Slashdot Mirror
MySpace Predator Caught By Code
An anonymous reader writes, "Wired News editor and former hacker Kevin Poulsen wrote a
1,000-line Perl script that checked MySpace for registered sex offenders. Sifting through the results, he manually confirmed over 700 offenders, including a serial child molester in New York actively trying to hook up with underage boys on the site, and who has now been arrested as a result. MySpace told Congress last June that it didn't have this capability." Wired News says they will publish Poulsen's code under an open-source license later this week.
PWND.
[sarcasm]While most of us here know how trivial searching for string a in string b is, I for one believe that Tom couldn't do it. Aside from all the horror that it is conceptually, the (lack of) stability of their site actually makes that statement believable![/sarcasm]
This article isn't credible. It must be a hoax. I mean, c'mon, you really expect me to believe someone wrote a 1,000 line perl script. And that it did what it was supposed to?
I know what he did was a good thing, but what if I wrote a script to go through MySpace looking for other "stuff?" Isn't this a breach of privacy and wouldn't this person or MySpace be vulnerable to lawsuits?
Sure it's easy. Suck down the HTML to the search page. Build a routine that does the HTML POST, and iterate through each name in the Offender's list, using it for the value of the "search by real name" field. Parse for the result count string in the returned HTML. When result count >0, investigate further. Now, how easy is it for MySpace? I'd say about an order of magnitude easier - they have direct access to the database. Roughly something like: SELECT * FROM userbase WHERE EXISTS (SELECT offenders.realname FROM offenders WHERE offenders.realname like '%'+userbase.realname+'%') Sure, there's a little added complexity for slight spelling variations, but SoundEx and the like can be used for such purposes.
Thus spake the article:
No amount of rummaging through any database is going to detect someone who registers under a false name, so no MySpace will NEVER really have the ability to find all the sex offenders, unless they can somehow verify that people are who they say they are when they sign up. Though they do now have the ability to catch the really stupid ones it seems.
I Am My Own Worst Enemy
With tens of thousands of teens visiting a site daily there is a significant risk is that a couple of sex predators are on the prawl.
So the question is... does Slashdot check all users if they are registered sex offenders or does this Paulsen guy have to run his script here too?
Tell your friends about xenu.net
That seems like a complicated way to get the same results as:
SELECT * FROM userbase WHERE SexOffender="1";
What I'm listening to now on Pandora...
I suspect the answer will illustrate why a white hat wouldn't be doing this sort of thing.
And then there is Jacob, one of the kids this 39 year old had "friended":
So Jacob's parents can't be bothered to, you know, go see wtf this kid is doing on MySpace? The earlier comment snippet makes it seem like the parents of this kid are totally off the hook here, but guess what? Wether your kid is hanging out at the local corner or someplace online, you really need to know where they are and what they are doing. And then there is the whole issue about not talking to stangers in the first place; apparently his parents have completely missed the boat in that area. Scary.
I Am My Own Worst Enemy
I'm quite glad for this guy; but law enforcement's malaise still cheeses my off a bit. Indeed, writing a Perl script to spider MySpace is not rocket science -- I whipped one up six months ago as part of a graduate school project. Immediately sensing the possibilities of catching people like this, I contacted several people in the CIA and FBI through my school. After several painfully blunt explanations, none of them could grasp how the script could be used in their agencies. Governments and major corporations wonder why China can get into "secure" sites and "kids" write viruses like "ILoveYou" or "Blaster". It's because they're so monolithically slow, stupid, and blind that they can neither see nor react to their environments. Maybe law enforcement will "wise up" and start offering prize money / sponsoring competitions, just like the recent Bio-Tech news here on Slashdot.
No. Most of the hard work in writing something like this is dealing with server errors, which Myspace serves up in lieu of content based on a sinusoidal pattern where you have between 10 and 100 percent probability of getting an error depending on the time of day on Mars.
MySpace needs to be whacked, hard. Harder.
The lazy, lying bastards should be shut down, made an example of. At the least, they're now liable because someone showed it could be done, and because they were too lazy to do it themselves, they now have a liability exposure for any child that was preyed upon through their web site.
