Login
close
Login is restricted to DCN Publisher Members. If you are a DCN Member and don't have an account, register here.
Search

Digital Content Next logo

Menu

Articles by: "Chris Olson, CEO & Co-Founder—The Media Trust"

Perspectives | Supporter Spotlight

Digital trust and safety: Do you have what it takes?

It’s not hard to see that digital advertising is undergoing another paradigm shift. Spurred by pandemic-fueled online use and continued cyber-driven attacks, consumers are becoming more aware of internet dangers. From ransomware and credit card theft to scams and inappropriate content, consumers have had enough.

Today’s consumers want to feel cared for and cared about. They also prefer brands whose values align with their own.

Recognizing this sentiment, brands seek to showcase how they contribute to building a better world as evidenced by multiple initiatives covering diversity, sustainability, and responsible programming. For publishers, this consumer-first mentality extends to the online environment, where brands are looking to safeguard consumer expectations of privacy and security.

Welcome to digital trust and safety.

A new era in digital

Digital trust and safety requires understanding and addressing the harmful content and/or conduct experienced by consumers when accessing websites/mobiles apps. This ranges from how digital products are built, managed, and promoted through to how they make consumers think, feel, and act. In effect, it’s all about putting the consumer at the center of decisions regarding their online experience.

This thinking is critical when you consider the different risks faced by different consumers, especially the more vulnerable members of society, e.g., elderly, children, technologically naive.

Layer on the reality of targeting and national security risks become apparent as government and military employees are consumers, too.

Accepting responsibility for the consumer experience transforms how the industry—brands, AdTech, publishers—approaches its contribution to the consumer experience. Instead of  focusing on activity that affects a business (viewability, ad fraud or brand safety), you prioritize actions that impact the consumer to build trust. As Conny Braams, Unilever’s Chief Digital and Commercial Officer recently acknowledged, “The currency in Web 3.0 is not crypto, it’s trust.” It has become clear: Digital trust and safety is the next phase in the digital evolution chain. 

The evolution is underway—just look at the new and growing crop of job titles on LinkedIn.

Factors driving digital trust and safety

Going beyond ad fraud, content moderation, bots and other brand-oriented initiatives, digital trust and safety is all about the consumer. It is driven by security, data privacy, and trusted content.

  • Security: Protecting consumers and their devices from malicious, anomalous, compromised, or non-compliant code that enables distribution of backdoors, credit card theft, ransomware, cryptomining, etc.
  • Data privacy: Guarding against unauthorized tracking of consumer activity, especially when performed by unknown parties
  • Trusted content: Ensuring the substance of the experience doesn’t endanger consumer well-being, e.g., false claims, misinformation, online scams, etc.

With digital at the nexus of companies and consumers, there’s nothing more important than safeguarding the user experience. It’s more than ad fraud and blocking ads. This focus on safety and security encompasses the entire consumer experience.

Adopting a consumer-first approach isn’t hard, but it does require unwavering dedication. Once executives agree that consumer well-being is important, this thinking will cascade to permeate all aspects of the business. All it takes is consistently asking and documenting the impact on consumers for key touchpoints and commercial initiatives, from product introduction and feature development to marketing promotions and customer service. This  guiding principle will add clarity to and inform decisions. It can also serve as a competitive differentiator elevating your business in the eyes of the market.

It’s your move

Government leaders and regulators are listening. Various initiatives are underway to protect  consumer online experiences: UK Online Safety Act, EU Digital Services Act, ban on surveillance advertising, more limits on data collection, and more.

Collectively, the industry needs to stop harmful activity as it enters the digital ecosystem and  ultimately before it is served to consumers. Frankly, it’s the right thing to do. That’s how we engender trust, and a trusting consumer will buy more (90% of consumers would buy more from a brand they trust).

Ask yourself: Are you willing to put the consumer first when it comes to digital? I’m game. Are you?

Perspectives

Can your consent management platform handle today’s regulatory challenges?

Digital regulation is in the process of adjusting to a sea of change brought in by legislators at state, national, and international levels. Following the EU’s GDPR lead, the California Consumer Privacy Act took effect meaning publishers must now ensure sufficient measures are in place to protect the data privacy rights of California residents. Otherwise, they face financial penalties due to noncompliance. Many publishers turned to their consent management platform (CMP) to handle these challenges. However, due to poor consent signals, publishers are concerned about continued monetization efforts.

Data protection actions

All data privacy regulations involve three basic tenets:

  1. Data Inventory: identification of all data collected, used, shared and stored by the organization. This frequently involves questionnaires and mapping of data touchpoints. 
  2. Consumer Interaction: covers the rights consumers have regarding their data, i.e., request information, opt-in to collection, privacy policy, etc.
  3. Technology Adjustments: ability to satisfy requirements for upholding consumer rights such as consent management, digital data tracking restrictions, data tracking categories and more.

Data regulation and browser actions put targeted advertising, cookies, and other persistent identifiers under unprecedented scrutiny unlike ever before. Tracking technologies have not been of much legal concern until recent years and private right of action is prompting companies to think and work smarter. 

Even worse, CMPs struggle to send the appropriate signals regarding consent. This is particularly difficult because different markets have different requirements. These unclear signals in RTB muddy the bid process, causing trepidation among AdTech out of fear of serving an ad to an un-consented user. The result? Lowered CPMs for everyone.

