An anonymous report in March 2014 led to an international investigation that identified Matthew David Graham, a Melbourne man who operated online as “Lux”. Two years later, he was sentenced to 15 years and six months in prison for offences connected with child sexual abuse websites.
The case shows how police used technical leads and international cooperation to identify a website administrator, gather evidence and bring him before a court.
Who was Lux?
Investigation overview
The Lux Case: From Anonymous Report to Prosecution
An investigation involving Australian and international law enforcement agencies identified Matthew David Graham, who operated online as Lux. He was arrested in August 2014 and sentenced in March 2016 for offences connected with child sexual abuse websites.
The case at a glance
The people, investigation and legal outcome.
Lux
The alias used by Matthew David Graham, who was 19 when he adopted it.
International cooperation
Australian authorities worked with the FBI and other international partners.
15 years, 6 months
The prison sentence imposed, with a non-parole period of 10 years.
Investigation timeline
The main milestones documented in public records.
An anonymous report
Victoria Police’s annual report says an anonymous report set the combined investigation in motion.
Investigation beginsA technical lead
The FBI captured an IP address associated with Lux. Investigators eventually identified their target as living in Melbourne.
Target identifiedArrest and device seizure
Police arrested Graham and searched his parents’ home. Electronic devices were seized for examination.
Digital evidenceSentence handed down
Graham was sentenced to 15 years and six months in prison, with a non-parole period of 10 years.
Court outcomeThe timeline summarises reported milestones. Public sources do not describe every investigative step or provide a complete technical log.
The key numbers
Figures reported by prosecutors and court reporting.
Graham pleaded guilty to 13 charges.
The sentence imposed by the court.
The non-parole period attached to the sentence.
Images found collectively on devices seized during the investigation.
Videos reported on the seized devices by the CDPP.
Prosecutors reportedly cited more than three million visits to pedoWiki. Visits are not necessarily unique people.
The device figures and sentence are from the CDPP. The website-visit figure was reported by ABC from court proceedings; it is not a count of victims or successful prosecutions.
How the investigation progressed
A simplified view of the documented sequence.
Report received
An anonymous report provided a starting point for investigators.
Technical lead
The FBI captured an IP address associated with the Lux identity.
Local investigation
The target was identified in Melbourne and police seized devices.
Prosecution
Graham pleaded guilty and was sentenced in March 2016.
This is an editorial summary, not a complete forensic reconstruction. The public accounts do not establish every tool, test or investigative action used.
Confirmed court outcome
15 years and six months in prison
On 17 March 2016, Matthew David Graham was sentenced after pleading guilty to 13 Commonwealth charges connected with controlling, promoting and making child sexual abuse material available, and encouraging offences against children outside Australia.
What the evidence establishes
Separating documented facts from undisclosed details.
Documented facts
- An anonymous report was received on 29 March 2014.
- The investigation involved Australian and international agencies.
- Graham was arrested in August 2014.
- The CDPP reported images and videos on seized devices.
- Graham pleaded guilty and was sentenced in March 2016.
Details not fully public
- The complete technical process used to identify Graham.
- Every forensic examination performed on the devices.
- A complete account of every person who visited the websites.
- A direct link between this investigation and unrelated dark-web operations unless reliable evidence establishes it.
Reporting suspected online abuse
Practical guidance for readers in the UK.
Do not save or share suspected abuse material
Do not download, save, forward or circulate suspected child sexual abuse imagery. Do not attempt to investigate the people involved yourself. In the UK, you can report suspected online child sexual abuse imagery to the Internet Watch Foundation. If a child is in immediate danger, contact the police.
Graham was 19 when he adopted the online identity Lux, according to Australia’s Commonwealth Director of Public Prosecutions (CDPP).
He controlled websites associated with child sexual abuse material, including one known as Hurt2theCore. Court reporting also referred to a wider collection of services called the Pedo Empire.
