The drive from Nashville takes more than 10 hours. That would have given Falte ample time to reflect on what he was heading to do.

He drove across the Smoky Mountains, through lush forests where the trees were aflame with autumn colours. He kept driving. Did he ever stop to consider whether it was right to rape a four-year-old girl? Regardless, he pressed on towards the house in Virginia.

As did Faulkner, all the way from Toronto.

On the dark web, they divided between them a kingdom of like-minded people who admired them and strove to curry their favour.

The supplicants included a man with access to the four-year-old girl. According to a police report, it was he who filmed the assaults. The pictures showed that at least one of the three men raped the girl that Saturday in September 2016.

American prison

The phone line crackles as the man who provided the four-year-old girl to Faulkner and Falte talks to VG from the prison, where he has been for almost a year.

Imprisoned man.

– There isn’t much privacy here in the prison, so there’s not much I can say on the phone, he says, and continues:

– I’m not going to lie. It was I who contacted CrazyMonk first.

VG has data showing that this man had visited several of the biggest child abuse websites. He had posted abuse pictures and asked other members for help in finding more.

For him, getting to talk to CrazyMonk, the head of the website, was a big deal. A famous man. To make contact, he showed Falte pictures of the child. That’s how it started.

A few weeks later, Falte arrived at his home. Under questioning, according to court documents, Falte said that during his first visit in 2015 he raped the child “until the minor complained”.

That was the first of a five visits to the small house in Virginia. Just after New Year’s Falte came back, this time with Faulkner.

In interviews with VG, the police say they don’t know why WarHead and CrazyMonk decided to meet, though they had a lot of information about the men.

After the police found the server where the site was stored, in July, they monitored all communications, including private messages between the administrators. The police kept tabs on where they travelled in Virginia, where they spent nights, and which houses they visited.

No one suspected a child was about to be raped.

– But we definitely wondered why they wanted to meet. That question hung over our heads, says Rouse, in Australia.

– Some of these men wanted so desperately something beyond just the confirmation they get online. They want to meet people like themselves, if only for a beer, says Griffiths.

– Why weren’t they arrested before the assault occurred?

– We had no idea that was going to happen. They never mentioned anything about it in the messages we saw about meeting, says Griffiths.

The man who filmed the abuse of the child confirms that was the case. The plans to meet were made in an encrypted chat program, he tells VG.

Police had access to these chats only after obtaining all the passwords from CrazyMonk and WarHead.

Faulkner and Falte say the same in an email to VG from prison in the United States.

– We made sure specifically not to talk about specifics anywhere other than Tox [encrypted chat], and burner phones with dummy burner phone numbers, they write.

They were surprised at how much the agents managed to find during the search.

– I was completely confident that they had very little on both of us in terms of evidence that they could use in court, writes Faulkner.

– Our machines were fully encrypted, we ran everything in Virtual Machines (VMs), all our removable media was free of anything implicating. They did not know anything about what was going on in Virginia.

ANNONSE

In a purely investigative sense, the arrests were a success. Task Force Argos assumed control of all of Faulkner and Falte’s usernames and passwords.

Task Force Argos became WarHead, but nobody outside the team knew.

Griffiths and his colleagues worked frenetically to learn all about Faulkner’s online persona so as to assume his identity without anyone catching on.

That took longer than some Childs Play members liked. Previously, WarHead had been a frequent presence on the site, often posting messages several times a day. Now he was silent.

«Did anybody hear from WarHead within the last 7 days? I'm waiting for a pm from him. Nothing happens.»

, a nervous member wrote, using an abbreviation for “personal message”.

«Strange, her disappearing and this forum going slower and slower......,», wrote another. Like most forum members, he used the pronoun “she”, though the vast majority were men.

Something had to be done. If the forum did not hear from WarHead soon, members would sense he’d been arrested. They might then begin deleting their own tracks. That must not be allowed to happen.

Online crime has no borders. That’s a problem, but in this case Argos and its partners turned it to their advantage.

It is VG’s understanding that when WarHead surrendered access to Childs Play and Giftbox each forum was stored on servers in separate European countries. Police, lawyers and the suspects themselves refuse to say which.

Police in Australia and the European country saw obvious benefits to having the Australian police, rather than a European force, running the site.

Australian laws give the police unusually broad powers to monitor suspicious activities online.

– During a so-called “controlled operation” we get permission from a judge to act in ways that normally would have been considered illegal. We are given the right to commit certain criminal actions and we are exempted from prosecution because we are investigating specific crimes, explains Griffiths.

At a meeting this spring in The Hague of the some of the world’s leading investigators of internet-related abuse, Griffiths told of a case in which he hacked into someone’s account on a web forum.

