Former Hacker Demos OSINT Live: Tracking a Child Predator in 20 Minutes

In a DEF CON hotel room, security researcher Ryan Montgomery opened an anonymous dating app and registered an account using an AI-generated photo of a child—no email verification, no age check. Within minutes, a user 78 feet away sent private photos.

This isn't a movie plot. In this episode of NetworkChuck's interview, Montgomery—CTO of the Sentinel Foundation and founder of pentester.com—uses an unvarnished live demonstration to show how open-source intelligence (OSINT) can tear through the camouflage of online sexual exploitation in an extremely short time.

From Addiction to Counterattack: A Hacker's Atypical Path

Montgomery's starting point was not glamorous. At age nine, his grandfather brought home a desktop computer with a floppy drive from his job at a Catholic cemetery, and an AOL trial disc made him realize for the first time the connection between the physical and digital worlds. What followed was phreaking, AOL chat room infiltration, and then something that truly changed his direction.

A friend's wife sent him a screenshot: on a forum, someone had posted photos of children in a bathtub, and below, a group of people discussed what to do to them. "My first reaction was to DDoS the site down." He found a backdoor in the old ZenForo theme used by the forum and exported the entire database—but deliberately did not download any media files, only keeping the text records. The site owner, Nathan Larson, was later arrested for kidnapping and sexually assaulting a 12-year-old child in Denver.

Montgomery organized the evidence and contacted law enforcement and the media. No media outlet was willing to report it, and law enforcement did not respond. This became the direct motivation for his shift toward working with NGOs and law enforcement agencies.

Phreaking is a hacker subculture that emerged in the 1970s-80s, referring to the technical manipulation of telephone networks to obtain free long-distance calls or explore the phone system. Early phreakers used devices like "blue boxes" to simulate control signals of the telephone network, which later evolved into exploiting system vulnerabilities for intrusion. Phreak culture is regarded as one of the predecessors of modern hacker ethics, emphasizing curiosity, technical exploration, and anti-authority spirit; many early computer security researchers originated from this. Montgomery's experience is a continuation of this tradition.

The 20-Minute Demo: How an Anonymous Account Exposes Platform Vulnerabilities

At the interview, Montgomery demonstrated the entire process. He created an anonymous profile on a dating app using an AI-generated photo and chose an obviously underage age. The app allows anonymous browsing and does not require real-name or email verification.

A user claiming to be 20 years old was the first to send a message, and after confirming the age, directly sent private photos. Montgomery pointed out that this person was only 2.5 miles away from them, likely near the DEF CON venue.

He then used pentester.com's reverse face recognition feature. After uploading the other party's photo, the tool matched a Facebook account, and the name and geographic location immediately surfaced.

The core tool throughout the process was OSINT Pilot—an automated intelligence aggregation platform built by Montgomery's team for law enforcement agencies, integrating dozens of tools that can start from a single photo or identifier and automatically aggregate public data and data broker information.

Reverse face recognition is a technology for identifying individuals based on facial images: users upload a photo, and the system extracts and compares facial features to search for similar faces on the public web or in databases, thereby linking to social media accounts, names, geographic locations, and other information. Unlike biometric systems used by law enforcement, these tools typically rely on publicly scraped data and operate in a clear legal gray area. Commercial services like PimEyes fall into this category, and their potential for abuse raises privacy concerns. Montgomery's team's tool is customized for law enforcement scenarios, emphasizing compliance and evidence chain integrity.

Why the Vigilante Route Doesn't Work

Montgomery early on provided free OSINT support to multiple vigilante predator-catching teams, helping them identify targets before in-person confrontations. But he later voluntarily abandoned this path.

There were two reasons. First, evidence chain contamination. If the investigator themselves participated in an in-person confrontation, the defense can invoke the "fruit of the poisonous tree" doctrine, causing previously handled cases to be reviewed or even overturned. Second, vigilante actions themselves carry legal risks—any child sexual abuse material sent by the other party, even if received in good faith, constitutes possession; if the device automatically syncs to the cloud, it escalates to distribution.

His current approach is to collaborate with NGOs like the Sentinel Foundation, with law enforcement issuing case numbers, and investigators providing methodology through "parallel reconstruction" rather than appearing directly as witnesses.

Fruit of the Poisonous Tree is an evidence exclusion rule in common law systems: if the means of obtaining evidence is itself illegal (such as illegal search or torture), other evidence derived from that evidence may also be excluded by the court. In child sexual exploitation cases involving vigilantes, if investigators engage in in-person confrontations or illegal contact with suspects, the defense can argue that subsequent evidence is tainted, leading to cases being dismissed or remanded. Therefore, professional investigations emphasize "parallel reconstruction"—law enforcement leads evidence collection, and NGOs only provide open-source intelligence analysis methods, avoiding direct contact with suspects.

A Darker Corner Than Predators: The 764 Group

In the interview, Montgomery mentioned his focus over the past two years—nihilistic/Satanic groups represented by 764. The operating logic of these organizations is completely different from traditional sexual exploitation: they infiltrate mental health support groups, seek out vulnerable children, build false peer relationships, obtain private photos, and then do not extort money but demand that children carve usernames into their bodies, harm animals, or engage in other self-harm behaviors.

These groups have been designated as terrorist organizations by the United States, but the number of sub-groups is vast and their operations are highly decentralized. Montgomery says that researchers who truly have cybersecurity skills and work in this field can be counted on two hands.

What Parents Can Do: Trust Matters More Than Monitoring

Montgomery repeatedly emphasizes one point: confiscating devices is the worst response. For today's children, phones are the main channel connecting them to the world; confiscation is equivalent to cutting off their social life. More dangerously, children will turn to friends' devices out of fear of punishment, entering a blind spot that parents cannot monitor at all.

His advice is to build a trust relationship where "telling the truth won't be punished," while using monitoring tools like Bark or Custodio as a supplement rather than a replacement. For parents themselves, regularly using data broker removal services and maintaining them continuously is a basic step to prevent family information from being easily pieced together.

Getting Started: Begin with Passive OSINT

For cybersecurity practitioners who want to enter this field, Montgomery provides a clear ladder: first practice OSINT challenges on platforms like TryHackMe, infer latitude and longitude from a street view photo, and track associated accounts from a username. Holehe can detect email registration status, Sherlock is used for username enumeration, and PimEyes and TinEye are used for reverse image searches.

But to truly participate in case investigations, one must go through NGO channels. The Sentinel Foundation's internship program has weekly case analysis; new members are assigned to an active case, and those who stay gradually become analysts. Montgomery says bluntly that most interns will quit within a few weeks—not because of insufficient skills, but because of psychological resilience.

"I have never failed," he says, referring to the weight of the statement itself—"find someone willing to meet someone they think is a child, and I have never failed once."

One-line Summary

A security researcher demonstrates how OSINT tracked an anonymous sexual exploiter in 20 minutes, and reveals the legal risks of the vigilante route and the darkness of the 764 group.

Paragraph Summary

Based on an interview with security researcher Ryan Montgomery, this article shows how he registered an account on an anonymous dating app using an AI-generated photo at DEF CON and within 20 minutes used OSINT tools to track the real identity and location of a user who sent private photos. Montgomery shifted from early vigilante support to working with NGOs and law enforcement, noting that vigilante actions contaminate the evidence chain (fruit of the poisonous tree) and carry legal risks. He highlights the nihilistic groups represented by 764, whose goal is not money but inducing children to self-harm, and which have been designated as terrorist organizations. For parents, he advises building trust rather than confiscating devices; for practitioners, he provides a path from passive OSINT challenges to NGO internships.