Under today’s regulatory environment, the systems by which organizations have previously built their digital ecosystems could cause significant headaches for ad-supported businesses. But it shouldn’t have to be that way. Publishers that take control of their websites and mobile apps can facilitate compliance with any data protection regulation.

The DCN example

The presence of unmanaged third-party vendors and their contribution to widespread data tracking activity are the chief culprits of this digital woe.

Analysis of leading DCN member websites reveals that 81% of the executing code required to render the user experience is from third parties. Other data points include:

  • 774: average number of domains executing
  • 8%: executing domains are risky
  • 138: average number of cookies dropped per user session
  • 21% of cookies exhibit lifespans greater than 1 year

With your websites and mobile apps causing this much code executing on consumer devices, you cannot ignore the data compliance risks of external code from service providers and third parties. As a site owner, you must know exactly what personal information your digital assets collect, the reason it’s collected, and who has access to the information. This will help you accomplish two CCPA obligations: 

  1. Provide users with full disclosure of what information you collect from them.
  2. Inform users in case their data has been misused or shared without consent. If consumer data is leaked or mismanaged, your company (and associated digital vendors) must accept responsibility for the incident and work to recover consumer trust and re-establish the brand’s position. 

Approximately 8% of executing, client-side code presents a controllable risk. These domains are overtly malicious, have a history of suspicious activity, or mask their ownership. Inability to verify domain ownership is a red flag; this type of obfuscation is basic tactic adopted by bad actors. Unmanaged third-party code is routinely hijacked and used as a backdoor to infiltrate consumer-facing websites and covertly skim customer data.

Throughout 2019, several big brands made the headlines and found themselves in regulatory hot water because of large scale data attacks by cybercriminals. These breaches resulted in well-known industry giants being slammed with record-breaking regulatory fines and penalties. 

Thus, it’s vitally important for companies to implement digital security measures to ensure their CCPA preparedness. 

Compliance is not a spectator sport 

Compliance is more involved than simply drawing up contracts that require service providers to comply with obligations. You must be just as concerned with ensuring that providers are compliant as you are with upholding your compliance. 

Many publishers perceive compliance to be harmful to page views, content consumption, and as a result advertising revenue. However, it has quite the opposite effect. Consumers and advertisers alike gravitate towards businesses that care about their privacy and strive to secure it. They’ll remain loyal to companies that have full visibility and knowledge over the data collection taking place on their sites. They expect companies to be transparent about and communicate all the information that will be collected during a browsing session. 

Compliance management can be burdensome and time-consuming without the right tools and expertise. But when procedures are optimized and tools with the capability to provide a broad view of the digital ecosystem are implemented, compliance management can be operationalized and streamlined to gain total control over unauthorized data tracking and take back control of the digital landscape your company operates on.

About the author

Chris Olson co-founded The Media Trust with a goal to transform the internet experience by creating better digital ecosystems to govern assets, connect partners and enable Digital Risk Management. Chris has more than 15 years of experience leading high tech and ad technology start-ups and managing international software development, product and sales teams. Prior to The Media Trust, Chris created an Internet-based transaction system to research, buy and sell media for TV, radio, cable, and online channels. He started his career managing equity and fixed income electronic trading desks for Salomon Brothers, Citibank and Commerzbank AG.

Perspectives

Malware thrives in a blocking world

Security professionals continue to tell us that the threat landscape is constantly evolving and it’s not uncommon for The Media Trust’s Digital Security & Operations (DSO) team to discover a new threat firsthand. For example, the industry has been testing the effectiveness of malware blockers in lieu of scrutinizing code in the ecosystem. Unfortunately, the result is that publishers are experiencing larger, more penetrating attacks.

A current attack, named Ghostcat-3PC by our DSO, involves malware running behind the scenes. It slips through third-party feed-based malware blockers in order to hijack mobile browser sessions in the U.S. and Europe. Over the course of three months, the DSO discovered more than 130 different outbreaks related to this attack that affected hundreds of well-known publishers.

We detected the malicious ad while analyzing suspicious code from ad files hosted on two cloud platforms, one of which had the URL: qing.js. The malware hid in an ad served to publisher websites. When the malicious ad was delivered to the browser, it lifted browser fingerprints and used them to check whether the ad was running on one of 100+ publishers it was targeting. Each campaign centered on code containing its own list of 100+ publishers that was distinct from the lists of the other campaigns.

Exploiting defense security weakness

The malware achieved persistence by disguising malicious code – either by cloaking it with additional characters at both ends or splicing with additional characters. Most blockers work by detecting known malicious code found in an ad tag or on a publisher site. If the malicious code fails to match any code on the blocker’s keyword list, it will run as designed. Any change to the targeted code, no matter how minor, will prevent the blocker from recognizing it as a threat.

Knowing blockers’ fundamental weakness, attackers split the URL of the malicious domain, qing.js. In this scenario, blockers on the lookout for “qing.js” failed to recognize the disguised URL and therefore allowed it to run. For good measure, the attackers also used hexadecimal encoding to add a layer of obfuscation to the concatenated URL and the JavaScript file that delivered it.

