HADDONFIELD, N.J. — A New Jersey child pornographer has been charged with trying to use the dark web to order a hit on his young victim, federal authorities said.
John Michael Musbach, 31, of Haddonfield, was arrested Thursday and charged with one count of murder for hire, according to Craig Carpenito, U.S. Attorney for the District of New Jersey. If convicted, Musbach faces up to 10 years in prison.
Court records indicate that Musbach paid about 40 Bitcoin, or $20,000, to have the child killed.
“Mr. Musbach is accused of doing what is every parent’s worst nightmare,” Assistant U.S. Attorney Diana V. Carrig told the Philadelphia Inquirer. “He enticed a child to send sexually explicit images … and when that all came to light, he decided he can’t have that and decided the victim should be murdered.”
Carpenito said in a news release that Musbach, who pleaded guilty in October 2017 to endangering the welfare of a minor by sexual contact, was accused of initiating communication with his then-13-year-old victim in the summer of 2015 via an Internet Relay Chat website.
“At some point, Musbach began using those IRC conversations to request and receive sexually explicit videos and photographs of the minor victim and to send to the victim sexually explicit videos and photographs of himself,” Carpenito said. “In September 2015, the victim’s parents discovered the nature of Musbach’s communications with the victim and notified local law enforcement officers in the state of New York, where the victim resided.”
Camden County man charged with attempting to hire hitman on Dark Net to kill victim of his child pornography crime https://t.co/FbBgqGSwDZ
— NJ US Attorney (@USAO_NJ) August 13, 2020
New York detectives began investigating the allegations and, after the victim told Musbach that his parents had called the police, investigators called Musbach to inform him of the probe and order him to stay away from the boy, the news release said. They also reached out to prosecutors in Atlantic County, New Jersey, because Musbach was a resident there at that time.
Musbach was arrested in March 2016 and charged with child pornography. He ultimately pleaded guilty to the endangering charge and was sentenced Feb. 9, 2018, to a two-year suspended sentence. He was also placed on parole supervision for life.
In a federal affidavit, Special Agent George Herbert of the U.S. Department of Homeland Security wrote that Musbach’s alleged plot to kill the boy did not come to light until January 2019, when an informant told federal agents about a murder-for-hire website operating on the dark web.
The “dark web,” Herbert explained, is a “colloquial name for a number of extensive, sophisticated, and widely used criminal marketplaces operating on the internet which allow participants to buy and sell illegal items and services, such as drugs, firearms, assault/murder and other hazardous materials with greater anonymity than is possible on the traditional internet (sometimes called the ‘clear web’ or simply ‘web’).”
The black-market sites use a variety of encryption techniques to avoid detection.
The alleged murder-for-hire site – which ultimately turned out to be a scam, Carpenito, said – offered contract killings and other acts of violence in exchange for cryptocurrency.
“If you want to kill someone or to beat the (expletive) out of him, we are the right guys,” the website’s homepage boasted, according to the affidavit. “We have professional hitmen available throughout the entire USA, Canada and Europe and you can hire a contract killer easily. Most of our gang members are drug dealers but they do contract killing when they are short on cash.
“No undercover cops here. No risks of getting caught, because we are professional killers.”
Herbert declined to identify the site in the affidavit, citing ongoing investigations, but the Inquirer identified it as a now-defunct site called Besa Mafia. Multiple news outlets who have reported on the website over the past several years included in their reports screenshots that appear to include the sales pitch detailed by Herbert in the affidavit.
The Inquirer reported that there have been no killings linked to money paid to Besa Mafia for contract hits. A Minnesota man, Stephen Carl Allwine, shot and killed his wife in November 2016, however, after being scammed of his money by the fake murder-for-hire site.
Stephen Allwine has been found guilty by a jury in Stillwater of fatally shooting his wife and staging her death as a suicide. https://t.co/8yoifakrps pic.twitter.com/djc7HaBWpI
— Star Tribune (@StarTribune) February 1, 2018
Allwine was convicted in January 2018 of killing Amy Allwine and sentenced to life in prison, the Minneapolis Star Tribune reported.
The informant against Musbach told federal agents he had “scraped” data from the website by hacking its server, court records show. Among the data he provided to authorities were private communications between site administrators and people seeking their services.
“That information included communications between website administrators and an individual using the screen name ‘agentisai,’ who was later determined to be defendant Musbach,” the affidavit states.
Media outlets including Vice News reported in May 2016 that Besa Mafia had been hacked and the data taken from the site dumped online. The data included alleged lists of hitmen, photos of targets that customers had provided to the site and messages between its users and administrators.
Business as unusual
According to Herbert’s timeline, agentisai first showed up on the site the night of Dec. 26, 2015, just over three months after Musbach learned he was under investigation for child porn. He first put feelers out about potential violence the following May, less than two months after his arrest.
“Hey there, I am in south NJ and need a handgun with ammo because I lack the ability to obtain one myself legally,” the user later identified as Musbach wrote on May 7, 2016. “How would getting this work and how much would it cost?”
By the following day, the request turned deadly, court records show.
“Alternatively to a gun order, I could place a hit order,” the second message said. “However, the target would be 14. Is that an acceptable age or too young? I can budget up to $20k for the order.”
The site administrator responded, saying the age of the target was acceptable.
“We have gang members to do the hit; however, the price is about ($18,500),” the response said. “This should be in your budget. Please add order using the order page and add 40 Bitcoin to your account. The Bitcoin will remain in your account until the job is done. Let me know.”
