What broke my heart was how sad his father was when I told him, he said he trusted the son the most.
At eighteen, the boy is an adult and would take full responsibility for his actions and inactions. Parents indeed need to closely monitor their children's activities online, but at that age, it will be very difficult to watch over that boy. This child simply chose to be a criminal, maybe he was influenced by friends or other agents of socialisation.
It would have been very easy for the boy's dad to suspect him and monitor his activities online but his father doesn't have the knowledge of what the boy is doing. It becomes very difficult to monitor what your boy at 18 years is doing online. However, he might choose to play good at home but when he is with his friends, he continue with his criminal activities.
You did the right thing OP, to tell his dad so that he can be aware of who his son is and shouldn't be surprised if the police comes looking for him. I feel that bringing up your child in a God fearing way and engage them with church activities might limit