The Bot Hunters

If you’re buying or selling ads online, there’s a good chance you’re being robbed little by little without even knowing it.

In the dark corners of the Internet, bot fraud—in this case, the use of malware to generate non-human web traffic—has become such a problem for advertisers that Solve Media estimates bots will waste $11.6 billion in ad spend in 2014, according to a study published last January. Those buying ads are scammed out of spend by cyber criminals controlling fake traffic, and those selling legitimate ad space are forced to deal with a market plagued by artificially low rates.

However, White Ops—an enterprise cyber-security company that launched in October 2013—is on a mission to protect advertisers and publishers from bot fraud. Their software relies on side-channel analysis to track digital behavior that differentiates humans from bots, which helps provide accurate data for those buying and selling ads. Or, as the company explains in the bio of their Twitter account: “Bots are bad for business. We’re bad for bots.”

“We’re in a long-term arms race with the bad guys,” said co-founder Ash Kalb, who also serves as the company’s general counsel. “We’re examining the browser environment and looking for signs of the automation that you need to do this sort of fraud at scale.”

So who are the bad guys? That’s not exactly certain. But Kalb said that in many cases, bot fraud can be traced back to organized crime. It’s a new, lucrative racket without much oversight. A 2013 Adweek article went as far as to claim that bot fraud “involves organized crime, Russian millionaires, ex-bank robbers, and one-sixth of the computers in the U.S.”

In that same article, White Ops chairman Jon Bond said: “I always joke, there are no poor bot vendors—you’re dead or you’re rich.”

The worlds of advertising and criminality don’t usually mix, but bot fraud has been a serious problem for years. A comScore study from May 2012 to February 2013 suggested that 54 percent of display ads “never appeared in front of a human being.” Think of it like Mad Men meets Mad Max.

The goal for White Ops is to cut off the profits for cyber criminals. Tracing the money back to organized crime makes for a good hook to get people’s attention, but stopping bot fraud is all about empowering potential victims with the right tools to accurately measure their true, bot-free audience. If done correctly, there’s no need to follow the money, because White Ops is targeting the root of the problem.

Eliminating bot fraud is also about changing the perception of how digital advertising should work. Advertisers may be aware of bots, but, according to Kalb, many don’t realize just how serious the problem is. Plus, in the past, agencies and publishers were incentivized to report bloated traffic to satisfy bottom lines and keep the money flowing. Now that organizations like the Association of National Advertisers (ANA) and the Interactive Advertising Bureau (IAB) have claimed bot fraud is rampant and in the billions, looking the other way isn’t a viable solution.

“The bots make it feel like there’s an infinite supply of human attention on the Internet,” Kalb explained. “They make it feel like there’s always another viewer available to go and see an ad, but there isn’t. That’s why the publishers are suffering from declining prices—we’ve got infinite supply and fixed demand.”

Even though the automated functions of programmatic and targeted ads have recently made it easier for bot fraud to take place, White Ops gives their clients a reliable metric for buying and selling: cost per human, which filters out the bot footprint to accurately price display ads. Beating bots is all about capturing value correctly, and those who verify quality traffic can stay a step ahead. Simultaneously, the ad industry has also seen a few premium publishers like The Economist and the Financial Times start selling ads based on time spent, not clicks.

With enough infrastructure in place, advertisers will no longer have to worry about computer hackers sitting in robes, aiming to become the next Die Hard villain.

“I think a lot of dollars are going to shift around from companies that may or may not know they have bot problems to companies that are taking proactive steps to eliminate fraud,” Kalb said. “We see a lot of people looking for trusted ecosystem players, people who they know have cleaned up their content.”

He turned to one of his company’s success stories: the website for a TV channel that is owned by a major media conglomerate. Originally, the site was hurt by 12–14 percent bot traffic. After three months, White Ops had sliced fraudulent traffic to below 1 percent.

White Ops has grown from seven employees to over 30 over the last year and now has offices in New York City, San Francisco, and British Columbia. Because of the sensitive nature of cyber security, they can’t disclose much about who they work with (“We’re like a really good plastic surgeon—our customers don’t really want us talking about them”) or get into too many specifics about how they track bots. When I asked Kalb if the company has spoken to former black-hat hackers to get a better understanding of who they’re going after, he paused for a beat and said, “I can’t confirm or deny that.”

However, the company is currently working with the ANA on a comprehensive study that covers 36 brands and tries to demonstrate what ad fraud looks like across the industry. The results should be available by the end of the year.

White Ops is already aware of some emerging fraud trends—for example, bots have been going after video content more than written content. “The bad guys are in this business to make money, so they go where the money is,” Kalb said. “They chase high CPMs. And unfortunately, video is a natural fit for brands. … It’s very easy to set up a video fraud cash-out site.”

Focusing on that area, as well as mobile, are two points of emphasis for White Ops as they move forward. Still, Kalb cautioned that getting rid of all bots isn’t a likely solution; the hackers are smart enough to retreat and adapt. But now that there’s a financial deterrent in place to protect against bot fraud, traffic numbers are finally becoming more dependable.

“If you want to spend a million bucks to beat us once, you can do it,” he said. “It’s not that the goal is to totally eliminate bots, but if you cut off the money, there’s no reason to do it anymore.”