If you distribute encrypted materials you also need to distribute a means of decryption. I'm willing to bet a honeypot was used to trick him into distributing his csam right to the government hinself.

Neither Tor nor end-to-end encrypted messengers will cover the endpoints. It's possible that they caught him using good old fashioned detective work. You don't need a software back door for that.

He didn’t use encrypted everything. He had a public telegram group chat in which he stored a lot of his material. Which, as many people in the comments on the article pointed out, is not encrypted, but is presented by telegram as if it is. That’s likely how they caught him.

The article is exaggerating the guy's setup way too much. Opsec doesn't end at the application level... The OS (the most popular being in bed with US), ISP, tor nodes, Honeypot VPNs, so on and so on could leave a trail.

Using telegram public groups and obfuscating a calculator as a password protection layer is hillbilly level of security.

And i'm glad these fuckos don't have the knowledge to go beyond App developers marketing.

Yeah, it does. Perfect opsec is impossible even with encryption.

The material was allegedly stored behind password protection on his phone(s) but also on Mega and on Telegram, where Herrera is said to have "created his own public Telegram group to store his CSAM." He also joined "multiple CSAM-related Enigma groups" and frequented dark websites with taglines like "The Only Child Porn Site you need!"

My guess would honestly be Telegram. For starters, they aren't end-to-end encrypted by default, you have to turn it on. The only end-to-end encryption that Telegram offers is their "secret chats" which are only available between two users. Groups are not encrypted.

The Ars article seems to suggest that they were able to crack his phones pretty easily

Android uses data at rest encryption, which isn't really useful without a lockscreen PIN/password since data gets decrypted after you unlock your screen the first time after each boot

Although it doesn't appear he was actually using any encryption apps to store material; rather, he used a fake calculator app as password protection. Obviously not the brightest bulb in the drawer.

Agreed, he probably felt safe enough "hiding" the files. Definitely not the sharpest tool in the shed, which is great because fuck this guy

I honestly don't think he really had any opsec apart from those few applications, look at what tools he was using, what a joke. Fake calculator app to store files are great to protect from your parents, not the FBI.

He was clearly using Android and I bet he was using the stock rom, kyc sim card, and not even a vpn behind tor.

Don’t get me wrong, I’m very happy and relieved he was caught, but if he had done serious research and did a better opsec, it wouldn’t have been so easy for the authorities to get him

Likely, data may have been encrypted but he may have leaked compromising metadata. Even more likely it was bad operation security linking a personal identity to his anonymous persona.

I'm always thankful for incompetent criminals.

In the list of apps he was using I don't see any mention of a VPN. How much you want to bet he raw dogged it with encrypted apps over the clearnet so it was trivial to leak his real IP address

It sounds like he created material, not only AI but actual children then distributed it. The tools to track down the creators of CASM is only getting better.

A single legal image of any of those children posted to social media is going to allow algorithms to make the match and its routine detective work from there.

It only takes one child to talk. No amount of encryption is going to stop that.

I'm still not entirely convinced that tor is as protected as people think it is.

There's only something like 6,000 exit nodes. It really wouldn't be that much money for the government to run thousands of them. If you monitor enough exit nodes and enough relays, you can start to statistically tie connections back together with timing analysis.

I don't know this to be the case for sure but I can't imagine the government hasn't pushed towards breaking the security and identifiability of the tor network