Task Force Argos Operated a Darknet Child Abuse Forum for 11 Months

With striking similarity to the US FBI’s takeover of the darknet child abuse forum PlayPen, Australian police triggered arrests across the globe after spending nearly a year secretly running the forum. Investigative journalists with VG, a Norwegian newspaper, unintentionally stumbled upon the secret operation while investigating the massive child exploitation forum known as Childs Play.

While investigating the site, one of the newspaper’s computer experts found the hidden service’s IP address. It was hosted on a server owned by Digital Pacific. The IP address, according to VG’s explanation, was found via a simple leak that occurred when uploading a profile picture (or picture elsewhere). VG travelled to Sydney, Australia, and visited the offices of the web host. They spoke with the founder who wanted to help them find the owners of Childs Play. Andrew Koloadin, the founder of Digital Pacific allegedly agreed not to shut down the server in order to preserve VG’s work. He additionally agreed to lookup the owner’s registration information.

“A few keystrokes later, we have an answer: the server is leased by Task Force Argos in Brisbane,” VG explained. Koloadin was taken back by this. He wished the Task Force Argos—the internationally known branch of Australian law enforcement that took down The Love Zone—had notified him of the operation. VG then reached out to Task Force Argos and arranged a conversation. The investigators eventually worked with VG in answering questions about the investigation.

When VG uncovered Childs Play, Task Force Argos had taken the forum over only three months prior after the arrest of the site’s owner in the United States. Like with The Love Zone, Argos investigators quickly studied the owner’s writing style, typos, and punctuation. They slid into the admin’s position almost seamlessly, posting as the owner known as WarHead and using WarHead’s writing style. With full control of the server, Argos saw that some members knew that law enforcement had taken the site over. Nobody, though, revealed that information to the “public” forum.

Argos, after assuming the identity of the Canadian owner, Benjamin Faulkner aka WarHead, maintained the forum for nearly a year. Part of this task included posting monthly status updates (warrant canaries) that included pictures of children being abused. This was a conflict for the investigators, but a necessary evil, they explained to VG.

Operation Artemis, the name Argos gave to the undercover part of the operation, remained open as investigators around the globe gathered information on suspects. Australian law enforcement agencies have more leeway in these cases than law enforcement in many countries combined, so Australia taking the lead was a welcomed move. On September 13, 11 months after sliding into the operator’s seat, Argos shut the site down. One Argos investigator told VG that he had a loss of “60-90” people worldwide. Canadian police claimed to have saved a dozen children. One unidentified country’s police reported they had a list of 900 suspects.

Homeland Security Investigations reported an open investigation connected to Childs Play. And Faulkner’s case is still sealed—for the most part. As arrests begin to line up, the controversies surrounding Operation Artemis are sure to surface. People objected to the FBI running PlayPen for less than two weeks. At 11 months, the Artemis is (that we know of as) an operation of an unparalleled scale. How far can law enforcement push an investigation? At what point does keeping a forum open cause more damage than shutting it down? Will law enforcement open their own drug markets or child abuse forums?