On advertising fraud and RuneScape's bot economy

February 13, 2019 (2939 words) :: What the prevalence of advertising fraud tells us about the business models of platforms like Google & Facebook, and why advertising is core to capitalism as a whole.
Tags: games, advertising, big-tech

This post is day 44 of a personal challenge to write every day in 2019. See the other fragments, or sign up for my weekly newsletter.


My first major website endeavour began in 2004. A friend had created an online puzzle game (based on Notpron, which was highly popular at the time) and I wanted to get involved. I solved the existing levels of the puzzle, then came up with new levels for it, and essentially learned how to build websites in the process.

Not long after, the friend got bored of it, and I took over entirely. I had just learned about Google AdSense as a way of making money off of websites you own, and I thought, why not? I set up AdSense and configured it to allow banner ads on the pages of my website (not the game itself, but all the content around it) - ads that now look antiquated and frankly hideous. I didn’t have high expectations for the amount of money I could earn, since the website was only moderately popular, but I figured I might as well try.

I never ended up making any money from that, because Google only mails you a check when you get to $100, and I only got just above $99 before I disabled my account out of guilt. The guilt came from feeling like I didn’t fully deserve all that money, and so I shouldn’t receive any of it. You see, somewhere around the halfway mark, I realised I could make money faster if I clicked the ads myself. I did it slowly, in little increments, and I would try to simulate as organic an experience as possible (I had convinced myself that if I actually read the ad that I was clicking on, then it was a legitimate click). On my home computer, at school, at the library. Only a small proportion of the money I had “earned” could be due to my personal (and very fraudulent) clicks, but I still felt guilty enough about it that I wouldn’t feel comfortable getting any of it.

I remember wondering if there were other people who did the same thing, but with fewer ethical hang-ups than I. I always did it manually, because that lessened the guilt somewhat, but surely you could automate it, too? And if you automate it, you could basically just print money, simply by clicking on your own ads. Or you could click on other people’s ads, and charge them for the service. You’d have to constantly innovate to make sure Google didn’t find out and shut you down, but you could probably make a lot of money with each iteration. That was the first time I realised just how easy it was to make tons of money if you have 1) access to the right technology and 2) no moral scruples.

The other thing I realised, which I found really frustrating, was the total power imbalance between me and Google, due to the information asymmetry. I had no idea if the numbers Google showed me about my ad impressions were genuine. Each day, Google told me I had garnered a certain number of clicks, and consequently earned a certain amount of money. But how on earth could I verify that? What was to stop Google from paying me less than I deserved? Who would ever know if they did?


A few years after I said a sad goodbye to that website - whose name is truly too embarrassing to repeat here - I spent a summer in San Francisco working as a software engineering intern at Google. I wasn’t working directly on any advertising-related products, but the internal lines of communication were pretty open at the time, and I had the chance to read internal documentation about how AdSense worked.

The first thing I confirmed was that AdSense did pay out publishers fairly, at least in the sense that Google wouldn’t deliberately lie about the number of impressions. (Whether a payment structure can ever be “fair” when its terms are dictated by a quasi-monopoly is debateable, but that’s another topic. Also, it later transpired that Facebook lied about its metrics for video ads, but again, another topic.) Sure, they could make some money from that in the short term, but the employees working on it would know, and some of them would feel ethically challenged enough that it would eventually leak. And once it leaked, Google would be open to lawsuits, and would also lose publishers’ trust, threatening its dominance in the long run.

So Google couldn’t deliberately commit fraud, by showing publishers lower impression numbers in order to pay them less. Nor could it lie to advertisers about how many impressions their ads had gotten, and make more money through overcharging advertisers.

But what if Google was creating a system that incentivised others to commit fraud instead? The sort of fraud where publishers getting paid more, and Google gets paid more, and advertisers are charged for impressions that turn out to be fraudulent?

I’m not just talking about mildly unscrupulous webmasters like my teenaged self, sheepishly clicking ads I knew I was not interested in just so I could make another 10 cents. I’m talking about massive, institutionalised click farms that contribute to a billion-dollar industry. Some are automated, but some take advantage of low labour costs in developing countries to hire armies of real people to view and click ads, to the point where it’s difficult to tell these apart from “genuine” ad impressions.

Pretty much every digital advertising platform has huge problems with ad fraud. It’s just too lucrative an opportunity to pass up, for those who enjoy the thrill of playing cat-and-mouse with these huge corporations while also raking in a ton of money. It’s not even illegal, most of the time - at worst, it’s a violation of platforms’ terms of service, but who anointed them king, anyway?


