How investigators took down the world's largest torrent site
The US Department of Justice said on Wednesday that Ukrainian Artem Vaulin was arrested in Poland. He's accused of running KickassTorrents, which has since gone offline.
A document published by US authorities outlines the methods used to find the servers and the people who are allegedly behind KickassTorrents.
The site got hold of movies before they were released on DVD
First off, the document shows that KickassTorrents was regularly able to post movies before they were available to buy. The chart below shows that mainstream films were made available on the torrent site days after being screened in cinemas, and weeks before the DVDs were officially released.
The document goes on to explain that the filename for the movie "Captain America: Civil War" included the description "TC." That means that the movie was transferred from the cinema reels using a telecine machine to create a digital copy. Cinemas, then, were the source of these early releases on the torrent site, not a source in the retail release supply chain.
Investigators posed as advertisers to place ads on KickassTorrents
The document shows how investigators pretended to be advertisers and contacted KickassTorrents asking to run ads on the site. An undercover agent from the Internal Revenue Service (IRS) contacted a KickassTorrents administrator named "Mr White" and agreed to pay $300 per day to run an advert on the site.
The ad ran next to a torrent for the movie "Deadpool."
The undercover investigation turned up bank information for the site
In order to pay for the ads, investigators obtained bank account information from KickassTorrents. One bank account was based in Latvia and was for a company named "GA Star Trading Ltd, 9 Barrack Road Belize City, Belize." Another account was in Estonia, and registered to a company known as "Glomeratus LTD, Beneficiary address: 1 Straits Parade, Bristol, BS16 2LA, UK."
KickassTorrents told advertisers not to reference the site or anything to do with advertising payments. An email sent to undercover investigators read "Please pay attention to the bank details. They should be entered correctly. Also please don't mention KAT and 'for advertising anywhere.' Could you please inform me when you send the payment?"
Investigators say that the Latvian account received €28,411,357 (£23 million) in deposits between August 28, 2015, and March 10, 2016.
Google, Apple, and Facebook handed over data
Another reason why investigators were able to take down KickassTorrents was cooperation by large technology companies that were used by the alleged mastermind to run the site. The document posted by the Department of Justice shows that Google handed over data from the Gmail account avaulin@gmail.com that showed early versions of the KickassTorrents site.
It wasn't just Google that gave up user data, though. Apple also provided emails sent from the tirm@me.com account, as well as the IP addresses of logons to the account. That helped investigators tie the person behind the emails to the Facebook page for KickassTorrents, as the IP addresses for those posts were also provided to police.
The company accused of running the torrent site also developed a wine identification app
Investigators say that Artem Vaulin ran a Ukrainian technology company called Cryptoneat that is accused of working on KickassTorrents and maintaining the site. The website for Cryptoneat was registered using Vaulin's personal account.
There was only one product listed on Cryptoneat's website: A wine identification and scanning app called "Winee" that is still live in the App Store. It lets people track and rate wines, and users can also scan their labels to find out more information on them.