Read the news of recent computer security guffaws, and it’s striking how many problems stem from online advertising. Advertising is the bedrock of web sites that are provided without charge to end users, so advertising is everywhere. But advertising security gaps are equally widespread: from “malvertisement” banner ads pushing rogue anti-spyware software, to click fraud, to spyware and adware, the security lapses of online advertising are striking.
During the past five years, I have uncovered hundreds of online advertising scams defrauding thousands of users–not to mention all the web’s top merchants. This chapter summarizes some of what I’ve found–and what users and advertisers can do to protect themselves.
At first glance, online advertising seems to be as measurable a medium as any ever invented. Advertisers can count how many times an ad was sent, then measure sales–yielding an analysis that seems to report the value of an online ad campaign. But the reality is considerably more complicated.
Yahoo’s Right Media ad marketplace features widespread ads exactly designed to deceive. I present ten examples of these deceptive ads, and I critique their unwelcome characteristics. To estimate the prevalence of deceptive tactics, I examine Right Media’s own analysis ad characteristics — finding that by Right Media’s own admission, deceptive ads total 35% or more of Right Media’s advertising inventory.
A variety of services offer consumers discounts when dining at participating restaurants. This case examines four such services: Entertainment Book, Restaurant.com, Rewards Network, and Groupon. Despite key functional similarities, each of the services chooses an importantly different approach–different pricing, different benefits to consumers, different benefits to restaurants, and different underlying technologies.
Right media considers systems and policies to make sure that ads are only shown on web sites where they are appropriate, and vice versa. Setting standards is particularly challenging given the large and growing marketplace, the numerous participants, their diverse requirements, and the dynamics of policy enforcement when market participants are competing intensely.
Teaching materials:
Ad Classification at Right Media – Teaching Note (HBP 909037)
Ad Classification at Right media – Slide Supplement (HBP 911038)
Ad Classification at Right media – Slide Supplement (widescreen) (HBP 914054)
Ad Classification at Right media – Pre-Class Slides (HBP 911037)
In a new article, I introduce an alternative method of fraud prevention for certain online advertising systems. By delaying payments, a merchant or network differentially harms bad affiliates (who rightly worry they may get caught) without unduly harming good affiliates (who know they’ll get paid, and who receive a bonus in compensation for the delay). With a suitable delay, a merchant or network can deter many bad affiliates while retaining the good.
I present and critique pay-per-click ads that don’t deliver what they promise. I consider implications for search engine revenues, and I analyze legal and ethical duties of advertisers and search engines. I offer a system for others to report similar ads that they find.
Read Google’s voluminous Adwords Content Policy,
and you’d think Google is awfully tough on bad ads. If your company
sells illegal drugs, makes fake documents, or helps customers cheat drug
tests, you can’t advertise at Google. Google also prohibits ads for
fireworks, gambling, miracle cures, prostitution, radar detectors, and
weapons. What kind of scam could get through rules like these?
As it turns out, lots of pay-per-click advertisers push and exceed
the limits of ethical and legal advertising — like selling products
that are actually free, or promising their services are “completely
free” when they actually carry substantial recurring charges.
One scam Google doesn’t prohibit — and as best I can tell, does nothing to stop — is charging for software that’s actually free. Search for “Skype” and you’ll find half a dozen advertisers offering to sell eBay’s free telephone software. Search for “Kazaa” or “Grokster” and those products are sold too. Even Firefox has beentargeted.
Each and every one of these ads includes the claim that the specified
product is “free.” (These claims are expressed in ad titles, bodies,
and/or display URLs). However, to the best of my knowledge, that claim
is false, as applied to each and every ad shown above: The specified
products are available from the specified sites only if the user pays a subscription fee.
These ads are particularly galling because, in each example, the specified program is available for free elsewhere on the web,
e.g. directly from its developer’s web site. Since these products are
free elsewhere, yet cost money at these sites (despite promises to the
contrary), these sites offer users a particularly poor value.
Often these sites claim to offer tech support, but that’s also a ruse: Tests confirm there’s no real support.