– I looked around the room and knew that none of the other investigators had permission to do the same. Technically, it wasn’t difficult. But legally they would not have been allowed, says Griffiths.

He thinks that’s a problem.

– It means they lose the opportunity to identify some of the worst offenders on the internet, he says.

– If they had the options we have, I’m sure they would catch people they can’t get today. But it must be done properly, within a given framework. For it to work you have to have certain abilities and controls in place. I feel we have that.

With permission from the European police partner, Task Force Argos logged on to the server, took over the “Childs Play” site, copied it and moved it to a server in Sydney, as VG discovered in January.

Experts consulted by VG say the transfer was comparable to the way the United States once flew terrorism suspects to countries with lax human rights records for questioning.

Jon Wessel-Aas Photo: Gorm Kallestad / NTB scanpix

– The logic seems to be the same in this case, says Jon Wessel-Aas, a Norwegian lawyer and specialist in privacy and human rights.

– It is worrying if the police “outsource” investigations to a country where police have freer rein, at least if it’s done intentionally and systematically. But the legal picture is unclear.

Cross-border investigations are demanding, both legally and ethically.

– In the absence of sound regulations, the police in countries with the fewest legal protections can end up with responsibility for an investigation, Wessel-Aas says.

«Warhead» is back

On Thursday, October 6th, 2016,

Four days after the arrest, “WarHead” was back on Childs Play:

«Phew, what a month that was!. A month of my life that I won’t get back. Although technically most of the really screwed up shit happened in October, not September, hence my late foray into this month»

Then he reprimanded his subordinates: «Sorry again about the late arrival but I did ask the Staff team to step in and cover for me in my enforced absences.»

He, WarHead, was no longer Faulkner, but Paul Griffiths of Task Force Argos.

Thus began the undercover phase of Operation Artemis.

Within four days of the Canadian’s arrest, Griffith had examined every message WarHead had written. He studied WarHead’s writing style, including the typographical errors he was prone to. He knew the snippets of background history he had revealed online.

He did this during the day. Nights were spent in telephone conferences with colleagues in Europe and the United States.

It was inevitably 2 a.m. in Brisbane when everyone else was available to talk.

Going undercover online takes more than grammar and personal history. To write like WarHead, Griffiths had to be WarHead. It was a mental effort that he and his task force colleagues disliked.

– When you’re trying to be someone who has written a lot online, who a lot of people know and whose way of writing and expression they recognize, you can’t just show up and use a completely different vocabulary. You have to study the punctuation he uses, as well as the smileys and other characters.

Not even that guarantees success.

– You need to understand how he feels. It’s destructive. Really difficult. I have been working in this field for 22 years. Seeing pictures has no effect on me anymore. But to sit online and talk like one of these guys ... Every time I’ve done it, I feel like I have to take a shower afterwards.

Paul Griffiths. Photo: Tore Kristiansen / VG

Griffiths – friends call him «Griff» – is considered a leading expert on identifying victims and perpetrators based on images.

He has been identifying victims of abuse for 22 years. If one person has abused another, and it was filmed, he most probably has seen it.

– My main motivation is to identify the children and get them out of their horrible situation. That’s how I manage to work with it.

– I also have a touch of Asperger’s. At least, that’s what my wife says. She says I have no empathy, says Griffiths with a short laugh.

– That makes it easier to stay in the job.

It also helps that he has a photographic memory, remembering everything as pictures. Even when sifting through millions of pictures, he knows which ones he has seen before, including where and when.

– We have good databases, but I generally find things faster than them.

Five years ago he saw a picture. It was a picture of a naked man. Griffiths knew immediately that he had identified one of the internet’s most ruthless and notorious abusers: Falko.

The man in the photo had a feature that Griff recognized from child exploitation films that Falko had shared online. No one had managed to identify him or the victims, because he was careful never to show his face during the abuses he committed.

But “Griff” recognized a mark on the man’s penis.

That led to Falko’s arrest and lengthy prison term in Kazakhstan. Now he is on the run, after a spectacular escape that involved throwing himself out of a courtroom window and breaking both legs, then escaping from the hospital. But it was “Griff” who found him.

«We are, I can assure you, as safe as we have always been, and I hope we will always continue to be so,»

Griffiths wrote in the guise of WarHead.

Members believed him.

For nearly a year, Task Force Argos would harvest information about the members on the website.

Having complete control of the site meant they could see everything that went on there. By reading private messages, deleted messages and email addresses and passwords they could build a profile of the members. They could also add bits of code to the program that controlled the site, enabling them to find members’ IP addresses. They tried a variety of techniques to identify Childs Play members, but decline to discuss them with VG.

– If this was war, do you think the general would let you into central command? We do not want to tell these people how we work, and I really hope you don’t either. You won’t get our operating methods, says Rouse.

