AFTER posting a Gumtree ad, looking for a particular doll for her young daughter, a grateful mum was touched when a woman named Liz offered to donate one for free.
Liz added: “Can I just ask one thing? I want to be a hundred per cent sure that the doll really is going to the little girl rather than a sneaky, adult collector. Could you take a picture of your daughter holding a sign which says, ‘I “heart” SB.’”
The unsuspecting mum took a photograph of her daughter in her pyjamas, holding the sign, and emailed it to Liz.
Within half an hour of receiving it, a dangerous child abuser, known as the notorious 666devil, was using it as their avatar on the dark web.
Chillingly, the initials SB stood for the depraved child pornography website, Scream, B****!
The young girl was about to become another victim of the UK’s most prolific online paedophile, Matthew Falder, who used blackmail to fuel his increasingly dark and dangerous desires.
The hunt for the abuser, who boasted of being untraceable, is told in the first episode of a gripping documentary series called Prime Suspect: Hunting the Predators, starting on Channel 5 on Wednesday.
Police bodycam footage shows the moment of Falder’s arrest while interviews with investigating officers, surveillance footage and examples of their vile online messages reveal how cleverly the predator managed to get away with it for years.
The National Crime Agency (NCA) deals with the UK’s most serious offences and their manhunt began in 2015 when intelligence reported that a user on the dark web was threatening to abuse their own daughter, giving her “the week of hell.”
An intelligence officer, known only as Luke in the documentary, explains: “It was to be a week of intense abuse against this child.
“One of the posts was of a little girl holding a sign which says ‘I “heart” SB,’ with the date on it, which referred to Scream, B****!, set up for the darkest type of child exploitation, including rape and murder.”
The person was asking other individuals on the forum to suggest what abuse should be delivered, which included starving her for 24 hours and keeping her in a cage.
“The online poster had gained VIP status because all the other like-minded individuals knew, or thought, they had access to a child,” says NCA Interviewing Officer, Jane Lawrenson.
“This was extremely worrying for us because at this stage we didn’t know that the picture was not their daughter.”
Immediately the NCA put out a national child rescue alert in which all the forces across the UK received the image and were to report any sightings to Luke.
Matthew Long, NCA Branch Commander, vividly calls, “I remember driving home and feeling an unbelievable pressure that it was Wednesday going into Thursday and there was a possibility that the child might die on Friday.”
The discovery of the Gumtree link was a huge relief to officers but it was apparent that the individual was causing much harm and distress by soliciting and then blackmailing hundreds of young and vulnerable people.
I remember driving home and feeling an unbelievable pressure that it was Wednesday going into Thursday and there was a possibility that the child might die on Friday.
Matthew Long
Jane Lawrenson and a social worker visited the home of the young girl whose image was being used on the website to make sure she was safe and to see if she and her mother could bring them any closer to the identity of the offender.
“I told the mother I was from the NCA and immediately she said, ‘I know why you are here,’” she says.
“She was devastated. She told us that Liz had asked for more pictures of her daughter and that’s when she got suspicious and reported them to Gumtree.
“After that, she never let her daughter play outside or let her out of her sight.”
Clearly, Liz was just a made-up name and further investigation led to a man in the UK.
But with an IP address that identifies a computer being masked on the dark web, finding him, says Matt Sutton, who headed the manhunt, “a needle in a haystack.”
Paedophile network
In 2013, the FBI took down a dark child abuse website called Hurt 2 The Core.
It had been set up by a 21-year-old named Matthew Graham and ran from his bedroom at his parent’s home in Melbourne, where Australian police arrested him.
He was eventually sentenced to 15 years in prison and evidence from his arrest revealed details of an international paedophile network.
“There were a number of individuals believed to be UK-based and those usernames were shared with the UK,” says Matt.
“One of the abusers had the username of InTheGarden. He was posting about a girl he had managed to blackmail into producing indecent images which were then shared on the website for the benefit of others.
“When he had got the images is when the blackmail started and the victims became scared that the images would go viral or be sent to their loved ones or their school,” says Jane.
Luke adds: “One of the victims was encouraged to do more and more degrading acts of self-abuse such as licking toilet bowls, writing degrading messages across their body with lipstick while posing nude and attaching bulldog clips to body parts.”
