Redazione RHC:21 October 2025 15:07
For the first time, the U.S. Department of Homeland Security has asked OpenAI to disclose the identity of a ChatGPT user whose requests were implicated in a child pornography investigation .
The warrant, issued to investigators at Homeland Security Investigations (HSI) and released after being declassified in Maine, marks the first known instance in which authorities formally require a generative AI developer to disclose data on specific requests.
The investigation began with attempts to identify the administrator of a large darknet website that distributed child pornography. Undercover agents managed to contact the alleged administrator, who casually mentioned using ChatGPT.
During the conversation, he described the specific questions he had included, including innocuous topics like “What would happen if Sherlock Holmes met Q from Star Trek?”
In another conversation, she mentioned receiving a Donald Trump-esque poem about the Village People song “YMCA” from a model and even slipping a snippet into the conversation.
These details allowed investigators to send a subpoena to OpenAI , requesting account information: names and addresses, payment information, conversation history, and metadata associated with the entered prompts.
The agency later confirmed that the company provided agents with an Excel file, but the document’s contents were not disclosed . It’s unclear whether OpenAI’s data directly contributed to the suspect’s identification, but the warrant set a precedent for using ChatGPT prompts as a basis for user searches.
However, investigators were able to identify the suspect not through OpenAI data, but through the details he shared himself . He described undergoing medical checkups, mentioned living in Germany for seven years, and mentioned his father’s military service in Afghanistan.
This information led agents to 36-year-old Drew Hoenner, who has ties to Ramstein Air Base and had applied for a job with the U.S. Department of Defense. He has been charged with conspiracy to promote child pornography but has not yet pleaded guilty.
According to investigators, since 2019, Hönner was involved in managing at least 15 forums on the Tor network dedicated to the exchange of prohibited material . The combined audience of these platforms exceeded 300,000 users. The sites’ structure resembled a hierarchical system with administrators, moderators, and “rewards” for the most active participants. One of the forums contained a separate section, presumably created for the publication of AI-generated content.
OpenAI’s report reveals that in the second half of 2024 alone, 31,500 instances of child exploitation content were detected and notifications were sent to the National Center for Missing & Exploited Children (NCMEC). During the same period, OpenAI received 71 official requests from government agencies, resulting in the provision of data on 132 accounts.
Redazione
The editorial team of Red Hot Cyber consists of a group of individuals and anonymous sources who actively collaborate to provide early information and news on cybersecurity and computing in general.