The Advertisement That Finally Worked

For a quarter of a century the online advertisement has begged us to click on it, and it has taken an Israeli firm to discover that the advertisement is far more persuasive when it no longer asks.

That, at least, is what the researchers of Citizen Lab at the University of Toronto allege about Discover-Tech, and one must be scrupulous here, because the company’s capabilities remain the researchers’ claim rather than an established fact. Still, the claim deserves attention even before it is proven, because it describes something the respectable world has spent years pretending was impossible. The allegation is that an advertising agency served adverts capable of delivering “zero-click” spyware. The victim need not be foolish, careless or curious. He need only be present. The banner arrives and sits beside his morning news like an uninvited guest who is too well dressed to be turned away, and while he reads about the weather it reads about him.

The conventional view, which is the view of every trade association that has ever issued a statement, is that this is a perversion of advertising. On this account there is the honest business of selling shoes to people who have looked at shoes, and there is the criminal business of hacking telephones, and a wall stands between the two. The view deserves its strongest form. Targeted advertising, its defenders say, deals in categories rather than persons. It knows that someone in a certain city, of a certain age, with a certain fondness for running shoes, is looking at a page. It does not know his name, and it does not want to. It wants his attention, which he gives freely and which costs him nothing.

The difficulty with this defence is that it describes the advertisement and ignores the auction. Before a single advert appears on a screen, a great deal of private information has already been handed out. The visitor’s device, his approximate location, his habits, his inferred tastes and the fact that he is reading this particular page at this particular hour are all offered to a crowd of bidders. That crowd is not vetted with any rigour worth the name, and it competes in a fraction of a second to decide who should be allowed to speak to him. The system was built to let a stranger pick out one person from millions and place something in front of him. It was never necessary to corrupt this machinery in order to hunt a person with it. It was only necessary to be the stranger who wins the bid.

So the scandal, if the allegations hold, is not that someone broke the advertising industry. It is that someone used it exactly as designed and changed only the parcel. The industry has always sold access to a person while insisting that it sold nothing so vulgar as the person himself. Discover-Tech, on Citizen Lab’s account, simply declined to keep up the distinction. One could almost admire the candour, if candour were what the business required. The profitable thing about surveillance has always been that it called itself marketing; the dangerous thing about this case is that it stopped calling itself anything at all.

This explains why the stakes cut both ways, and why “mass-profiling” and “covert hacking” belong in the same sentence. The first is the ordinary condition of the internet, and nobody is arrested for it. The second is a crime almost everywhere. The researchers’ finding is that the road from the first to the second turns out to be short, paved, and lit, and that it runs through the same pipes that carry an advert for a holiday in Crete.

Then there is the location, Israel, which has produced commercial spyware firms with a regularity that suggests a national gift. The usual reply is that each new company is an aberration, a few bad actors in an honourable trade. An aberration that keeps occurring is better described as a curriculum. It does not follow that every engineer is a spy. It does follow that a market exists, that it pays handsomely, and that the customers are governments, who are the only clients in the world wealthy enough to want to know everything and powerful enough never to explain why.

Picture, then, the person all this is for: a journalist, perhaps, or a lawyer, or someone who has merely annoyed the wrong ministry. She sits with her coffee, scrolls past a cheerful picture of a sunlit beach, and does nothing whatever. That is the beauty of it. After all these years, she has finally become the ideal audience. She does not click, she does not buy, and she does not know, and somewhere a client is billed in full.