Photograph by George Oates
Last month we covered the controversy over Paxfire, a firm that researchers have accused of "hijacking" search results by placing a proxy server between users and major search engines and modifying some responses. Paxfire and one of its customers, RCN, was soon hit with a class-action lawsuit claiming that the use of search hijacking violated the Wiretap Act, consumer protection laws, and RCN's contractual obligations. Now Paxfire has responded with a countersuit, charging the lead plaintiff, Betsy Feist, with slander, libel, and tortious interference with its business relationships. Paxfire strenuously denies that it shares user information with third parties. It argues that its actions don't constitute interception of user communications under wiretapping law and that users consented to Paxfire's activities when they signed RCN's acceptable use policy. Paxfire asked the court to award it compensatory and punitive damages of at least $50 million. Ars talked to Mike Sullivan, Paxfire's vice president for engineering, about Paxfire's technology. In this article, we'll describe the technology Sullivan explained to us, discuss whether Paxfire's actions pass muster under federal wiretapping laws, and conclude with an analysis of whether the technology is good for users. Error correction
Originally, Paxfire simply  offered technology to help ISPs to monetize invalid DNS queries. When a user entered a nonexistent domain name into the URL bar of his browser, Paxfire's DNS server would direct the user to a Paxfire-sponsored page of search results rather than returning an error message. This search page would generate advertising revenue, which Paxfire would share with its ISP clients. This practice has been criticized by some as a violation of network neutrality, but it's becoming increasingly common and isn't generally regarded as being against the law. Then (from Paxfire's perspective at least) browser vendors began encroaching on Paxfire's turf. Some browsers began merging the functions of the address and search bars. If the user entered an invalid URL into the address bar, the browser itself would interpret it as a search term and automatically submit it to a search engine. Google's Chrome takes this trend to its logical extreme, eliminating the search bar entirely in favor of a combined address/search bar. This reduced demand for Paxfire's DNS error-correction "service. "
Apparently seeing a threat to its business model, Paxfire took an aggressive countermeasure. Its DNS servers began responding to queries for the IP addresses of search engines with the IP address of proxy servers operated by Paxfire itself. That effectively made Paxfire a "man in the middle" between the user and search engines. For most queries, the proxies would simply relay the query to the appropriate search engine and send the result back to the user. But the proxy server would handle a limited number of queries itself. For example, if the user searched for "apple," the proxy server might redirect the user to apple.com. This allowed Paxfire to claim a referral fee that might otherwise have gone to the user's chosen search engine. Paxfire shares the resulting revenue with the user's ISP. In his conversation with us, Sullivan stressed two points about this technology. First, it's highly customizable, and the final decision about how (and whether) to use the proxying capability is up to each individual ISP. Second, he said, the technology is conservative about which queries get redirected. By examining query parameters, Paxfire's proxy server can detect whether a query was generated from a search engine home page, from the search box in the browser's chrome, or from a browser's unified search/address bar. Sullivan said Paxfire servers only intervene in this final case. He said that if a user goes to google.com and enters search terms, the user will always get ordinary search results, as expected. Finally, Sullivan flatly denied the allegation that Paxfire shared the contents of queries with others. "We don't give any information to any third parties," he said. Is this wiretapping? So is this legal? To help us answer that question, Ars talked to Julian Sanchez, a privacy scholar at the Cato Institute (and Ars Technica alumnus). He told Ars that it's complicated. Federal law distinguishes between addressing information and the content of communications, with the latter receiving stricter legal protection. "To run afoul of the Wiretap Act, Paxfire and the ISP would have to be 'intentionally' divulging or intercepting 'content' without consent," Sanchez said. "If they were redirecting or logging queries from the Google-branded search bar, I think that would pretty clearly be an interception of the contents of a communication whose intended recipient was Google. "
However, if a user types "apple" into the browser's unified search/address bar, it's not clear if the user considers "apple" to be a search term or an address. If the user is trying to go to Apple's website, then "apple" could be addressing information. "Depending on the details of what they're doing, the companies might be able to argue that they're only looking at faulty or incomplete addressing information in an effort to get a web request to its intended recipient. "
Paxfire also argues that its service is legal because users consented to it via Paxfire's agreements with ISPs. But Chris Soghoian, a security researcher at Indiana University, rejected that argument. He noted that users rarely read the fine print of privacy policies, and tend to assume that the existence of privacy policies means their privacy is protected. Sanchez agreed. "I think they'd have an uphill battle trying to lean on vague legalese buried in the ISP terms of service to claim 'consent,'" he said. "Providers can't disavow liability under the Electronic Communications Privacy Act that easily. "
Maybe not illegal, but definitely bad for users
The best that can be said for Paxfire is that the company is operating in a legal grey area. There's limited case law about what exactly counts as wiretapping in a packet-switched network, and the Paxfire case may give the courts an opportunity to establish clearer principles on the topic. But whatever the outcome of the legal debate, we think it's clear that Paxfire's "service" is bad for users. The Internet was designed with an end-to-end architecture for good reasons. The user experience should be controlled by users, the browsers they choose to run, and the websites they choose to visit. Paxfire's technology undermines that principle by giving themselves the ability to tamper with search results as they traverse the Internet. Even if Paxfire's proxy servers never modified communications between users and search engines, the unnecessary man-in-the-middle would still add unnecessary complexity, degrading performance and creating unnecessary security risks. And Paxfire admits it does sometimes modify requests as they flow across the network. While the specific modifications Paxfire makes seem relatively innocuous, the principle is a dangerous one. Users shouldn't have to worry about ISPs tampering with their communications. Update: After our conversation, Sanchez did some additional reading on the Paxfire case. "On a first pass, it sounded like they were probably clear legally," he writes. "Now I think that’s likely wrong. "