Best regards.
Doing a bunch of HTTP fetches, parsing and extracting the data -- from sources that were probably never designed to be automatically parsed, and hence have lots of weird exceptions and corner cases -- and then performing string compares, easily adds up to 1000 lines, especially with comments and error messages. The task is trivial in theory but somewhat hairy in practice.
And speaking from unpleasant experience, doing something like this in a language without features dedicated to text parsing (like C++ without the Boost Perl regexp library) would take at least three times the lines.
So how many false positives and false negatives does this produce? i.e., how many non-offenders does it misidentify as being offenders and how many offenders does it misidentify as non-offenders? Furthermore, of the offenders properly identified, how many of them are actually committing, planning to commit, thinking about committing, wanting to commit, or some other way being involved with the committing of a sexual offender related crime on myspace?
While the tool may produce results, are the results good enough and non-damaging enough to be useful? (I'd consider any given non-offender being identified as an offender and subsequently harrassed as such rather extensively damaging.)
Should read: Jim Foley breathed a sigh of relief when MySpace told Congress last June that it didn't have this capability.
Now why is that, exactly?
We know that child molestation has occurred for untold eons. Humans are therefore resilient, resistant to such things, for the sake of survival. And at the risk of getting flamed, I want to point out the evidence that most victims of such mistreatment do in fact go on to lead normal lives. Natural selection sternly requires it.
So. Why is child molestation such an obviously hideous evil?
Is it just because we in the West are presently obsessed with sex?
I swear I am not trolling. I myself am actually a victim, from age 8, but I seem to be fine (although my level of slashdotting may be a sign of a deep malfunction). Ever since I realized that I survived unscathed, I have been wondering for a long time why this subject gets an automatic "OMG teh molestation!!!11!" response, when it is actually such a commonplacde in human history.
It almost -- ALMOST -- smells like we are protesting too much.
FATMOUSE + YOU = FATMOUSE
Hey folks.
Picking and choosing when it is/is not OK to cooperate with authorities in a criminal investigation might be very convenient for Kevin Lee Poulsen, but it should give his sources -- past, present, and future -- significant pause.
Wired News -- and Kevin -- have shown that writing a splashy story means more to them right now than the danger of blurring the lines between reporter and cop. This isn't about protecting kids, or about what MySpace should or should not do. It's about eroding the role of the journalist as a fair and impartial witness, in a time when too many people are already barking up that tree.
A hacker should know better.
-- Adrian Lamo
Even so, robots.txt is not a privacy guarantee, it's only a friendly suggestion.
Naturally.
Myspace IS a 1000 line pearl script.
Please sign petition to restore sanity to our banking system!!!
http://financialpetition.org/
It's because people want to outlet their aggressive tendencies someplace, and we've all collectively aggreed that "child molesters" (and now, to some degree "terrorists") are a target that no one will object to our over-reactive hatred for. Other acceptable groups include "cop killers". Let's get all righteous and bloodthirsty over these groups of people, now that it isn't socially acceptable to hate a group based on their skin color.
See how far we've come?
Ever since I realized that I survived unscathed, I have been wondering for a long time why this subject gets an automatic "OMG teh molestation!!!11!" response, when it is actually such a commonplacde in human history.
It is a fear response.
On the other hand, if there is a way to find out repeat sexual predators who are looking for new prey then shouldn't we use that method?
I'm going to make a general comment - I find MySpace unbearably creepy and exhibitionistic. I wonder if its purpose was to provide titillation and unhealthy fascination in young people because it appears to be doing an excellent job at that.
Tubby or not tubby. Fat is the question
I sure hope he wore gloves and/or other protection for that part!
This issue is a bit more complicated than you think.
Also keep in mind, while I haven't read the testimony, "They don't have the ability" means the don't have the code written to perform those tests today, nothing more. Not "A million monkeys could never develop that code because its impossible, now, then, and in the future". And filtering for child molesters potentially puts them at risk, if they miss one the patents are almost certain to sue (you should have protected my kids! I shouldn't have to raise them and look after them...)
