Europol dismantles Kidflix, a major child pornography platform with links to Alicante

Agents of the National Police have arrested in Spain 16 individuals, one of them in Alicante, for purchasing access to a child pornography platform on the dark web using cryptocurrency payments. This is part of an international investigation aimed at dismantling one of the world's largest platforms for distributing paedophile material.

The investigation was coordinated by Europol and led by Germany, conducted across 38 countries, resulting in 79 arrests and 1,393 identified individuals. Some of those arrested not only uploaded and viewed videos but also abused minors. The investigation is ongoing. In Spain, it took place in the provinces of Alicante, Almería, Barcelona, Jaén, Las Palmas, La Rioja, Madrid, Málaga, Murcia, Orense, Seville, Tarragona, Santa Cruz de Tenerife, Valencia, and Zaragoza.

The National Police conducts complex investigations in the fight against child sexual exploitation, such as those carried out on the dark web, designed to conceal the data of those who operate within it. Among them is the TOR network, an acronym for The Onion Router, which not only anonymises the connection but also hosts a series of hidden services (such as websites), whose location is highly complex.

Within this effort and coordinated by Europol, a page was located that served as a repository for recordings of child sexual exploitation, continuously growing through user contributions. It had nearly two million subscribers and 91,000 videos, increasing by more than three videos per hour. In Spain, 17 people had purchased videos, and one had also uploaded one to the platform.

To use it, one only needed to register for free, gaining immediate access to a partial and low-quality preview of all the videos present. If a user wished to view them in full or higher quality, they had to purchase them using the corresponding payment, using cryptocurrencies. Each purchased video could be downloaded or viewed online in high quality. Additionally, credits could be obtained and used to acquire other videos by contributing new recordings not already on the page or helping to classify those already present.

The truly novel aspect of this platform is the professionalisation of its design, allowing users to create a social profile source perfectly adapted to their criteria, as if it were a social network, police sources highlight. Moreover, communication and contact with other users was one of its essential characteristics, making the platform very dangerous for the distribution of child sexual abuse material.

The German police led the main investigation and were able to locate and seize the server hosting these contents, gaining access to payment data for each user. However, cryptocurrency payments are also designed to be anonymous, so using sophisticated asset tracking systems, they were able to find the buyers, tracing each transaction back to the bank details of each one.

Once all the information was gathered, and with the collaboration of the different territorial teams involved, it was determined that the arrests should be made between March 10 and 14, as on the last day, once the economic investigation was completed, Germany was going to disconnect the page and replace it with an official notice.

Under the supervision and coordination of the National Police, who also conducted the distributor's search, 15 entries and searches were carried out in as many homes. In this way, the only distributor present in Spain was arrested, a computer science student who was found with abundant child pornography, access links to both the main investigation page and other child pornography sites, payment receipts, and other detected personal data.

The individual arrested in Alicante, who worked as a freelancer, was found with evidence of payment to the investigated page and also proof of drug trafficking. More than 700 ecstasy pills and 42,000 euros in bundles of 50-euro notes were seized. He was sent to prison by the judge handling the case, police sources indicate. In Almería, a Moroccan citizen who had already been naturalised was arrested, and a large amount of computer equipment was seized.

In Barcelona, there were two different targets, carried out on different days of the action week. In both searches, child pornography was found on the devices, as well as evidence of the payment made. Both were brought before the court. In Arrecife (Las Palmas), another of the suspects was found, a Madrid resident in Lanzarote. Evidence of the payments made was found, so he was arrested and brought before the court. In Alfaro (La Rioja), the detainee had evidence of the payments and the necessary apps to make them. Other data, such as the email used, also matched.

In Madrid, where there were two investigation targets, one of them had abundant child pornography and evidence of the payment made, as well as the TOR browser, so he was arrested. The other, who was not found with images but did have data related to the payment made, was questioned as a non-detained suspect for these events. The suspect in Málaga had moved to La Línea de la Concepción (Cádiz). Officers travelled to that town, where they managed to locate him. Although he did not have pornography at the time of the search, sufficient evidence of the payment was found, as well as a spontaneous confession of the facts, so he was arrested.

A dentist was the target in Murcia, so the search was conducted both at his home and clinic. Abundant evidence was found on different media, not only of the payment but also images of sexually exploited children stored on a USB drive for greater discretion.

Ampliar

The person responsible in Orense was working in Madrid, so he was arrested on Sunday when leaving with his vehicle, although a search could not be conducted, and the material will need to be studied later. He was arrested and, after the corresponding procedures, released.

The detainee in Seville used both his name and his mother's for payments, which initially confused investigators. Once it was clarified that the son, not the mother, was responsible, two searches were conducted, as he used both as residences, where evidence of the payments and the means used to make them were found.

In Tarragona, the detected consumer was a man with a severe mental disability, including psychosis and hallucinations. In addition to the payments, images of children generated by artificial intelligence were found. Due to his special circumstances, he was not arrested but was heard as a non-detained suspect.

On the island of Tenerife, an individual was found with a multitude of child pornography in various instant messaging chats. He also used cloud storage services and was found with payments to the platform.

Finally, in Zaragoza, an individual was found with a large amount of child pornography and evidence of payment via cryptocurrencies. He admitted the facts in his statement. As for the other searches, in Valencia, the target had moved and resides in Paris, while the one in Jaén was investigated but not detained.

Operation "Stream" has been the largest operation ever managed by Europol experts in the fight against child sexual exploitation, and one of the most important cases supported by the police agency in recent years. The countries that participated in the investigation are Albania, Australia, Austria, Belgium, Bulgaria, Canada, Colombia, Croatia, Cyprus, Czech Republic, Denmark, Estonia, Finland, France, Germany, Georgia, Greece, Hungary, Iceland, Ireland, Italy, Latvia, Lithuania, Luxembourg, Malta, Netherlands, New Zealand, Norway, Poland, Portugal, Romania, Serbia, Slovakia, Spain, Sweden, Switzerland, United Kingdom, and the United States.

In total, investigators estimate that 1.8 million users worldwide logged into the paedophile platform between April 2022 and March this year, when in a joint operation by the authorities of Germany and the Netherlands, the platform's server was seized, containing "around 72,000 videos" at that time.

In the course of the investigation, which remains open, a total of 39 minors have been protected, and more than 3,000 electronic devices from which the platform was accessed have been confiscated.

According to Europol, the Kidflix platform was created in 2021 and since then has allowed paedophiles not only to upload and download videos (up to 91,000 unique files while it was active) but also to stream content live. Users made payments with cryptocurrencies.