– We’re trying to do something that has never been done before. So in a way you write your own – I won’t say ‘rules’ – but you write your own script. We use techniques that have never been applied before, and we don’t always know how to prepare ourselves for the results, adds Griffiths.

As a sort of anthropologist of the dark, Griffiths learned the culture of this online community of exploiters: what should not be posted on the main site (torture videos); what could be shared in a small, trusted group (torture videos); who among the members were popular and in favour and who were not.

Accessing private messages between members turned up a surprise for Griffiths. Several of them knew the police were now running the site.

– A substantial number knew exactly what had happened. They had exposed us as police and saw through the smokescreen we had put up around WarHead. They knew it was us, but didn’t tell anyone. Those who exposed us talked to each other but didn’t warn anyone else.

Griffiths tried to write as few posts as possible, but there was one that the Australian police could not escape: WarHead’s monthly status update.

The understanding between WarHead and forum members was that a missing a status update would signal that the site had been taken over by others. That is why the messages were so important, and had to be written in the same style as always,

Under Faulkner’s rules, each status update had to end with a sexual assault picture.

– The assumption was the police couldn’t share such images, making it impossible for us to run the site, says Griffiths, who is originally British.

– In Britain, we couldn’t have done this. But when you’ve worked in this field a long time it becomes obvious what needs to be done and why. Doing this gives us a chance to identify those who commit new assaults. Most of them have probably already seen the photos we share.

On January 3rd, 2017, Task Force Argos published WarHead’s monthly update. In it, they wrote about the work WarHead had been doing on the forum, ostensibly to make it more secure for members.

The message was concluded with:

«I hope that some of you were able to give a special present to the little ones in your lives, and spend some time with them. It’s a great time of year to snuggle up near a fire, and make some memories.»

He ended the update message, as required, with two child abuse images.

– Could this message be seen as encouraging sexual abuse? VG ask.

– Well, there’s no ... I mean, you know, says Griffiths.

– Things can be read between the lines, but that doesn’t necessarily mean we’re encouraging anything. We may have talked about sexual abuse in a number of different forums and platforms, but we would never encourage abuse.

– Sharing any such image is an abuse of that child. However, it is something we can justify as being for the greater good and to prevent ongoing abuse of children.

– How do you think the children in the pictures feel about your sharing pictures of them?

He pauses for a second.

– I hope they understand that we are trying to catch as many offenders as possible.

Carissa Byrne Hessick. Photo: Einar Otto Stangvik, VG

Carissa Byrne Hessick, a professor of law at the University of North Carolina, questions Griffith’s argument. She is one of the world’s leading legal experts on investigating such abuse.

– It sounds like the police tell one story about how damaging the images are when others share them, and another story when the police share them.

– That’s a kind of hypocrisy I really don’t like. But this sheds light on the argument that any and all sharing of such an image is abuse. If the police say they’re only sharing images that have been shared before, it means the police do not think all sharing is harmful, says Hessick.

She expresses concern upon learning that the police themselves did share child sexual abuse images.

– I don’t necessarily think it’s wrong for them to commit criminal acts during undercover operations. My concern is not about them breaking the law. My concern is whether we get enough information about the balance in what they do.

– If the site is used to facilitate the actual abuse of children and the police continue to run it, I question their ability to strike a balance, she adds.

Griffiths claims they do seek balance:

– There is definitely a balance between what we want to achieve and how we go about it, he says.

– Eventually we get to the point where it isn’t worth running the forum any more. But as long as we’re identifying victims, producers and abusers, we will keep running it.

He tells of a previous operation in which investigators ran “The Love Zone” website for just a few months. Griffiths claims they identified more than 80 children.

– You can ask them if our running the forum was worth it, he says.

– Isn’t there a risk that people downloading such images will develop into abusers?

– Abusers are abusers. People who have a desire to abuse children will abuse children no matter what, Rouse says.

New York

On September 1st, VG makes contact with a woman in New York. Images of abuses against her daughter have been shared thousands of times – and now on Childs Play as well, under administration by Task Force Argos.

She starts to cry, then pulls herself together.

– They might argue in the long term it will be beneficial to my daughter because it will help them capture other pedophiles. But just sending her image to one offender can turn into it being in the hands of hundreds or thousands of others, hurting her more, not helping her, says the mother.

Her lawyer, James Marsh, takes a more positive view of the police using such images. He represents numerous children who feature in the most widely shared exploitation images.

– Several of my clients would have welcomed police use of their images in the battle to track down abusers. They know how skilled these men are at hiding and understand what it takes to catch them, Marsh says.

He nevertheless understands the mother’s reaction. The pictures of her daughter had been less extensively distributed than many others, so each new share carried more significance.

