MySpace Predator Caught by Code
Kevin Poulsen 10.16.06 | 2:00 AM
YAPHANK, New York -- The computer crimes unit of New York's Suffolk County Police Department sits in a gloomy government office canopied by water-stained ceiling tiles and stuffed with battered Dell desktops. A mix of file folders, notes, mug shots and printouts form a loose topsoil on the desks, which jostle shoulder-to-shoulder for space on the scuffed and dented floor.
I've been invited here to witness the endgame of a police investigation that grew from 1,000 lines of computer code I wrote and executed some five months earlier. The automated script searched MySpace's 100 million-plus profiles for registered sex offenders -- and soon found one that was back on the prowl for seriously underage boys.
Andrew Lubrano's mug shot.
That's something that MySpace has said it cannot do. Rather, it is seeking new laws that would make it easier to ban sex offenders from the site through an e-mail registry.
MySpace busts are rare in this unit. About half the work done by the eight detectives here is aimed at online predators, but the networking site poses challenges that open chat rooms -- a dying social scene among today's youth -- never did. "It's a dangerous place for kids," says Frank Giardina, a good-natured, 49-year-old detective with salt-and-pepper hair and a matching mustache. "It's also difficult for law enforcement."
That's because much of what happens on MySpace unfolds outside public view. The computer crime unit has erected bait profiles registered to fake underage teens, but so far the tactic has netted only one arrest. Proactively scouring MySpace pages is futile: The smarter sexual predators stick to private messages, and diligently prune their public comment boards of any posts from young friends that hint at what's happening behind the scenes.
Rate this story on reddit.Today's investigatory target, 39-year-old Andrew Lubrano, has been less careful, and now he faces his fourth arrest for a sex crime. Lubrano was sentenced to three years probation in 1987 for sexual abuse against a 7-year-old boy, according to police. In 1988, he got another probation term for second-degree sex abuse. In 1995, he earned a three-to-nine-year prison term for sexually abusing two boys he'd been babysitting, one 11, the other 9.
The parole board turned Lubrano down three times, and he was cut loose in September 2004 largely unsupervised, having served every day of his nine-year max. By November 2005 he was on MySpace, making friends.
In the beginning, Lubrano seemed to use the site innocently. But in April, he began adding teenagers to his friends list. One of the first was Jacob (not his real name), a gay 14-year-old high school student in Virginia, who reports his age as 16 in his profile. Lubrano starts calling him "sex toy" and asking him about his living situation. Lubrano thanks another Virginia boy for adding him to his friends list by writing, "Thanks for the ass, I mean add."
Giardina has been posing as another 14-year-old boy in online chats with Lubrano, and he says he's received less-nuanced communiqués from the offender discussing having oral sex with the fake teen. He shows me part of a chat log, Lubrano asking, "u into hair? Like hary (sic) men? Where do you have hair at?"
Lately, Lubrano's been talking about meeting at a campsite or a movie theater. Today the detective thinks his target is ready to firm up a tentative commitment to meet at a local bowling alley. A signed search warrant is burning a hole in Giardina's pocket.
Serial sex offender Andrew Lubrano's MySpace profile, in June, showed 93 friends, including six teenagers he met through the site.
But so far, Lubrano hasn't turned up online. The detective keeps one eye on his monitor as he talks, willing the appearance of the pop-up box that will announce that the predator has logged onto AIM for another chat. "He sent me an e-mail Saturday night, but nothing today," he sighs.
My road to this New York police unit began in Perl.
In May, I began an automated search of MySpace's membership rolls for 385,932 registered sex offenders in 46 states, mined from the Department of Justice's National Sex Offender Registry website -- a gateway to the state-run Megan's Law websites around the country. I searched on first and last names, limiting results to a five-mile radius of the offender's registered ZIP code.
Wired News will publish the code under an open-source license later this week.
The code swept in a vast number of false or unverifiable matches. Working part time for several months, I sifted the data and manually compared photographs, ages and other data, until enhanced privacy features MySpace launched in June began frustrating the analysis.
Excluding a handful of obvious fakes, I confirmed 744 sex offenders with MySpace profiles, after an examination of about a third of the data. Of those, 497 are registered for sex crimes against children. In this group, six of them are listed as repeat offenders, though Lubrano's previous convictions were not in the registry, so this number may be low. At least 243 of the 497 have convictions in 2000 or later.
Five of the sex offenders are listed as "absconded" -- one of those still logs in regularly. Others are listed as "in custody," and last logged into MySpace shortly before their arrest. Some are fresh out of custody. One North Carolina user went to prison in 1999 for rape and "indecent liberties with a minor." When he got out this year, he was on MySpace within two months -- though so far his only friend is MySpace's Tom.
A 34-year-old former basketball coach uses MySpace to keep in touch with his one-time students; his sex offender registry entry says he had boys under 13 remove their clothes in front of him. A 33-year-old man who served 18 months for molesting a child under 13 in 1994 set his MySpace motto to "Love knows not age."
