How police tracked down suspects in AI deepfake investigation involving dozens of women

< warm>WARNING: This story contains inside information of force and sexual development, including assault.  

The file outlines how one investigator unravelled a case that began with one victim — but now involves more than 50 — using IP addresses, leading him to the rental where the accused had stayed with his wife in February 2024.

The details are contained in sworn affidavits by Ottawa police officer Det. Const. Dakota Bashford, filed with the court to obtain search warrants and production orders — court orders compelling a business to produce records or data. 

The allegations in the 345 pages of documents have not been proven in court.  

Stephen Lowe, 60, of Maitland, N.S., was arrested on Feb 12, 2026. He is facing 79 charges including harassment, uttering threats, possessing and publishing obscene material and child sexual abuse and exploitation material.    

The Ottawa Police Service is the lead agency in the multijurisdictional investigation because the first complaint came from within the area.  

A second man, Gregry Peter Joseph Van Beek, 38, of West Nipissing, Ont., is facing seven charges including harassment by watching and besetting, conspiracy to commit an indictable offence and publishing intimate images without consent.  

"It is believed that this online conduct has emerged in the 'real world,'" Bashford wrote in the court documents. 

Bashford, who identified himself in the documents as the lead investigator, explained he believed a then-unknown person had attended a woman's residence and "surreptitiously" recorded her through the window. 

“It is imperative that this person(s) is identified and charged accordingly for having engaged in this predatory behaviour,” he wrote.

According to the documents, Bashford now alleges this person is Van Beek, whom the documents state is an enforcement officer for Ontario's Transportation Ministry. 

The court documents also show that as of May 19, police are still trying to identify a third man in connection to the case, who may or may not be in Canada.   

The alleged victim's identity is protected by a court-ordered publication ban. 

The documents show police would later come to believe Lowe had uploaded 7,200 files on this site alone.  

Bashford launched an investigation and discovered X and Instagram accounts he believed were associated. He sought data from X, Meta, Microsoft, Airbnb, Bell Canada and pornographic websites.

2 charged over violent, sexual AI deepfakes of dozens of Canadian women

He noted that X and Meta, though both American companies, would assist Canadian law enforcement if there was a court order, but Tumblr — on which there were more than 300 applicable posts — would not do the same.

In his efforts to obtain the orders, Bashford laid out the evidence he had thus far. 

He believed an "unknown person" had created a Tumblr account on Aug. 1, 2020, and had posted a picture of two sisters and their mother that day, with another image beneath them of four bound women. 

The documents show the graphic and violent posts of the family continued for more than five years. They included photos of the women that had been manipulated to show them being ejaculated on, beside "date rape" drugs, one with a gun to the head, and another holding a sign reading, "RAPE ME PLEASE." 

Some of the posts were very detailed, including the creation of movie posters, with titles such as "Rape Napped" that included real photos of the sisters and their mother, portraying them as the characters in the movie, with similar aliases as their real names. 

Finally, Bashford started receiving some of the data he had requested. 

On Oct. 3, 2025, X provided the IP address connected to the account Bashford had identified. The officer discovered that the internet service provider for the address was Nova Scotia-based NCS Managed Services.

But he hit a dead end: The IP address provided service to 372 subscribers, the company told him. 

Six days later, one of the pornography sites Lowe is alleged to have used the most provided four different IP addresses associated with Nova Scotia companies, as well as Bell Canada. 

On Nov. 3, Bell Canada provided a civic address in Ottawa associated with one of the IP addresses, along with the owner's name.

A week later, the officer showed up at the address, the documents state, and met a woman who said she had rented the place on Airbnb from the man Bell Canada had identified.  

This prompted Bashford to seek a court order requiring Airbnb to confirm whether the rental had been occupied when the pornography website logged the IP address. He wrote in the documents that this would help the police figure out whether the owner was a person of interest.

Wife of man charged for AI deepfakes say she's filing for divorce

While awaiting the information from the company, Ottawa police began looking into the owner. 

They asked the internet service provider in Nova Scotia if he was a client, and therefore might possibly be one of the 372 subscribers the company had previously identified. But it said he wasn't.  

On Dec. 3, 2025, Bashford hit another curveball. 

Airbnb got back to him to say there were no reservations at the Ottawa address during the time about which he was inquiring. (Bashford later determined the company had erroneously provided information for 2025 instead of 2024.)  

Police also asked Bell Canada for cell tower locations for the property owner's phone. It turned out he hadn't been outside of Ottawa during the times the alleged perpetrator was logging onto the site from Nova Scotia. 

But Bashford seemed to be getting closer, working through the Christmas holidays.  

On Dec. 26, he says in the affidavit, he spoke with the owner directly, who informed him that a man he identified as Stephen Lowel (spelled incorrectly) and his wife had rented the property between Feb. 15 to Feb. 21 in 2024. 

Bashford stated that the owner provided proof of this, and also shared a phone number, which the officer looked up in a police system. It was linked to a Stephen Lowe.

The investigator then searched for Lowe on the Ontario Transport Ministry's database and noted that his digital driver's licence photo matched the one the property owner said was his guest's profile picture on Airbnb.  

Lowe's licence had been cancelled in Ontario, so Bashford looked him up in Nova Scotia's database and found his address in the small village of Maitland, around 85 kilometres north of Halifax. 

On Dec. 29, Airbnb confirmed that Lowe had stayed at the Ottawa address. 

"From this point forward the unknown person was confirmed to be Stephen Lowe," Bashford wrote in the court documents. 

Bashford then obtained a search warrant on Jan. 28, 2026. 

On Feb. 12, the RCMP executed the warrant at Lowe's residence, arresting him and seizing 22 electronic devices, including a red iPhone.

Three days later, the documents state, Bashford interviewed Lowe in Nova Scotia, "during which the following was disclosed:

a. He is the person responsible for the posts; 

c. He had secure conversations with other likeminded individuals on [secure messaging platforms] Sessions and Wire; 

d. He utilized a red iPhone to commit the offences alleged." 

Lowe’s lawyer, Michelle O’Doherty, said it would be inappropriate for her to comment on the documents given the case is ongoing, but noted while they may purport to outline parts of Lowe’s statement, they do not encompass the full investigation or his full statement.      

The documents show police had obtained Session messages, as well as those sent through a pornography site, where the person they now identify as Lowe was talking to another person or people with various usernames.

The documents allege Lowe shared with a user the address of one of the sisters. He also shared a photograph that someone else had shared with him. Taken through the window, it showed the other sister and her friends, who were at the house at the time.

On March 12, 2026, the pornography website provided the IP addresses linked with the user that police believed had shared the photo, which Bell Canada confirmed was associated with a Gregry Peter Joseph Van Beek. 

Bashford looked him up on Ontario's Transport Ministry database and found his address. Van Beek was arrested on May 2.

Senior reporter

---

---