I’ve written previously on Old School RuneScape, the MMORPG that consumed a lot of my time when I was younger, from which I was recently banned for running a script. These days, if you spend a good amount of time in the game, you’ll eventually run into bots - characters that are run mostly or entirely by an automated script, often for the purpose of gathering natural resources (through fishing, mining, woodcutting, etc) in order to sell them on the Grand Exchange.

You’ll know a bot when you see it. They usually have names that follow a predictable pattern, and their character tends to go with the most basic body/outfit combination: a bald head, goatee, olive shirt, dark green pants. They don’t talk to other players, and they follow extremely repetitive play patterns. Sometimes you’ll get lucky and spot a dozen or more bots in the same place, doing exactly the same thing, one after the other.

screenshot of a bot Screenshot of the typical bot aesthetic, from the Dark Runescape Wiki.

Real players usually find it kind of funny when they encounter a ton of bots in the game. Sometimes you’ll be fishing for lobsters in Catherby and then all of a sudden an army of bald, goateed, green-clad men will descend upon the harbour in one long, smooth procession, and all the real players - usually silent - will start to crack wry jokes. Bots are technically banned, but people are pretty used to them, and most players just accept them as a fact of the game. It’s a cat-and-mouse situation, because RuneScape’s creators need to crack down on bots to prevent rampant cheating from ruining the fun of the game, but there’s always a delay during which any particular bot can make a lot of money. RuneScape can’t stop botting entirely without the risk of penalising real users.

Plus, in a way, the bots make the game better, by providing liquidity to the market. If you want to stock up on a particular item that isn’t sold in stores, you have two choices: you can gather or make it yourself - which could take ages - or you could buy it from other players, ideally via the Grand Exchange. Before the Grand Exchange, if you wanted to spin flax into bowstring in bulk, in order to level up your crafting, you’d have to go pick all the flax manually, by going to a field where the flax is grown and clicking on each individual patch of flax on the ground until your inventory is full and you have to drop them off at the bank. It’s incredibly boring, and I’m saying this in the context of a game where you literally just click pixellated blocks on the screen to simulate fishing or mining or woodcutting.

Now, there are some players who actually do flax-picking, because they find it relaxing or because they’re young and naive, bless them. But most players who need flax, or similar resources, will just buy them from the Grand Exchange, and for a pretty low price.

Who makes up for the massive imbalance between supply and demand? Bots do. The same is true with lots of other items whose acquisition can be easily scripted - if it’s profitable enough, it will be automated.

In my opinion, this is A Good Thing. Bots are solving an inefficiency in the game - a failure of the market, even. Picking flax is so boring that you can’t induce people to spend time doing it without having to break the rules of the game. The work is such drudgery that it has to be automated for it to be bearable.

There’s a potential tangent here about the automation of work, but I’ll sidestep that for now. The point I want to make is: if picking flax is so boring, and automating that so useful for players, then why isn’t it part of the game? Why should RuneScape have legions of external bots picking this flax and immediately selling it on the Grand Exchange, at a price that, incidentally, is usually quite stable? Surely it would be more efficient to make flax an item that could be bought in stores, cutting the middleman out of the equation?

One factor is probably financial - botting does improve RuneScape’s revenue numbers (as some bot-owners pay for membership). But there’s a more existential problem, too. If you excise bots from the game by rendering purchasable anything that was previously boring, then you essentially ruin the whole game. Because the very premise of the game is about grinding, which requires maintaining a careful balance between the simultaneous tedium and joy to be found in the process of mind-numbingly clicking the same thing over and over. You could ban flax bots and replace them with in-game flax merchants, but then you’d end up wanting to do the same for fishing, and mining, and woodcutting, and pretty much every other skill as well. In the process, you’d undermine the entire point of the game.


RuneScape’s bot economy is not a perfect analogy for ad fraud, I’ll admit. For one, RuneScape is actually really fun to play, despite the harsh words I’ve levelled at it above; advertising, on the other hand, induces in me only despair and/or anger. The cat-and-mouse movement is similar, though, in a way that’s also paralleled in the world of spam detection for email.

Why is there so much ad fraud, and why do the big players in the digital space (Facebook and Google, mostly) let them get away with it? After all, the companies that create the whole advertising system, and control what users, advertisers and publishers all see, have the most power here. There’s a reason I say “cat-and-mouse game” instead of “arms race” - the latter implies some sort of equality between the two powers, which is not what we see in the realms of RuneScape or digital advertising. One side has the power over the workings of the system, while the other is merely trying to navigate within it, profiting by perching in its interstices.

