|
Everyone is happy that this hacker's code found one, and oblivious that the code violates MySpace rules and the law. |
|
10-21-2006 National:
How to Catch a MySpace Creep |
.Six months ago, Wired News launched an investigation of MySpace with the goal of comparing the company's 120 million user profiles against public sex offender registries to see how many matches we could find. The project began when Wired News contributor Jenn Shreve found a handful of matches based on a random search. How many would you find with a software script that systematically went through those records and compared them all? We decided to find out. I wrote a series of Perl scripts and began sifting the data. The technique was crude, like searching for a needle in a haystack. When I began checking ostensible matches by hand, false positives registered in the thousands.
Nevertheless, after several weeks of part-time work on the project, I was led to one suspect whose behavior was so disturbing I contacted New York's Suffolk County Police Department for comment. The suspect, Andrew Lubrano, was arrested earlier this month on attempted child endangerment charges. Some 700 other matches were also confirmed, though none of those individuals could be linked by public MySpace posts to actual evidence of wrongdoing.
..more..
: by Kevin Poulsen
|
News & Noteworthy © ---
Featured 10-22 |
|
Will the real criminals standup?
|
|
10-22-2006 National:
MySpace Predator Caught by Code |
.The computer crimes unit of New York's Suffolk County Police Department sits in a gloomy government office canopied by water-stained ceiling tiles and stuffed with battered Dell desktops. A mix of file folders, notes, mug shots and printouts form a loose topsoil on the desks, which jostle shoulder-to-shoulder for space on the scuffed and dented floor. I've been invited here to witness the end-game of a police investigation that grew from 1,000 lines of computer code I wrote and executed some five months earlier. The automated script searched MySpace's 1 million-plus profiles for registered sex offenders -- and soon found one that was back on the prowl for seriously underage boys. [snip]
My road to this New York police unit began in Perl (a computer programming code). In May, I began an automated search of MySpace's membership rolls for 385,932 registered sex offenders in 46 states, mined from the Department of Justice's National Sex Offender Registry website -- a gateway to the state-run Megan's Law websites around the country. I searched on first and last names, limiting results to a five mile radius of the offender's registered ZIP code. Wired News will publish the code under an open-source license later this week.
..more..
: by Kevin Poulsen and an unnamed Wired News Reporter
|
.It is interesting what one finds when you get past all the hype. A Wired News Journalist (Kevin Poulsen) writes a computer code to quietly search the MySpace network and quietly compare its members to the National Sex Offender registry.
He finds one person (Andrew Lubrano) who is a previously convicted sex offender listed in the national registry. He also finds that person has engaged in further illegal activities with children on the MySpace network. Accordingly, Kevin Poulsen is to be praised for finding what he found?
Not so fast folks, who is Kevin Poulsen? A convicted computer hacker according to this report. His criminal background involving computers and the Internet is quite impressive. Note this report "He also pleaded guilty to breaking into computers and obtaining information on undercover businesses run by the FBI."
Now lets look at his computer code. Is it legal to quietly search MySpace with an automated computer program? No, according to the MySpace "Terms of Use Agreement (TOUA)," which says:
"8. Content/Activity Prohibited. ... The following is a partial list of the kind of activity that is illegal or prohibited on the MySpace Website and through your use of the MySpace Services. ... 19. any automated use of the system, such as using scripts to add friends or send comments or messages; ..."
So, does history repeat itself? Is computer hacking as addictive, as it is claimed, that sex offenses are? More interesting is, the police were watching and didn't arrest him for his illegal activity, they participated. What part of the alleged evidence gathered will be declared inadmissible under the "Fruit of the Poisoned Tree" doctrine when the sex offender gets to court? And, worse yet, the computer code is going to be released so anyone can use it to commit further illegal activities. Does anyone see a problem here?
How did Poulsen find RSOs on MySpace?
Obviously there is a hidden MySpace Profile which does contain "last names" as you must have one when you sign up for a MySpace account (See MySpace Sign-up screen). So, how was Mr. Poulsen able to prove any registered sex offender had a MySpace account?
