Thread by @doctorow

In 1998, two Stanford students published "The Anatomy of a Large-Scale Hypertextual Web Search Engine," in which they wrote, "Advertising funded search engines will be inherently biased towards the advertisers and away from the needs of consumers."

research.google/pubs/pub334/ 1/

If you'd like an essay-formatted version of this thread to read or share, here's a link to it on pluralistic.net, my surveillance-free, ad-free, tracker-free blog:

pluralistic.net/2023/02/24/pas… 2/

The co-authors were Lawrence Page and Sergey Brin, and the "large-scale hypertextual web search-engine" they were describing was their new project, which they called "#Google." They were 100% correct - prescient, even! 3/

On Wednesday night, a friend came over to watch some TV with us. We ordered out. We got scammed. We searched for a great local Thai place we like called Kiin and clicked a sponsored link for a #Wix site called "Kiinthaila.com." 4/

We should have clicked the third link down (kiinthaiburbank.com).

We got scammed. The Wix site was a lookalike for Kiin Thai, which marked up their prices by 15% and relayed the order to our local, mom-and-pop, one-branch restaurant. 5/

The restaurant knew it, too - they called us and told us they were canceling the order, and said we could still come get our food, but we'd have to call Amex to reverse the charge.

As it turned out, the scammers double-billed us for our order. 6/

I called Amex, who advised us to call back in a couple days when the charge posted to cancel it - in other words, they were treating it as a regular customer dispute, and not a systemic, widespread fraud (there's no way this scammer is just doing this for one restaurant). 7/

In the grand scheme of things, this is a minor hassle, but boy, it's haunting to watch the quarter-century old prophecy of Brin and Page coming true. 8/

Search Google for carpenters, plumbers, gas-stations, locksmiths, concert tickets, entry visas, jobs at the US Post Office or (not making this up) tech support for Google products, and the top result will be a paid ad for a scam. Sometimes it's several of the top ads. 9/

This kind of "intermediation" business is actually revered in business-schools. As Douglas @rushkoff has written, the modern business wisdom reveres #GoingMeta. 10/

You "go meta" by not doing anything useful, but rather, creating a chokepoint between people who do useful things and people who want to pay for those things, and squatting there, collecting rent:

rushkoff.medium.com/going-meta-d42… 11/

It's the ultimate #PassiveIncome #RiseAndGrind #SideHustle: It wouldn't surprised me in the least to discover a whole festering nest of creeps on Tiktok talking about how they pay #MechanicalTurks to produce these lookalike sites at scale. 12/

This mindset is so pervasive that people running companies with billions in revenue and massive hoards of venture capital run *exactly* the same scam. 13/

During lockdown, companies like Doordash, Grubhub and Uber Eats stood up predatory lookalike websites for local restaurants, without their consent, and played #MonsterInTheMiddle, tricking diners into ordering through them:

pluralistic.net/2020/09/19/we-… 14/

These delivery app companies were playing a classic #enshittification game: first they directed surpluses to customers to lock them in (heavily discounting food), then they directed surplus to restaurants (preferential search results, free delivery, low commissions). 15/

Then, having locked in both consumers and producers, they harvested the surplus for themselves.

Today, delivery apps charge massive premiums to both eaters and restaurants, load up every order with junk fees, and clone the most successful restaurants out of #GhostKitchens. 16/

These are shipping containers in parking lots crammed with low-waged workers cranking out orders for 15 different fake "virtual restaurants":

pluralistic.net/2020/12/01/aut…

Delivery apps speedran the enshittification cycle, but Google took a slower path to get there. 17/

The company has locked in billions of users (e.g. by paying billions to be the default search on Safari and Firefox and using legal bullying to block third party Android device-makers from pre-installing browsers other than Chrome). 18/

For years, it's been leveraging our lock-in to prey on small businesses, getting them to set up Google Business Profiles.

