and that he felt a desire

towards children. And he was, although he told me he hadn't done anything, he was really scared about what he might do. And he had searched for help, but I mean, Norway is a small country and he was living in a very small community. He couldn't tell his doctor because everyone knows everyone there. So he was stuck with his feelings by himself. And he still is. So say you're a social pariah

and you can't get help or you believe you can't. What do you do? Well, some men follow a particular path. They go down all the rabbit holes the clear net has to offer, and eventually they find themselves overlooking the biggest rabbit hole of all. The dark web. Many of the sites that we looked into in relation to the downloader story were hinting at these sites on the dark web as well. So there would be links to dark websites

and mention of dark websites on blogs and message boards. And simply put, it's an encrypted web within the web that's designed to be hidden from surveillance, hidden from people trying to monitor what's going on there, trying to censor the stuff that's on there. There's a lot of mystique surrounding the dark web, but really it's just a bunch of hidden websites. To navigate them, you need a specialized browser called Tor. Now, there are plenty of non-sketchy, completely legal sites on Tor. Places to share photos, opinions, recipes. Places to sell and buy things. Places for fan fiction and politics.

None of them any more disturbing than what you'll find on the clear net. But then, there are plenty of disturbing sites too. If you go looking for the dark markets and try to find a hitman for hire and you're likely just going to lose your Bitcoin. And then there obviously are the child abuse sites and various other sorts of sexual abuse sites as well. But the child abuse scene has been fairly active and thriving there for many years now. Some of the sites are dedicated to sort of self-help, how to control the urges, how to accept that you're a pedophile, but at the same time try to curb your desires.

And then they go even further in many cases and go beyond sort of opening up on their deepest, darkest secrets to give descriptions of specific abuse, specific things they've done, and also to provide, obviously, photos, videos of that abuse. And then there are sites that are dedicated to just enabling people. There are sites with huge collections of texts, even books, e-books on how to be a successful abuser, how to hide yourself from law enforcement, how to hide yourself from your family and so forth. A big part of the dark web's appeal is that it offers these men something they can't find anywhere else. A subculture of like-minded people. And it is almost entirely men, by the way.

Women account for less than 1% of the people interested in child pornography. So Einar started monitoring what was happening on the dark web. Håkon, who was reading through one of the forums on the dark web and saw a reference to the downloaders. Einar's talking about the downloaders,

the 10 men in the story he and Håkon had published. And they were discussing them or describing them as clear net losers or some such, I don't know. It said more like these guys who were identified were the idiots on the clear nets, the people who are taken all the time. the clear net, the people who are taken all the time. Darkness is still safe and sound, and I'm proud to be a member of a worldwide movement of child lovers. So it was really a middle finger to our work, and, you know, just fuck you and you won't

be able to find us. And so we took that as a challenge. Okay, you claim that we can't identify and we can't take you just because you're on the dark net. Let's see if we can't identify and we can't take you just because you're on the dark net. Let's see if we can do that. So Einar and Haken get clearance from their editors to start tracking some of the dark web users. Einar creates a few different user accounts on different child abuse websites. So he's configured his browser settings so he's not actually able to see any of the images.

But he can read all the text on these pages, all of the comments about the images, diatribes, confessions. And in reading this stuff, he starts to get a lay of the land, who the players are. He also identifies three or four of the biggest and most popular sites. And among these, one stands out. The Child's Play seem to be the biggest of them. Child's Play. The site has over a million registered user profiles. Einar starts keeping tabs on the site. He focuses on messages posted by Norwegian users. And almost immediately, he discovers something awful. And we identified a Norwegian who was bragging about abusing a younger boy.

I've read the post Einar's talking about, and I'll spare you the details. But the guy admitted to abusing an 11-year-old, in part by promising the kid a toy, a very specific toy. The guy went by a unique username on Child's Play. Håkon quickly found someone with an almost identical username on Skype and Facebook. On the Facebook page,

there was a photo of that same very specific toy mentioned on the Child's Play post. It was circumstantial evidence, but it was enough. Håkon and Einar had an ethical obligation. So we had to

take that to the police, because this was ongoing abuse. The police took the information and started an investigation. Einar and Håkon now knew that they could successfully hunt for users on the dark web. But users are small game. Håkon and Einar

were after larger prey. So you were interested in finding out who ran these sites, the administrators. Child's Play was this growing beast on the dark net. Yeah. How did you identify the administrator of Child's Play? What did you know about him? Yeah, what we knew about the administrator on Transplay was his name. Well, not his name, his username, which was Warhead.

