A new report from Bloomberg Businessweek covers the investigation and arrest of a pedophile who used the Roblox gaming platform to groom his victim, before abducting and sexually assaulting her multiple times. The man assumed various identities on Roblox but was best-known as the creator of a profitable Sonic the Hedgehog fan game on the platform, a position that gave him considerable clout within the Roblox community, and one which he used to prey upon its young users.

DoctorRofatnik created Sonic Eclipse Online, a game where Roblox users could race as Sonic and friends, and it proved unsurprisingly popular with the young audience. As is typical of the platform’s experiences, users could buy costumes and trinkets with Robux, and DoctorRofatnik claimed to be one of the best-paid creators on the platform. He further claimed to be Jadon Shedletsky, the younger brother of Roblox’s longtime creative director John Shedletsky.

Many users were attracted by DoctorRofatnik’s story, popularity and position on the platform: even his overtly sexual sense of humor. Others smelled danger, and perhaps the most shocking element of this story is that Roblox users seemed more alert to the danger posed by this individual, and did more to expose his behaviour and even identify him, than Roblox and the conventional authorities.

In late 2020 screenshots were posted to Twitter showing a private chat DoctorRofatnik had with a 12 year-old, in which he wrote: “soon I’ll corrupt you beyond your wildest dreams. Words cannot explain what I want to do with you. You’re the reason why I’m gonna end up behind bars.”

One of the figures involved in exposing DoctorRofatnik is Ben Simon, a controversial Roblox YouTuber who goes by the handle Ruben Sim. He was sent the above screenshots of the chat exchange and, as well as posting them to Twitter, made a video exposing the behaviour that he also sent to Roblox’s developer relations team. Other users reported the account, as did the mother of the girl DoctorRofatnik had messaged.

Roblox banned the DoctorRofatnik account, and reported it to the National Center for Missing & Exploited Children. He nevertheless remained active on other accounts, and boasted the controversy had boosted sales in Sonic Eclipse (which remained available). Simon thought the Roblox response was weaksauce: “Roblox spends so much time, effort and money convincing parents that their platform is safer than it actually is.”

Further tips would lead Simon to DoctorRofatnik’s real identity: Arnold Castillo of Paterson, New Jersey. He called the Tucson police, who said there wasn’t enough evidence for a criminal investigation.

Roblox says Simon is not a “credible source of information about our strong safety record.”

Another user adopted a new tactic: telling Sega that Sonic was being used by a pedophile on Roblox. The 22 year-old Japanese player wrote to Sega executives and tweeted at the company in public, and soon afterwards Sega filed a copyright infringement notice with Roblox. Sonic Eclipse disappeared in late 2021.

Then, in May 2022 a missing-person report was filed for a 15-year-old girl from Indiana. She’d taken personal possessions and left the state despite lacking the financial means to do so. The detective assigned to the case soon found out from her sister that the girl had been talking to a man she’d met on Roblox going by the name Jacob Shedletsky. Shedletsky had bought one of the girl’s drawings, then began sending her gifts and food deliveries.

It took eight days for the authorities to track the girl to Paterson, New Jersey, where they soon found her with Arnold Castillo. Interviewed after his arrest he admitted to using the identities Jacob Shedletsky, Jadon Shedletsky and DoctorRofatnik, and paying a driver $1,000 to bring the girl from Indiana. He admitted to having sex multiple times with the girl over the eight days since her disappearance.

As the FBI investigated how this happened, it was surprised to discover that Roblox users had already exposed Castillo 18 months prior. “Seeing what those children did, as far as compiling all this and their ability to identify Mr. Castillo,” says FBI special agent Len Rothermich, “well, they might want to submit some applications to the FBI one day.”

In August 2023, Castillo pleaded guilty to transporting a minor across state lines to engage in sex. The court heard that Castillo was a shut-in with “zero social confidence” who shared a bed with his mother, but was talented with computers and worked out he could “make good money” designing Roblox games.

Federal prosecutor Tiffany Preston outlined what she called “every parent’s worst nightmare”, the eight days in which Castillo’s victim was held in a room he’d rented next to his apartment, and repeatedly sexually assaulted. In a victim statement, the girl’s sister said she now suffers from depression, anxiety, finds it hard to even leave her room, and refuses to attend school. “These scars will remain with her forever,” she said.

The judge sentenced Castillo to 15 years. The scandal prompted a policy overhaul at Roblox, as well as the creation of many new roles in child safety alongside a child exploitation moderation team.

Part of the problem is the scale of policing a platform that has 12 million games and 78 million daily users. Roblox makes a big deal of how it prioritises safety, but one moderator said her team receives “hundreds” of child safety reports daily and simply can’t work through them fast enough. Eight current and former trust and safety workers are spoken to in the report, and emphasise inadequate staffing, failure to implement features they recommended (like pop-up safety notices), and the inability of AI moderation systems to discern signs of grooming.

A Roblox spokesperson disputed these claims, pointing to a “robust pipeline” of new safety features. “Implying that a lack of immediate integration of specific ideas, tools or features is a reflection of not caring or lack of prioritization is simply wrong,” said the spokesperson.

The real worry for any parent is how many more Castillos are out there. Bloomberg offers data showing that, since 2018, “police in the US have arrested at least two dozen people accused of abducting or abusing victims they’d met or groomed using Roblox.” These included “a sheriff’s deputy, a third-grade teacher and a nurse.” Specifics include “a man in Florida accused of trying to kidnap a teen he played with on Roblox; a man charged with abducting an 11-year-old New Jersey girl he met on the platform; and a California man who allegedly abused a kid he, too, had met on Roblox.”

Roblox said in a statement that the Bloomberg report is awash with “glaring mischaracterisations about how [it] protects users of all ages” and “fails to reflect both the complexities of online child safety and the realities of the overwhelmingly positive experiences that tens of millions of people of all ages have on Roblox every day.” Do judge for yourself.