For those who haven't already, check out Beautiful Soup, which is a great python module for web-scraping - particularly when used together with ClientCookie... the results are shockingly elegant in many cases.
I've personally written functionally equivalent scripts of 100-200 lines to search MySpace for underag... oops, I've said too much.
That he manually confirmed 700 of the results.
That doesn't say how many false positives he sifted through to get to those.
Should Myspace be required to have people who manually confirm all users aren't sex offenders?
My twitter
Yes, children are resilient, but another instinct that is supposedly hardwired into us is protection of our offspring. This (perhaps more than the "I want government to raise our kids" thing) is a big factor in heightened reactions to crimes against children. Add in the more rational sympathy for living beings that can't protect themselves like adults can, and you can end up with people overreacting to, and often overestimating the frequency of, these crimes.
My personal feeling on this specific issue is that I don't think MySpace has any true responsibility to monitor this, any more than other social networking programs/websites (like the many IM programs). The only real recourse society has in this case (barring violation of MySpace's rights) would be to legislate them into things like requiring credit cards for access (thus supposedly proving adult status), boycotting the service or going "vigilante," rooting out the pedophiles Dateline style.
I don't think he was the internet archive. http://www.archive.org/about/exclude.php
This sig has not been evaluated by the FDA. It is not designed to diagnose, treat, prevent, or cure any disease.
1000 lines, bah. I could have done it with .NET in 10,000 lines.
I once used an image from an offender website as a message board avatar.
Really, really scary looking guy, convicted of several counts of incest.
But, HE didn't have an account, his image was used without his knowledge or permission.
Of those couple of hundred, one seemed to be trying to prey on little girls. This seems to be pretty much of a non-problem.
A little perspective? Make that little girl that he targets your daughter and we'll see how your "perspective" changes.
I think you'll find that it's mostly the young people providing the "titillation and unhealthy fascination" to each other.
Setting aside issues of what is a "sex offender" vs what I think the public perception of one is, are all "sex offenders" not allowed to use MySpace?
This is a little like cross referencing a list of library card holders and comparing it to the list of "sex offenders" and waxing hysterical that there are "sex offenders" in the library. Do the same with Blockbuster cards, or the phone book. Geee gads, there are "sex offenders" in the city...
Yes, there are young people on MySpace, but not all MySpace users are young. Some people are well into their 30s and 40s and use it to connect with other 30 and 40 year olds.
The mere presence of "sex offenders" should not be cause for concern anymore then if they were in a library, Wal-Mart, mall, grocery store, etc. This is reinforced with the fact that many "sex offenders" really aren't-people who were 18 and their partner was 15, public urinators, that guy that grabbed that girl to yell at her for jaywalking or whatever, etc.
I posted it under another "funny".
I think there are folks who take the mod system way too seriously and have some sort of problem with the fact that "funny" doesn't garner "karma", so they feel obliged to give it "insightful" or some such. I don't care, If I post a "funny", I don't expect "karma".
My personal opinion is that "funny" is just that - for those who think it is funny. Maybe having zero karma for funny is "right", maybe it is "wrong".
I dunno.
Hey mods - don't zap me down too much. I didn't mod myself up. You are in a pissing match with other mods! (Not that I give a shit what my "karma" is, I am soo going to hell, maybe, depending on who you ask.)
This issue is a bit more complicated than you think.
Survival of the fittest sternly requires it?
Evolution is "death of the least fit", not "survival of the fittest". As long as a critter can eek out an existence, it doesn't have to be the very best. Some one can be completely fscked up, and yet still be fit enough to survive.
Evolution may prove lots of things, but it certainly doesn't prove that rape, child molestation, beatings, or racism are not bad things (by your logic, all of these things have been going on for a long long time, and yet we're all fine).
Make anything personal and you'll care a lot more. It doesn't change the statistics. If you've got fifty million idiots congregated at one place, many of whom are always-horny teenagers, you'd expect more than a handful of predators to try to take advantage of the system. Sure, it's still unfortunate, but considering the numbers we've seen in other situations, it seems remarkably low.