Although sophisticated users will realize that these sites are bad
deals, novice or hurried users may not. These sites bid for top search
engine placement — often appearing above search engines’
organic (main) results. Some proportion of users see these prominent
ads, click through, and get tricked into paying for these otherwise-free
programs. Claiming a refund takes longer than it’s worth to most
users. So as a practical matter, a site need only trick each user for an
instant in order to receive its fee.
The “completely free” ringtones that aren’t
Ringtone ads often claim to be “free,” “totally free,” “all free,”
“100% complimentary,” and available with “no credit card” and “no
obligation” required. These claims typically appear in pay-per-click ad
bodies, but they also often appear in ad titles and even in ad domain
names, of course along with landing pages.
Often, these claims are simply false: An ad does not offer a “totally
free” product if it touts a limited free trial followed by an
auto-renewing paid service (a negative option plan).
Other claims are materially misleading. For example, claiming “no credit card required ” suggests that no charges will accrue. But that too is false, since ringtone sites generally charge users through cell phone billing systems, unbeknown to many users who believe a service has no way to impose a charge if a user provides no credit card number.
Each and every one of these ads includes the claim that the specified
product is “free” (or some other claim substantially similar, e.g.
“complimentary”). In most cases, subsequent language attempts to disavow
these “free” claims. But in each case, to the best of my knowledge,
service is available only if a user enters into a paid relationship
(e.g. a paid subscription) — the very opposite of “free.” (Indeed, the
subscription requirement applies even to unlimitedringtones.com, despite
that ad’s claim that “no subscription [is] required.” The site’s fine
print later asserts that by requesting a ringtone registration, a user
“acknowledge[s] that [he is] subscribing to our service billed at $9.99
per month” — specifically contrary to site’s earlier “no subscription”
promise.)
Vendors would likely defend their sites by claiming that (in general) their introductory offers are
free, and by arguing that their fine print adequately discloses users’
subsequent obligations. This is interesting reasoning, but it’s
ultimately unconvincing, thanks to clear regulatory duties to the
contrary.
The FTC’s Guide Concerning the Use of the Word ‘Free’ is exactly on point. The guide instructs advertisers to use the word “free” (and all words similar in meaning) with “extreme care” “to avoid any possibility that consumers will be misled or deceived.” The guide sets out specific rules as to how and when the word “free” may be used, and it culminates with an incredible provision prohibiting fine print to disclaim what “free” promises. In particular, the rule’s section (c) instructs (emphasis added):
All the terms, conditions and obligations upon which receipt and retention of the ‘Free’ item are contingent should be set forth clearly and conspicuously at the outset of the offer … in close conjunction with the offer of ‘Free’ merchandise or service.
In case that instruction left any doubt, the FTC’s rule continues:
For example, disclosure of the terms of the offer set forth in a footnote of an advertisement to which reference is made by an asterisk or other symbol placed next to the offer, is not regarded as making disclosure at the outset.
Advertisers may not like this rule, but it’s remarkably clear. Under
the FTC’s policy, ads simply cannot use a footnote or disclaimer to
escape a “free” promise made earlier. Nor can an advertiser promise a
“free” offer at an early stage (e.g. a search engine ad), only to impose
additional conditions later (such as in a landing page, confirmation
page, or other addendum). The initial confusion or deception is too
strong to be cured by the subsequent revision.
Advertisers might claim that the prohibited “free” ads at issue come
from their affiliates or other partners — that they’re not the
advertisers’ fault. But the FTC’s Guide specifically speaks to the
special duty of supervising business partners’ promotion of “free”
offers. In particular, section (d) requires:
[I]f the supplier knows, or should know, that a ‘Free” offer he is promoting is not being passed on by a reseller, or otherwise is being used by a reseller as an instrumentality for deception, it is improper for the supplier to continue to offer the product as promoted to such reseller. He should take appropriate steps to bring an end to the deception, including the withdrawal of the ‘Free’ offer.
It therefore appears that the ads shown above systematically violate
the FTC’s “free” rules. Such ads fail to disclose the applicable
conditions at the outset of the offer, as FTC rules require. And even
where intermediaries have placed such ads, their involvement offers
advertisers no valid defense.
