Buster Hernandez: Crimes, Capture, and 75-Year Sentence

Buster Hernandez is a convicted federal sex offender and cyberterrorist from Bakersfield, California, who used the online alias “Brian Kil” to sextort and terrorize at least 375 victims, many of them minors, across the United States and in two foreign countries between roughly 2012 and 2017. On March 12, 2021, U.S. District Judge Tanya Walton Pratt sentenced him in the Southern District of Indiana to 75 years in federal prison followed by lifetime supervised release, after he pleaded guilty to all 41 counts against him.¹

How He Targeted Victims

Hernandez contacted underage girls through social media, particularly Facebook, using dozens of profiles. His approach followed a pattern. He would tell a girl he already had sexually explicit images of her, then threaten to publish them on social media unless she produced more explicit photos and videos. He referred to his victims as “slaves.”² When a victim resisted, he escalated to threats of rape, murder, and mass violence against her and her family, and in some cases followed through by releasing what he had already extracted from her.¹

Prosecutors identified no fewer than 375 victims across multiple federal districts and two foreign countries. He also used counterintelligence tactics, at one point coercing a victim into secretly recording a law enforcement community forum held about his own case.¹

The Indiana Bomb Threats

The “Brian Kil” name became publicly notorious in Indiana. In a message to one victim in Plainfield, Hernandez wrote that he had “three homemade pipe bombs, two handguns and a rifle” and threatened to “slaughter” her entire class.³ On December 17, 2015, bomb threats he issued under the alias forced the closure of Plainfield High School and Danville High School, both in suburban Indianapolis. Three days later, further threats shut down a Plainfield Walmart and the Shops at Perry Crossing shopping center.⁴ The closures disrupted thousands of students and community members and drove sustained fear across the area.

How He Evaded the FBI for Years

Hernandez ran his operation through the Tails operating system, a privacy platform that routes all internet traffic through the Tor anonymity network, masking a user’s real IP address. Standard investigative methods went nowhere. Federal investigators later described the effort to identify him as “astronomical,” involving roughly 100 search warrants starting in January 2016.³

An early FBI attempt to deanonymize him with a hacking tool failed because the tool was not built for Tails. Hernandez noticed. He mocked investigators online, writing: “Everyone please pray for the FBI, they are never solving this case lmao … I’m above the law and always will be.” He told at least one victim, “You thought the police would find me by now, but they didn’t.”⁵

How He Was Caught

Facebook took an unusual step. According to former employees, the company paid a six-figure sum to an outside cybersecurity firm to build a custom zero-day exploit targeting a vulnerability in the Tails video player. The exploit was designed so that anyone opening a specially crafted video would leak their real IP address, bypassing Tor entirely.⁵ Facebook passed the tool to the FBI through an intermediary. With a court order, agents worked with a victim to send Hernandez a booby-trapped video. When he played it, the exploit captured his real IP address, and an emergency subpoena to his internet provider produced a physical address in Bakersfield, California.⁶

A Facebook spokesperson said Hernandez “was using such sophisticated methods to hide his identity, that we took the extraordinary steps of working with security experts to help the FBI bring him to justice.”⁷ The company said this was a one-time measure taken only after other options were exhausted. The underlying Tails vulnerability was reportedly patched in a later software update, but Facebook never disclosed the flaw to the Tails developers, who learned of the exploit through news reporting.⁵

The decision divided people inside and outside the company. Some employees viewed it as a justified response to a horrific situation. Others called it “sketchy as hell” and worried about the precedent of a tech company undermining a tool that journalists, dissidents, and abuse survivors rely on.⁵ Senator Ron Wyden publicly questioned whether the FBI reused the zero-day in other cases, shared it with other agencies, or submitted it through the government’s Vulnerabilities Equity Process, the framework for deciding whether to disclose security flaws. Reporting indicated the exploit was never submitted to that process.⁸

Arrest and Charges

FBI agents arrested Hernandez on August 3, 2017, at a residence in Bakersfield, California, where the 26-year-old was living with his girlfriend and her 85-year-old grandmother. He was unemployed.¹ Agents searching the home recovered cell phones with selfies matching profiles he had used, along with chat data and child pornography depicting his victims.²

