Google DoubleClick Mozilla essay second draft

This essay will describe the history of Internet advertising at Google. I will also talking about the ethical issues of some of the kinds of ads that Google produces, and why Larry/Sergey didn’t consider them for example. Of course, it is worth noting that Google isn’t the only one involved in the ad bubble. This essay will also talk about Mozilla, including Brendan Eich who created JavaScript.

Google was founded in 1998 by Larry Page and Sergey Brin while at Stanford, and took VC funding. Eric Schmidt was bought in as CEO in 2001 and recently left but are still on the board. Google IPOed in 2004.

The first kind of ads that Google did was AdWords, dating back to 2000. AdWords was based on search keywords, and the text ads was displayed at the top of the search results (labelled as ads) and was relatively simple. Typically the highest bidder was shown, and the advertiser paid Google when the user clicked on the ads. AdWords involved relatively little tracking at least initially and will not be mentioned much here. At this time Google was also taking a stand against popup ads.

AdSense was ads shown on webpages themselves, based on JavaScript. It was invented in 2003. AdSense at least initially was based on keywords on webpages themselves (which Google fetched from its cache for example), which advertisers could bid on. Like with AdWords, Google and websites gets paid when users click on the ads. It also involved little tracking at least initially, but the malware problems will be described here.

Google bought DoubleClick in 2008. DoubleClick was invented in 1995. It made more sophisticated ad tracking via cookies and the like famous (which was often called “retargeting”), and the problems will be described here. DoubleClick themselves called its product “Dynamic Advertising Reporting and Targeting” at one point for example. Initially DoubleClick was mostly banner ads, and many users developed so called banner-blindness from these ads.

Google bought Urchin in 2005, turning it into Google Analytics. Initially its product was to analyze web server log files, with JavaScript tags being added later.

One of the problems of ads is malware. Typically advertisers take the highest bidder of ads and fill as much space as possible with ads, making malware like exploit kits difficult to prevent. To make things worse, companies can only spend a limited amount of money on ads, so sites often have to take the highest bidder and sometimes websites even use multiple ad networks. Flash was famous for many exploits for example, and these days in general plug-ins are dying off (Java was even worse for example). Of course, there are browser exploits too like in Firefox and Chrome.

Though the vast majority of exploits in kits are typically already patched, sometimes unpatched zero day exploits get delivered by ads like in the case of https://www.trendmicro.com/vinfo/us/security/news/zero-day-exploit. There is a market for exploit kits in general, and zero days are particularly valuable.

One of the most famous of ads that contain malware was at Forbes, where the Angler exploit kit was served via pop-under ads after the site asked users to turn off ad blockers. Of course, asking users to turn off ad blockers or otherwise fighting against them is not a good idea in the first place.

Douglas Crockford tried to prevent malicious JavaScript in ads at Yahoo with AdSafe, including cross site scripting attacks. Of course, JavaScript is a Turing complete language making this more difficult, and Flash is even more complex. This is especially an issue when browser exploits are involved.

Another problem is tracking. The current economy is a debt-based economy based on consumption. The more money advertisers can extract from consumers, the more they are willing to spend on ads. This results in tracking getting creepier and creepier. Most of the tracking is called “retargeting” and it is often based on cookies and JavaScript.

For example, DoubleClick has cross-device retargeting introduced in 2015. Of course, it is limited to logged-in users tracking via the user account at least initially which any websites can do, but it illustrated the trend. Google changed the privacy policy to allow Google accounts to be used for such logged-in user tracking in 2016.

Google Analytics added AdWords and AdSense support in 2009. In 2012, Google changed its privacy policy to allow data to be consolidated, which was also very controversial. In 2014, Google Analytics integrated with DoubleClick, allowing things like remarketing lists to be shared. Remarketing lists for search ads (tied to Google Analytics) was introduced in 2015. Remarketing lists are basically lists of website visitors that can be uniquely identified by things like cookies, and it is one of the ways of targeting ads to users. Sharing remarketing lists basically ties the tracking together.

Of course, users often has little control and benefit over storage of user data and ad retargeting by trackers too, especially when many parties are involved. Of course, some provides more control than others.

So why didn’t Larry/Sergey consider the issues when buying DoubleClick for example?

One reason I assume is that no one cared as much about security when AdSense added Flash ads for example, with exploits not as common as now. I assume that the market for exploit kits and zero day exploits and the like took time to develop.

Before the Google-DoubleClick acquisition, DoubleClick was once planned to merge with Abacus. FTC blocked the merger because of the privacy problems (especially problems with deanonymizing users) and it never happened.

The Google-DoubleClick acquisitions was controversial, with EPIC for example filing complaints with the FTC. There was also a Senate hearing on Sept 27, 2007 with testimonies from a variety of sources regarding that issue. One of the concerns was aggregation of tracking data and lack of control by users.

Now, lets talk about Mozilla. Brendan Eich was the creator of JavaScript and was the CTO of Mozilla Corporation from 2005 to 2014. After he stepped down from Mozilla in 2014, he started Brave with its Basic Attention Token etc. Andreas Gal joined Mozilla in 2008 and was the CTO from 2014 until 2015 when he left Mozilla.

Mozilla signed the Google search deal in 2004, before Google even IPOed (let along things like DoubleClick). Mozilla switched to a Yahoo search deal in late 2014. Recently Mozilla switched back to Google as the default.

BrendanEich mentioned in https://twitter.com/BrendanEich/status/932747825833680897 on the Google search deal and history of Google that “It's not a simple Newtonian-physics (or fake economics based on same) problem.”

It was mentioned that Firefox OS enabled tracking protection by default unlike desktop Firefox. It was mentioned in https://twitter.com/andreasgal/status/932757853504339968 that “Yup. I was able to sneak that past management”.

Google’s ad blocking and “better ads” involves annoying ads, but don’t fix the issues described here. Apple’s ad blocking targets retargeting, but does not change the display of ads or make ads less annoying.