Federal authorities announced on Wednesday the arrest of the alleged mastermind of KickassTorrents (KAT), the world’s largest BitTorrent distribution site. As of this writing, the site is still up.

Prosecutors have formally charged Artem Vaulin, 30, of Ukraine, with one count of conspiracy to commit criminal copyright infringement, one count of conspiracy to commit money laundering, and two counts of criminal copyright infringement.

Like The Pirate Bay, KAT does not host individual infringing files but rather provides links to .torrent and .magnet files so that users can download unauthorized copies of TV shows, movies, and more from various BitTorrent users.

According to a Department of Justice press release sent to Ars, Vaulin was arrested on Wednesday in Poland. The DOJ will shortly seek his extradition to the United States.

“Vaulin is charged with running today’s most visited illegal file-sharing website, responsible for unlawfully distributing well over $1 billion of copyrighted materials,” Assistant Attorney General Caldwell said in the statement. “In an effort to evade law enforcement, Vaulin allegedly relied on servers located in countries around the world and moved his domains due to repeated seizures and civil lawsuits. His arrest in Poland, however, demonstrates again that cybercriminals can run, but they cannot hide from justice.”
DMCA ignored all day long

According to the 50-page affidavit authored by Jared Der-Yeghiayan, Vaulin and KAT claimed that they respected the Digital Millennium Copyright Act, but they did not. Der-Yeghiayan is a special agent with Homeland Securities Investigations and also was a key witness in the trial of Silk Road founder Ross Ulbricht.

When Hollywood and other film studios filed a notice-and-takedown for a potential DMCA violation, KAT would respond this way:

Greetings,
Your request has been reviewed, but cannot be processed due to one (or
more) of the following reasons:
1) The Claim wasn't written in English language;
2) You provided no evidence showing that you are the copyright holder
or that you are acting on behalf of the copyright holder;
3) You provided no evidence showing that the content is legally
copyrighted;
4) There were more then [sic] 30 torrents mentioned in the Claim email;
5) Your content is hosted on a different website.
Please, make sure to fulfill all the conditions mentioned above before
sending a claim.
You can find more detailed information regarding the DMCA email
layout via the following article - https://kat.cr/dmca/
Respectfully,
KAT team

Keeping mum

Der-Yeghiayan also estimated KAT's annual advertising revenue as being more than $16 million per year as of 2016.

In the complaint, the HSI agent also describes how an undercover IRS agent purchased an ad on KAT in March 2016 at the rate of $300 per day. The KAT representative, "Mr. White," provided details for a Latvian bank but warned the American buyer to "make sure that you don’t mention KAT anywhere."

After a successful five-day ad buy, the undercover IRS agent again tried to buy another ad. Mr. White told him that the existing "faster download" ads were all sold out but that he could buy a pricier banner ad at $1,000 to $3,200 per day.

By May, Mr. White informed the undercover agent of new banking details, this time in Estonia. Through the Mutual Legal Assistance Treaty (MLAT) process, US investigators were able to easily obtain those bank records.

HSI and IRS looked into the historical hosting records of KAT and found that for about 3.5 years, ending in January 2016, the operation was hosted out of Chicago, Illinois, which explains why the case is now being prosecuted out of the Northern District of Illinois. The site also used a Canadian hosting service—the two American agencies also used MLAT to get an image of the Canadian server.

Finally, Der-Yeghiayan also described how Apple provided a copy of Vaulin's e-mail account (tirm@me.com), which included other incriminating information that establishes probable cause of a criminal conspiracy. He concluded by noting that the Costa Rican and Filipino authorities have been alerted and that HSI and IRS would be using the MLAT process to try to seize the kat.cr and kat.ph domains, among others.