Tor users in the US were allegedly hacked by Australian authorities, as part of a child pornography investigation, which involved a prolific dark web child abuse site called "The Love Zone". The law-enforcement led-hacking came to light, thanks to court documents recently filed in the US.
According to a report by Motherboard, in 2014, the Queensland Police Service's specialised unit focusing on fighting child exploitation crimes - Task Force Argos – took control over The Love Zone site after uncovering the identity of the dark web site's Australian administrator. The task force then posed as the site's owner in an undercover operation to go after the site's members. Task Force Argos' logo includes the tagline "Leave No Stone Unturned" and the image of a scorpion.
The Australian Federal Police, however, denied any knowledge of such an operation. "The AFP was not aware of, or involved with this operation," the law enforcement agency said.
The dark web site had over 29,000 members by 2014 and required members to upload content at least once a month to retain their access to the site. Users generally connected to the site via Tor, which only allowed authorities to determine what pages and content they were viewing, without revealing their location. In retaliation, the task force hacked some of the users, in efforts to find their real IP addresses.
"The proprietors of TLZ [The Love Zone] designed the website to allow users anonymity when they visited the site, but after the Australians took it over, they unmasked the IP addresses of many of those who used the site," reads a court document from the case of Seth Piccolo, who was sentenced to five years in prison after pleading guilty to possession and distribution of child pornography. Piccolo's lawyer Matthew Borgula, confirmed that Australian authorities had sent his client a link, which when clicked, sent back the real IP address to the investigators.
A court document revealed: "When a user clicked on that hyperlink, the user was advised that the user was attempting to open a video file from an external website. If the user chose to open the file, a video file containing images of child pornography began to play, and the FLA [foreign law enforcement agency] captured and recorded the IP address of the user accessing the file."
The case and documents revealed highlight how law enforcement agencies across the globe are increasingly going after overseas targets using hacking techniques, thanks to the still-ambiguous legalities surrounding such investigative methods.
"If they get your IP address from the Tor Browser, then it is law enforcement hacking," Christopher Soghoian, principal technologist at the American Civil Liberties Union, told Motherboard.
Although refraining from commenting on the specifics of the case, a spokesperson for the FBI, Christopher Allen, said: "The FBI, led by its legal attaches in numerous countries around the world, seeks to foster strategic partnerships with foreign law enforcement, intelligence, and security services as well as with other US government agencies by sharing knowledge, experience, capabilities and by exploring joint operational opportunities."
The Love Zone's Australian owner is currently serving 35 years in prison for child sexual abuse.