These changes to the URL, combined with the large number of subdomains in use, made the attacks hard to detect and, even once discovered, hard to follow. Obfuscation blurred any connection between the subdomains and the ads, making these links impossible to find except by experts who find and track evolving threat patterns. 

Tracking the progress of this massive attack

The malicious attack was out of the ordinary — not only in sophistication but also in scale. The Media Trust identified and rebuffed more than 130 outbreaks linking back to 18 strikingly similar malicious campaigns over just three months. In that period, the malware script morphed into four different versions, each one concatenating URLs to hide from blockers. This method of foiling blockers enabled attackers to repeatedly infiltrate the supply chain—unimpeded—and infect hundreds of publisher websites and their millions of users.

We noted the malvertiser’s use of a host and file naming convention. The pattern emerged once the number of split URLs hosting the malicious script and the number of infected ad campaigns appeared to have reached a critical mass. The convention seemed to associate the script with and track each campaign.

To track the script’s progress, file names and hosts varied with each campaign, and included the JavaScript file name and the image width. Note the strict naming convention for JavaScript file names, which includes the use of Chinese words for:

  • Numbers (“ba” means 8 and “si” means 4)
  • Elements (“shui” means water)
  • Basic colors (“huang” means yellow, “zi” means purple, “qing” means green, “cheng” means orange)
  • Animals(“niu” means cow)
  • Vehicles (“che” means car, “sanling” means Mitsubishi)

The URL naming convention suggests the involvement of a group of hackers who continually morph their code and URLs to track their progress. Their tracking did not end here. They appeared to also track the presence of known signature-based security defenses, perhaps to find out how each would respond to the malware. In other words, they might be tracking whether these security tools have been updated to recognize the code and impede its progress.

Protecting the digital ecosystem from this threat

Today’s new and emerging threats are designed to fool signature-based security tools by combining a number of advanced techniques in obfuscation and morphing. In such a challenging environment, the best defense is one that involves collaboration with the entire digital supply chain on identifying and rooting out malicious actors.

Clearly, as publishers embrace blockers’ set-and-forget convenience, malicious actors are taking note.  A single security solution will be no match against the thieves and fraudsters who continue to sharpen their saws. Nor will it fulfill the data security requirements of a rising number of data privacy laws like the upcoming California Consumer Privacy Act. More importantly, consumers are willing and able to vote with their feet—and file lawsuits. And they won’t entrust their business to companies that can’t be trusted with their data.

About the author

Chris Olson co-founded The Media Trust with a goal to transform the internet experience by creating better digital ecosystems to govern assets, connect partners and enable Digital Risk Management. Chris has more than 15 years of experience leading high tech and ad technology start-ups and managing international software development, product and sales teams. Prior to The Media Trust, Chris created an Internet-based transaction system to research, buy and sell media for TV, radio, cable, and online channels. He started his career managing equity and fixed income electronic trading desks for Salomon Brothers, Citibank and Commerzbank AG.

Innovation

Own your code and its impact on user experience

It’s hard to remember a time before the Internet. But many would still be surprised to learn that the first online news publication was launched in 1979, on CompuServe’s dial-up service. This September, it will turn 40, and its memory is kept alive by news organizations that took part in CompuServe’s historical experiment on the potential of online papers: The New York Times, Washington Post, San Francisco Chronicler, Atlanta Journal-Constitution, Virginian Pilot, and many others.

All of them are still online, proving that the spirit of innovation—and braving what was then a largely unknown new world—they all shared may be key to their longevity. However, times have changed. At the dawn of digitalization, publishers still owned the code that ran their online platforms. Decades later, a shift to third-party assets has changed the balance of power and introduced risks that the media is still struggling to control.

First in digital, last in security

Thanks to digitalization, publishers now have access to a global audience. Not only is it possible to communicate with readers in real-time, but new revenue models fundamentally change the way that they pay for it. From ad-supported content to metered paywalls, the digital ecosystem boosts a publisher’s reach while offering long-term profitability.

At times, however, the race for revenue and new markets has turned hectic. Bells and whistles like programmatically targeted ads, content recommendation, online chat, and video offer a competitive advantage. They can improve user experience, extend the possibility of content generation and raise profits. But to keep the show going, publishers need code. And today, most of that code comes from third parties.

Unfortunately, third-parties reduce the amount of direct control that media can exercise over its properties. Left unmonitored, they can lead to latency, data breaches, and fake news—all of which can threaten revenue streams. Add to the mix new regulations being introduced across the country, the pressure on publishers to regain control of their digital ecosystem and pressure continues to mount. Now, the industry that pioneered digitalization must also embrace programmatic monitoring, and that begins by understanding where many of these problems come from.

The risks of third-party code

Today, 60-95% of the code across digital platforms is owned and operated by third-party vendors, with online media averaging 90-95%. Given that there are over 7,000 digital vendors to choose from, publishers can make some bad partnership choices—ranging from one with poor controls that open it to compromise to one with explicit nefarious intent. Whatever the case, AdTech is abused to steal or resell user data, spread malware, and redirect users to malicious domains.

