Authorities began investigating Hernandez, who operated under the pseudonym "Brian Kil," in December 2015.
To "sextort" his victims, Hernandez is said to have created multiple social media accounts, contacting underage female targets via private messages, suggesting he possessed "dirty pics" of them, and threatening to send the offending snaps to the victim's family and friends if they didn't provide him with more.
ISP Supt. Doug Carter speaks @PlainfieldPD court house on arrest of Buster Hernandez, the Plainfield cyber terrorist pic.twitter.com/pktUxHfd6T
— Indiana State Police (@IndStatePolice) August 7, 2017
The FBI's court filing suggests Hernandez targeted victims in "at least 10 federal districts" between 2012-2017, extorting images from girls as young as 12.
The first case outlined in the filing claims "Kil" talked one girl into sending him naked pictures of herself, which he then posted to a Facebook account, disseminating child pornography in the process.
When the victim began to resist, "Kil" threatened a Columbine-style attack on her high school (Plainfield High, Indiana), as well as neighboring Dansville High School.
"Tomorrow will be a f***ing bloodbath at Plainfield High. I will open fire on all you sickening pieces of s***. I have in my possession three homemade pipe bombs, two handguns and one semi automatic rifle. I will be targeting [the victim] personally," he wrote.
@NOS @FBI arrests #Sextortion criminal Buster Hernandez 26: terrorised children, threatened to bomb schools: https://t.co/LZiDRDD4kc pic.twitter.com/oqHin6hYn4
— AdrianaStuijt (@AdrianaStuijt) August 8, 2017
The threat led to both high schools closing, and their constituent towns erupting into chaos, as they tried to identify "Brian Kil" and stop him — they have also since given Hernandez two further charges (threats to use an explosive device, and threats to injure).
However, authorities were unable to locate this "Kil," because the IP address connected to the account was a Tor access node, thus rendering him anonymous.
"Kil" soon moved on from Plainfield and began targeting new areas, creating fresh aliases and dozens of Facebook accounts to contact victims, while also using text messages, Twitter, and Dropbox to send sextortionate messages and threats. He also boasted about not getting caught, saying he had "a lot more stealing and blackmailing" to do and wished to become the "worst cyber terrorist that ever lived."
He also said he would add a "dozen dead police" to his "tally," and said it would take a "miracle" for authorities to find him, as they were "useless."
Determined to catch the predator, the FBI contacted one of Hernandez' victims while she was still in communication with "Kil," and created a non-pornographic video for her to send to him.
The video contained a small scrap of code, known as a Network Investigative Technique, into the file. It recorded the real IP address of the suspect, connected to a home in Bakersfield, California, then sent it to the FBI.
26-year-old Hernandez, who seldom left his house, was quickly identified as the culprit, and arrested August 7.
He is charged with threats to use an explosive device, threats to injure, and sexual exploitation of a child. He faces a minimum of 15 years behind bars and a maximum of 30 years, if convicted on all counts.
The case serves as a palpable demonstration that Tor — frequently vaunted as an entirely anonymous form of web browsing — does not offer any degree of invisibility if authorities are suitably determined to catch a user, and their crimes are requisitely severe.
As US Attorney General Jeff Sessions remarked in July, when an international sting operation entrapped users of Hansa Market — a key dark web resource for the purchase and sale of guns — drugs and malware, the dark web is "not a place to hide," and law enforcement agencies will "continue to find, arrest, prosecute, convict, and incarcerate criminals, drug traffickers and their enablers wherever they are."
