How One Hacker Exposed Sex Offenders on MySpace with 1,000 Lines of JavaScript

02.09.2026

MySpace used to tell us it was impossible to monitor its own platform for predators. The excuse was simple. They couldn’t do it. Wired News editor and former hacker Kevin Poulsen didn’t believe that. He treated the claim as a personal challenge.

It took him five months.

Not to break in, but to build a tool. A script designed to find registered sex offenders who were either incredibly dumb or annoyingly honest. These people signed up using their real names. Poulsen’s program located them.

Зміст

The Email Registration Loophole

MySpace was waiting. They were hoping new laws would force registered sex offenders to provide valid email addresses during registration. The logic seemed flawed to anyone who actually uses the internet. Most people have multiple emails. Four is standard for me. Some folks have ten.

Blaming MySpace for assuming no predator would use their real name is easy. But Poulsen shot that assumption down. He proved it wrong.

His code was not complex in structure, but it was thorough. It consisted of 1,000 lines of Javascript. The script compared MySpace profile names and reported zip codes against the U.S. Department of Justice’s online sex-offender database. It targeted 46 U.S. states. The code ran directly on MySpace’s database servers.

The results were disturbing.

The Numbers Don’t Lie

Out of one million profiles scanned, Poulsen found over 700 registered sex offenders. Nearly 500 of those had committed crimes against children.

And that was only a fraction of the data.

At the time of his report, he had analyzed only one-third of the generated data. The final count would have been higher. The sheer volume of data suggests a significant number of offenders were using the platform openly.

False Positives and Real Threats

Poulsen admits the system wasn’t perfect. It generated false positives. He had to manually cross-reference MySpace profiles with mug shots and ages in the DOJ database. Filtering out the matches took effort. It wasn’t a magic button. It was good data hygiene.

But the true positives were alarming.

One offender was actively compiling lists of young friends. He sent sexually explicit, private messages to underage boys. Police arrested him. They charged him with attempted child endangerment. He never made physical contact. That is a legal technicality. The behavior was predatory.

Other profiles contained similar alarming communications. But here is the nuance most reports missed. For every offender who seemed to be acting on their urges, eight others were just living their lives. They posted funny photos. They talked about weddings. They mentioned job promotions. They blogged about hobbies.

This is what pretty much every MySpace member was doing. The platform was not a den of iniquity. It was a social network. But it was a social network with a few very dangerous users hiding in plain sight.

Open Source Justice

Congress was slow to act. Waiting for legislation to require a single email address for sex offenders was a losing strategy. The law would be absurdly easy to bypass. Who has only one email today? Can Congress enforce a single-address rule? Unlikely.

Poulsen’s code offered a better solution. Immediate, technical, and bypassable only by using a fake name.

He planned to release the code in open-source format. Police departments would have full access. No waiting for committees. No lobbying. Just tools.

MySpace said nothing.