According to the affidavit, the next two weeks’ worth of exchanges played out like a simple business transaction gone wrong. In the first few days, there were several messages back and forth regarding agentisai’s ability to obtain the cryptocurrency.
On May 10, agentisai wrote that his limit on Coinbase, a currency exchanger, was $10,000, so it would take multiple transactions to obtain the cryptocurrency. The next day, the administrator told the customer to “add Bitcoin to (his) personal wallet on (his) account” and a hit man would be assigned.
“OK, I placed the order. Thanks,” the user responded.
“We received the order,” the administrator wrote the next day. “I have assigned a hit man on the job and he got the info. We will keep you posted in the next days, and we will tell you as soon as it is done, and provide proof.”
“OK, sounds good,” Musbach allegedly responded.
On May 14, agentisai asked if a date for the hit had been arranged, the court records show. When he got no response, he wrote again on May 17.
“A little worried I haven’t heard anything. There’s three days left,” his message read. “Please keep me posted on how things are going and do the job within the next three days. If it’s not possible, please let me know and I will withdraw the Bitcoin.”
The administrator initially responded that a date had been set, but on May 19 he wrote to agentisai that the assigned hit man had been arrested for cocaine possession near the site of the proposed hit.
“We have another hit man ready to do the hit, but he (said) this is an important person and he asks for an difference of $5,000,” the administrator wrote. “Can you get the difference exchanged to Bitcoin and deposited to your account for the new hit man to do your job?”
Musbach’s alleged response on May 19 was almost nonchalant, according to the affidavit.
“Bummer. :( I can get the $5,000 extra but there is a $1,000 daily bank account purchase limit,” he wrote.
Read the entire criminal complaint against John Musbach below.
He asked if the new hit man could do the hit the next day. He offered to give the killer the Bitcoin already in play and follow up with the remainder once it was transferred from his bank account and converted into the cryptocurrency.
The supposed hit man declined to do the job without all the funds, the administrator claimed. Agentisai wrote multiple messages as he scrambled over the weekend to come up with the money.
“I think that up to this point I have been very honest and shown that I do have the money I say I do and (will) deposit it as soon as I can. However, Bitcoin is a bit difficult to obtain and transfer short notice,” he wrote. “I’d really like for this transaction to end on a positive note, and I have a vested interest in this being a success.”
An unsatisfied customer
Musbach then did something unusual for a site like Besa Mafia: he offered to provide his name and address “as collateral” to prove he was good for the money, the records show.
By the next day, his local Bitcoin contact had fallen through and agentisai wrote that “this won’t work out given the circumstances.” He also wrote that he’d tried to withdraw the original $20,000 worth of Bitcoin, but the request wouldn’t go through.
The administrator offered to have the hit done on another date, but the dissatisfied customer declined.
“Thanks for the offer of trying some other time but I think I’m done for how,” he wrote.
According to court documents, the next message turned the entire transaction sideways.
“I am sorry to disappoint you. Unfortunately, our site is a scam, and we pass customer and target information to law enforcement,” the administrator wrote. “We are able to dox the customers (find out who they are ) by expert IP and proxy analisis (sic) and as our site uses JavaScript to extract personal information from the user computer.”
The 40 Bitcoin the customer had sent was lost, the administrator wrote, but if he wanted to avoid his name being sent to law enforcement, he should send another 20 Bitcoin, or $10,000, to the same address as before, the court records show.
“Once we receive the additional money, we will delete your account, all messages, and all information about you and the target,” the administrator wrote. “If you don’t send the additional money, we will send all information to law enforcement and you might be arrested. Ordering murder and paying for murder can get you in jail for a long time.”
“Is this a joke? Please just send my BTC back. Thanks,” Musbach allegedly responded.
The administrator then wrote that the website had been hacked and that he, one of the hackers, had control over it and had extracted Musbach’s information from his computer.
Musbach wrote that if the administrator could provide the incriminating information, he would pay the Bitcoin the alleged hackers were demanding.
It was unclear Friday if Musbach ever attempted to pay the blackmail amount.
Herbert wrote in the affidavit that his office was able to link the agentisai account used on the scam website to Musbach. Agents then subpoenaed Coinbase and learned that deposits into an account opened on May 6, 2016, by someone identifying himself as Musbach matched those discussed in the exchanges between agentisai and the dark site administrator.
Musbach gave Coinbase his personal information, including his date of birth, social security number and home address, when opening that account, the document shows. Coinbase also had a photocopy of Musbach’s driver’s license on file.
The last activity on Musbach’s Coinbase account was on May 24, 2016, when Musbach deleted his email information.
Herbert wrote in the affidavit that based on the information from Coinbase, federal agents subpoenaed Musbach’s Bank of America account. The account showed that he wired $20,040 to his Coinbase account on May 9, 2016.
In October 2019, agents obtained the computer hard drive that Atlantic County officials had seized from Musbach’s home in conjunction with the child porn case. A forensic search of the drive confirmed Musbach’s link to the agentisai username.
The Google searches found on the drive were also incriminating, according to the affidavit.
Along with searches on child grooming laws, investigators found searches about gun shows and whether they take credit cards. There were also numerous searches on methods of death beginning in December 2015 and extending through March of the following year.
The methods included chloroform and caffeine poisoning, as well as hemlock and other poisonous plants.
Someone also looked up how to fully erase a MacBook, the document alleges.
Cox Media Group