The methods used by attackers have also increased in complexity, easily bypassing traditional security measures used by Ad Ops to block them. In recent history, we have witnessed:

  • ICEPick-3PC – injected code into Javascript libraries used across thousands of websites
  • PayLeak-3PC – infected seemingly secure iOS devices by disguising itself as an update
  • JuiceChecker-3PC – evaded detection by conducting checks on user motion, battery level, user agent, and screen size
  • CartThief-3PC – injected formjacking scripts to steal payment card details from e-commerce sites
  • Stegoware-3PC – hid in seemingly innocuous PNG files and conducted various checks to ID and infect iOS devices

These are not isolated incidents. Over the past three years, the number of malvertising attacks has steadily risen, with major consequences for online publishers. In a span of 24 hours, The Media Trust manages an average of 1,500 active malware incidents. Each month, we detect more than over 6,000 new malicious domains responsible for malvertising and redirect attacks.

Self-regulation threatened

In 2018, billions of consumers around the world were impacted by data scandals. The EU’s General Data Protection Regulation (GDPR) has placed extensive restrictions on how publishers may legally use consumer data, resulting – already – in record penalties and active investigations.

In the United States, the California Consumer Privacy Act (CCPA) threatens to follow in GDPR’s footsteps. Meanwhile, U.S agencies including the FTC and DOJ have begun to levy unprecedented penalties on digital brands accused of data mishandling.

Where governments aren’t trying to contain cybercrime and privacy violations, browsers and hardware manufacturers are filling the gap.

Cookieless world emerging

In an attempt to curb data leakage and malware spread, periodic cookie audits are mandated by the GDPR in Europe and by the Privacy and Electronic Communications Regulations in the United States. But as third-party cookies are projected to become less important to the digital ecosystem, this effort becomes increasingly fruitless.

Attackers now have multiple routes for tracking users from fingerprinting to device IDs and limited browser tracking functions. As time goes by, yesterday’s malware vectors disappear, leaving behind only one common denominator: the attackers themselves. Producing a safer digital ecosystem begins by eliminating them.

Steps to reclaim user experience

After Cambridge Analytica, a global userbasecares what happens to their data, and – whether through regulations or ad blockers – they are holding publishers accountable.

The best way for publishers to respond is by retaking control of the code that operates outside their jurisdiction, and they can do it in five steps:

  1. Decide the rules. Publishers must know who they want to work with before they enter into any agreements. They must also know what counts as “unacceptable” behavior across their digital properties. These policies should be decided in tandem with all relevant parties, including IT, marketing, and privacy executives.
  2. Know who is running code on your site. Before allowing digital code and assets onto their domains, publishers must identify and vet the creators. Doing otherwise is sacrificing a basic level of control that accumulates with time.
  3. Communicate policies. Not all data breaches happen because of malicious third parties. Some vendors are just careless or forgetful. To avoid preventable violations, publishers must clearly and specifically communicate their security rules to their partners.
  4. Monitor compliance. Aside from communicating the rules, publishers must also enforce them. And to enforce them, they must continually monitor their partners by scanning their domains, so they will be aware when violations occur.
  5. Terminate and report bad partners. Publishers must take action against the partners who violate their rules and communicate these violations to upstream partners, helping to permanently remove repeat offenders from the digital ecosystem.

By following these rules, online media would experience an immediate, noticeable improvement in ad quality and UX. As data breaches decreased, AdTech Tax and other penalties would become a dwindling threat to revenue, leaving publishers exactly where they belong: as leaders of digital commerce and security.

Perspectives

Google Chrome cracks down on tracking cookies. But who should make the rules?

Google has joined the likes of Apple Safari and Mozilla Firefox on the privacy front by offering users of Chrome the chance to disable or remove third-party tracking cookies. Last week, the company announced three protections that will soon be coming to the world’s most widely used web browser:

  1. In order to access consumers, developers will be required to specify – with attributes – which cookies contain user tracking and cross-site capabilities.
  2. Chrome users will be able to access this information and delete all cookies without affecting those which are active on a single domain (e.g., login, settings, site preferences).
  3. The browser will “aggressively restrict” fingerprinting techniques used by websites to identify browsers without a tracking cookie, though Google is vague on what this entails.

In today’s environment, it shouldn’t come as a surprise that one of the biggest players in online advertising and data-tracking is coming down hard on third parties (even if they don’t have a stellar track record with tracking). Let’s take a critical look at this new direction, starting with the positives.

The good

In the past, measures to crack down on data privacy abuse have swung between ruthless and milquetoast. Safari’s Intelligent Tracking Protection (ITP) has been called “nuclear” [by pundits for crippling trackers right out of the box, a measure that users rarely bother to disarm.

As a cornerstone of the digital ecosystem, Google understands the importance of data tracking for online publishers, acknowledging on its blog that cookies “play an important part of the web experience today,” It went on to add:

“Blunt solutions that block all cookies can significantly degrade the simple web experience that you know today, while heuristic-based approaches—where the browser guesses at a cookie’s purpose—make the web unpredictable for developers.”

Chrome’s new privacy features differentiate themselves by providing, in outline, a standard for transparency that eliminates guesswork and ostensibly leaves users in charge of their web experience.

This approach is both more balanced and precise than the wide bat swung by some competitors. These approaches challenged publishers to take inventory of the cookies they drop, and to use them in a more responsible way.

But not everyone is convinced that Google should wield its power over the web this way.

The bad

With a natural vested interest in its own data-driven products and services, some wonder whether the new privacy standards will apply to Google itself. While the company insists that they will, its power to act otherwise points to a larger problem.