Ads impersonating famous and well-known sites
Some pay-per-click ads affirmatively mislead users about who is advertising and what products are available. Consider the ads below, for site claiming to be (or to offer) Spybot. (Note text in their respective display URLs, shown in green type.) Despite the “Spybot” promise, these sites actually primarily offer other software, not Spybot. (Spybot-home.com includes one small link to Spybot, at the far bottom of its landing page. I could not find any link to the true Spybot site from within www-spybot.net.)
In addition, search engine ads often include listings for sites with names confusingly similar to the sites and products users request. For example, a user searching for “Spybot” often receives ads for SpyWareBot and SpyBoot — entirely different companies with entirely different products. US courts tend to hold that competitive trademark targeting — one company bidding on another company’s marks — is legal, in general. (French courts tend to disagree.) But to date, these cases have never considered the heightened confusion likely when a site goes beyond trademark-targeting and also copies or imitates another company’s name. Representative examples follow. Notice that each ad purports to offer (and is triggered by searches for the name of) a well-known product — but in fact these ads take users to competing vendors.
Google’s responsibility – law, ethics, and incentives
Google would likely blame its advertisers for these dubious ads. But Google’s other advertising policies
demonstrate that Google has both the right and the ability to limit the
ads shown on its site. Google certainly profits from the ads it is paid
to show. Profits plus the right and ability to control yield exactly
the requirements for vicarious liability in other areas of the law (e.g.
copyright infringement). The FTC’s special “free” rules indicate little
tolerance for finger-pointing — even specifically adding liability
when “resellers” advertise a product improperly. These general rules
provide an initial basis to seek greater efforts from Google.
Crucially, the Lanham Actspecifically contemplates injunctive relief against a publisher for distributing false advertising. 15 USC § 1125(a)(1) prohibits false or misleading descriptions of material product characteristics. § 1114 (2)
offers injunctive relief (albeit without money damages) where a
publisher establishes it is an “innocent infringer.” If facing claims on
such a theory, Google would surely attempt to invoke the “innocent
infringer” doctrine — but that attempt might well fail, given the scope
of the problem, given Google’s failure to stop even flagrant and
longstanding violations, and given Google’s failure even to block
improper ads specifically brought to its attention.
(See e.g. World Wrestling Federation v. Posters, Inc., 2000 WL 1409831,
holding that a publisher is not an innocent infringer if it “recklessly
disregard[s] a high probability” of infringing others’ marks.)
Nonetheless, the Communications Decency Act’s 47 USC § 230(c)(1)
potentially offers Google a remarkable protection: CDA § 230 instructs
that Google, as a provider of an interactive computer service, may not
be treated as the publisher of content others provide through that
service. Even if a printed publication would face liability for printing the same ads Google shows, CDA § 230 may let Google distribute such ads online with
impunity. From my perspective, that would be an improper result — bad
policy in CDA § 230’s overbroad grant of immunity. A 2000 DOJ study seems to share my view, specifically concluding
that “substantive regulation … should, as a rule, apply in the same
way to conduct in the cyberworld as it does to conduct in the physical
world.” But in CDA § 230, Congress seems to have chosen a different
approach.
That said, CDA § 230’s reach is limited by its exception for
intellectual property laws. § 230(e)(2) provides that intellectual
property laws are not affected by § 230(c)(1)’s protection.
False advertising prohibitions are codified within the Lanham Act (an
intellectual property statute), offering a potential argument that CDA §
230 does not block false advertising claims. This argument is worth
pursuing, and it might well prevail. But § 230 cases indicate
repeated successes for defendants attempting to escape liability on a
variety of fact patterns and legal theories. On balance, I cannot
confidently predict the result of litigation attempting to hold Google
responsible for the ads it shows. As a practical matter, it’s unclear
whether or when this question will be answered in court. Certainly no
one has attempted such a suit to date.
Notwithstanding Google’s possible legal defenses, I think Google ought to do more to make ads safe as a matter of ethics.
Google created this mess — by making it so easy for all companies,
even scammers, to buy Internet advertising. So Google faces a special
duty to help clean up the resulting problems. Google already takes
steps to avoid sending users to web sites with security exploits, and
Google already refuses ads in various substantive categories
deemed off-limits. These scams are equally noxious — directly taking
users’ money under false pretenses. And Google’s relationship with these
sites is particularly unsavory since Google directly and substantially
profits from their practices, as detailed in the next section.
