Playpen Member “Clockwork” Forgot to Empty His “Trash Folder”
An investigation conducted by Europol and the German Federal Criminal Police Office led to the recent conviction and sentencing of a member of the darkweb child abuse forum “Playpen,” German news outlets reported the incident in September. During the case, the court heard information detailing the Federal Bureau of Investigation’s role in the investigations and arrests of German members of the forum caught during Operation Pacifier in 2015.
The Siegburg District Court in North Rhine-Westphalia, Germany, heard how a 36-year-old man from the Rhein-Sieg district of North Rhine-Westphalia had downloaded child abuse pictures and videos from Playpen in 2015. According to information revealed by the prosecution, the evidence from the Federal Bureau of Investigation “concretely” identified the defendant as one of many members living in Germany.
In May 2017, Europol announced that the Department of Justice and other international law enforcement agencies, following the 2015 operation that resulted in the forum’s takedown, had sent information on suspected forum members living in Europe. The Federal Bureau of Investigation had silently moved the child abuse forum from the original owner’s servers to new and secure ones under FBI control in Virginia. From there, the FBI modified parts of the forum in a way that allowed them to exploit a vulnerability in certain versions of the Tor Browser Bundle.
The FBI obtained a warrant to exploit the vulnerability in a way that targeted members in a widespread and controversial manner. Due to the nature of their NIT, many researchers and defense attorneys argued that the FBI had hacked computers not only out of their jurisdiction in the United States, but that the FBI had illegally hacked computers in almost every country in the world. In the United States, the majority of judges ruled that the FBI had not acted illegally or outside of good faith. Some agreed that the FBI had taken things too far during the investigation. The Department of Justice, in one case, had to drop all charges against a defendant due to their refusal to reveal the source code of the so-called “malware.” However, much less attention has been shown to similar cases outside of the United States.
As of the May 2017 announcement, Europol had sent information from the FBI to dozens of European countries after reviewing the data, matching IP addresses with subscribers, and assembling “packets” on each suspected member of Playpen. The FBI’s information, after passing through Europol, led to 368 arrests in Europe. Many of those suspects have since been convicted in connection with Playpen.
The North Rhine-Westphalia man was one of 609 suspected Playpen users the FBI had unmasked in Germany. The FBI had technically only passed on the IP addresses (and other information obtained through the use of the NIT) of unmasked Tor users in Germany. There was likely a massive difference in number of IP addresses and the number of unique members that the FBI handed over to Europol. Europol compiled the data from the FBI and passed it to the German Federal Criminal Police Office in late 2015.
Later, in 2017, the FBI provided the German Federal Criminal Police Office with information that connected the 36-year-old defendant to a Playpen account under the name “Clockwork.” Evidence indicated that he had used the same username on similar darknet child abuse sites. He had also been convicted of possession of child pornography and receiving child pornography in 2012 and spent eight months in prison as a result. This time around, when the police raided and arrested the 36-year-old, German authorities only charged him with possession of child pornography.
According to information revealed in the courtroom, the defendant had admitted to downloading the illegal content in 2015 but explained that had deleted it shortly after downloading it as he “wanted a fresh start.” He had moved in with his daughter. Investigators confirmed that the man had deleted the content but that he had never deleted the pictures from his computer’s “trash folder.”
Due to the man’s alleged fresh start and the lack of evidence indicating that he had accessed illegal content at any date later than the 2015 Playpen takedown, the court sentenced the man to only six months in prison and ordered him to pay a 600 Euro fine to the Catholic Youth Agency in Bonn. The judge suspended the sentence for a probation term of six months.