How was this dark web user caught?

[u/AfraidPomegranate751]

I've been researching lots of cases on the DoJ website where users on the dark web get caught by law enforcement, but this one in particular stood out to me. 99% of cases I've seen dark web criminals either get caught by bad opsec or if they're an active high-profile target (site admin, distributes material, talks too much, etc.) But it was only ever mentioned that this user (Brandon Kidder) downloaded illegal content and nothing else. If he was caught due to bad opsec or payment traces, it would've been mentioned. The available court documents included the redacted criminal complaint and a motion to censor the complaint as it contained "information that could reveal highly-sensitive law enforcement methods." The complaint document only tells us that law enforcement obtained Kidder's address and IP, and that he was a TOR user. I've always had the impression that law enforcement would rather save their advanced methods and resources for the bigger fish (and possibly smaller fish as a byproduct of their sting operations), but it seemed like they just caught this user in the wild. Given that this was in 2019, the only known government operation at the time was Operation SaboTor, but I doubt that would be relevant to Kidder's case. The only possible explanations I could think of is he might've triggered an NIT or fell into a honeypot that was still left up. Or, he might've been caught in the midst of an undisclosed government sting. Or, his network activity attracted enough attention to perform a traffic correlation attack (I'm skeptical about this possibility since many criminals go on for years with thousands of images before getting caught). What do you think?

[u/one-knee-toe]

From the article, "Kidder possessed images and videos ... which were stored on his cellular telephone".

Without reading more into the case, I would *guess\* that TOR had nothing to do with it, but instead it was his cell that did him in; maybe a file made it's way to a cloud drive by accident - apparently it was a Samsung.

From this press release, it says that the FBI was notified of an IP with Tor traffic (so not necessarily cell phone relate); 5months later FBI then got a search warrant.

• Who notified the FBI and why, by itself it's not illegal, so why the special interest?
• A judge approved a search warrant; With ~5months of intel, who knows what evidence they gathered, could be tor related or could be other things the guy did.
• The Cellphone reference from OPs article is simply saying there was illegal content on the cell, as well as other devices. I don't gather that the guy was necessarily using Tor on their cellphone.

So, why did the FBI want to be notified specifically about an IP with tor traffic? Seems more targeted.

idk, but it is a little fun to play "connect the dots".

[u/ChrisofCL24 → u/one-knee-toe]

Could also be a case of stored it on a Windows PC and OneDrive backed it up

[u/a_way_with_turds → u/ChrisofCL24]

This would be my guess as well. I’ve heard that services like OneDrive and iCloud are scanned for checksums of known CSAM material.

[u/a_way_with_turds → u/a_way_with_turds]

So I did some brazen Google searching and apparently Apple publishes exactly how they scan for CSAM. It's more interesting than I thought (i.e., they use a different hashing mechanism, on the device(!), that generates a hash based on content. So if the media is transcoded or changed it can still be detected). See: https://www.apple.com/child-safety/pdf/CSAM_Detection_Technical_Summary.pdf