Darren Welsby, 48, was convicted of 18 offences including rape and jailed for 23 years after the National Crime Agency used a combination of digital forensics and anthropological analysis to identify him from images he uploaded to the dark web. An expert matched the knuckles visible in his abuse images to photographs of Welsby’s own hands. A separate forensics report confirmed the abuse images were taken on the same device as images known to belong to Welsby’s phone.
How the Investigation Started
The case began in 2020 when officers examined three sets of child sexual abuse images that had been uploaded to an Interpol database. This is part of Interpol’s standard mechanism for global intelligence sharing on child exploitation material, law enforcement agencies from member countries contribute images to a shared database, where they can be analysed across jurisdictions and compared for patterns that might identify perpetrators.
The images uploaded to the database were flagged. From there, investigators at the National Crime Agency began working to identify the person who had created them.
At this stage, Welsby had attempted to use the dark web to evade detection, uploading images to a part of the internet accessible only through specialised software and designed to obscure who is accessing or hosting content. As we’ve covered in our explanation of what the dark web actually is, the Tor network provides anonymity for the network connection itself. What it cannot do is remove the identifying information embedded in images metadata, visual evidence, and in this case, the physical appearance of the abuser’s own body.
The Forensic Evidence: Two Expert Reports
The conviction rested significantly on two independent forensic analyses, each tackling the identification from a different direction.
The digital forensics report: A digital forensics expert compared images from the dark web with photographs known to have been taken on one of Welsby’s phones. The analysis concluded that the abuse images had been taken on the same device. CPS Specialist Prosecutor Bethany Raine described this as “landmark” forensic evidence: “The expert digital forensic evidence proved that those images were taken on the same device as other images, known to have been taken on one of Welsby’s phones.”
The anthropological analysis: Separately, an anthropologist examined photographs that showed Welsby’s hands, specifically, the distinctive appearance of his knuckles. Those images were compared against other images uploaded to the dark web and the adult pornography site, some of which showed the hands of the person committing the abuse. The conclusion was that the hands in the abuse images were Welsby’s.
Both reports together created a chain of evidence that connected Welsby directly to the content he had attempted to distribute anonymously.
This is an example of the kind of forensic innovation that has become increasingly important in dark web investigations, where traditional identification techniques, IP address tracing, financial records — may be disrupted by the anonymizing technologies involved. The NCA’s approach to this case shows that when digital anonymity is effective, investigators can still work from the physical evidence captured in the images themselves.
The Arrest and What Was Found
Welsby was arrested by NCA officers at Manchester Airport in August 2020, shortly after the investigation had identified him. His phone was seized at the time of arrest.
Officers subsequently searched his former address in Wythenshawe and seized 58 exhibits, including ten digital devices. Those devices contained more than 30,000 indecent images of children, including photographs and videos taken by Welsby himself, capturing his own offending. The material dated back to 2005.
By category under UK law:
- 4,700 Category A images, the most serious level
- 4,500 Category B images
- 24,000 Category C images
- 18 extreme pornographic images depicting bestiality
Among the 18 offences for which Welsby was convicted: rape of a girl under 13, causing or inciting a girl under 13 to engage in sexual activity, and taking indecent photographs of children without their knowledge.
NCA Senior Manager Jen Cruickshank described the victims’ ages in her statement: “Darren Welsby is a predatory sexual offender who inflicted the most horrific sexual abuse against children, some as young as six, over a period of eight years.”
Why Dark Web Anonymity Failed Him
The Welsby case adds to a growing body of evidence that the dark web’s technical anonymity tools, while real, are not a complete shield against prosecution particularly in cases where perpetrators create their own identifying evidence.,
Welsby’s mistake was not simply using the dark web. It was uploading images in which parts of his own body were visible, taken on a device he also used for legitimate purposes. The same phone used to record abuse was also used for everyday activity, creating a digital bridge between his anonymous criminal identity and his real one.
This mirrors what we’ve seen in the Operation Alice dark web CSAM takedown where Europol and 23 countries identified 440 customers who had paid for illegal content on supposedly anonymous platforms, by following the payment and interaction records that the platforms themselves generated. In Welsby’s case, the evidence was physical. In Operation Alice, it was financial. The principle is the same: technical anonymity does not erase all evidence, and determined investigators find what remains.
The NCA’s Jen Cruickshank acknowledged the difficulty of the investigation: “Our investigation was painstaking and time-consuming; utilising innovative forensic techniques to identify Welsby, who attempted to hide his offending by using the dark web. This comprehensive investigation ensured that necessary evidence was secured to bring him to justice.”
Reporting and Support
If you have encountered content that sexualises children online, or have concerns about an individual’s behaviour towards children, there are established reporting channels designed for exactly this.
The Internet Watch Foundation (IWF) accepts reports of child sexual abuse material found online, including content on the dark web, and works with law enforcement to remove it and identify those responsible.
CEOP (the Child Exploitation and Online Protection command) , part of the National Crime Agency, operates a specific reporting portal for concerns about online grooming, exploitation, and abuse imagery. Their safety centre provides guidance for children, young people, parents, and anyone with concerns.
For urgent concerns about a child’s immediate safety, call 999. For non-emergency reporting, Humberside Police and forces across the UK accept reports through 101.
The NCA has said it will continue to pursue offenders of this kind. “We will continue to pursue dangerous offenders like Welsby, who prey on those who are vulnerable, to protect children from sexual abuse,” Cruickshank said.
Frequently Asked Questions
Who is Darren Welsby?
A 48-year-old man from Wythenshawe, Manchester, convicted of 18 offences including the rape of a girl under 13 after abusing six children over an eight-year period.
How was he caught?
The NCA’s investigation began after images were flagged through the Interpol database. An anthropologist matched the knuckles visible in abuse images to Welsby’s hands. A digital forensics expert confirmed the images were taken on the same device as a known Welsby phone.
What did police find when they searched his home?
Ten digital devices containing over 30,000 indecent images of children, including 4,700 Category A images, dating back to 2005.
Did using the dark web protect him?
No. While the dark web concealed his network activity, images he uploaded contained physical evidence visible in his own hands, that investigators used to identify him. His phone also created a link between the abuse images and devices registered to him.
How long is he in prison?
Welsby was jailed for 23 years.
