title:

A semi-visible semi-abomination

By: Scott Bradner

Most of the time I never hear from venders that are targets of negative comments in this column. Every now and then I get a flame and once in a blue moon someone actually wants to talk seriously about the issues I raised. NebuAd, the advertising startup I criticized recently turns out to be one of those blue moon companies.

A few days after the column (An invisible abomination - http://www.networkworld.com/columnists/2007/070209bradner.html) appeared I got email from one Ben Billingsley who identified himself as involved in marketing for NebuAd. Ben said he had read the column "with interest" and wanted to know if I would be interested in talking with NebuAd's CEO. No flaimage, just a polite offer, so I accepted. Ben set up a conference call where I was able to have a very polite and informative conversation with him, Robert Dykes, NebuAd's Chairman and CEO and Kira Makagon, president of advertising systems.

I wrote the original column using information on NebuAd's web site and information from a number of on-line comments and blogs. Robert did not say I had gotten things wrong -- he just offered to describe what they did. Based on the description I'm not sure I did get the basics wrong but what NebuAd is doing is not as good as I would like, but not as bad as I feared.

Basically they are monitoring all sites you are visiting and building up a profile of your interests. Based on what Robert said, the profile is quite coarse and basically keeps track of the categories of the sites you visit. They categorize the sites based on their review and based on scanning site metadata and text. Robert said they carefully do not include any categories related to health issues, politics or adult topics. Thus they wind up with a profile tied to an IP address (which they hash before storing) with counters indicating how often particular types of sites are visited. This lets them serve up an ad for a car even if you are visiting a web site focused on quilting if your previous web activities included visiting a lot of car-related sites.

They also keep track of session-based activities - for example, how many people who visited Ford, what they saw and what else they visited. They provide this info to ad agencies but only after double hashing the IP address to make it essentially impossible for the ad agency to link the activity back to an individual IP address.

Robert also said that they try hard to be sure that the web site or the customer knows what's going on. Mostly they sell their services to web site operators - the quilting site can get more ad revenue if it is not restricted to quilting-related ads. They also offer their services to ISPs. Robert said that most major ISPs do not want them to add still more ads to the user experience but that ad-supported ISPs (for example public WiFi nets) do want the revenue from additional ads. Robert said that NebuAd insists that the ISP's users are told up front about the usage monitoring with enough lead time so that they can switch providers if the want to. He also said that any ad that NebuAd inserts without the web site's OK has a banner on it indicating that the ad is not from the web site. Ben sent me an example and I'd just as soon that the banner were bigger and clearer but at least there was one.

As I said above, I'm now not as unhappy as I was. I still do not like the idea that NebuAd is keeping track of what I'm doing and worry about what additional info they might decide to start using their systems to record if they run into financial difficulty or are bought by a less scrupulous company. But they, and their privacy board, do seem to be trying to do this, to me, bad thing, in as responsible a way as I can think of.

disclaimer: It's not likely that Harvard will run into significant financial difficulty anytime soon so the above worries would not apply and the university has not expressed any specific opinion on this topic.