Even self-interest ought to push Google to do more here. Google may
make an easy profit now by selling ads to scammers. But in the long run,
rip-off ads discourage users from clicking on Google’s sponsored links
— potentially undermining Google’s primary revenue source.
Who really profits from rip-off ads?
When users suffer from scams like those described above, users’ money goes to scammers, in the first instance. But each scammer must pay Google whenever a user clicks its ad. So Google profits from scammers’ activities. If the scammers ceased operations — voluntarily, or because Google cut off their traffic — Google’s short-run revenues would decrease.
Users
service fees Scammers advertising fees Google
How Google Profits from Scammers
Consider the business model of rogue web sites “selling” software
like Skype. They have one source of revenue — users buying these
programs. Their expenses tend to be low: they provide no substantial customer service, and often they link to downloads hosted elsewhere
to avoid even incurring bandwidth costs. It seems the main expense of
such sites is advertising — with pay-per-click ads from Google by all
indications a primary component. The diagram at right shows the basic
money trail: From users to scam advertisers to Google. When users are
ripped off by scammers, at least some of the payment flows through to
Google.
How much of users’ payments goes to Google, rather than being retained by scammers? My academic economics research
offers some insight. Recall that search engine ads are sold through a
complicated multi-unit second-price auction: Each advertiser’s payment
is determined by the bid of the price of the advertiser below him. Many
equilibria are possible, but my recent paper with Michael Ostrovsky and
Michael Schwarz offers
one outcome we think is reasonable — an explicit formula for each
advertiser’s equilibrium bid as a function of its value (per click) and
of others’ bids. In subsequent simulations (article forthcoming),
Schwarz and I will demonstrate the useful properties of this bidding
rule — that it dominates most other strategies under very general
conditions. So there’s good reason to think markets might actually end
up in this equilibrium, or one close to it. If so, we need only know
advertisers’ valuations (which we can simulate from an appropriate
distribution) to compute market outcomes (like advertiser profits and
search engine revenues).
One clear result of my recent bidding simulations: When advertisers
have similar valuations (as these advertisers do), they tend to “bid
away” their surpluses. That is, they bid almost as much as a click is
worth to them — so they earn low profits, while search engines reap
high revenues. When a user pays such an advertiser, it wouldn’t be
surprising if the majority of that advertiser’s gross profit flowed
through to Google.
A specific example helps clarify my result. Consider a user who pays
$38 to Freedownloadhq.com for a “free” copy of Skype. But Freedownloadhq
also received, say, 37 other clicks from 37 other users who left the
site without making a purchase. Freedownloadhq therefore computes its
valuation per click (its expected gross profit per incoming visitor) to
be $1. The other 10 advertisers for “Skype” use a similar business
model, yielding similar valuations. They bid against each other,
rationally comparing the benefits off high traffic volume (if they bid
high to get top placement at Google) against the resulting higher costs
(hence lower profits). In equilibrium, simulations report, with 10
bidders and 20% standard deviation in valuations (relative to valuation
levels), Google will get 71% of advertisers’ expected gross profit. So
of the user’s $38, fully $27 flows to Google. Even if Freedownloadhq’s
business includes some marginal costs (e.g. credit card processing
fees), Google will still get the same proportion of gross profit.
One need not believe my simulation results, and all the economic
reasoning behind them, in order to credit the underlying result: That
when an auctioneer sells to bidders with similar valuations, the bidders
tend to bid close together — giving the auctioneer high revenues, but
leaving bidders with low profits. And the implications are striking: For
every user who pays Freedownloadhq, much of the user’s money actually
goes to Google.
In January I estimated
that Google and Yahoo make $2 million per year on ads for
“screensavers” that ultimately give users spyware. Add in all the other
terms with dubious ads — all the ringtone ads, the for-free software
downloads, ads making false statements of product origin, and various
other scams — and I wouldn’t be surprised if the payments at issue
total one to two orders of magnitude higher.