MySpace TOUA indicates they do not display or reveal members' last names:
"... Your MySpace.com profile may not include the following items: telephone numbers, street addresses, last names, and any ..."
And the "Privacy Agreement" wherein it states:
"... Users' full names are never directly revealed to other members. ..." -AND- "... To facilitate searching and finding friends and acquaintances on the service, MySpace.com allows users to search for other members using first and last name, email address, and schools and/or companies where users may have attended or worked. ..." Clearly MySpace presumes folks know their friends' names.
Now notice comments from Poulsen's article: "In May, I began an automated search of MySpace's membership rolls for 385,932 registered sex offenders in 46 states, mined from the Department of Justice's National Sex Offender Registry (NSOR) website." -AND- "I searched on first and last names, limiting results to a five mile radius of the offender's registered ZIP code."
The "automated search" is the first TOUA violation. More importantly is, the program obviously accessed "MySpace membership rolls (Profiles)" using the -full name- from NSOR (See Note-A below). Then when the program got a hit, it checked to see if the MySpace Profile had the same NSOR zip code (See Note-B below) likely creating a suspect file, where only duplicates would have to be removed to filter that list of RSO MySpace users. The key being non public MySpace Profiles were accessed, another violation.
Criminalizing Innocent Conduct:
The essence of what is happening here is the criminalization of innocent conduct. There is no basis to presume that a person with a sex conviction will always act criminally. However if the basis is a prior criminal record, then all persons with criminal records must be presumed to act criminally, to get by a constitutional unequal treatment claim.
Apparently many RSOs used their real names when establishing MySpace accounts and there are some calling the RSOs nitwits, stupid and the like for doing so. (See NOTE-C below) To me it shows the RSOs followed the rules and did not violate them. I never could understand political folks that suffer from offender-itis, so many of them are in power positions these days.
Is Social Isolation The Answer?
The net result is that MySpace will likely remove any RSO from their site. How many will come back under false names? It seems that as it is, they could be monitored, but if removed they cannot. I guess that is today's legislative vision rubbing off on the public. The very purpose of Megans' laws was that communities would know where offenders live. Iowa's residency laws have proven that social isolation causes more and more to go underground. A smart move by MySpace?
How many predators have the police caught?
Important to note is the New York's Suffolk County Police Department, "the computer crime unit has erected bait profiles registered to fake underage teens, but so far the tactic has netted only one arrest." I presume MySpace officials are aware of these -false profiles- as they too violate the TOUA. So the results are two persons have offended with one being a RSO. If it is true that there are hundreds of other RSOs on MySpace it appears they have done nothing wrong and will be banned for no reason except a presumption; could they sue?
Parental Concerns?
Parents should be real concerned, not by the presence of RSOs, but that there now is a program available to gather private information from member profiles, who knows how that could be used. Hopefully the current silence of MySpace officials signals an effort to close those loopholes, but can that program be used for other social networking websites?
Social networking websites are not used exclusively by persons under 18, in fact, statistically persons under 18 are in the minority on those websites. (August 2006 11.9% of MySpace visitors were 12-17 years old. Note: Those between 12-13 were there in violation of MySpace Terms of Agreement).
I wonder, how many other politician type accounts (Mark Foley) there are on MySpace, and who their friends are? However, that is for someone else to search out now that we all know how.
---------------------------------------------
NOTE-A: When Poulsen wrote a different program to mine RSO names from the NSOR, that program bypassed the NSOR "Terms of Use" step which requires one to agree or disagree for every search.
NOTE-B: Within a MySpace Profile there is a setting which members set to allow friends within xx miles to add themselves to their friends list. This setting is similar to the MySpace Browse feature to find folks within xx miles to make friends with. Those settings require a zipcode which is what Poulsen's program likely used.
NOTE-C: "In my first phone call with Giardina, he was amazed that Lubrano was so easy to find. "He registered on MySpace using his real name? What a nitwit." Parry Aftab, an internet privacy lawyer, says she's not surprised. "A lot of the bad guys use their real name, as you've seen. It's amazing to me how many. -AND- Congressman Greg Walden, R-Oregon commented ""I believe some of these guys are stupid enough to use their real name."
|
|
|