How are sites slashdotted when nobody reads TFAs?
Too easily countered. Go to a public facility / library / wireless hotspot. It'll decrease the risk of being 'provably false', and also look even more "suspicious" - "hey look, he even covered his tracks!".
I dislike / despise these people as much as the next person. I just also despise justice-by-the-mob.
I am also a victim of childhood sexual abuse and I am an incest survivor. For me it was from age 10.
Here are some of the problems and pains it has caused me.
The biggest thing it does to you is break down your "boundaries".
What that means is:
I wind up confusing love and sex.
I am more aware of what other people want than what I want.
I do things I don't want to do to please others, even without them asking.
Then I get angry at them and resenting it.
Hypervigilence - always knowing where other people are around you, even behind you.
Also sitting in a restaurant with your back against the wall nearly all the time is
hypervigilence.
I am reluctant to tell my friends with kids because I worry they will think I will molest their kids. (This is based on the idea that most molesters were molested themselves)
By the way, I ended up not having kids. I think I was afraid I would be like my Dad.
One of my abusers put a lot of energy into making sure I felt "OK" and that I was not upset.
Of course, his main concern was that I would get upset and tell somebody.
I think it is this thing you end up hearing over and over from your abuser.
"Everything is ok"
So when you grow up, you think: Well it kind of sucked but it didn't really affect me too much.
Speaking for myself, it affected me in lots of ways.
A lot of times I have felt "I want my life back".
You didn't deserve to be abused.
Kids shouldn't have to trade their bodies for love.
So has murder, rape, robbery, torture, etc. Those things aren't any less evil just because they've been around for a long time.
Again, how does that imply it's not evil? Only things that kill, maim, or emotionally scar someone for life are truly evil?
I think the point he was making was NOT that child molestation isn't a bad thing; rather, that it's no different than murder, rape, etc. Possibly even less of a crime than murder or other violent assault. Murder deprives you of your life, and it is thus the highest of crimes. Assault deprives you, sometimes, of physical health and capabilities. Lesser forms of assault deprive you of your rightful control of your own body and leave nothing but psychological scarring; non-violent rape (e.g. the kind where you are not beaten or stabbed, etc) falls into this category. (Violent rape obviously falls into the former category, and nonviolent rape can segue into for former if STDs or unwanted pregnancy follows). Mind you, I'm not in any way saying that these lesser crimes are at all OK; I'm just saying, look at them in comparison to other, much greater crimes.
Child molestation is categorically no different than rape; the victim is just younger. Some "child molestation" (statutory "rape" of 16 or 17 year olds, who are biologically adult) is even less of a crime, since the act would by all objective standards be considered consensual if it weren't for the legal fiction that people younger than 18 are incapable of giving consent.
But we freak the hell out about child molesters and lose all sense of rationality when anything about them comes up. We don't freak out this much about murderers. We still *do something* about murderers; that's why we have police, and courts, and jails and such. We still do something about people who physically assault others, but you don't see this vigilanteism toward your run of the mill violent criminals around. You don't see people writing 1000-line perl scripts to try to identify known gang members on MySpace - particularly because there's not as convenient a list of known gang members to compare with. But a lot of those people are violent criminals guilty of much greater offenses than the pedophiles that every mom in America is terrified of.
Americans just get particularly worked up about sex, and particularly worked up about children; combine the two together and you get instant emotional frenzy, no rational thought involved. Pedophiles, rapists, witches, communists, terrorists... hell, the whole terrorist scare seems sane in comparison to the frenzy that people get into over sex offenders. At least terrorists actually murder people. Pedos and rapists are the next nearest the top on that little list I just gave, and at least they're a step up from just persecuting people with different beliefs (witches and communists). But next time you or anyone else starts to get riled up about sex offenders, ask yourself why you don't feel the same way about all the more violent criminals out there. Do you want them all on watch lists too? Every man who's ever gotten into so much as a fist fight, a much more violent act than rape? Are you constantly concerned about your children running into people like them on MySpace? If not, why not?
If so, well, at least you're consistent. I have to give you that.
