I covered this on Ship It Weekly along with a couple related ops stories (RDS blue/green downtime improvements, and ECR cross-repo layer sharing) plus a Honeycomb EU outage write-up as the human closer.
Situations where criminal activity took place would usually include police (with child trafficking, more likely even the FBI). To think these ideas or photo analysis techniques are new to LE is naive.
Audio + links here: https://www.tellerstech.com/ship-it-weekly/curl-shuts-down-b...