Towards a solution
Some of these practices have been improving. For example, six months
ago almost all “ringtones” ads claimed to be “free,” but today some
ringtones ads omit such claims (even while other ads still include these
false statements).
Recent changes in Google pricing rules seem to discourage some of the
advertisers who place ads of the sort set out above. Google has increased its pricing
to certain advertisers, based on Google’s assessment of their “low
quality user experience.” But the specific details of Google’s rules
remain unknown. And plenty of scam ads — including all those set out
above — have remained on Google’s site well after the most recent round
of rule changes. (All ads shown above were received on September 15,
2006, or later.)
Google already has systems in place to enforce its Adwords Content Policy.
My core suggestion for Google: Expand that policy to prevent these
scams — for example, explicitly prohibiting ads that claim a product
is “free” when it isn’t, and explicitly prohibiting charging users for
software that’s actually free. Then monitor ads for words like “free”
and “complimentary” that are particularly likely to be associated with
violations. When a bad ad is found, disable it, and investigate other
ads from that advertiser.
To track and present more dubious ads, I have developed a system
whereby interested users can submit ads they consider misleading for the
general reasons set out above. Submit an ad or view others’ submissions.
These problems generally affect other search engines too — Yahoo,
MSN, and Ask.com, among others. But as the largest search engine, and as
a self-proclaimed leader on ethics issues, I look to Google first and
foremost for leadership and improvement.
Google’s (Non-)Response
When Information Week requested a comment from Google as to the ads I reported, Google responded as follows:
When we become aware of deceptive ads, we take them down. … We will review the ads referenced in this report, and remove them if they do not adhere to our guidelines.
A week later, these ads remain available. So Google must have
concluded that these ads are not deceptive (or else Google would have
“take[n] them down” as its first sentence promised). And Google must
have concluded that these ads do adhere to applicable Google policies,
or else Google would have “remove[d] them” (per its second sentence).
Google’s inaction exactly confirms my allegation: That Google’s ad
policies are inadequate to protect users from outright scams, even when
these scams are specifically brought to Google’s attention.
All identifications and characterizations have been made to the best
of my ability. Any errors or alleged errors may be brought to my
attention by email.
I thank Rebecca Tushnet for helpful discussions on the legal duties of advertisers and search engines.
Originally posted October 9, 2006. Last Updated: October 16, 2006.
Read Google’s voluminous Adwords Content Policy, and you’d think Google is awfully tough on bad ads. If your company sells illegal drugs, makes fake documents, or helps customers cheat drug tests, you can’t advertise at Google. Google also prohibits ads for fireworks, gambling, miracle cures, prostitution, radar detectors, and weapons. What kind of scam could get through rules like these?
As it turns out, lots of pay-per-click advertisers push and exceed the limits of ethical and legal advertising — like selling products that are actually free, or promising their services are “completely free” when they actually carry substantial recurring charges. For example, the ad at right claims to offer “100% complimentary” and “free” ringtones, when actually the site promotes a services that costs approximately $120 per year.
An example misleading ad, falsely claiming ringtones are “complimentary” when they actualy carry a monthly fee.
In today’s article, I show more than 30 different advertisers’ ads, all bearing claims that seem to violate applicable FTC rules (e.g. on use of the word “free”), or that make claims that are simply false. I then analyze the legal and ethical principles that might require search engines to remove these ads. Finally, I offer a mechanism for interested users to submit other false or deceptive ads they find.
I’ve always been puzzled by the divergent attitudes of anti-spyware programs towards advertising cookies. Some anti-spyware programs take their criticism to the extreme, with terms like “spy cookies” and serious overstatements of the alleged harm from cookies. Others ignore cookies altogether. In between are some interesting alternatives — like ignoring cookies by default (but with optional detection), giving users an easy way to hide cookie detections, and flagging cookies as “low risk” detections.
I understand why some users are concerned about cookies. It’s odd and, at first, surprising that “just” visiting a web site can deposit files on a user’s hard disk. Cookies are often hard or impossible to read by hand, and ad networks’ cookies offer user no direct benefit.