We have heard time and time again that “data is currency,” and that’s true. Organizations depend on it for every step of the business cycle, from lead acquisition to customer service. However, with customer bases collectively exceeding half the global population, tech giants like Google  and Facebook have as much data as they could possibly want.

Even assuming the best of intentions on their behalf, we still must ask: Should privacy standards be determined and enforced by the very organizations who stand to benefit the most from them?

The battle for control

The drive for more and more data has given rise to the advertising crisis as we know it today. In the face of invasive third-party trackers, malvertising, performance issues, data breaches and other privacy infringements, consumer trust is at an all-time low.

One thing is increasingly clear: The industry needs oversight, and many contenders have stepped up to fill the vacuum. From emerging legislation like GDPR and CCPA, to Google, Mozilla, and other browsers, publishers have no shortage of authorities trying to dictate their relationship with clients—both consumers and brands/advertisers.

Awash in downgraded content, poor segmentation, and privacy agreements galore, end users are the casualties of this struggle, and the battle for privacy governance has quickly become a case of too many chefs spoiling the pot.

So, here’s a thought: What if organizations were equipped to set their own rules? And instead of concentrating power in the hands of Silicon Valley giants, what if the relationship between businesses and advertisers could be self-governed?

A better way forward

Publishers and media organizations are on the cusp of winning the future of digital. With historical direct relationships with brands and ownership of coveted first-party data, there’s never been a better time to take control of the digital revenue channel. The first step to winning is knowing the parties that contribute to your supply chain and verifying compliance with publisher policies covering data, security, quality and performance.

In most cases, more than 90% of their code is third-party generated and the veil of mystery surrounding a third-party’s identity has been a significant obstacle to content moderation. If Google did one thing right with the new Chrome updates, it was forcing developers to identify the purpose and scope of their cookies to the end user.

As long as businesses can vet the partners executing on their platforms, vulnerable and abusive code can easily be censured, creating a better digital supply chain for users, ad exchanges and publishers alike.

In this future, Digital Vendor Risk Management (DVRM) can arm organizations with the information they need to govern their digital assets. With built-in regulatory compliance, DVRM not only identifies risks, but ensures that the proper response is taken in any jurisdiction.

The best solution for customers and the best solution for business always go hand in hand. Rather than bringing them under an iron fist, DVRM creates a sustainable digital ecosystem by empowering businesses to protect their customers while driving revenue.

About the Author

Chris Olson co-founded The Media Trust with a goal to transform the internet experience by creating better digital ecosystems to govern assets, connect partners and enable Digital Risk Management. Chris has more than 15 years of experience leading high tech and ad technology start-ups and managing international software development, product and sales teams. Prior to The Media Trust, Chris created an Internet-based transaction system to research, buy and sell media for TV, radio, cable, and online channels. He started his career managing equity and fixed income electronic trading desks for Salomon Brothers, Citibank and Commerzbank AG.

Perspectives

The cookie conundrum: Complexity for publishers in the age of ecommerce and cybercrime rings

Media publishers in 2018 are at a historical juncture as they face new pressures from many directions. These pressures included competing content providers who provide a wider array of products to draw site users; readers with changing habits, expectations, and preferences; and a growing number of data privacy regulations that are forcing businesses, in general, to change how they operate.

Publishers in the increasingly diversified digital media landscape have had to revise their business models along with the introduction of paywalls, multi-tiered subscription packages, and merchandise. Not only are they content providers but full-blown ecommerce businesses, a change that comes with its own set of challenges.

Cookies and commerce

That fact is that, if a website accepts any form of payment, it is running an ecommerce platform. Actually, media companies are unique in that they can have three disparate revenue channels all tied to their digital environment: advertising/sponsorships, subscriptions and merchandise. More likely than not, these three channels are managed by various internal groups with different objectives. The absence of a single throat to choke for the digital environment at a time when the latter is under mounting cyberattacks and a growing number of data privacy regulations raise these companies’ exposure to a host of digital risks.

The most significant challenge is managing all the third parties and digital partners who help make the ecommerce websites’ user experience a success. That experience involves providing content to users based on their subscription level and enabling payment for subscriptions and—for a growing number of publishers—merchandise.

The problem is, most of these third parties, and the cookies they use to identify visitors/users, are unknown to publishers. On average, the cookies they drop into an ecommerce site can account for anywhere between 50-95% of all cookies on that site. Left unmonitored and unchecked by publishers’ digital policies, those largely unknown cookies can degrade the user experience by driving up latency, collecting information from unsuspecting users, or both.

Regulation ups the stakes

While latency might not break any laws, collecting information without users’ informed, specific consent violates a rising number of data privacy regulations. We have seen the impact of changes to the legislative landscape on publishers. Privacy laws such as the EU’s GDPR and the state of California’s Consumer Privacy Act have created an increasingly dangerous environment for data processors who fail to adhere to them.

In May of this year, after GDPR came into effect, large US based publishers such as The Chicago Tribune became unavailable to EU readers, due to the mismatch in privacy laws in the European Union, and the code operating on these sites. At the time of writing, the Tribune remains offline in the EU, highlighting how seriously even the largest publishers are taking the legislative changes we have witnessed this year. The proposal of a U.S. federal Consumer Data Privacy Act, which would jail CEOs for misleading regulators makes compliance even more urgent, especially for large companies.