After the closure of Hurt 2 The Core, its successor, Scream, B****! was set up, once more enabling thousands of child sex offenders to engage with each other.
“In order to access these forums you have to register,” says Luke.
“So you have to create a username and password. I did this and for months was collecting information, watching users, looking for opportunities to safeguard our children.
“It’s quite challenging mentally, due to the material you are exposed to.”
How to spot your child is in danger online and what to do
ONLINE grooming is a growing threat, with predators using social media, gaming platforms, and messaging apps to target children. Here’s how to spot the warning signs and what to do.
Warning Signs
- Secrecy – Your child becomes secretive about online activity, quickly switching screens or hiding messages.
- New “Friends” – They talk about a new older friend or receive gifts, money, or gaming credits.
- Mood Changes – Anxiety, withdrawal, or anger when asked about their online interactions.
- Excessive Time Online – Spending increasing hours online, especially late at night.
- Inappropriate Content – Receiving sexual messages or being asked to send explicit images.
What to Do
- Talk to Your Child – Approach them calmly and encourage openness.
- Check Devices – Monitor chats and apps for suspicious contacts.
- Report It – Contact CEOP (Child Exploitation and Online Protection Command) via the NSPCC or police.
- Restrict Access – Use parental controls and educate them about online dangers.
Grooming can escalate quickly—act immediately if you suspect it. For support, visit NSPCC.org.uk.
A connection between the usernames of Liz, InTheGarden, EvilMind and 666devil was eventually made leaving the police confident that they were all the same person.
‘Liz’ was also found to be on a babysitting website in America and also one for young people with anorexia nervosa, where she was posing as an artist who would pay hundreds of pounds for topless or fully nude photographs.
They would later be used to blackmail them for sexually degrading videos.
He would sometimes get them to give him control of their Facebook accounts and would pose as them and send abusive messages to their friends which could lead to physical attacks when they arrived at school.
“The volume of children who were being abused was bordering on the unprecedented,” says NCA Branch Commander Matthew Long.
‘Rap sheet from hell’
Four years after the online abuser was first discovered, police finally had a breakthrough.
“The level of communication with him on forums over the years meant it would be likely that at some point he would have a hiccup,” says Matt.
“In March 2017, we identified, through a tiny piece of intel, a possible IP address that was linked to a home address in the UK.
“I can’t be specific on how the hiccup occurred but there was enough to identify a real world identity that was behind EvilMind and the other usernames.
“You always have some idea who you think you are looking for and it never ends up being right.
“It’s not the old bloke in the brown ‘flasher’ mac outside the school gates. It can be virtually anybody and they can be of any age.
“He was a Cambridge alumnus, who was 28 and worked for Birmingham University as a geophysics lecturer. Not someone we expected.
“He had a long term girlfriend and came from the north of England from a well-to-do family. By all accounts had a vast network of friends and associates and was well liked.”
Police bodycam footage of balding, bespectacled Matthew Falder’s arrest at Birmingham University show him startled and in disbelief that his dual life has been discovered.
When he is read the horrific list of sexual charges, he responds, “It sounds like the rap sheet from hell.”
After his arrest, he was interviewed by Jane Lawrenson who remembers, “He looked like a normal person who you would walk past in the street and wouldn’t have a second glance at.”
At first, he replies “no comment” to every question but for his second round of questioning, his solicitor reads out a statement from him, in which he admits that he is EvilMind.
Devices seized from his bedroom contained nearly 14,000 indecent images and 1251 videos of children from around the world, making him the most prolific online paedophile the NCA have ever investigated.
In court he pleaded guilty to 137 offences against 46 victims and was sentenced to 32 years in prison – the biggest sentence that an online predator had received in the UK.
Following an appeal, his sentence was reduced to 25 years.
Ruona Iguyovwe, of the Crown Prosecution Services, said Falder had shown no sympathy or humanity towards his victims, who were left too ashamed to tell family and afraid to leave the house.
When one said they were ready to “end it all”, he told them the images would still be circulated “so what good is that going to be to you”.
For the NCA the lengthy sentence was a huge win.
“I take great satisfaction that I still think he doesn’t know how we managed to catch him,” says Luke.
Prime Suspect: Hunting the Predators begins on Channel 5 on Wednesday, Feb 26 at 9pm
