An iTunes account and the associated Apple email address were keys to the investigation leading to a takedown of the head of the world's largest torrent aggregator.
Ukranian national Artem Vaulin was arrested and charged in Poland on Tuesday for his involvement in the "KickassTorrents" (KAT) site. The arrest concluded several years of investigation, and encompasses two counts of criminal copyright infringement, conspiracy to commit criminal copyright infringement, and a money laundering charge stemming from his purchase of legal content from the an iTunes media store.
The sequence of events from start to finish span several cooperative efforts between advertising agencies, Apple, Facebook, and financial institutions. Latvian banking information was gleaned from an advertisement placed on the site by law enforcement, which allowed investigators to glean a valid email address for Vaulin, and direct connections to several KAT fansites and Facebook groups associated with the site.
Using basic "WhoIs" and website ownership services, law enforcement discovered two name server IP addresses that KAT used for several years. The name servers were reportedly tracked back to Vaulin in march 2016, after law enforcement was given access to the Chicago-based server logs. For the first time in the eight-year investigation, an actual name for the site owner was known.
Also discovered by US Homeland Security through the name server data was an associated email Apple email for Vaulin. The Apple email was used by the same IP address to purchase iTunes content, as well as manage one of the KAT Facebook properties.
The same email address also was used for the KAT Bitcoin wallet, and was associated with a $72,000 transfer to a Coinbase account belonging to Vaulin.
The US is seeking forfeiture of the seven domains associated with KAT, and extradition of Vaulin for trial. Attorney General Leslie R. Caldwell said that Vaulin "stole more than $1 billion in profits from the U.S. entertainment industry" in his role as the head of the site.
Despite the attorney general's claims about lost profits, which always come under fire from critics, Vaulin allegedly reaped $31 million in deposits from advertising on the site between August 2015 and March 2016. KAT ran for eight years, and the Department of Justice claims that it receives more than 50 million unique visitors per month and is the 69th most frequently visited website on the internet.
KickassTorrents never actually hosted the infringing content. The site was a torrent file tracker, providing a search engine to discover files that allowed a BitTorrent client to identify who had a wanted movie, album, or book available. Notices were posted on the site claiming that they respond to Digital Millennium Copyright Act content removal requests, but how often such requests were fielded is unknown.
The site's content and indices were delisted in 2013 from Google, at the behest of the Motion Picture Association of America (MPAA). Mirrors of KAT databases pop up from time to time, and are indexed for a time until Google identifies the source of the originating data.
BitTorrent itself is not illegal, but frequently comes under fire for enabling the easy and rapid distribution of pirated digital content. The underlying technology is frequently used to distribute game patches, such as Blizzard's World of Warcraft, and a similar implementation was used to deliver the Windows 10 update and subsequent patches to users.