The mood of publishers’ audiences is also changing. As the Cambridge Analytica scandal has proven, users of all types of platforms are increasingly aware and suspicious of how their own data is collected and used. The last year’s mega breaches such as Equifax have only escalated consumer wariness of the security and use of the data they willingly provide to publishers.

Bad actors

To further muddy the waters, we have seen the exponential growth of malicious campaigns targeting publishers. Increasingly sophisticated cybercrime groups such as Magecart, widely believed to be responsible for the British Airways breach, and, more recently, 3ve, are exploiting vulnerabilities around payment pages, capitalizing on digital advertising’s obscure processes, and targeting users of digital wallets.

As if all of this wasn’t enough, publishers also have to contend with upstream partners who process or use the data harvested on their platform whose consent management process, or lack thereof, could put publishers at risk of infringing data privacy laws.

Digital cookies are routinely dropped on with 65% of cookies collecting personal data, and 28% of cookies lasting longer than a year. While they allow publishers to provide a better experience for readership, it can also mean that they are in direct conflict with the latest data privacy laws.

Getting cookies right

Publishers can take proactive measures to stay compliant by ensuring that executives in charge of the various ecommerce revenue streams align their goals, objectives and policies in order to safeguard and enhance the user experience. Understanding the landscape of your digital ecosystem is essential. Make sure that you are monitoring your website for the code being run, and proactively question why it is running. Furthermore, the third parties running code, and the companies in their own supply chain who process data need to understand the players and activities in their own digital landscapes.

However, taking these steps are just the start. Publishers must also prove such measures are being taken. Therefore, publishers, their third-party partners and any other relevant parties should undertake rigorous audit trails to retain proof of regulatory compliance. This allows you to make the case for your overall legislative posture, if it is called into question.

In addition to this, there are industry organizations which aim to create a set of standardized compliance-related practices in order to create a more transparent culture around cookies. The International Advertising Bureau have attempted to deliver and enforce a framework via their CMP Validator. The AOP (Association for Online Publishing) UK has engaged in similar activities with their Cookie Consortium. Involvement of as many publishers and technology vendors as possible in these industry initiatives is crucial to the continued success of publishers and other players along the digital supply chain.

Why it matters

It’s important to establish that the running of cookies on web pages is a fundamental part of how the internet functions in 2018. It makes life significantly easier for both publishers hoping to keep users happy, even working to turn this hope into an actionable reality. It also benefits users hoping to access content, and marketers hoping to build a strategy.

However, they can only provide these useful functions if the organizations that use them do so with the appropriate regard for any regulations that govern them, as well as for the users whose data is stored in them. In fact, publishers stand to gain the most from the changing regulatory environment, which provides an opportunity to collaborate more closely with third parties and digital partners, and ultimately build customer trust by improving their user experience.

About the Author

Chris Olson co-founded The Media Trust with a goal to transform the internet experience by creating better digital ecosystems to govern assets, connect partners and enable Digital Risk Management. Chris has more than 15 years of experience leading high tech and ad technology start-ups and managing international software development, product and sales teams. Prior to The Media Trust, Chris created an Internet-based transaction system to research, buy and sell media for TV, radio, cable, and online channels. He started his career managing equity and fixed income electronic trading desks for Salomon Brothers, Citibank and Commerzbank AG.

Uncategorized

Policing third-party code is essential to digital vendor risk management

Some of the biggest companies including Saks Fifth Avenue, Lord and Taylor, Best Buy, MyFitness Pal, and Applebees have been the victims of breaches due to third party code. Third parties provide services around content recommendation engines, ads, customer identification platforms, data management platforms, social media widgets, and video players, to name a few.

Oftentimes, these third parties turn to their own third parties to help deliver their services. When unknown third (or nth) parties become part of a website’s support structure, they can introduce more risks than they were brought in to reduce, because they lie outside of a formal IT organization’s control. Gartner predicts these “shadow IT” will be the root cause of 33% of security problems by 2020.

Throwing light on digital shadow IT

Last year, one of the world’s largest magazine publishers was shocked to find their sites were supported by over 1,000 third parties. This year, they were able to winnow down that number to 100 of the most trusted. In July 2018, random sample of 350 of The Media Trust’s publisher clients showed that each of their domains was supported by an average of 140 third parties, which provided anywhere from 50-95% of each site’s code. For the magazine publisher and those in the random sample, most of these third parties (much less their activities) were unknown to them.

Recently, The Media Trust digital security and operations team found and foiled a malware campaign that affected close to 60 major publishers whose audiences span the globe. These publishers’ trusted digital advertising partners had unknowingly served an ad with malicious code that would replace the legitimate creatives of a globally recognized brand. The code would redirect visitors to a Facebook popup informing victims that they had won a prize and encourage them to enter personally identifying information.

What sets apart this campaign from other redirects is its scale and its targets: some of the world’s most popular online publications that deal only with reputable digital partners. While the campaign was effectively halted, it spotlights the growing challenges of managing the risks third parties and their own vendors can introduce to today’s ever-more dynamic, complex digital ecosystems.