One heuristic that I’ve adopted since I’ve found the left is that when you’re analysing a situation and looking for someone to blame, you should start by looking at those with the most power to change things. Don’t blame the immigrants or foreign workers who do jobs for less pay than domestic workers - they usually don’t have better options, and the real source of power is the company that is actively searching to lower wages in pursuit of profit. Similarly, when looking at click farms, it would be silly to blame the actual workers who click links all day, because they wouldn’t be doing that job if they had better alternatives; you could blame the click farm operators, but they’re also just trying to make money where they can. If you’re going to blame anyone, you should blame Google/Facebook, because they ultimately control this fraud-filled advertising dystopia. They set the terms of the game that has created these click farms, and they could iteratively change the terms to cut out the middlemen, one by one.

Of course, they’re not going to do this in any substantial way, for the same reasons that flax in RuneScape is picked by bots and sold on the Grand Exchange. For one, it helps the ad platforms make more money. But the more subtle reason is that cutting out the middlemen would also mean undermining the very indeterminacy that makes something an advertisement in the first place.

There’s only one way to completely eradicate ad fraud: by treating only the clicks/impressions that lead directly to a sale as genuine. Of course, this would either mean losing tons of “legitimate” clicks and impressions, or creating a highly complicated, fully automated end-to-end tracking system for customer engagement to solve the problem of attribution, so advertisers know which ad format provides the most ROI.

Let’s assume, for a second, that this is actually technically possible (it isn’t yet, though lots of tech startups are certainly trying, including my former startup). The challenge is to identify the source that most influenced the purchase, and distribute the advertiser’s spend accordingly. Beyond the technical challenges, this makes for a tricky philosophical problem. If I buy a Casper mattress, or sign up for Grammarly (I will never), or go to a restaurant on the basis of various advertisements, how can we know which advertisement closed the loop? Was it the billboard, or the Facebook ad, or the YouTube pre-roll, or the mention in the podcast? Was it the Instagram influencer campaign, or the native advertising campaign in Buzzfeed? Or was it a completely organic decision, based on a recommendation from a trusted friend?

And what if it’s a complicated mixture of various ads - the YouTube pre-roll imprinted it in my memory, but the Facebook ad that I clicked led me directly to the purchase? How do we quantify that in order to accurately split the ad spend between the sources?

Who the fuck cares? Why should funding for publishers be allocated according to how efficient they are at getting people to buy stuff? Why on earth would the advertising industry be the best judge of how to fund creative endeavours?

Advertising is structural support for our current stage of capitalism - on a macro scale, its economic function is to ensure continued consumption to meet capitalism’s endless need for growth. It has also, for reasons beyond the scope of this post, become the primary model for funding journalism, among other things. This is clearly a local optimum, a term which I am here using in a purely pejorative sense: a subpar system was designed, and as time went on, the suboptimality of that system became evident. But we are trapped in that system, partly because of its self-propelling feedback loop, and partly because the political establishment won’t suggest anything more radical than a timid step forward or backward.

If we want to leave the vicinity of this local maximum, we’re going to have to take a massive stochastic leap into the unknown, and abandon all the precepts that got us here in the first place. The problem is not ad fraud, per se; the problem is advertising in toto. We need to invent a new game, one that isn’t driven primarily by metrics that must go up in perpetuity, because that world will only result in the earth choking under a mountain of unwanted t-shirts and plastic and fidget spinners.


Anyone who’s ever voluntarily stopped playing RuneScape has a moment where they contemplate the futility of all that time spent clicking. They’ve levelled up all these skills, and completed all these quests, and acquired so much gold, but it’s all just pixels in a video game, and once you step away from your computer it fades into so much virtual dust. It’s meaningless. It adds up to nothing. It’s chasing the wrong kind of progress.

It’s not easy to quit, because you think: but look at everything I’m leaving behind! I worked so hard to build this! But maybe the real question is whether what you’ve built is actually worth anything. And if it’s not, then maybe it’s time to break clean. Start afresh, leaving behind the sclerotic logic of the old, in order to build something more meaningful in the new.

Thanks to Jason Prado for suggesting that I write about the heuristic of looking at the source of power. No thanks to Google AdSense for never sending me a check for nearly $100, nor to RuneScape for banning me for what I maintain was a very mild instance of scripting.


« See the full list of fragments