Unrequested arrival, no benefit to users — sounds a lot like spyware? So say some, including the distinguished Walt Mossberg. But that’s actually not my view. Unlike the spyware I focus on, cookies don’t interrupt users with extra ads, don’t slow users’ PCs, can’t crash, and require only trivial bandwidth, memory, and CPU time.
Cookies do have some privacy consequences — especially when they integrate users’ behavior on multiple sites. But such tracking only occurs to the extent that the respective sites allow it — an important check on the scope of such practices. That’s not to say shared cookies can’t be objectionable, but to my eye these concerns are small compared with more pressing threats to online privacy (like search engine data retention). Plus, ad networks usually address privacy worries through privacy policies limiting how users’ data may be used.
All in all, I don’t think cookies raise many serious concern for typical users. Still, I know and respect others who hold contrary views. It seems reasonable people can disagree on this issue, especially on the harder cases posed by certain shared cookies.
Earlier this summer, Vinny Lingham and Clicks2Customers asked me to test the current state of cookie detections by major anti-spyware programs. They had noticed that for those anti-spyware programs that detect cookies, not all cookies are equally affected. Which cookies are most affected? By which anti-spyware programs? I ran tests to see — forming a suite of cookies, then scanning them with the leading anti-spyware programs.
Vinny is generously letting me share my results with others who are interested. The details:
I ought to be a Vonage enthusiast. I support Vonage’s efforts to protect network neutrality. I applaud their flexible voice over IP service and their efforts to compete with incumbent phone companies. I’m even a VoIP customer (albeit using a competitor’s service).
But instead of praising Vonage, I have to criticize them — not for their core business, nor for their customer service (whichothershaverepeatedlycriticized), but for their reckless advertising practices. Vonage spends huge amounts on advertising — more than $20 million per month. (source) Unfortunately, among this spending is widespread and substantial spyware-delivered advertising.
For years, my manual and automated testing have documented Vonage ads appearing in all the major spyware programs. Now that Vonage has completed its IPO — itself promoted as a way to raise more money to buy more advertising — this page presents twelve recent examples of Vonage ads appearing in spyware.
I have repeatedly observed Vonage buying “ordinary” spyware pop-up ads from vendors like 180solutions, Direct Revenue, and eXact Advertising. See e.g. the top thumbnail at right, a March 2006 screenshot of a Vonage ad appearing through Direct Revenue. See also my March 2005 report of Vonage ads appearing through eXact Advertising. These relationships add up to big money: BusinessWeek last week reported that Vonage paid Direct Revenue $31,570 in a single month of 2005 — a remarkable $110 for each customer Direct Revenue sent to Vonage. Meanwhile, in its litigation against Intermix, the New York Attorney General specifically documented Vonage’s ads appearing in Intermix KeenValue pop-ups.
Beyond notorious spyware such as Direct Revenue and Intermix, Vonage ads also appear through less well-known spyware, including through programs that continue to be installed onto users’ computers through security exploits (without user consent). The second thumbnail at right shows a Vonage ad shown by Targetsaver (a California maker of software that becomes installed without consent, tracks users’ behavior, and shows targeted pop-up ads). Targetsaver sends traffic to Vonage in the way set out in the diagram at right: Targetsaver sends users to Traffic Marketplace which forwards users to Vonage (via aQuantive / Atlas, which serves to track most Vonage advertising purchases).
Despite the word “target” in its name, Targetsaver isn’t particularly picky about where it shows Vonage’s ads. The screenshot at right reflects a Vonage ad shown while a user tries to sign up for AOL — perhaps reasonable targeting, in that both companies provide telecommunication services. But Targetsaver also shows Vonage’s ads in unseemly locations, such as when users browse sexually-explicit sites. Screenshot.
As users revolt against pop-up ads, a growing trend is to inject ads into others’ sites. Users who receive injected ads may not notice they’re infected with spyware; the telltale signs are, perhaps, less obvious than extra pop-ups. And by hooking into Internet Explorer’s API, injection isn’t particularly difficult.
Of course ad injection raises serious legal concerns. A spyware vendor probably infringes a site’s copyright by inserting an ad right into that site — all the more so when such insertion occurs without a user’s consent and when such insertion lacks any labeling or disclaimer. But consider the vendors who use these methods: they already face substantial legal liability, e.g. from their nonconsensual installations of spyware onto users’ computers. Such vendors are unlikely to be deterred by possible copyright liability.
