Affiliates Indicted For Cookie Stuffing

The defendants in the following cases are considered innocent until proven guilty in a court of law. Additionally, the general schemes alleged in the cases are practices I have personally observed of numerous affiliates over the years.

Background

On August 28, 2008, eBay filed a civil suit against Shawn Hogan, Brian Dunning and Todd Dunning, along with their respective company entities Digital Point Solutions, Kessler’s Flying Circus, Thunderwood Holdings and BrianDunning.com. The suit alleges numerous actions including fraud, racketeering activity under RICO (Racketeer Influenced and Corrupt Organizations), wire fraud and unauthorized access of eBay’s servers. See full complaint (pdf).

The short version is that eBay alleges that the affiliates named engaged in “cookie stuffing”, specifically generating hidden forced clicks of their Ebay affiliate links. Hidden forced clicks are when an affiliate link is invoked without a physical click by the end user. Various forms of technology and/or coding are used so that the merchant’s site is not actually seen by the end user. The alleged activities in question occurred between 2003 and mid 2007.  eBay claims measures were taken to hide the activity and that the defendants denied any wrongdoing when questioned by CJ, which at the time was still running  eBay’s program, regarding suspicious traffic.

While this case should be of significant interest to affiliates, networks and merchants, it is a civil matter. Currently the case is unresolved with the outcome pending before the courts.

Criminal Charges Filed

On June 24, 2010, two separate indictments were handed down by a grand jury in California against Shawn Hogan (pdf) and Brian Dunning (pdf) following an FBI investigation by the Cyber Crimes Department. The indictments charge Hogan and Dunning with wire fraud and criminal forfeiture. Hogan was charged with ten counts of wire fraud and Dunning with five counts of wire fraud.

On July 22, 2010, Hogan and Dunning appeared before the court. Both were released under a $100,000 property bond and surrendering their passports. Both Hogan and Dunning entered not guilty pleas. Hogan’s next court date is September 9, 2010 and Dunning’s is August 19, 2010.

According to court documents, the maximum penalty in both cases is:

• Imprisonment of 20 years
• Maximum fine of $250,000 or twice the gross gain/loss (whichever is greater)
• 3 years of supervised release
• $100 special assessment (per count)

The indictments parallel the eBay civil suit, accusing the affiliates of engaging in hidden forced clicks within the eBay affiliate program.

For years cookie stuffing techniques have been discussed and debated in the affiliate marketing world. I’ve seen a rather casual attitude taken by some regarding the practice. I’ve seen long debates about what constitutes a physical click by the end user. I’ve seen black hat techniques for cookie stuffing and hiding the behavior discussed publicly. For me, one striking point with the indictments is that the FBI and a grand jury were evidently able to grasp technical aspects of affiliate marketing and tracking, and ultimately arrived at the conclusion that the tactics were criminal in nature.

Indictment Specifics

Several interesting specifics were outlined in both of the indictments:

• Between 2006 and June 2007, Shawn Hogan (Digital Point Solutions) earned approximately $15.5 million in commissions from eBay. Hogan was eBay’s number one affiliate.
• Between 2006 and June 2007, Dunning (Kessler’s Flying Circus) earned approximately $5.3 million in commissions from eBay. Dunning was eBay’s number two affiliate.
• Hogan and Dunning are accused of generating hidden forced clicks on both their own web sites as well as sites not connected with the defendants in order to increase the number of computers storing the eBay affiliate tracking cookie.
• The legal criteria for wire fraud was established not on money (commissions) being transferred over the wires, but because of transmission of the tracking cookie between states and internationally.
• The affiliates attempted to hide the activity from eBay and CJ by not engaging in the cookie stuffing on computers located in San Jose (eBay headquarters) or Santa Barbara (CJ’s headquarters). This is geo-targeting and is readily known to be used by affiliates engaging in questionable activity. Of course, not all geo-targeting activity in nefarious.
• Both Hogan (2005) and Dunning (2006) denied any cookie stuffing behavior when questioned by CJ.
• Each individual wire fraud account is related to a particular incident on an IP address outside California (location of eBay servers) where an affiliate cookie for the defendants was set.

Implications

Hogan and Dunning face serious repercussions if found guilty of the charges handed down by the grand jury. This is in addition to a pending civil suit which potentially carries stiff penalties of its own.

Regardless of the innocence or guilt of Hogan and Dunning, the fact that the U.S. Attorney deems cookie stuffing criminal should be a wake-up call for our industry.

As Linda Buquet stated when she first talked about the case, “For the blackhatters out there that say, ‘cookie stuffing isn’t illegal and all is fair in love and affiliate marketing’ – I say you better take a very close look at this case!”

The behavior outlined by the indictment is behavior, with some minor technical variation, I witnessed only yesterday by some affiliates. Nor is it difficult to find resources on how to engage in these types of activities, whether through web pages, adware, widgets, email or any other vehicle. Maybe now that the practice has been deemed illegal, the higher stakes will deter potential abusers.