Caught when he made a mistake.Hid IP address but was phished.
IndyStar:
“Posing as the woman from Michigan, agents on June 9 uploaded what was purported to be a sexually explicit video to Brian Kil’s Dropbox account.
There was no explicit video, but the file contained lines of code — a computer virus for the good guys — that when opened grabbed Brian Kil’s IP address and provided it to investigators.
“It’s empty, wtf?!” Brian Kil complained in a message after opening the file, according to the complaint. Hernandez, the complaint said, threatened the victim and her family by sending her a photo of a knife.”
https://www.indystar.com/story/news/crime/2017/08/31/unmasking-brian-kil-how-fbi-cracked-dark-web-catch-cyberterrorist/547864001/
>>They began surveilling his Bakersfield, California, residence and monitoring its use of the Internet. Agents soon noticed that the Tor usage happened “almost continuously” when Hernandez’s girlfriend was away at work.
Unemployed and a lot of time on his
hands..did these things while
girlfriend off at work...