Despite the problems with spyware-injected banner ads, I have repeatedly observed Vonage ads appearing through banners injected into others’ sites using spyware, without permission from those sites. In general, the resulting Vonage banners appear in places where, but for the spyware at issue, no banner would exist. Consider e.g. the Google screenshot at right. The “real” Google site does not include a banner above the Google logo. Although the banner appears to be an integral part of Google’s site, the banner was injected into the site’s on-screen display by Fullcontext spyware; it was not placed there by Google.
The left and center screenshots below show similar ad injections by Searchingbooth. True.com and eBay do not sell ads that appear above their respective sites. Instead, the Vonage ads at issue were injected there by Searchingbooth, yielding the on-screen appearances shown below.
The DollarRevenue example, right screenshot below, shows a special kind of banner injection. Whereas the first three examples inject ads above a site (albeit within the site’s own window), DollarRevenue injects its ads into a site — covering a banner placed by the site (which would yield payment to the site) with a banner for DollarRevenue (which produces payments to DollarRevenue). This business model is not altogether novel; Claria (then Gator) pioneered this approach with its 2001 covering of other sites’ banners. But whereas Claria quickly abandoned this practice, in the face of IAB and other criticism, DollarRevenue continues unabated. For a particularly vivid view of DollarRevenue’s ad replacement, see the video of this ad injection. Notice the original Boston.com ad appearing for a fifth of a second at 0:00:3.65, only to be covered nearly instantly by the DollarRevenue-injected Vonage ad.
Vonage pays the respective spyware vendors through the relationships set out in the diagrams below and at right. Click an ad thumbnail for a full-size image, along with a packet log of associated network transmissions.
Searchingbooth Injecting a Vonage Ad into True.com
Vendare Group Using Direct Revenue to Promote Vonage
Vonage moneyviewers
Vendare Group / eMarketMakers moneyviewers
LeadClick Media / eAdvertising moneyviewers
Rextopia moneyviewers
RevenueLoop moneyviewers
Direct Revenue
The Money Trail – How Vonage Pays Direct Revenue
NextClick Media Using Direct Revenue to Promote Vonage
As recently as March 2006, I was still observing Vonage ads shown by notorious spyware vendor Direct Revenue. (Screenshot.) But Vonage partners continue to advertise with Direct Revenue — even using Vonage-supplied site designs to do so. So Vonage’s money still reaches Direct Revenue and still helps to fund Direct Revenue.
To see who placed this pop-up with Direct Revenue, I again turn to packet log analysis. I observe that loading the ad entailed loading the following URLs. Click the list for the full packet log.
This analysis indicates that traffic and money flowed as listed at right. RevenueLoop (a California-based ad network), or a RevenueLoop business partner, bought traffic from Direct Revenue (controlling server offeroptimizer.com). Then RevenueLoop sent traffic to Rextopia (a New Jersey affiliate network), which redirected to Eajmp.com (LeadClick Media’s eAdvertising, of California), which redirected to eMarketMakers, which redirected to aQuantive’s Atlas and finally on to Myphonebillsavings.
The last few links of this chain reflect substantial involvement of Vendare Group. Vendare owns eMarketMakers, and Whois data indicates that Myphonebillsavings is also registered to Vendare Group. But despite receiving venture funding from Insight Venture Partners, Vendare’s ties to spyware are well-known. For example, I have widely observed — and carefully documented — Vendare’s New.net installed through security exploits without users’ consent . Furthermore, Vendare’s eMarketMakers directly funds a variety of spyware. For example, in January 2006 I documented eMarketMakers promoting NetZero using traffic purchased directly from 180solutions, and in March 2005 I documented eMarketMakers promoting Earthlink and Petchews via traffic purchased directly from eXact Advertising. Despite the direct and well-documented relationships between Vendare and spyware, Vonage nonetheless purchases advertising from Vendare and its eMarketMakers group.
