A Homeland Security Investigations operation that targeted internet child abuse forums and similar networks resulted in the arrest of a Florida manwho had been sexually assaulting his young children and uploading videos and pictures of the assaults to various dark web forums.

Like many criminals who once believed that using Tor to access or publish illegal content protected them from the eyes of law enforcement, James Lockhart, 30, failed to fully compartmentalize the various parts of his life, according to information revealed in recently unsealed court documents. One year ago, according to authorities, the former paramedic from Bradenton, Florida, and a dark web child abuse forum user had uploaded an eight minute video of an adult male sexually assaulting a toddler. The victim, later identified by authorities and Lockhart’s wife, was the couple’s daughter, who had only recently turned two.

The video was first spotted by Homeland Security Investigations in Boston, Massachusetts, earlier this year. According to information revealed alongside the news of Lockhart’s arrest, Homeland Security Investigations has been working with international law enforcement agencies to infiltrate pedophile rings and identify the members of dark web forums and message boards through content uploaded by the pedophiles themselves in the form of shared videos and pictures, stories or written content that contained identifying information, and even simple information leaks caused by a failure to keep the online pedophile accounts separate from accounts under his real name or in some way connected to his real identity.

In many dark web market cases, law enforcement discovers an account such as an email address created prior to the criminal activity on the dark web that also establishes a link between the digital identity and the real person. In the case of the alleged Alphabay owner, the Federal Bureau of Investigation found a hotmail address linked to some of the first confirmation emails for the Alphabay forums. That email address had been used by the person responsible for creating the forums, investigators determined. With a series of basic search terms, the Federal Bureau of Investigation identified a Canadian man named Alexandre Cazes as the owner of the email address in question. Cazes had allegedly signed up for some services with the email “[email protected].” The address also contained part of his first name and the last two digits of his birth year.

Although Cazes’ guilt will never be truly established in a court of law, the simple OPSEC mistake was not one exclusive to Cazes; many other cases, including the case against the creator of Silk Road, rested on similar compartmentalization mistakes. The case of the 30-year-old suspected pedophile from Bradenton involved many of the same investigative tactics. Homeland Security Investigations Special Agents investigated the account on the dark web child exploitation forum where the suspected pedophile had uploaded a video of the rape of a two-year-old girl. They found that Lockwood had been posting on more than one forum and had accounts under two different usernames. He had been using an account with the handle “StrangeWood” on one forum and “HardWood” on another forum.

Investigators searched elsewhere on the internet for accounts under the same name or email addresses containing a variation of the username. Although they had no success matching the second username to any clearnet or compromising accounts, they found a Kik messenger account under the “StrangeWood” handle. After identifying a possible suspect, the federal investigators moved quickly as Lockhart had been discussing the abuse of his son—his daughter’s twin. He promised forum users that he would soon report back with updated information and indicated that he would be sexually abusing both of his children at some point in the future. Homeland Security Investigations Special Agents in Florida showed up on Lockhart’s doorstep at nearly midnight on October 5, 2018. Lockhart’s wife willingly talked to the agents and agreed that she would watch a video of the sexual assault in an attempt to identify the victim in the video.

Even though her husband had blurred the daughter’s face before sharing the picture on any dark web forums, his wife recognized her daughter almost immediately and confirmed the man in the video was her husband and that the video had been filmed in a room in the same house. Special agents matched the carpet and a piece of furniture in the house to the video. They also matched the imprint left by his wedding band from the video to Lockhart’s actual hand after asking him to remove the band. They placed him under arrest after searching his computer and identifying eight illegal photos.

The federal agents arrested him on child pornography possession charges but launched a parallel investigation with the state authorities in order to pursue a sexual battery charge and additional child pornography charges.