Sean Reiser
ISPs inserting ads on webpages.
July 27th, 2007 I've seen this covered on slashdot and digg but haven't seen many people weigh in on it, so I figured I'd write it up with my opinions.
Back in June, there was a post from someone to thinking he was infected by spyware since he was getting additional ads from a company called "Fair Eagle" inserted on all the pages he visits. After a little analysis he found this happened from his home but not from his office and mentioned that his ISP is MoonOverAddison and it appeared that they were inserting the advertisements.<!--blockquote--> At which point jaiku user Chrisr chimed in with this information:
I noticed this at work and reported it to our IT department who contacted our ISP (Redmoon, who owns MoonOverAddison). Here's what we learned.
Fair Eagle sells a hardware device that sits between the ISP and all customers. It attempts to insert the ad Javascript into all HTTP traffic. Redmoon has purchased this device, intending it for all home customers, however, it lacks any sort of configurability based on IP address so all customers, including business customers leasing T1s from them, are affected.
Redmoon installed this device knowing that the ads would alienate some customers, but not enough to make the device unprofitable.
Very shady.
Some additional research reveled this to be the likely device. Basically this device is a transparent proxy that add advertising to every web pages that passes through it. Basically the ISP becomes a piece of adware which is just slightly out of your reach.
I don't see how this device is anything but a copyright circumvention device. I am writing some AGs in the next couple of days, explaining what the device is, how it effects us and explaining how it violates the DMCA (they gave me the gun, I'm going to try and use it).
Recently, The CS folks over at the University of Washington has an integrity checker which will check your connection and determine if your ISP is adding content and tracking the information for later publication. You should head over there to make sure your ISP is behaving.
Buried in the ISP's TOS, the user is agreeing to allow this to happen, of course. The problem for these ISPs is that they are still breaking the content owner's copyright by creating a derivative work of the webpage. This effects content providers in a number of ways.
If a site is kept in business by advertising the additional ads reduces the odds that someone is clicking on an ad that supports your site, losing potential income. If a site is advertising free either through a subscription model or through social contract, this device makes it appear that the provider is violating that agreement. Vows not to accept advertise from certain businesses or industries are now moot. At the end of the day the ISP makes the profit and we, the content providers, are left holding the bag.
What worries me more then this, is what the ISPs can do next. What prevents them for changing the content owner's adsense id to theirs, or replacing the website's ads with their ads altogether? I have no problem with a user blocking ads (let's face it anyone who goes through the effort to block ads isn't clicking on them anyway), but an ISP replacing them for their own profit is another matter entirely.
I'm planning on writing a drupal module to test of this and report back in the next couple of days (I'm writing the UW folks right now). Hopefully, if enough parties are interested we can get some visibility to this problem.
Sources
http://vancouver.cs.washington.edu/
http://www.nebuad.com/publishers/publishers.php
http://digg.com/security/Are_ISPs_modifying_your_web_pages
http://yro.slashdot.org/yro/07/06/23/1233212.shtml
Sean Reiser, 40, is a developer, technologist, and amateur photographer. Sean has spent the past 20 years as a programmer, system architect and development manager. He is a life long New York resident.
Sean currently serves as the President and Chief Geek Officer of Repair Sense, Inc.. Please go to that site with any professional inquiries.
Sean can be found using a number of social networks. These are the ones he's most active on:
- how is this going? im trying
1 day 18 hours ago - The icon thing is not meant
1 week 3 days ago - OK, you and I will pretend
1 week 4 days ago - It's funny, its not that I
1 week 4 days ago - The Green Icon or overlay
1 week 4 days ago - Not sure I approve of being
2 weeks 2 days ago - Hahahahaha!! Brilliantly
2 weeks 2 days ago - Great story, Sean. I left
2 weeks 2 days ago - Hey - Happy birthday belated!
3 weeks 1 day ago - Nice depth of field. It
3 weeks 2 days ago
- iSeanReiser (178) - Geek Blog
- The Early Reiser (20) - Mainstream Blog
- Livejournal (171) - Old Livejournal Blog
- Great Existence (99) - Photo of the Day
- Photosets (133) - Photos on Flickr
- July 2009 (3)
- June 2009 (54)
- May 2009 (41)
- April 2009 (46)
- March 2009 (21)
I replied on nextny as well, my $0.02 is that if the ad revenue mattered to me I'd block any such ISP, or alter the content delivered to that ISP to advise customers that the ISP is damaging my business (by skimming ads). You could offer customers of that ISP the option of paying for the content directly (which is unlikely to fly) or suggest alternate ISPs for the customer to use (and finally: recommend the customers to pressure the ISP to stop skimming or replacing the advertising).
It is copyright circumvention, which if that's the stated intent of the device may make its legality questionable under grokster and the DMCA. I'd also argue that any ISP which substantially changes the content served from a web site loses its common carrier status, making it liable for the content as a publisher of the content.
I wouldn't get upset over a mere copyright infringement - this is far worse.
The primary rights violation is of the publishing author's right to the integrity of their works, i.e. that they not be modified and presented as the work of the original author, unless it is made very clear that they are not the original author's work, but that of another author.
A secondary rights violation occurs in terms of misrepresentation, in that the publishing author is misrepresented as endorsing a product.
Don't piss about with the petty privilege of copyright. The ISP will claim some kind of nonsense that you've authorised them to convey/transmit your work to the members of your audience that they serve. They are making no unauthorised copies, but merely delivering their content 'alongside' yours for the benefit of the users they serve.
So, focus on the integrity of your web page (their failure to clarify that it is not the original work), and their failure to make it clear that you are not endorsing their adverts.
Otherwise, I'd resort to some kind of counter-javascript, ideally demonstrating to the browser that they and the advertiser were being ill served by their ISP.
I agree this is worst then copyright and I think like a programmer and not a lawyer but I'm looking at the tools in our arsenal to fight this. I'm sure that integrity is something that would work in court here in the USA. Assuming that changing the content is creating a derivative, the DMCA would apply. Either way if I were to pursue it, there would be a lawyer involved in the planning.
Put a script into your page that crashes/deactivates Fair Eagles ad Javascript.
This device sounds like it would make it even easier for a disgruntled ISP employee (or even a gruntled one) to replace all downloaded EXEs with a payload of her own creation.
Good thing the box isn't configurable....
Is the ISP market so competitive that some are resorting to blackhat style tactics? Kinda reminds me of a naughty NetZero back in the day. Speaking of NetZero...remember when they said that their service would always be free?
nice information