Honest Ads? The Act that’s Not Enough!

E.J. Hilbert
5 min readOct 20, 2017

Senators Klobuchar, McCain and Warner recently got together and proposed a law that is intended to regulate political ads on Facebook and other social media outlets. The Honest Ads Act would require political ads to be copied and made available for review by the public. It would also requires that information about the purchasers of the ads be disclosed.

The bill includes many changes in definitions about media and other relevant items to make the referenced court cases properly marry up with the letter of the proposed law but it also highlights the complete lack of understanding by the Senators and their staff of how online ads work.

This law would apply to any site with 50M visitors selling “qualified political ads” which are defined as being by or for candidates, or related to a political matter of national importance.

What it fails to realize is that websites do not sell “political ads.”

Websites like Facebook and Google simply sell ad space. They sell ad space to anyone willing to buy it.

An advertiser can go on to the website, establish an “ad campaign,” select the target demographic (chocolate loving people between 18 and 64 in the Cleveland area who attend church), submit their creative (fancy term for what the ad will look like), await approval and presto they have ads on websites.

The website will keep track of the number of times the ad is shown to users and/or the number of times someone clicks on the ad and will bill the advertisers accordingly.

That is how the system works.

Moreover, even if there was a category for “political ads” that advertisers are requested to select (there actually is on many sites) do you thing the propaganda artists of the various nation-states are going to click it? Come on.

Nevertheless, the vetting process will catch them right? The reviewers will flag the ads and catch these deceivers.

Not quite, websites are free because they sell ads. Ads equal revenue and unless the creatives presented are in clear violation of the sites Terms of Service (TOS), regulations or legal mandates, they will be approved. If you doubt that look at some of the ads that are displayed on CNN, the NYT or ABC (and they own Disney).

That is not to say that a vetting process does not exist. When a creative is submitted, it will include an embedded link. The website’s ad reviewer will click on the link and insure the landing page matches the advertised product and does not violate any of the website’s rules.

Here is the tricky part, when the reviewers click on the link embedded in the creative; they are not going directly to the final landing page. The link is to a site controlled by the advertiser, which they utilize to track where click traffic is generated.

Advertisers want to be able to independently track which ads are driving traffic to websites and not rely solely on the website where the ad appears. If I place an ad on site YXZ.com, YXZ will bill me $.10 for every time someone clicks on the ad. But, I do not trust YXZ not to inflate the number of clicks. Therefore, the link included in the creative/ad actually goes to a jumpsite where the referring website is recorded. The jumpsite then routes the traffic/user to the landing page associated with the product displayed in the ad.

My jumpsite records will be compared to the YXZ’s billing records and the actual number of clicks or click-throughs will be determined. I will then pay YXZ.com based on that number.

The jumpsite is a tracks click origination and routes traffic to the final webpage the advertiser wants the users to see.

Note the words, “the final webpage the advertiser wants the users to see.” Bad actors love this functionality.

If an advertiser, say a nation-state looking to sway opinion, does not want the website owner where they are placing an ad to know the real purpose of the ad, the nation-state will reroute the traffic.

When websites review ads, they utilize their corporate computers. These computers have a specified IP address or range of IP addresses. When the jumpsite detects web traffic coming from those IP addresses, that traffic is routed to very specific webpages. We will call them the clean pages. But, if the traffic is from other IP addresses, the traffic may be routed to other webpages. The Dirty pages.

The website owner, in this case YXZ.com, or Google or Facebook, do not see this reroute. They, or their ad reviewers, think they are going to the same page as everyone else.

Imagine a Facebook ad touting a website about Social Change. The Facebook ad reviewer clicks the link and goes to a RockTheVote website. All looks good. A Facebook user from rural Iowa clicks the link and based on the IP geolocation is routed to Alt-Right Conservative site. Another Facebook user from Midtown NYC clicks the link and again based on the IP geolocation, is routed to an Antifa Liberal site.

This is social media ad manipulation at its finest and social media site management is not addressing it. Moreover, neither will the Honest Ads Act.

If the Senators really want to affect change around social media advertising then it starts with making websites responsible for the products sold on their sites. The onus must be on the site owners to take responsibility for ads if for no other reason than the fact that they are profiting from the ad buys.

If an ad is placed on a website and that ad routes to a website that is different from that advertised, the website owner faces a penalty. Penalties will be avoided if the can prove they have taken reasonable steps to vet all ads on the site.

This means website will have to change their advertiser vetting process for all ads not just political ads.

Proper ad vetting will require website owners to do the following in addition to what they are already doing.

1. Vet each creative and its attached links from various IP addresses around the world. Utilizing VPNs, TOR and proxies makes this very easy to accomplish.

2. Record the click-through path of each ad clicked on and compare those paths to the path presented from other IP addresses

3. Publish a public list of all jumpsite domains and the advertiser with whom the domain is associated

4. Repeat this process randomly over the course of the ad campaign.

5. Document, Document, Document. Data storage is cheap and tracking the steps taken to vet ads and protect consumers will be the key to avoiding penalties

These simple steps will dramatically and negatively impact the ability of outside parties to utilize website based ads to manipulate users and/or to secretly spread propaganda.

A side benefit of these rules could also be a decrease in mortgage, dietary supplements and credit cards ads. But, I may be hoping for too much and I digress.

Senators Klobuchar, McCain and Warner, if you really want Honest Ads, then make the website owners responsible for what they get to paid to push on their sites. Make them take on the liability.

--

--

E.J. Hilbert

Work in the CyberSecurity and Privacy Arena worldwide, Owner of KCECyber, Ex-FBI. All opinions posted are my own !!!