-Forrest Cameranesi, Geek of all Trades
"I am Sam. Sam I am. I do not like trolls, flames, or spam."
[Note, this post and parent of parent only applies to US law]
I don't really understand parent. What I am saying is that, if you have any sort of "right" for information about you to be kept private, then that right is on a personal level (meaning it's a matter of common courtesy). It isn't something that is currently extant in the law. That's why tabloids exist. They divulge personal information about famouse people to the general public. Their legal right to privacy was not destroyed when they became famous, they never had such a right. If you want to maintain your privacy in this way, then don't become famous. Sometimes the tabloids publish lies about a famous person--this infringes on a right. We have a right to not have lies published about us.
As for enumerated rights. Our legal rights are pretty much enumerated; very few are not. The so-called right to privacy that is so commonly misunderstood is an "un-enumerated right," but it only exists because the Supreme Court says it does. After its "discovery" we are to presume that this right has always existed, but in practicality of course it never really existed until the Court said it did. Extending this, there may be other un-enumerated rights that, in the future, will be determined by the Court to exist. In the mean time, for practical purposes that right doesn't exist and won't until the Court conjures it up the same way the "right to privacy" was conjured out of nothing.
[Note, this post and parent of parent only applies to US law]
Actually, not exactly, natural selection just requires that the problem doesn't get so bad that it has a significant impact on the ability of the species as a whole to survive. It's perfectly compatible with natural selection if, say, 2% of the population, despite being totally innocent, meets some horrible unfair death, as long as the other 98% gets along fine. If that's enough to keep the species going, then it's all that natural selection requires.
I think there's a common misconception that evolution is a force which is so powerful that it eliminates all imperfection. That's not necessarily the case. It only eliminates perfections that threaten the ability of the species to do the minimum necessary to survive. All other imperfections are relatively unimportant, at least as far as evolution is concerned.
Having said that, I've heard it said that of the people who experience some form of severe trauma or abuse, there is a certain percentage who become pretty much permanently (or at least over the long term) messed up in the head and have trouble coping with life in a wide variety of ways. But then there is also a large percentage of people who come from a messed up background who grow up to be perfectly healthy adults. In fact, these people tend to take their messed up background and find some way to make it into something positive. They may even be more successful than the average person. Years ago, I knew someone who came from a background where he and his siblings had all been abused. He wasn't able to deal with it very well and his life was, I hate to say, a serious mess. (I hope he's managed to iron some things out by now.) His sister, on the other hand, had earned a graduate degree in social work (I think) and had written at least one book on the subject of child abuse. She had done well for herself and was making a real difference in the world, and I think she was emotionally healthy as well.
Basically, it seems like when something really terrible happens to someone, either they are never able to overcome it or they are able to overcome it, and they grow from it in ways that others never would even have the ability to grow. I'm thankful that a good percentage of the people are able to totally recover and be a stronger person as a result. But the reason child molestation and similar things are so bad is that a certain number of people will fall into the first category and never get past it. I don't know why some people are able to get past it and some aren't, but it seems to be the case, and that's why I think we should continue to treat it as a very serious issue.
Make that little girl that he targets your daughter and we'll see how your "perspective" changes.
You're absolutely right, that sort of thing is enough to change anybody's perspective and turn just about anybody into somebody who would suddenly support torture and summary execution.
That is, perhaps, the best reason of them all that it should be impartial parties who administer justice and decide the punishments for these sorts of things. Child sexual abuse is just one prime example. Replace it with "terrorism" and you have another one playing out each day before our very eyes.
Often times it is best to leave the emotion at the doorstep and debate things logically and dispassionately. Pretty much any issue with as much emotion behind it as this one is going to be one of those cases.
Another thing to consider with these "lock them up forever!" attitudes toward some crimes: You run the risk of making things worse. Somebody sexually abusing a child is bad. Somebody sexually abusing a child and then killing him/her because, in terms of their sentence, it is essentially free--that is worse. I'd rather get my child back and the offender get out of jail than have him/her killed and see the offender locked away forever. No contest.