Fake News, Russian Hackers, and...Your Media Plan

This isn't a political post...let's get that out of the way right at the start.

But as politics still dominate the news and will for some time, chances are that you have heard a few stories about the prevalence – and alleged sway – of fake news sites in this recent election season. The number of fake news sites that have surfaced is well into the hundreds and, for many, their intention wasn't to elect a particular person into office. According to Beqa Latsabidzean, the owner of one of these news sites, based out of Georgia (the Georgia with the capital of Tbilisi, not Atlanta, our fair city), “this is all about income, nothing more,”

In same New York Times article, he goes on to say, "The income comes mostly from Google, which pays a few cents each time a reader sees or clicks on advertisements embedded in one of his websites. Mr. Latsabidze’s best month, which coincided with the bogus hit story about Mexico closing the border, brought in around $6,000, though monthly revenue is usually much lower."

To be clear, the income is due to their availability as a site to advertise on within the Google ad network. If you run a lot of programmatic buys using that network, it's a safe bet that your ad may have appeared next to a fake news story.

In fact, you may have also heard that this caused a number of advertisers and agencies to push for removing Breitbart and similar sites from the automatically placed ad network.

And if this uncertainty around where your ads might actually be appearing makes you nervous, it probably won't help to know that it's been that way for a while now.

"I must break you" - Ivan Drago, Rocky IV

Recently Forbes and a security firm called White Ops, uncovered what they call the biggest "ad fraud ever," detailing how Russian hackers pocketed $5,000,000 a day by faking over 300 million video views.

They set up more than 6,000 domains and over 250,000 unique URLs to look like they were coming from well-known publishers (e.g. ESPN and Vogue), but the video ad was the only thing on the page.

The hack went further than just impressions. They invested in a 'bot farm' which faked traffic to the ads and generated higher sums for the placements. They created programs that mimicked human interaction with the ads, such as fake views, fake clicks, mouse movements, and social network log-ins, in order to fool any bot-detection systems in place.

Follow The Money

Every week there's a new story showing that hackers are not only able to divert traffic to fake sites that no one will actually go to, but that they can also create programs to interact with the ads which send data back to the programmatic vendor fooling them into showing brand marketers that everything's going great.

The question is, like fake news on Facebook and Twitter, why and how much should we care?

The $5 million a day these hackers are making comes from your budget. This money is never returned to the advertisers and when your ad runs next to an article of hate speech or pornography, it's because someone tricked Google into thinking that was a great place for your ad based on an algorithm.

Rigging these sites is a real way for people who know what they're doing to get rich quick and whenever there's a way to try and get rich quick a lot of people are going to rush at it.

So, Now What?

One way to ensure that your marketing is placed on exactly the types of sites you want it on, is to go old-school and place the buys directly. Yes, this loses some of the ease and speed of the programmatic trading desk buy, but at least you know what to expect.

If you're not ready to go cold turkey, here are a few other possibilities to consider:

1. Only use reputable programmatic platforms - ask your agency for more details and don't just assume it's okay. Do a little digging: if it's not a company you know and already trust ask where their headquarters is, how long have they been in business, and how they protect against fraud.
   
   
2. Use your own ad tracking codes - set up your own UTM tracking codes and compare your numbers with what you get back from your media platform. Or use a third-party tracking company like DoubleClick.
3. Ask for the site list - I promise the first response you will get is, well we can't because there are just too many sites in the network or something similar to that. Keep pushing to see whatever you can get your hands on. While you can't handpick each site you want to run on (it goes against the whole model of programmatic buying and defeats the purpose), you should be able to exclude any sites you definitely do not want to be running on.
4. Get site-level reporting -when everything is aggregated, it's hard to see irregularities. Try to make sure you're receiving site-specific reporting. Impressions can't be guaranteed ahead of time, however, once the ads have run you should be allowed to access impressions, clicks, CTR, conversions, CPM, and CPC numbers to see if anything odd stands out.