Editorial: "Hijacking web searches for cash threatens net success"
Read more: Click here to read an updated and longer version of this story
MILLIONS of web users' searches are being hijacked and redirected by internet service providers in the US. Patents filed by Paxfire, the company involved in the hijacking, suggest that it may be part of a larger plan to allow ISPs to generate revenue by tracking the sites their customers visit. It may also be illegal.
Last week Reese Richman, a New York law firm that specialises in consumer protection, filed a class action against one of the ISPs and Paxfire, which researchers believe provided the equipment used to hijack and redirect the searches. The suit, filed together with Milberg, another New York firm, alleges that the process has violated numerous statutes, including wiretapping laws.
The hijacking seems to target searches for certain well-known brand names only. Users entering the term "apple" into their browser's search bar, for example, would normally get a page of results from their search engine of choice. The ISPs involved in the scheme intercept such requests before they reach a search engine, however. They pass the search to an online marketing company, which directs the user straight to Apple's online retail website.
Fourteen ISPs in the US, which together have several million subscribers, have been redirecting queries in this way. None of the companies would comment, but evidence collected by Christian Kreibich and Nicholas Weaver at the International Computer Science Institute in Berkeley, California, who discovered the redirection, suggests the process generates revenue for them.
The researchers have identified 165 search terms, from "apple" and "dell" to "safeway" and "bloomingdales", that are passed to marketing companies and then redirected to the appropriate retail website. Retailers pay the marketers - in particular, Commission Junction, based in Santa Barbara, California - a fee to supply traffic to their websites. Organisations that provide Commission Junction with traffic - which may include Paxfire and the ISPs the Berkeley team monitored - receive a cut of any purchase their users make. The cut is typically around 3 per cent. Commission Junction says it is investigating the behaviour identified by the Berkeley team.
The practice is highly contentious. A user who searched for "apple" would easily have found the company's online store via a search engine, so Apple may be needlessly sharing revenue with Commission Junction and the ISPs. Search engines are also being deprived of traffic intended for them. The ISPs are understood to have stopped redirecting Google searches after the company complained to them earlier this year. Twelve of the ISPs identified by the Berkeley team still redirect some Bing and Yahoo searches, however.
The redirection can also produce unwanted results. A user wanting to read an article in The Wall Street Journal, for instance, might search for "wsj"; the redirection system would take them to a page offering subscription deals for the paper.
"This interception and alteration of search traffic is not just your average privacy problem," says Peter Eckersley at the Electronic Frontier Foundation, a San Francisco-based internet advocacy group that aided the investigation. "This is a deep violation of users' trust and expectations about how the internet is supposed to function."
It is not the first time that the desire of ISPs to monitor and monetise the traffic they carry has led to controversy. In 2008, it emerged that service providers in the UK were working with Phorm, a company that developed techniques for tracking the interests and activities of internet users. Advertisers and publishers already track users' browsing, but ISPs are in a more powerful position because they can observe almost everything we do online. Users' complaints about Phorm's data collection prompted several ISPs to sever links with the company.
In the present case, analysis of the redirected traffic has led the Berkeley team to believe that the service is provided by Paxfire. The firm, based in Sterling, Virginia, has provided advertising services to ISPs since it was founded in 2003. As well as using Paxfire to redirect specific queries, the ISPs pass many, or perhaps all, searches on Google, Bing and Yahoo through Paxfire servers - a process that places Paxfire in a similar position to Phorm.
Paxfire executives did not reply to New Scientist's requests for comment, but patents that the firm has been awarded, as well as others it has applied for, hint at its plans. In March, company CEO Alan Sullivan applied for a patent for a system that would allow ISPs to create a "database of information about particular users" based on the searches and website visits they observe. The patent says that ISPs could use the information to display relevant advertising.
Paxfire is named in the lawsuit filed by Reese Richman and Milberg, alongside RCN, based in Herndon, Virginia, one of the ISPs identified by the Berkeley team. The suit, which was filed in the district court for the southern district of New York, claims that the two companies violated privacy safeguards enshrined in the Wiretap Act, a 1968 law that regulates electronic communications.
Is your search safe with them?
The following 12 internet service providers, with millions of customers between them, were observed by researchers to be hijacking users' search traffic and shunting it to retail websites. If you get your internet from one of them, your searches may be compromised: Cavalier, Cincinnati Bell, Cogent, Frontier, Hughes, IBBS, Insight Broadband, Megapath, Paetec, RCN, Wide Open West and XO Communication.
Charter and Iowa Telecom were also observed to be redirecting search terms, but have since ceased doing so. Iowa Telecom stopped its redirection between July and September 2010, and Charter stopped in March 2011.
If you would like to reuse any content from New Scientist, either in print or online, please contact the syndication department first for permission. New Scientist does not own rights to photos, but there are a variety of licensing options available for use of articles and graphics we own the copyright to.
Have your say
Only subscribers may leave comments on this article. Please log in.
Only personal subscribers may leave comments on this article
Subscribe now to comment.
All comments should respect the New Scientist House Rules. If you think a particular comment breaks these rules then please use the "Report" link in that comment to report it to us.
If you are having a technical problem posting a comment, please contact technical support.
brooklyn decker contagion contagion flight 93 flight 93 osama bin laden dead picture act
No comments:
Post a Comment