For every profile with warning signs, I found eight without. In many cases, the sex offender's MySpace profile is a window into a seemingly normal life: Their comment board is innocent; their image gallery contains a wedding photo or two; the underage friends on their list, if they have any, turn out to be relatives, or adults lying about their age to game MySpace's old security model -- in which only 14- and 15-year-olds enjoyed private profiles.
Lubrano stood out early in the results. His rap sheet was chilling, and by the time I found him, a half-a-dozen underage boys populated his friends list, many commenting on his message board. He lavishes particular attention on Jacob, the 14-year-old in Virginia, lamenting the distance from his home on Long Island to the house Jacob shares with his grandparents near Washington, D.C. -- about a six-hour drive. "Damn," he writes, "it's a shame you don't live close by boy the things we can do."
I sent Lubrano a message through his MySpace account, asking about his conduct, and reached out to seven teenagers with whom he'd been corresponding. When no one replied, I contacted the Suffolk County police, which has jurisdiction over Lubrano's home in Centereach, New York, and was responsible for busting him in 1995. The computer crime unit opened an investigation, and I agreed to hold this story until that investigation was complete.
In my first phone call with Giardina, he was amazed that Lubrano was so easy to find. "He registered on MySpace using his real name? What a nitwit."
Parry Aftab, an internet privacy lawyer, says she's not surprised. "A lot of the bad guys use their real name, as you've seen. It's amazing to me how many. Look at (former Rep. Mark) Foley, the idiot, happy to use his real name and communicate with people who know who he is."
Aftab is executive director of WiredSafety.org, an online safety nonprofit group that works closely with MySpace. She thinks the MySpace offender search results are a chance to drum home to kids that predators are out there -- a reality she says teenagers aren't easily accepting. The Wired News project also illustrates something MySpace could do to make its community safer, she says: hunting down and banning sex offenders from its site. "I don't think they thought about it. But I think that once we bring it to their attention they will. This is a threshold moment in internet safety."
My search left me less convinced that targeting past offenders would be an effective way for MySpace to find current or future predators. By its nature, a search like mine is only going to produce people who use their real names and addresses, and who are perhaps the least likely of the offenders to be up to no good.
But Aftab believes MySpace's crush of young people eager to make friends, posting racy photos and sharing a slice of their daily lives is too strong a temptation to child predators; they simply don't belong on MySpace. Whether it is one, or a thousand, you should kick them off. "You can't take an alcoholic to a bar. You can't take a drug addict to a place where people are smoking grass or doing heroin," she says.
Last week, I told MySpace about my search, and about Lubrano. The company's chief security officer, Hemanshu Nigam, responded that MySpace would like to ban sex offenders from the site, but is waiting for new laws that would make it easier to do so. He said the company is lobbying Congress for legislation that would require sex offenders to register their e-mail addresses with a central database. "By having such a database, MySpace and other sites would be able to access it in order to block these individuals from ever registering on the site," Nigam said in a written statement.
The subject came up in a hearing before a House subcommittee in June. Michael Angus, executive general counsel of Fox Interactive Media, which owns MySpace, talked up the benefits of an e-mail registry at that time, suggesting that name-matching against public registries, the very technique I was at the same time applying in the Wired News investigation of MySpace, simply wouldn't work. "The numerous registries aren't readily available to us, he said at one point. He also argued that predators could easily use false names.
That position drew a skeptical line of questioning from Rep. Greg Walden (R-Oregon).
"If you're checking for the amount of skin in an image and that sort of thing, and however your logarithms work, you'd think you ought to check, you know, 'John Doe,' who happens to be a sex offender, and weed them out," Walden said at the time. "I believe some of these guys are stupid enough to use their real name. And if you weed out one?"
By Oct. 2, my simple script had brought me to the brink of just such an arrest.
Three hours into the stakeout, watching DrewWho26 fail to appear on AIM is getting tiring. The detectives suspect they've been stood up. It goes like that sometimes, says Giardina -- a perp will get cold feet ahead of the first planned meeting, the second. By the third time, blind hope usually overpowers the cool, rational voice telling the suspect he's being set up, and the day ends with handcuffs.
But with Lubrano, the detectives already have a search warrant. Giardina goes to a phone in a side room and calls Lubrano's house -- Lubrano delivers newspapers for a living, and sometimes sleeps in the afternoon, so a wrong number call might wake him. Someone answers after two rings, and Giardina hangs up. The voice didn't sound like Lubrano's though.
Two of the detectives head out to drive past Lubrano's house and look for his car.
I wander into the small office space. They have a rogue's gallery set up in the corner, three poster boards with 36 mug shots of sex offenders the computer crime unit has busted this year. It's an odd bunch. Some appear young and angry, most are middle-aged, despairing, sunken pale faces. "Some of these are sorry, sorry sacks," says Giardina.
The detectives perk up when I tell them how I found Lubrano. John Friberg, a slender, steel-haired man who looks like CNN's Anderson Cooper, has a degree in computer science, and he asks probing questions about the ins and outs of screen-scraping MySpace and the DOJ. He's game to try it himself. "Right now we've got the whole big pool of MySpace to try and narrow it down to the sex offenders," he says.
