But the real trick was the “friend graph remnant.” When two people had once been friends, and one deleted their account, Facebook scrubbed the data—but not the timestamp of the friendship . By cross-referencing timestamps with public events, you could deduce where someone was on a given night.
Mira’s hands went cold. She didn’t need to see his private posts. The residue of his public digital life—the photos he was tagged in, the places he checked into, the friends who mentioned him—had painted a map of his stalking. view facebook profiles without account
She saw his profile picture history: a beach in Thailand last month. A bar in Chicago last week. Then, a gas station two blocks from Lena’s new apartment, timestamped three days ago. The JSON showed he had been tagged in a comment by a stranger: “Great seeing you at the 24-hour diner on 5th!” That diner was across the street from Lena’s workplace. But the real trick was the “friend graph remnant
Mira hesitated. The obvious tools—fake accounts, friend requests from strangers—were clumsy and left digital fingerprints. But she remembered something buried deep in Echo’s archives: a forgotten Facebook API endpoint from 2015, before Graph API v2.0 locked everything down. Back when the internet believed in openness. She didn’t need to see his private posts
Mira faced a choice. She could patch the flaw—but that would require telling Facebook about their own forgotten skeleton key. Or she could release the tool to the public, democratizing surveillance.
The story of The Glass Key spread through domestic violence shelters, investigative journalists, and paranoid exiles from social media. But it also spread to people with darker intentions. Within a month, someone used it to track a witness in a criminal trial.