Slashdot Mirror
The Vanishing Click-Fraud Case
PreacherTom writes "In March of 2004, a computer programmer arrived at Google's offices with one goal in mind: blackmail. He had invented a program called "Google Clique", which could generate millions of fake clicks to Google's ads. The price to avoid disaster: $150,000. At the time, it didn't end well for the programmer; Google had the police in the next room. However, a few days ago the U.S. Attorney quietly dropped the case. The reason: apparently Google was unwilling to cooperate with prosecutors. Why the odd behavior?"
What's with both the article and summary playing to the channel 5 action stopper team "Why?!?!?" question?
Duh, that's the point of blackmail. You don't show your hand until you have something that will discourage the victim from turning you into the police. Obviously, the guy could've released the method to the public and caused Google more than letting him go.
First question: What did they have to gain by persuing it ? not much me thinks
Next question: What did they have to lose by persuing it ? trade secrets, embarassment, other
Analysis: Very predictable.
<tinfoilhat>
November 22 is the day they killed Kennedy! Coincidence? You be the judge ...
</tinfoilhat>
I hear there's rumors on the Slashdots
Love sees no species.
Did Google hire the guy?
It's a serious question; some firms actually do hire the black hatters who targetted them.
I'm curious... if he could generate 30K per month with his program, why only extort for 150K?
Why not just run it for 5 months and call it good?
Comment removed based on user account deletion
Except that if their plan was to profit from his 'fraud', they wouldn't have set him up in the first place. They'd have just 'called his bluff' and let him do it.
Instead, they chose to have him arrested and let the world know about his scheme. We don't know WHY they chose not to prosecute, but I seriously doubt it has anything to do with being evil.
"If you make people think they're thinking, they'll love you; But if you really make them think, they'll hate you." - DM
Maybe G just doesn't want to give the story any more credibility, but in any case, not exposing its anti-fraud methods in court would be a good enough reason. Why give the bad guys more info than you have to?
Rgds
Damon
http://m.earth.org.uk/
What I don't understand is why they needed to know about google's click or anti-click-fraud system to punish the guy. Yes, they might need to know such to assess damages for financial issues, but blackmail/extortion would be illegal regardless. If they've got the cops in the next room taping the guy making a "pay me out or else I'll do X", the feasibility or impact of X is not so important as the fact that the individual has already attempted to extort money from google.
"Do no evil", my ass.
Right, because a company ONLY cares about money and making more of it. And the only way to make more money is to do things that are "evil" because having morals and making decisions based on them wouldn't be good for business.
maybe google just fixed it
-- lol pwned
All the cases I'd heard of were long, long ago. Are there any recent examples of somebody being that dumb?
>Why not just run it for 5 months and call it good?
Crime has cost-benefit analyses just like legitimate business.
If he ran the scam himself, he'd be limited to what one individual could do before some Google engineer figured out a way to block it.
If he tried to sell his program to other criminals, he'd be betting that criminals wouldn't pass along unauthorized copies.
If he released it for free, it would cost Google way more than he could have stolen on his own, but he wouldn't see most of that kajillion dollars.
So the big payoff was in extortion, telling Google "Nice advertising business ya got here, be a shame if something happened that cost a kajillion dollars, when you could buy insurance for only $150,000". At the risk of getting arrested, a bigger risk than if he'd run the click fraud himself.
To me it says: There is no profit in independent security research. Go ahead and release your research findings to the public. It will cost Google (or whatever corporation) untold millions of dollars, but they will pay nothing for your work. If you ask for money, you will be accused of blackmail and sent to jail (until they fix the exploit and drop the charges).
Why are exploits expected to be donated? I acknowledge that there is a fine line between asking for a bounty and blackmail. But to treat bountyhunters like blackmailers seems to be a poor way to promote security.
Some organizations like iDefense will pay a bounty for independent security research.
Otherwise, you can gain some degree of credibility by detecting and publishing security exploits, and there are organizations which will hire "white-hat" teams to perform penetration testing, or hire people who have a good security track record to fix major security holes, but a big part of that involves working with the organizations and being willing to not publicize security exploits until the vendor has had a reasonable period of time to fix things. Trying to coerce an organization into paying you is another matter entirely....
"The human race's favorite method for being in control of the facts is to ignore them." -Celia Green
If you are the CEO or any senior exec of a public company you have to sign a piece of paper that commits you legally to chasing profit for the stock holders.
If there was any commitment from government toward making society better then maybe there would be repercussions for certain activities that would punish execs who do things like screw up the environment or rip off their customers.
Since corporations run government maybe we should get to vote for CEOs.
Then we could call our system a democracy again.
If you are the CEO or any senior exec of a public company you have to sign a piece of paper that commits you legally to chasing profit for the stock holders.
Yeah, I get that, but where does it say that the only way to raise profits is to do evil things? So many people have adopted this idea that corporations are evil because all they care about is money, while this isn't true at all. You can care about money and still do good things. Here's a real shocker: you can do good things and make money by doing it! Knowing that doing an "evil thing" will lead to increased profit at the moment is easy, but having the foresight to to know that it will lead to drops in profit in the future is much better. Google doesn't have to do "evil" things just because its a corporation.
Call the cops in, prosecution gets court orders to search his properties (including hardrives, etc.), have that info shared under discovery (probably shared by the prosecution in order to build a case and verify that he actually had something in which to blackmail with. Important in a blackmail case as it shows intent.), then drop the whole shebang.
Once they have the information, they can then fix/modify the filters, all without having to pay the guy his blackmail demands or ever allow any of it to reach the public domain.
Problem solved.
Maybe the Programmer hinted (or threatened) a release
of How To Do It info... to all the rest of us
Didn't Google Invent Click-Fraud? I thought they held the patent! When I see the Google adds they almost never take me to the website, but if I Google the site name I can usually find a url that gets me reasonibly close to where I was hesded in the first place.
"Can there be a Klein bottle that is an efficient and effective beer pitcher?"