Graham’s case involved more than visiting or possessing illegal material. He pleaded guilty to 13 Commonwealth charges, including controlling, promoting and making child sexual abuse material available. The charges also included encouraging people outside Australia to commit offences against children to create material for his websites.
In February 2016, the Australian Broadcasting Corporation (ABC) reported on the court proceedings. Prosecutors said the FBI had monitored more than three million visits to his pedoWiki website and that it had more than 1,000 active users worldwide.
These figures describe reported website activity, not the number of individual visitors, victims or people later prosecuted.
How the investigation started
According to the Victoria Police 2015–16 annual report, the investigation began after an anonymous report on 29 March 2014. Victoria Police, the FBI and Interpol were involved.
The FBI identified an IP address associated with the online identity Lux. Investigators eventually identified their target as a person living in Melbourne.
An IP address can provide a lead, but it does not by itself prove who carried out an online activity. Investigators must assess it alongside other evidence.
The Australian Federal Police (AFP) also played a role. The CDPP says the FBI referred the case to the AFP, which worked with Victoria Police through the Joint Anti Child Exploitation team.
The public records describe these key stages, but do not disclose every technical step used to identify Graham. They do not establish that a particular software flaw or hacking technique exposed his identity.
The arrest and digital evidence
Police arrested Graham in August 2014 and searched his parents’ home.
According to the CDPP, devices seized during the investigation contained more than 12,000 images and 130 videos of child sexual abuse material.
The devices were encrypted. Prosecutors said Graham initially refused to provide the passwords, even after a court ordered him to do so.
Encryption is widely used to protect legitimate personal and business information. Its presence alone does not prove a crime. In this case, the relevant evidence was considered as part of the wider criminal investigation.
The case also helped investigators pursue other suspects. Victoria Police reported that information Graham provided led to further arrests in the United States and Canada.
The court outcome
On 17 March 2016, Graham was sentenced to 15 years and six months in prison, with a non-parole period of 10 years.
The CDPP’s official announcement confirms that he had pleaded guilty to 13 Commonwealth charges connected with operating and promoting child sexual abuse websites and encouraging offences against children outside Australia.
The sentence followed an investigation that crossed national borders and involved multiple law enforcement agencies.
What the case tells us about online anonymity
The Lux case shows that an online alias does not guarantee protection from investigation. It does not mean that every person using privacy technology can easily be identified.
Tools such as Tor have legitimate uses, including protecting privacy and helping people access information under censorship. Using privacy technology is not, by itself, evidence of wrongdoing.
In this case, the documented sequence was an anonymous report, an international investigation, a technical lead, the identification of a target in Melbourne, an arrest and a prosecution. Public records do not reveal every forensic detail, so claims about specific methods should not be treated as established fact.
The case also shows why website administrators can matter in criminal investigations. Operating a service can help make illegal material available and encourage further offending. Identifying an administrator, however, does not automatically identify every user or undo the harm caused.
How to report suspected online child abuse
If you encounter suspected child sexual abuse material, do not download, save, share or forward it, and do not try to investigate the people involved yourself.
In the UK, you can report suspected online child sexual abuse imagery to the Internet Watch Foundation. If a child is in immediate danger, contact the police.
Parents and carers should also make it clear to children that they can ask for help if someone pressures them online, asks for images or tells them to keep contact secret.
Sources and what remains unknown
The main facts in this report are supported by the CDPP’s sentencing announcement, the Victoria Police annual report and ABC’s reporting from the court proceedings.
Those sources establish the timeline, the agencies involved, the evidence reported by prosecutors, the charges and the sentence. They do not describe every technical step investigators took, so this article does not speculate about undisclosed forensic methods.
Community discussion
Join the conversation
0 comments
Be the first to join in
There are no comments yet. Sign in to start a thoughtful discussion.
Sign in to comment
Join the conversation with your Secritic account. Comments are available to signed-in readers.