Warhead. Yeah, that's the only thing we knew about him. And you wanted to go after him. Yeah. I've never been uncertain that we could unmask people on the dark web. I mean, it's all about effort. It's all about how much time you're willing to spend on it. Anyone, everyone can be unmasked if you're willing to put the time and resources into it. That's at least my experience.

Einar starts investing the time and resources. Child's Play was run off a modified version of some common open source software, the kind ClearNet hosting sites use too. Meaning Einar had a set of blueprints to work with. Luckily, I mean, for us and for law enforcement, people don't often know exactly how to fiddle with it to make it really secure. So I just pretty quickly came up with a couple of ideas on how I could potentially poke some more information out of those sites.

So Einar starts poking and prodding and looking for weaknesses. It was January 5th, 2017, when I get a message from Einar. We had just had Christmas holidays, and it was late in the evening, and I remember I was at home folding clothes. evening and I remember I was at home folding clothes. Einar tells me just very matter of fact, just writes, oh, I think I've identified the site of the server of Child's Play. Einar had located the server at a hosting facility in Sydney, Australia, a place called Digital Pacific. And I'm, my God, how? How is that possible? It shouldn't be possible. It is impossible to do that.

That's the entire meaning of dark web, that you're not supposed to be able to track down the location of the servers. It should be impossible. Were you incredulous? Did you not believe him? Sure, of course I believed him. As I said, he can do whatever he wants online.

I'm really amazed that he was able to do that, but still not surprised. Because when he sets his mind onto something, he does it. It might take some time, but he does it. Yeah, he had just done some magic. That magic involved reading the hosting software's source code in its entirety. And that's how he found a weakness. Like many websites, Child's Play allowed you to upload an

image to your user profile. Einar noticed that if that image originated from somewhere on the clear net, then the Child's Play software would reach out and look for it, meaning the site would send a brief signal from its hiding place on the dark web. The signal was traceable, and it contained information about the server's IP address. Child's Play wasn't the only server

that Einar had been able to identify or to locate. He had also located one in France and one in Germany. Two other child abuse websites on the darknet using the same technique that he had used to locate the server in Australia. Wow. Yes. Neither the German nor the French leads came through, so he focused on the Australians. It took me a couple of weeks to get in touch with this Australian guy. And he was, sure, come one day day and it was Thursday here in Norway.

So of course I was wondering is Child's Play put there on this server by someone in this company? Right. Yeah. I mean we didn't know I mean mean, who are the people behind? Who is Warhead? What will happen if we alert the company or the owner or anyone else at the company about what's on this server? Will they delete it? I felt like I couldn't give too much information about it at all to the owner or to anyone there until I met them face to face. So you bought some plane tickets? Yes.

It's January 20th and it's a blizzard in Oslo that morning when I'm walking up to the bus stop to take the bus to the airport. So I'm really struggling with the suitcase, you know, in the snow and wind, and it's terrible weather. And while I'm walking, I get a phone call from the police who has been investigating the Norwegian that we were able to identify a couple of months earlier

when we first started this research. This is the guy who was bragging about abusing a kid. Right. So this policewoman, she would just inform me that yesterday they had arrested this man and because of this there was

a young child who would get a better life. Wow. Yeah. How are you feeling? I don't cry very often but I did then. A little over 24 hours later, Håkon lands in Sydney and makes his way to Digital Pacific, the hosting facility. They had offices very close to the Opera House, in the high-rise there. It's a typical server farm, nondescript office space, and rooms with row after row

of server stacks. So this is our data center. We have about 2,000 servers in this facility here. Halkin's got a meeting with the company's owner. The internet, this is where the cloud lives. A guy named Andrew Kolodin. You were, this is where the cloud lives. A guy named Andrew Kolodin. You were saying this is where the cloud is?