These profiles are supposed to help Google distinguish between real sellers and scammers. 19/

But Kiin Thai has a Google Business Profile, and searching for "kiin thai burbank" brings up a #KnowledgePanel with the correct website address - on a page that is headed with a link to a *scam* website for the same business. 20/

Google, in other words, has everything it needs to flag lookalike sites and confirm them with their registered owners. 21/

It would cost Google to do this - engineer-time to build and maintain the system, content moderator time to manually check flagged listings, and lost ad-revenue from scammers - but letting the scams flourish makes Google money, at the expense of users and business customers. 22/

Now, Google has an answer for this: they tell merchants who are being impersonated by ad-buying scammers that all they need to do is outbid them for the top ad-spot. 23/

This is a common approach - Amazon has a $31b/year "ad business" that's mostly its own platform sellers bidding against each other to show you fake results for your query. The first five screens of Amazon search results are 50% ads:

pluralistic.net/2022/11/28/ens… 24/

This is "going meta," so naturally, #Meta is doing it. 25/

Facebook and Instagram have announced a $12/month "verification" badge that will let you report impersonation and tweak the algorithm to make it more likely that the posts you make are shown to users who asked to see them:

vox.com/recode/2023/2/… 26/

The corollary of this, of course, is that if you *don't* pay, they *won't* police your impersonators, and they *won't* show your posts to the people who asked to see them. 27/

This is pure enshittification - the surplus from users and business customers is harvested for the benefit of the platform owners:

pluralistic.net/2023/01/21/pot…

The idea that merchants should master the platforms as a means of keeping us safe from impersonators is a hollow joke. 28/

For one thing, the rules change all the time, as platforms endlessly twiddle the knobs that determine what gets shown to whom:

doctorow.medium.com/twiddler-1b5c9… 29/

And they refuse to tell anyone what the rules are, because if they told you what the rules were, you'd be able to bypass them. #ContentModeration is the only #infosec domain where "#SecurityThroughObscurity" doesn't get laughed out of the room:

doctorow.medium.com/como-is-infose… 30/

Worse: the one thing the platforms *do* hunt down and exterminate with extreme prejudice is anything that users or business-customers use to twiddle *back* - add-ons and plugins and jailbreaks that override their poor choices with better ones:

theverge.com/2022/9/29/2337… 31/

As I was submitting complaints about the fake Kiin scam-site (and Amex's handling of my fraud call) to the FTC, the California AG, the Consumer Finance Protection Bureau and Wix, I wrote a little Twitter thread about what a gross scam this is:

https://twitter.com/doctorow/status/1628948906657878016

32/

The thread got more than two million reads and got picked up by #HackerNews and other sites. 33/

While most of the responses evinced solidarity and frustration and recounted similar incidents in other domains, a significant plurality of the replies were #ScamApologetics - messages from people who wanted to explain why this wasn't a problem after all. 34/

The most common of these was victim-blaming: "you should have used an #AdBlocker" or "never click the #SponsoredLink." Of course, I *do* use an ad-blocker. 35/

But this order was placed on mobile, after an absentminded query into the Google search-box permanently on the home screen, which opens in Chrome (where I don't ad-block so I can see material behind an ad-blocker-blocker), not Firefox (which *does* have an ad-blocker). 36/

Now, I *also* have a #PiHole on my home LAN, which blocks most ads even in a default browser - but earlier this day, I'd been on a public wifi network that was erroneously blocking a website (the always excellent superpunch.net). 37/

I'd turned my wifi off, which meant the connection came over my phone's 5G connection, bypassing the PiHole:

pluralistic.net/2022/04/28/shu… 38/

"Don't click a sponsored link" - well, the irony here is that if you habitually use a browser with an ad-blocker, *and* you backstop it with a PiHole, you *never see sponsored links*, so it's easy to miss the tiny "Sponsored" notification beside the search result. 39/

That goes double if you're relaxing with a dinner guest on the sofa and ordering dinner while chatting. 40/

