OpChildSafety: when parents fight back against predators

Earlier this month, there was an incident involving one of my kids and a man posing as a teenage girl named Karla on TikTok. We monitor our children’s phone and internet activity like the NSA. However, this man had taught our daughter how to circumvent our inspections by hiding a messaging app called JusTalk in a hidden apps folder.

The folder was protected with a 6-digit PIN, which she knew since it was the same PIN as the phone’s lock code itself. Once inside, we found the JusTalk app, a secure messaging app that uses end-to-end encryption for one-on-one video calls and chats. We suspected where this was going because our daughter is not technologically savvy.

With access to her messages, as parents, our worst fears came full circle. Karla was using emotional blackmail to coerce and guilt trip our child into doing certain things, keeping her constantly engaged with this unknown person who wanted to meet our child face-to-face. We knew from the tenure of the messages that we were not dealing with a teenager but an extremely cunning manipulator and social engineer.

Throughout these messages, the individual made our daughter feel like she owed them – it was how he controlled her while offering friendship. This, in turn, caused our daughter to do everything in her power to lie when we questioned her about the messages, as she felt she needed to protect Karla.

The thing about TikTok is that users can see who they’re interacting with as their videos are watched, liked, and reshared in the public domain. This is how our daughter was targeted. Furthermore, the minimum age to create a TikTok account is 13 years old.

While this policy sounds effective, kids can easily circumvent the age restriction by simply falsifying their birthdate. This means the registration process isn’t regulated beyond a simple, unverifiable age check.

When predators become the prey

My girlfriend and I are both online predator hunters with a network of cybersecurity researchers in our respective communities. In the online world, she goes by the alias Toxicity and is the founder of Dead Cyber Society, an online initiative that helps safeguard people and children from online threats. Similarly, I founded an online child safety educational and investigative group called Fenrir’s Helm (formerly known as W1nterSt0rm).

Therefore, we would like to believe that we are well-versed in our experience of fighting in the trenches to safeguard kids. More importantly, our kids know how to identify inappropriate online behavior and always come to us whenever they encounter something like this while gaming or chatting.

Using Open-Source Intelligence (OSINT) tools, it took us about a day to completely de-anonymize the identity behind this fictitious Karla personality and have everything needed to expedite a report to the UK’s Crime Stoppers, the national charity that allows people to report crimes anonymously. Online incidents like online sexual enticement of minors fall under the ‘Computer Misuse’ category. Most importantly, Crime Stoppers works with the UK police.

“Above all, those discussions about what is inappropriate is a vital deterrent to ensure your child knows the difference. Whether they put it to use is another story.”

Thanks to data aggregators, the right OSINT tools can uncover information most people think cannot be found. The information we found was substantial because they collect vast amounts of data from different sources, such as public records, social media, online directories, and data brokers.

This includes Google Calendar information, geolocation pins, additional user names, associated subscriptions, social media, and additional email addresses. As the graph tree expanded, showing each new data node and where it all leads, we knew more about Karla’s vile internet operations across social media but still did not have a direct phone number.

A little reverse psychology allowed Toxicity to get the predator to hand that over. What’s more, we did not have an address, although we hardly needed to obtain that ourselves. You must understand that the powers of law enforcement exceed our own in many ways. In some ways, they pale in comparison to what we can do without the presence of red tape.

In this case, law enforcement was able to verify the predator’s identity and obtain the necessary information to proceed to the next phase – an arrest. Conversely, as concerned parents, we left no stone unturned. By doing so, we were able to reasonably satisfy our need to know who was targeting our child.

What is emotional blackmail?

It is important to understand when someone is using manipulation to control you. Growing up, I had the unfortunate experience of being the target of manipulation in a religious cult. So, I understand this relationship dynamic from years of first-hand encounters.

Emotional blackmail is a form of manipulation where someone uses guilt, fear, obligation, or other strong emotions to control or coerce another person into doing what they want. It often occurs in close relationships, such as with family, friends, romantic partners, or colleagues, and exploits the emotional connection to exert power or influence. This predator was running an emotional blackmail campaign, and it involved many victims.

Upon examining the predator’s TikTok posts, he employed a variety of emotional manipulation aimed at exploiting sympathy. He posted staged chats with himself, making it seem that he (Karla) was being bullied into self-harm by her peers and that she was maybe considering it.

Karla said she wasn’t considered pretty enough or likable and didn’t have many friends because nobody listened or cared. Naturally, this provoked the sympathetic human instinct to reach out and offer comfort and support. This is how he baited young users and began grooming them into committing inappropriate acts.

How to protect your kids online

A rule of thumb I’ve come to believe after everything I have experienced is if an app is marked safe for kids, it is best to assume that nothing is safe for kids. This doesn’t mean parents have to throw the baby out with the bath water but pay attention to their online interactions, be vigilant, and ask questions.

Above all, those discussions about what is inappropriate is a vital deterrent to ensure your child knows the difference. Whether they put it to use is another story.

While it is relatively impractical to actively monitor a device minute by minute, it's important to have the right tools at your fingertips to review online interactions. We use FamiSafe, a reliable parental monitoring tool that provides real-time location tracking, detects inappropriate content, and manages screen time. More importantly, they cannot uninstall it or circumvent it.