Third-party code putting companies at risk

Third parties can pose risks in several ways. First, they tend to have weaker security measures. This makes them ideal attack vectors for bad actors. The headline-grabbing breaches of Target, Equifax, Ticketmaster, and, more recently, Adidas, prove how popular third parties are to exploit because of their vulnerabilities. In this scenario, when taking on a large organization, hackers will first target a third party and use it as a gateway to enter the larger network.

Second, third party code operate outside the website operator’s cybersecurity infrastructure. Their activities, authorized or otherwise, can neither be monitored nor remediated by the publisher’s marketing and IT departments. As a result, user experience can deteriorate and erode a publisher’s topline and reputation.

However, another, more serious consequence is the unsanctioned collection of user data, which in the EU will expose the publisher to the risk of infringing the GDPR and, soon, the ePR, whose scope is expected to be broader and penalties equally stiff. In fact, the ePR could potentially override the GDPR. Non-compliance is therefore a risk, and will figure prominently in other sought-after markets like Canada, which will enforce PIPEDA later this year, and California, which recently passed the California Consumer Privacy Act.

Reining in risk

Unless they have the tools to actively monitor third party-code, website owners will likely remain unaware of the broad range of code that execute on their sites and of how unexpectedly and frequently new, unknown code appear.  The ability to identify, document and authorize these ever-changing vendors is critical to properly mitigate risk. Not only do most enterprises not know the full scale of vendors executing code, but they would be surprised at the amount of consumer data collection activity, i.e., cookie drops, pixel fires, device fingerprint, etc.

Continuous monitoring from your customers’ points of view helps IT teams pinpoint how these vendors and their actions—specifically the domains executed and cookies dropped—change according to user geography, browser, or device. Collecting this type of vendor intelligence provides clear insight into third party behavior to protect customers and brand reputation from cyber threats.

Working with third parties toward strong security posture

Third-party application security is essential for today’s IT security compliance, especially now that regulations are proliferating. Even if the security risk resulted from a third-party compromise, the legal responsibility falls on the primary organization. Therefore, it is crucial that organizations take sufficient steps to manage third-party risk and ensure a safer online environment for themselves and their users.

To do that businesses need to ensure that both their systems and those that look beyond their perimeter to third and nth party codes are secure. First, they should carefully vet all third parties by conducting a risk assessment before bringing any third parties on board. Second, they should maintain a continuously updated inventory of their direct and indirect third parties. Third, they should spell out security policies and standards and use contract clauses and SLAs to enforce them. Fourth, they should follow through by conducting periodic audits of third party security measures. Finally, they should conduct continuous, real-time scanning of their websites to identify any unauthorized code and activities and then compare their findings with what is executing on their visitors’ browsers outside their firewall.

These steps will help to mitigate risk and lock out bad actors from digital ecosystems. Taking a proactive approach to cleaning up and protecting websites will improve the company’s security posture, ensure customers’ safety and protect organizations from the high, upcoming fines of the GDPR and other regulations that follow it.

About the Author:

Chris Olson co-founded The Media Trust with a goal to transform the internet experience by creating better digital ecosystems to govern assets, connect partners and enable Digital Risk Management. Chris has more than 15 years of experience leading high tech and ad technology start-ups and managing international software development, product and sales teams.

Advertising | Perspectives

Honest truth about the Honest Ads Act

Concerns about fake news  and potential Russian involvement in the U.S. 2016 general election is reaching fever pitch that was highlighted last week with multiple congressional hearings, and, digital advertising is in the crosshairs. And, like many challenging discussions about digital advertising, transparency is at the heart of the issue.

Digital compliance for political ads

The proposed Honest Ads Act, a bipartisan effort to govern digital advertising according to the same rules followed by traditional broadcast media regarding political advertising, and is the one tangible fallout from the investigations.

The act calls for all politically-oriented digital ads to be declared at purchase, clearly labeled in the creative, and available for consumer access via a searchable interface. Among other things, the buyer must disclose their contact information, candidate and/or campaign, ad flight duration, number of impressions/views, and targeting criteria. The platform must collect this information and retain it for at least four years. It applies to digital platforms with at least 50 million unique visitors a month for the preceding 12-month period that have political ad buyers who spend at least $500 within a calendar year.

In a nutshell, it requires publishers know their ad buyers, ensure ads comply with (regulatory) policies and provide consumer access to these ads and any associated targeting criteria. Sounds familiar?

Transparency starts with the buyer

As The Media Trust announced a few short months ago, our Digital Vendor Risk Management (DVRM) platform provides real-time visibility and insight into non-compliant activity and threats operating in an enterprise website and mobile app environments. More than a risk management framework, DVRM operationalizes client-specific digital asset policies, continuously evaluates digital partner compliance, and actively facilitates the resolution of violating behavior.

The crux of this solution is the ability to identify and manage an enterprise’s digital ecosystem participants, from ad tech up to the source buyer, and authorize their presence. In addition to privacy regulation and escalating security concerns, the Honest Ads Act is just another reason why enterprises need to know their partners.

DVRM – A simple solution to a complex problem

Applying a political lens to DVRM it’s evident that the platform is already satisfying most of the requirements to enable transparency and accountability. Advertising supply chain partners register via an online portal; ads are uploaded and continuously scanned according to targeting criteria; client-specific policy violations are flagged; and, ads are stored for historical reference.