There's a name for this kind of security failure: the #SwissCheeseModel. We all have multiple defenses (in my case: foreknowledge of Google's ad-scam problem, an ad-blocker in my browser, LAN-wide ad sinkholing). 41/

We also have multiple vulnerabilities (for me: forgetting I was on 5G, being distracted by conversation, using mobile with a permanent insecure search bar on the homescreen, and being accustomed to ad-blocked results so I got out of the habit of checking for ads in results). 42/

If you think you aren't vulnerable to scams, you're wrong - and your confidence in your invulnerability actually *increases* your risk. 43/

This isn't the first time I've been scammed, and it won't be the last - and every time, it's been a Swiss Cheese failure, where all the holes in all my defenses lined up for a brief instant and left me vulnerable:

locusmag.com/2010/05/cory-d… 44/

Other apologetics: "just call the restaurant rather than using its website." Look, I know the people who say this don't think I have a time-machine I can use to travel back to the 1980s and retrieve a #YellowPages, but it's hard not to snark at them, just the same. 45/

Scammers don't just set up fake websites for your local businesses - they staff them with fake call-centers, too. The same search that takes you to a fake website will also take you to a fake phone number. 46/

Finally, there's "What do you expect Google to do? They can't possibly detect this kind of scam." But they *can*. 47/

Indeed, they are better situated to discover these scams than anyone else, because they have their business profiles, with verified contact information for the merchants being impersonated. 48/

When they get an ad that seems to be for the same business but to a different website, they *could* interrupt the ad process to confirm it with their verified contact info. 49/

Instead, they choose to avoid expenses and pocket ad revenues. If a company promises to "to organize the world's information and make it universally accessible and useful," I think we have the right to demand these kinds of basic countermeasures:

google.com/search/howsear… 50/

The same goes for Amex: when a merchant is scamming customers, they shouldn't treat complaints as "chargebacks" - they should treat them as reports of a crime in progress. 51/

Amex has the bird's eye view of their transaction flow and when a customer reports a scam, they can backtrack it to see if the same scammer is doing this with other merchants - but the credit card companies make money by *not* chasing down fraud:

buzzfeednews.com/article/rosali… 52/

Wix also has platform-scale analytics they could use to detect and interdict this kind of fraud - when a scammer creates many lookalike websites for restaurants and uses Wix's merchant services to process payments for them, that could trigger human review - but it didn't. 53/

Where do all of these apologetics come from? Why are people so eager to leap to the defense of scammers and their #adtech and #fintech enablers? Why is there such an impulse to victim-blame? 54/

I think it's fear: in their hearts, people - especially techies - know that they, too, are vulnerable to these ripoffs, but they don't want to admit it. 55/

They want to convince themselves that the person who got scammed made an easily avoidable mistake, and that they themselves will *never* make a similar mistake.

This is doubly true for readerships on tech-heavy forums like Twitter or (especially) Hacker News. 56/

These readers know just how many vulnerabilities there are - how many holes are in their Swiss cheese - and they are also overexposed to rise-and-grind/passive income rhetoric. 57/

This produces a powerful #CognitiveDissonance: "If all the 'entrepreneurs' I worship are just laying traps for the unwary, and if I am sometimes unwary, then I'm cheering on the authors of my future enduring misery." 58/

The only way to resolve this dissonance - short of re-evaluating your view of platform capitalism or questioning your own immunity to scams - is to blame the victim. 59/

The median Hacker News reader has to resolve the tension between "just install an adblocker" and "Chrome's sandbox is a dumpster fire and it's basically impossible to know whether any add-on you install can steal every keystroke and all other data":

mattfrisbie.substack.com/p/spy-chrome-e… 60/

In my thread, I called this "the worst of all possible timelines." Our lives are mediated by gigantic, surveillant monopolists who spy on us comprehensively from asshole to appetite. 61/

But none of them, not a 20th century payment giant nor a 21st century search giant - can bestir itself to use that data to keep us safe from scams. 62/