– I agree with her that the police should compensate the victims, but not with money. If victims could be consulted along the way, it would give them a sense of control. Control is exactly what they were deprived of during the assaults, says Marsh.

Help us finance investigative journalism: VG+ subscription

Several participants in Operation Artemis refused to be interviewed or identified, including the investigator who monitored the Scandinavian sub-forum as well as other European partners in the operation.

Homeland Security Investigations agents declined interviews as well, saying that the legal cases against WarHead and CrazyMonk were still in progress.

– There is a lot we can’t say about this operation, especially not what our partners did, says Rouse.

Some of his own Australian investigators disapproved of VG being given information.

– Several of my international colleagues know you are here and talking with us today. They are not very happy about what your colleague did to expose us. We have done a lot of good work together and I want it to continue. So you can’t use my name, says one of them.

He is, however, willing to talk about his work an undercover agent.

–Anyone who says they haven’t cried in this job is lying. You give a part of yourself the job, and that part becomes a friend of those you’re investigating. When we were done with one of our recent operations, it felt like I had locked up all my friends.

Apart from Griffiths, this was the agent who most often went undercover as WarHead. All the website’s members followed every word he wrote. Successfully imitating an abuser online has its challenges.

– It’s as if you force yourself to have a split personality, and you download this other person into a part of your brain and hand over that part of your brain to him. It’s hard.

Childs Play statistics Number of posts per day Accumulating number of posts with pictures* * Each post can contain multiple images / videos

Activity on Childs Play was high during the time the police ran it.

In January, when VG first wrote about Childs Play, the site had 427,000 registered accounts. Through September of this year, more than a million accounts had been registered.

On 25 October 2016, two weeks after Argos took over the site, an unidentified user created a discussion thread featuring images of an eight-year-old girl being raped.

By August of this year, the post had been viewed 770,617 times – all while the police were running the website.

Childs Play shuts down

Wednesday, September 13th: After running the site for 11 months, Task Force Argos finally shuts down Childs Play without fanfare.

In a few keystrokes, the forum vanishes from the dark web.

If you managed to find the old web address, you would simply be informed there is nothing there. Childs Play is gone.

Now the work of sending cases to police around the world is underway. A dozen countries are already involved in the investigation of the site’s members. Griffiths has a list of between 60 and 90 people from around the world who are his main targets.

Another country’s police are believed to have a list of nearly 900 people they think should be arrested. Some have been already, with more to come.

Canadian police say they have identified and saved “a dozen” children and referred some 100 cases to other countries. Task Force Argos The Argos Task Force itself declined to provide numbers to VG.

– The media tends to use such figures as “weapons” against us and our colleagues around the world, and we don’t want that, Griffiths tells VG.

Also uncertain is the total number of children identified and rescued.

Professor Hessick wonders about the missing numbers.

–If they conduct investigation without even checking if the people have been arrested, it’s hard for Argos to argue that such police operations are necessary. I worry the police apparently think they don’t need to justify an operation like this, she says.

The FBI ran a similar operation in 2015, and the numbers weren’t released for two years. According to the FBI, 870 people were arrested or convicted as a result of the operation, and 259 children were rescued or identified.

In the pursuit of child abusers, the police seem to have found a highly effective method: don’t leave the market to the predators. Run the sites themselves.

– Our job is to make sure we play at the same level as the abusers. If we don’t, they will always be one step ahead, says Jon Rouse.

Richmond, Virginia

On Friday, September 15th, two 27-year-old men faced a judge in a Richmond, Virginia, courtroom. The prosecutor had demanded a sentence of 50 years in prison. The defendants’ own lawyers said 30 years would be more appropriate.

The judge didn’t agree with either side, and sentenced both 27-year-olds to life in prison.

Neither will ever be released. Not because they, as CrazyMonk and WarHead, had run the internet’s largest abuse forums, but because as Benjamin Faulkner and Patrick Falte they had raped a four-year-old girl.

In Tennessee, prosecutors are preparing to try the men accused of running «The GiftBox Exchange».

In an email to VG from prison, Falte and Faulkner say they will fight their case in court.

– We would love to talk more about GBE, CPlay, and some other sites, but we cannot get into that until after the Tennessee trail. Saying all that, we may have been involved at every level, for years, starting from the basic user to moderating, administrating, owning and creating, several sites, chatrooms, and services, Falte and Faulkner write, using initials for Giftbox Exchange and Childs Play.

They later add that they will appeal the life sentence ruled in Virginia.

Their lawyers have not answered VG’s inquiries.

There will probably never be a trial focused on Childs Play, the site that Task Force Argos ran for almost a year. Faulkner has been sentenced in any case to spend the rest of his life in prison.