This is where the cloud is, yes. And this is where the darknet is? Håkon's not sure what to expect. So I went there and I told them that we are investigating

child abuse websites on the darknet. And that we had found that one of the main websites was stored on the server that they had. And that I needed them to tell me who had rented the server. Because they were probably the people who were running the website and the administrators. How did he react? I'd prepared a long speech. If he denies, if he says this, I will say this.

I had really prepared this talk with him. I felt like he thought I was running the operation. You've got to admit, you had that in you as well when you first came, right? You thought you'd caught the criminal. Turns out Håkon didn't need that speech. Koloden tells Håkon to pull up a chair. He said, I'm just as interested as you in knowing who this is and to get to the bottom of this. And come sit beside me and we'll take a look

at who's rented this server. Were you kind of surprised? Yeah, absolutely. I mean, are you kidding me? So he pulled up some files and took a look at it together. It's a customer registry, I guess. And he could see that this server had been rented since 2014. And then we saw some messages by the customer. Customer service? Yes, customer service. Because they thought that this person who was renting the server was a bit peculiar. They couldn't find out his identity. So this customer service person, he wrote in a message,

sketchy looking ID has been submitted and customer is withholding information towards their projects. So the customer service guy, he had seen this and thought, okay, something's fishy going on here. Who is this guy who wants to rent the server? And why do they want to rent it? So he sent a message and he tried to know, okay, something's fishy going on here. Who is this guy who wants to rent this server, and why do they want to rent it? So he sent a message, and he tried to call this guy, but he didn't answer.

And the same day, they get an email from the people who wants to rent this server, and it says, you can contact Mr. Paul Griffiths at Task Force Argos, as he will verify the validity of our presence. And that's when we knew who these people were. Who were they? Task Force Argos.

They are worldwide celebrities sort of in the law enforcement community. They're cops? Yeah, they're cops. It's the police. I'd gone down to Australia to find out who Warhead is and all of a sudden I find out that Warhead is the police. I'd gone down to Australia to find out who Warhead is and all of a sudden I find out that Warhead is the police. Håkon and Einar had stumbled on a major

undercover operation. Which brings us back to the guys in the hamburger joint. John and Paul. So you're in Brisbane. I'm in Brisbane. It's hot. It's hot. And I'm waiting to meet some police officers.

I mean, they definitely look like police officers with their white shirts and their ties. You know, the way they're walking, they feel very confident. You can see that they're confident and they know what they're doing. Were you intimidated at all? Not by them. But I was a bit surprised that they wanted to talk to me, wanted to take me out to have lunch outside the police headquarter because I told them that I got some information

that I need to talk to you about. So I was hoping that we could meet at an office inside the headquarter. So you guys went out for lunch then? We went for lunch to this noisy burger bar that was looking around me and, you know, is this a place where I'm going to have to tell them that we know what they're doing? And that's what I had to do. So finally they asked me why I'm here. Why do I want to talk to them?

I tell them that I know that they're the ones who are running this website. And Paul, one of the guys, he just turns purple and quiet. And John, the other guy, he turns completely white and gets real stiff and upright and stern and says we're not going to discuss this anymore until I know how you have found this information how you knew it was us I'm going to go. produced by Chris Oak and me, Damon Fairless. The series is co-produced by Halkin Hoytel and associate producer Mikhail Arana. Sound design by Cecil Fernandez. Emily Cannell is our digital producer.

Original music by Olivia Pasquarelli. The senior producer of CBC Podcasts is Tanya Springer, and our executive producer is Arif Noorani. Hunting Warhead is a co-production of CBC Podcasts and the Norwegian newspaper VG. Coming up on Hunting Warhead. Now we knew that Warhead, he's the police. So we could track this operation from our computers

sitting here in Norway. But the police didn't create the site. So that's when he found one article about three men charged in Virginia. It was just sort of one loud bang. Then all I could hear were dogs barking and people just screaming in terror. For more CBC Podcasts, go to cbc.ca slash podcasts.