Vendare’s Myphonebillsavings is just one of many Vonage partners still paying to receive traffic from Direct Revenue. Last month I also observed Phonebillsolution pop-ups appearing through Direct Revenue. Like Myphonebillsavings.com, Phonebillsolution.com’s copyright line reflects creation by Vonage. Phonebillsolutions hides its Whois data, but directly requesting the IP address of the Phonebillsolution web server yields a default page titled “NextClick Media” (a California-based ad network). The final thumbnail at right shows NextClick promoting Vonage using Direct Revenue.
Spyware-Delivered Banner Farms Promoting Vonage
Look2me and Hula’s Global-Store Promoting Vonage
Vonage moneyviewers
ad networks (one or more) moneyviewers
banner farm moneyviewers
placement intermediaries (zero or more) moneyviewers
spyware vendors
But there are plenty of other banner farms, and in my testing most banner farms promote Vonage. For example, my June banner farm article mentions Whatsnewreport, which I have also observed promoting Vonage.
The diagram at right reflects the canonical relationships between Vonage, ad networks, banner farms, and spyware
Vonage’s Spyware Advertising in Context
Vonage isn’t the only advertiser with widespread spyware ad-buys. Other buyers of untargeted or semi-targeted ads get plenty of spyware-delivered advertising too. For example, I see Verizon ads in spyware pop-ups with remarkable frequency. In a future article, I’ll present screenshots of some other big spyware advertisers.
As best I can tell, Vonage does not specifically intend to have its ads shown in spyware. Instead, the advertising chains shown above reveal that these are generally indirect relationships, not direct spyware ad buys. (In comparison, see my September 2005 report of Expedia directly and intentionally buying spyware-delivered advertising from numerous notorious spyware vendors — a practice that, to its credit, Expedia subsequently stopped.) Yet by failing to take appropriate precautions and failing to diligently supervising its ads, Vonage makes payments to spyware vendors — funding spyware that is known to harm users’ PCs.
Vonage may seek to write off these examples as insignificant within its nine-digit advertising budget. But these spyware placements have important negative externalities: When Vonage pays spyware vendors, even indirectly, Vonage helps make spyware more profitable, and helps make the spyware problem worse. Even if Vonage is content to waste some money on buying unwanted spyware ads, it still needs to take action to avoid funding software that damages users’ PCs.
When asked about Vonage’s spyware funding, Vonage CEO Jeffrey Citron last year told the Associated Press “We do everything we can to make sure our partners adhere to our standards.” I disagree. There’s plenty more Vonage could do. For example, Vonage could refuse to work with partners like Vendare, that have known ties to spyware vendors and that even make and distribute their own spyware. Vonage could refuse to work with Traffic Marketplace and Yield Manager — partners that can’t provide reasonable assurances of keeping ads out of spyware. Vonage could specifically review all its advertising partners, and Vonage could prevent those partners from subcontracting with further unverified subpartners of their own. Vonage may consider these changes burdensome or inconvenient. But based on current practices, Vonage can’t credibly claim to be doing “everything” to stop spyware advertising. To the contrary, as the many examples above indicate, far more work is still required.
Last month Vonage won an “Effie” award for the “effectiveness” of its advertising campaign. I can’t speak to Effie’s criteria in granting this award. But advertisers might appropriately hesitate to praise an advertising strategy that, whether intentionally or recklessly, includes buying ads in spyware.
Beyond Vonage, criticism might reasonably focus on the advertising intermediaries that broker Vonage’s spyware placements. For example, Vonage receives and tracks all these spyware placements through aQuantive’s Atlas advertising. Atlas’s Acceptable Use Policy proclaims that “Atlas technology may not be used in connection with any downloadable application that is downloaded without notice and consent.” But I see no indication that Atlas actually enforces this policy: All the programs discussed above are programs I have observed installed without consent, yet these placements repeatedly flow through Atlas, as shown in each posted packet log. Other ad intermediaries lack even Atlas’s anti-spyware statement: Searching 24/7 Real Media’s site for “spyware” yields no hits, and 24/7’s lengthy and prominent code of conduct does not prohibit use of spyware.As advertising service providers, advertising specialists, publicly-traded companies, and purported ethical leaders, aQuantive, 24/7, and others could do far more to keep spyware out of their networks.