Chuck sits down at Defcon with Ryan Montgomery, who works against online child exploitation, to learn how to do the work himself. The interview shows how easy predators are to find, then lands on Ryan's main point: don't do it as a vigilante. Ryan says the effective and legally safe route is to join an NGO that works with law enforcement and learn OSINT on safe targets first. He also says that educating parents, not arrests, is the most valuable thing he has done. Chuck commits to joining Ryan's team, and they plan a second episode built around an OSINT challenge on an already-convicted predator.
Who Ryan is. Ryan describes himself as a business owner who works with law enforcement and NGOs to identify predators, builds tooling for them and trains them. He is CTO of Sentinel Foundation, an NGO countering human trafficking and violence against children. He started hacking at nine through AOL chat rooms, IRC and phone phreaking, mentored by the nerdcore rapper YTCracker among others. Later, while running three rehab facilities, he found vulnerabilities in their electronic-records vendor's platform, including a defaced support subdomain. The vendor had just paid $40,000 for a pen test, and hired him as a consultant. A later sale of that company, for what he calls eight figures, funded his security company, pentester.com.
How the child-safety work began. A friend's wife sent him screenshots from a clear-web forum where users discussed abusing children. He meant only to DDoS it. Instead he found that it ran a nulled, backdoored theme on XenForo, which gave him a shell and its database. He dumped text only, deliberately excluding all media, and kept timestamped notes. The site's owner, whom he names as Nathan Larson, was arrested about six months later for kidnapping and raping a 12-year-old in Denver, and according to the news died in prison. Ryan had reported the site to law enforcement, tip lines and reporters. Every reporter wanted the story, but their legal departments refused, and about 7,000 other users went uninvestigated. That frustration led him to vigilante predator-catching with an MMA fighter named Dustin, the 561 PC channel. Ryan did the identification and filmed from behind the camera.
The live demonstration. Chuck asks how hard it is to find a predator right now. Two teen-chat sites from a Google search left Ryan's chat disabled. He then used a geolocating gay hookup app: anonymous login, only an 18+ birth year, no verification, an AI decoy photo of a young boy. It placed them in their hotel, with users 78 feet away. Within minutes one man 0.25 miles away sent explicit images. He was told the decoy was under 18, then asked to move to text, then backed out and deleted the messages. A second, who said he was 20 and was 2.5 miles away, said he was fine with "younger" and asked to trade nudes. Ryan says he could get either to knock on the door, and that he has never failed this demonstration in any country. A reverse face search through pentester.com turned one man's photo into a Facebook profile with a name. Ryan would only report the profile URL, because acting further could destroy a case. He says the same thing works on Instagram, Snapchat, TikTok, Grindr and Roblox. He cites an anonymous Australian survey in which one in five men admitted sexual thoughts about children and one in ten said they had acted on them.
Why not vigilante. Ryan says vigilante groups were getting disorderly-conduct and trespassing charges while predators walked free. He also says citizen-decoy cases bring far shorter sentences than ones where a federal agent did the decoying. Federal agents told him repeatedly that any association with vigilante work could discredit all his earlier cases as "fruit of the poisonous tree". So he works only through law enforcement and accepts losing the public profile. The mechanism is "parallel reconstruction": an NGO such as Sentinel Foundation, the Tim Tebow Foundation, Operation Light Shine or NCMEC asks the FBI, HSI or the Marshals for a case number. Analysts then do OSINT, and with the right signed authorization sometimes more. Investigators recreate the steps, and the analyst is never a suspect or witness. Working alone carries legal risk: once CSAM lands on your device it is possession, once it syncs to Google Photos or iCloud it is distribution, and once it is edited it is manufacturing. Passive OSINT carries less of that risk than active decoying. Ryan also criticizes another researcher who stayed in a chat recording children being extorted, which he calls complicity.
Getting involved. He says adults only, not teenagers. Sentinel runs an internship: email the foundation and write something like a resume. He says of about 500 emails perhaps 10 look like real candidates, and many interns drop out because the work is hard to stomach. Interns meet weekly and work one active case, and those who stay become analysts. Ryan says he can count on both hands the people with real security skills working child crimes. He offers to put Chuck straight in as an analyst, needing practice only with chain of custody and reporting.
The OSINT on Chuck and the tools. Ryan defines OSINT as professional Googling: public records, even hard-to-find ones, usable in court without subpoenas. From only Chuck's name and a phone number, his law-enforcement-only OSINT Pilot found Chuck's Social Security number, birthday, every phone number, his addresses, his wife's name, his dad's address and his past employers. It runs about 40 tools, live rather than from stale broker data, and AI summarizes the results. Chuck had paid for removal services. Ryan says brokers have 45 days to delist but relist whenever a detail changes, so removal has to be continuous. Chuck then reads an unprompted ad for pentester.com, starting at $19 a month. For learning, Ryan points to TryHackMe and OSINT challenges. The tools he names are whatsmyname.app and Sherlock for usernames, and Holehe, which checks which sites an email is registered on without notifying anyone. He also names PimEyes (paid; it found nothing on the decoy match) and TinEye for exact-image search, plus reverse caller ID. The chain runs from face to name, to data brokers such as Whitepages or Instant Checkmate, to breach data. He says breach sites are mostly on the clear web, and he declines to name them. He uses the dark web only alongside federal cases.
764 and parents. Ryan describes 764, a nihilist, self-identified Satanist network he says the US designates as terrorist, with many subgroups. They pose as peers in mental-health groups, groom vulnerable children, obtain nudes, then demand self-harm, animal killing or violence for clout. This has been his focus for close to two years. Because of death threats, he had three armed plainclothes guards at Defcon. For parents he recommends ic3.gov or the NCMEC tip line, and monitoring apps: he favours Bark and says he isn't sponsored, while Chuck uses Qustodio. He says monitoring is not enough. Taking away a phone drives children to friends' devices, so they must trust they won't be punished for telling. Children as young as six are in these chats. Chuck says his daughters have no social media.
What made it worth it. Ryan says a one-minute clip that drew 10 million views in a night built the network he now uses. He counts educating parents above the arrests: one recent case had 59 arrests, and his group flew children out of Haiti. He also built an ESP32 device, on a $4 chip, that counts nearby devices from BLE advertisements, to tell raid teams whether a house is occupied. He says MAC randomization broke his home-alarm version of the idea, but not the occupancy count.