I Used Google Ads for Social Engineering
Ad campaigns that manipulate searchers’ behavior are frighteningly easy for anyone to run.
Note: This is part 4 in a series. Part 5 is here. This originally appeared in The New York Times in a slightly different form.
Kevin Hines had one thought as he plummeted toward the Pacific Ocean: I can change anything in my life except the fact that I just jumped from the Golden Gate Bridge.
“One sentence could have stopped me,” Kevin wrote. “Had any one of the hundreds of passers-by engaged with me, it would … potentially have showed me that I had the ability to choose life.”
No person stopped Kevin from trying to kill himself. Could a Google ad have?
Google marketers like me survive by exploiting your impatience and impulsiveness (see Part 2). We must be there to serve you an ad in your “micro-moment” — the second you use your phone to alleviate the discomfort of not having something now. You have micro-moments about 150 times per day.
A helpful ad on Google will match your micro-moment keywords with a relevant landing page. But some ads provide counter-messaging or alternative destinations that go against your search words. These are called “redirect ads” (see Part 3).
With redirection, marketers swerve your monetizable desperation. But we can also swerve something bigger: your beliefs, convictions and ideology. There are advertisers in the digital marketing industry who want to find out how effective this new form of social engineering is. One of those advertisers is Google.
After Google used redirect ads to sway the ideologies of ISIS-sympathizers, they used them to sway the far-right. Then Google left behind a blueprint. The blueprint shows, step by step, how you can create your own redirect ads to sway any belief or opinion — held by any Google user, anywhere in the world — of your choice.
You don’t have to be a marketer with years of experience to do this. You just need to follow the instructions and put up a credit card (a few hundred bucks will suffice).
Recently, I followed the blueprint and created a redirect campaign of my own.
The first step was to identify the problem I wanted to address. I thought about Kevin Hines and how his fate might have changed if cellphones with Google had existed back in 2000 when he tried to take his own life.
Could Kevin have been redirected? Could he have been persuaded — by a few lines of ad copy and a persuasive landing page — not to jump? I wondered if I could redirect the next Kevin Hines. The goal of my first redirect campaign was to sway the ideology of suicidal people.
The problem my campaign addressed: Suicidal people are underserved on Google. In 2010, Google started making the National Suicide Prevention Lifeline the top result of certain searches relating to suicide. It also forced autocomplete not to finish such searches.
The weakness of Google’s initiative is that not enough variations of searches trigger the hotline. A search for “I am suicidal” will result in the hotline. But a search for “I’m going to end it” won’t always. “I intend to die” won’t ever. A lot of “higher-funnel” searches don’t trigger the hotline.
I hoped my redirect campaign would fill the gap in Google’s suicide algorithm. I would measure my campaign’s success by how many suicidal searchers clicked my ad and then called the number on my website, which forwarded to the National Suicide Prevention Lifeline.
Nine days after my campaign began, the ads were accepted by Google. My ad was the first result across the United States when someone Googled with suicidal intent. I showed unique ads to suicidal people who were physically located around the Golden Gate Bridge.
Nearly one in three searchers who clicked my ad dialed the hotline — a conversion rate of 28 percent. The average Google Ads conversion rate is 4 percent.
The campaign’s 28 percent conversion rate was met in the first week. Not counting people who thought I was associated with the lifeline or who did not read the ad or language on my website, that leaves a rate suggesting there’s a need in this ad space not being met.
After the suicide deterrence campaign ended, I created another redirect campaign targeting Americans who told Google they wanted to shoot up a school or commit terrorism.
Like the suicide deterrence campaign, these ads connected clickers to a website with a crisis hotline. Prospective school shooters were enticed by my ad, but the conversion rates were low. They were reluctant to speak with someone.
Google let me run the ads with no issue. It didn’t seem to care what the language on my website was, or what phone number I directed people to. There was no vetting process to become a redirector. I didn’t need qualifications to be a conduit of peoples’ fates. I expected the ads to get rejected, but they were not.
For every search conducted by an American who wanted to kill, I saw the exact words he or she typed into Google before clicking my ad. And anyone who runs campaigns using the blueprint will have access to the same. It is a one-way mirror into the American psyche.
Click data can be used for harm by a redirector with bad intentions. If redirectors can groom ISIS sympathizers, they can also use it to groom school shooters. A redirector using a call-forwarding service ($30/month through Callrail) can link up with like-minded terrorists by having clickers’ calls directed to their phones.
Another example: A redirector creates a campaign to sway painkiller addicts from trying heroin. The redirector targets keywords like “I’m going to try heroin.” His ad and website encourage the clicker to call a substance abuse hotline. But the call forwards the impressionable addict to the redirector’s number. Over the phone, the redirector convinces the clicker to buy his heroin. (I tested such a campaign, and saw searches from Americans who asked Google where to buy, how to cook, how to use, and if to try, heroin. There was no vetting of where the phone number on my website forwarded.)
With their ISIS campaign, Google decided what a radical view was, who seemed to hold those views and who should be able to view them. It’s hard to be cynical about an initiative that deters extremism. But entering the domain of social engineering is a slippery slope. The standard of what needs to be deradicalized is adjustable.
Using Google’s blueprint, anyone can access the platform’s precise targeting tools and redirect ads to help further his or her own agenda. For instance, swaying peoples’ political beliefs during an election.
Those who bear the brunt of that abuse aren’t just the impatient and impulsive. (As we saw in Part 1, more than 50 percent of people still can’t differentiate between an ad (redirect or not) and an organic result on Google.)
What the public needs is a free blueprint on how to use Google defensively. But that won’t happen while profits for advertising are tied to exploiting your micro-moments.
Looking for Part 5? It’s here.
