PLAINFIELD, Ind. -- About 20 months after the online threats were first seen on Facebook, investigators with the FBI and other agencies arrested their suspect.
But what happened in between the first threat in December 2015 and the announcement of an arrest on Monday?
The investigation began Dec. 17, 2015, when somebody with the Facebook name "Brian Kil" made online threats to students at Plainfield High School. They appeared to taunt authorities, tagging Plainfield's and Danville's police Facebook pages, as well as the FBI's page.
Federal agents say they now believe 26-year-old Buster Hernandez, of Bakersfield, Calif., is responsible for the threats.
"Almost from the beginning, they told us this would take a long time to solve," Plainfield Police Chief Darel Krieger said. "They weren't kidding."
PREVIOUS | CALL 6: Why is Plainfield threat investigation taking so long?
The complaint states that Hernandez would then ask the victims for more nude or sexually explicit images or videos, or he would send what he has to their friends and family.
The FBI contacted Facebook, requesting records related to the "Brian Kil" account.
Facebook responded with an email address and IP for the registration. The IP address went to an anonymous proxy, which is a middleman between a person's computer and the internet. People can use anonymous proxies to hide their information when online.
Investigators believe Hernandez also used a Tor network to hide his communication. Tor software bounces a user's information around the world, via different computers run by other users.
"There's nothing illegal about the Tor network or the dark web," U.S. Attorney Josh Minkler said. "There's nothing illegal about people wanting internet privacy. I completely understand that and respect that. All of us do. We respect the constitution. But it does make it difficult when somebody does that."
Throughout the investigation, the FBI learned the suspect would frequently create and disable Facebook accounts to make anonymous threats.
Federal agents believe Hernandez created at least 16 different Facebook accounts, using names like:
- Brian Kil
- Brian Kimore
- Brianna.lik
- Plainfield Massacre
- Brianna Kilian
- Brian Mil
- Bre Harris
- Lamarr Raymer
- Ryan Kel
- Greg Martain
As Facebook shut each account down, the suspect created a new one.
According to the criminal complaint court document, Hernandez forced one of his victims to attend a community forum in Plainfield, organized by law enforcement to quell the public's fears and answer questions about the investigation, then report back to him.
TIMELINE | Brian Kil threats investigation
For the FBI, a break in the case came in June 2017, when a judge authorized the use of a Network Investigative Technique, or NIT, to find the suspect's true IP address.
A NIT is a small piece of code that can be attached to a video or photo. When somebody opens the video or photo, the NIT discloses the user's IP address to the FBI. A NIT, as Minkler said, is a bit like a virus when it's attached to a file.
A NIT is a controversial tool used by FBI. In 2015, it was used to hack 8,700 computers with one warrant as part of a child pornography investigation.
The NIT was placed on a piece of media that was sent to Brian Kil by one of the victims he was extorting. When he opened the media, law enforcement was able to identify his real IP address.
Once investigators had the suspect's IP address, they subpoenaed Bright House for subscriber information on the location, which came back to a house on Eucalyptus Drive in Bakersfield, Calif.
According to a police report from the Kern County Sheriff's Office in California, Hernandez lived at the house with his girlfriend and her grandmother.
A few days later, the FBI requested the use of "pen-trap devices," a form of wiretapping to and from the IP address. A judge granted the request.
"As you've seen, we've followed the four corners of the law," Minkler said. "We did not secretly get somebody's internet. We did not secretly steal anybody's emails. We went through a judge on everything we did or through a grand jury to do this case the right way so it will stand up in court."
One of the online communications intercepted by the FBI showed that somebody at the IP address viewed a photo "Brian Kil" posted when he threatened Plainfield schools in 2015.
The FBI also installed a pole camera near the house, which showed a man matching the description of Buster Hernandez come in and out of the house. A review of the Tor records showed the Tor was accessed only when Hernandez's girlfriend was not at the house, and only when Hernandez was at the house.
MORE | 26-year-old from California charged in 'Brian Kil' Plainfield, Danville school threats case
At Monday's press conference, police and FBI representatives said that despite how long it took to solve the case, they were working on it the whole time.
"To the community of Brownsburg and Plainfield, but specifically Plainfield, it doesn't seem like it was that long ago and probably many people thought that since we were at a place where we couldn't do much more, we weren't doing anything. But by golly, nothing could be further from the truth," Indiana State Police Superintendent Doug Carter said. "Unfortunately for me, I'm having those experiences all over Indiana right now. And we will do everything within our power -- everything within our power -- every single time, sometimes at personal expense, and I'm OK with that too."
PREVIOUS PLAINFIELD COVERAGE | Parents want more answers in Plainfield threats | WATCH: Man escorted out of Plainfield safety meeting after gun found | No arrests; police mum on Plainfield threats despite raid | Plainfield asks for kids to come to school | Call 6: Why no arrests in Plainfield case? | Plainfield HS to have officers on 1st day back at school | More threats made to Plainfield retailers | Two Danville students arrested, school closed after threats | Plainfield police create tipline after threats