The case was brought in the U.S. District Court for the Southern District of Indiana. Through superseding indictments the charges grew to 41 counts, covering production of child pornography, coercion and enticement of minors, distribution and receipt of child pornography, threatening to use explosive devices, threats and extortion, threats to kill, kidnap, and injure, witness tampering, obstruction of justice, and retaliation against a witness or victim. “Brian Kil” was his primary handle, but the Department of Justice said he used “hundreds of other aliases,” including Brianna Killian, Brian Mil, Greg Martain, and Purge of Maine.¹

Guilty Plea and 75-Year Sentence

Trial was scheduled for February 10, 2020. Four days before it was to begin, on February 6, 2020, Hernandez signed a plea agreement and pleaded guilty to all 41 counts.⁹

At sentencing on March 12, 2021, Judge Pratt imposed 75 years in federal prison and lifetime supervised release. She explained that she did not impose a life sentence because Hernandez had cooperated with the FBI after his arrest, helping investigators identify additional victims.⁴ Under 18 U.S.C. § 2251, production of child pornography carries a mandatory minimum of 15 years and a maximum of 30 years per count for a first-time offender.¹⁰ With eight production counts and additional counts carrying their own minimums, the 75-year total reflected the cumulative weight of the charges.

Acting U.S. Attorney John Childress said at sentencing: “Conduct like this falls so far outside even the most basic understanding of human decency and compassion… We must acknowledge that evil such as this exists in our world.”¹¹

Several victims spoke in court. One told the judge: “He took what was supposed to be the most pivotal years from my life. He stole them, he tried to destroy me, diminish me, and almost succeeded. At the end of the day there are wounds that will never heal and psychological damage and trauma that will haunt me to my grave.” Hernandez then addressed the court himself: “Reading the texts, I just can’t believe that I’m the one who did it. But it was me who did it and I take ownership of it.”¹²

Appeal

Hernandez appealed his sentence and restitution to the U.S. Court of Appeals for the Seventh Circuit. The district court had ordered $110,000 in restitution, including $10,000 for each of several victims. He argued the government had not adequately proved victim losses and that the district court improperly used an amended judgment to add $10,000 in restitution for three victims omitted from the original order.¹³

In 2022, the Seventh Circuit declined to reach the merits. The panel found Hernandez had waived his restitution challenge by staying silent at sentencing despite ample notice, characterizing that silence as a strategic choice to preserve credibility with the judge while arguing for a shorter prison term. On the three additional victims, the court noted Hernandez had explicitly told the district court he did not object, which the panel called “textbook waiver.” The 75-year sentence and $110,000 restitution order were both affirmed.¹³ The Seventh Circuit case was terminated on August 17, 2022, and no further appeals or habeas petitions appear on the federal docket as of late 2024.¹⁴

1
U.S. Department of Justice. Child Predator and Cyberterrorist Buster Hernandez Sentenced to 75 Years
2
GovInfo. United States v. Hernandez, Case 1:17-cr-00183
3
ABC News. Self-Proclaimed Cyber Terrorist in Custody in Sextortion Case Involving Minors
4
The Indiana Lawyer. Man Sentenced 75 Years for Bomb Threats, Extortion
5
Vice. Facebook Helped FBI Hack Child Predator Buster Hernandez
6
Infosecurity Magazine. FBI Uses Malware to Trap Alleged Child Predator
7
Gizmodo. Facebook Helped the FBI Exploit Vulnerability in Tails
8
Techdirt. Facebook Helping FBI Hack Tails to Track Down Truly Awful Child Predator Raises Many Questions
9
WRTV. Suspect in Brian Kil Threats Case Pleads Guilty to All Federal Charges
10
U.S. Department of Justice. Citizens Guide to U.S. Federal Law on Child Pornography
11
Newsweek. Buster Hernandez Sentenced 75 Years for Threatening to Kill 375 Children, Bomb High Schools
12
IndyStar. Buster Hernandez Brian Kil Plainfield Indiana Bomb Threat Sentenced
13
FindLaw. United States v. Hernandez, Nos. 21-1481 and 21-1935
14
CourtListener. United States v. Buster Hernandez, Case No. 21-1481