Self-regulation forces a new digital approach

Major platforms have announced their approaches to address congressional concerns and hopefully stave off the vote, let alone passage, of the Honest Ads Act. However, this self-regulation will need to extend to others meeting the requirement threshold, like ecommerce and media publishers.

Regardless of Honest Ads going to vote, changes are in the air. As an industry that has largely grown via self-regulation, the signals are obvious. It is incumbent upon the industry to embrace these changes, especially with the DVRM platform as an easy way to codify and operationalize your policies.

Chris Olson founded The Media Trust (@themediatrust) with Dave Crane in 2005. He currently serves as CEO, where he drives the company’s vision, direction and growth plans. Prior to establishing The Media Trust Company, he spent four years as the chief operating officer and board member at Spheric Media. From 1998 until 2000, he was the vice president, global equities at Commerzbank; and from 1993 until 1998, he was the vice president of electronic trading at Salomon Brothers, Inc.

Advertising | Perspectives

Agencies and the ad quality quandary

There’s no denying that two major phenomena are actively reshaping the existing digital advertising supply chain:

  1. Accountability is being pushed upstream

    Not long ago, digital publishers bore the brunt of the blame, shame and liability (financial and legal) for ad-related problems such as performance issues, unauthorized collection of audience data, and security concerns (malvertising). Today, armed with more public awareness (in the form of ad blocking, among others), industry best practices (e.g., TAG, IAB LEAN) and regulations (GDPR anyone?), publishers are finally pushing back on upstream partners when policy-flouting ads are served to their digital environments. And many partners are listening. Now, several other ad tech players on the buy side of the digital supply chain are joining this publisher revolt and to direct accountability for creative issues to their upstream partners.

  2. Advertisers have spoken

    Earlier this month, in an interview with The Wall Street Journal, P&G’s chief brand officer, Marc Pritchard didn’t mince words when it came to expressing his irritation with everyone’s acceptance of serious flaws with the digital advertising supply chain. He highlighted the complexities of digital advertising and confusing agency contracts. However, what stood out were his comments on the quality of the digital ad experience for consumers:

“Sometimes we deliver a high-quality media experience, but all too often the experience is, well, crappy. We bombard consumers with thousands of ads a day, subject them to endless ad load times, interrupt them with pop-ups and overpopulate their screens and feeds…” Marc Pritchard, CMO, P&G

This comment from the world’s biggest advertiser underscores the importance of digital ad quality in regards to what is being “presented” to audiences today and rightfully so. According to recent research, the consumer packaged goods (CPG) industry spends almost 20% of their $225 billion annual marketing budget on digital advertising. Yet retailers and shoppers alike gave digital advertising low marks for effectiveness.

This provides further impetus for more advertisers to focus on improving the digital ad experience, thus putting the sell-side is under immense pressure to not just launch high-quality ads into the digital supply chain but to prove that those are high-quality ads.

New priorities, New challenges

As the digital ad ecosystem evolves, agencies and media buyers need to re-establish trust with both consumers and advertisers. The first step is adopting industry best practices and standards for ad quality and security. This includes being judicious about audience data collection activity and keeping abreast of the ever-evolving guidelines for a plethora of ad formats.

Agencies have a lot of work to do. As depicted here, most media buyers today need to take a more farsighted approach to campaign development and scanning. The assumption that an ad, upon entrance into the digital ecosystem, is exactly the same when it renders on a website showcases this ignorance.

To meet changing advertiser demands for a better digital ad experience, agencies need to adopt a more comprehensive view of the entire ad experience: Creative + ad (the actual creative with all the corresponding analytics code) + landing page, not just the creative.

A paradigm shift in agency priorities is required. Agencies and media buyers are under unprecedented scrutiny to address ad quality as they are where creatives originate. Their inability to meet the changing demands of both advertisers and publishers directly impact the following areas:

Ability to Launch and Serve Ads

As ad formats and standards continue to evolve, meeting these specs across publishers, platforms, and networks impact your ability to serve ads

Ad Spend and Campaigns

Delays in launching campaigns jeopardize ad spend and campaign metrics. Also, the inability to verify the campaign and its success – is the ad getting served the way it should be and to the target audience – could damage relationships with advertisers.

Brand Image

Noncompliance with complex and changing regulations damage brand image and lead to penalties potentially for the advertiser, publisher and the agency itself.

Pressure changes the status quo 

The brief to media buyers about what to do and what is expected is clear.  But it will be interesting to see how agencies actually adapt to the changing digital advertising landscape. Balancing advertiser demands while trying to achieve operational efficiencies and scale and trying to win a turf war against big consulting firms will likely prove to be a heavy lift for agencies. These bi-directional pressures coming from advertisers on one end and published on the other end of the digital ad supply chain will force revolutionary change. If done right, the end result is a transformed digital advertising ecosystem. Positive UX via an optimized and profitably monetized channel.

Chris Olson founded The Media Trust (@themediatrust) with Dave Crane in 2005. He currently serves as CEO, where he drives the company’s vision, direction and growth plans. Prior to establishing The Media Trust Company, he spent four years as the chief operating officer and board member at Spheric Media. From 1998 until 2000, he was the vice president, global equities at Commerzbank; and from 1993 until 1998, he was the vice president of electronic trading at Salomon Brothers, Inc.

©2024 Digital Content Next. All Rights Reserved.