At 2:15 p.m., a detective in the field calls in. "He just got home? Great," Giardina says into the phone. They'll keep watching the house, in case Lubrano leaves again, while back in the office DrewWho26's grayed-out name in the AIM window is eyed with new intensity.
"Send him an e-mail," suggests Friberg. "'Hey, I see you just got home.'" Everyone laughs.
At 2:25, Lubrano comes on. Giardina leans back, hands off the keyboard, waiting for Lubrano to come to him. Instead, the man's out of AIM almost instantly.
Six minutes later, the phone rings again. Lubrano has just left in his car, and the detectives on the scene want to know what to do: Should they pull him over?
No. They'll just tail Lubrano while a patrol car is radioed to make a traffic stop. The remaining cops at the office -- three of them -- pile into an unmarked car and head out, while I follow in my rental.
By the time we get there, Lubrano's in the back of an unmarked cop car and the detectives are doing paperwork and inventorying the contents of his SUV. The cruiser lit up Lubrano on a busy street about a mile from his home, and he pulled into the parking lot of a small law practice next door to a motorcycle shop.
Suffolk County police detectives take computers out of Lubrano's home in Long Island shortly after his Oct. 2 arrest.Two of Lubrano's five children were with him, and they're standing sullenly at the rear of the car. The eldest is 18, with a shock of bristly red hair; he's on his cell phone. The other is 14, and has Down's syndrome. He idly kicks at some fallen leaves, then wanders around to the side of the car, where one of the detectives is still crouched, searching the glove box.
His older brother grabs the boy's arm gently to stop him. Protecting him.
Friberg and another detective head over to Lubrano's home -- a pleasant, ranch-style house on a quiet, shady street. Down the block, kids are tossing a football in their front yard, while the police haul Lubrano's computers out the front door and put them in their hatchback.
Later, the detectives tell me that Lubrano claimed in the car that he didn't go any further with his online friends than some dirty talk. If true, that's good news for the kids, and for Lubrano. Under a July state appellate court decision, merely soliciting a minor for sex online in New York is no longer a felony, unless the perpetrator sends explicit photos as part of the enticement.
Lubrano's is one of the first cases under the new decision, and the next day, the police and the county district attorney hold a press conference to announce that they'd caught a repeat sex offender, and could only charge him with attempting to endanger the welfare of a child, a misdemeanor.
Giardina is optimistic that the local media attention over the light charge will spur a change in the law. Lubrano is being held on bail of $25,000 cash or a $50,000 property bond. He could simply stay in jail and serve out the maximum sentence of 90 days.
In the final analysis, I still believe MySpace is good for kids. Jacob, the boy Lubrano most flagrantly courted, provides a clear example of the site's benefits, as well as its flaws. When the teen recently got in trouble with homophobic bullies at his high school, he came home to MySpace, and quickly garnered an outpouring of sympathy and advice from his friends. Any reaction to the incidents of MySpace predation that would rob Jacob and other children of the promise of such self-expression and support is suspect.
But it's clear that MySpace could do more. It should more diligently employ its technical resources to look for the signs of predation, perhaps automatically scanning the contents of private and public messages between adults and children for sexual content, backed up by a manual inspection. It's difficult to imagine any scenario in which a 39-year-old man should be calling a teenager "sex toy."
It's all up to MySpace. We can't count on parental supervision; how many teenagers looking for a space to hang out in with friends will accept one occupied by parents? We can't count on peer policing; nobody reported Lubrano for his inappropriate comments.
We definitely can't count on teenage street smarts. Swagger isn't judgment. Young Jacob is a smart guy, but even after he politely rebuked Lubrano for hitting on him, he made plans to meet the man at a Pennsylvania amusement park.
Lubrano didn't initiate the planned meeting; he'd already announced he would be there with his family when Jacob's school scheduled a field trip to the destination. Their plans fell through when Jacob's trip was canceled.
"Thank Gosh I didn't go," says Jacob.
I'm chatting with Jacob in AIM the day after Lubrano's arrest. I found his screen name in a friend's comment board, and caught him online after school. He calls Lubrano a "friend," but quickly renounces him when he learns that his friend is a child molester. He says he's shocked by the news; but then incongruously explains that he just thought Lubrano was a 39-year-old man who likes young boys.
"I do think its kinda weird for that age to flirt with me and stuff," he writes. "Like, kinda desperate and kinda leading me to think that something's wrong. But I didn't really do anything. I love being complimented. So, I thought it was nice of him to say that he thought I was cute or whatever."
MySpace is a big part of Jacob's life, and his greatest fear is that this story, or the ongoing police investigation, will get him banned from the internet, or he'll lose his MySpace profile. I urge him to be more careful about adding friends -- he has 3,800 of them -- and to make his profile private. He says he will, but so far his MySpace page remains wide open.
http://www.wired.com/science/discoveries/news/2006/10/71948?currentPage=all