Paxfire: our search query intercepts are not wiretapping

from the can-it-back-it-up? dept
Well, well. Following a research paper that claimed that a company named Paxfire was teaming up with some ISPs to hijack search terms and take people directly to certain websites, a class action lawsuit was quickly filed. Paxfire wasted little time in responding angrily that the basis of the lawsuit was completely wrong, and saying that it would seek sanctions against the lawyers for filing it in the first place. Now the company has taken things even further and filed a countersuit against the law firm , Milberg LLP, as well as the individual, Betsy Feist, who as a client of Milberg, was the official person who kicked off the attempted class action lawsuit. Paxfire is charging, as you might imagine, both defamation and tortious interference -- and is demanding a whopping $50 million. It should be interesting to see what happens next. The thing with these kinds of lawsuits is that they do expose to the world certain things, so if Paxfire can't back up its claims, then it's going to be in a world of hurt.


Paxfire Sues The Lawyers And Individual Who Filed A Class Action Lawsuit Over Its Search Redirects

3 Comments
Edit Note: This is a guest post by Dane Jasper, CEO of ISP Sonic.net. The post can also be found on the Sonic.net CEO blog here . Recently a number of ISPs have been caught improperly redirecting end-user traffic in order to generate affiliate payments, using a system from Paxfire. A class action lawsuit has been filed against Paxfire and one of the ISPs. Advertisement
This is a serious allegation, but it’s the tip of the iceberg. I’m not sure if everyone understands the levels of sneakiness that service providers can engage in. So, while I’m no expert (as we are an ISP who doesn’t do these things), but as a broad overview, here is my quick guide to the five levels of ISP evil, and the various “opportunities to monetize customers” that we’ve passed on:
Advertisement
5: Improper NXDOMAIN handling, also known as “Domain Helper” applications. When a customer attempts to visit an invalid site, instead of returning the RFC standard “no such domain” response, the servers provide a search result which includes sponsored links. Sometimes the results are not well matched to the mis-typed domain, and they promote ads instead with broad commercial appeal like insurance, which will generate a high payout if the customer clicks. Extra evil points for making it difficult to opt out of this, requiring opt-out via a cookie or browser setting rather than providing “clean” DNS servers. (Paxfire’s system is positioned as a search/helper application, but these systems can be easily converted, even without the ISP’s awareness, to an affiliate pumping system. ) Evil score: 2 evil points, somewhat evil, but now every major access provider provides helpful results for address typos. Advertisement
Advertisement
A diagram showing how Phorm's "Webwise" system creates copies of its tracking cookie in each domain the end-user visits, based on the report published by Richard Clayton. Wikipedia. Advertisement


The five levels of ISP evil

16 Comments
Some Internet Service Providers have apparently been hijacking the search traffic from customers typing keywords into Yahoo (s yhoo) and Bing (s msft) search engines, and now the backlash has begun. Instead of searching on their chosen search page, ISPs — using gear from a company called Paxfire — are reportedly routing the traffic to the ISP’s servers or to Paxfire’s servers and delivering search results that can generate money for firms selected by the ISP as well as the ISP itself. Now Paxfire has been hit with a class-action lawsuit and may face a Congressional inquiry. Advertisement
From an Electronic Frontier Foundation blog describing the practice:
Advertisement
ICSI Networking’s investigation has revealed that Paxfire’s HTTP proxies selectively siphon search requests out of the proxied traffic flows and redirect them through one or more affiliate marketing programs, presumably resulting in commission payments to Paxfire and the ISPs involved. The affiliate programs involved include Commission Junction, the Google Affiliate Network, LinkShare, and Ask.com. When looking up brand names such as “apple”, “dell”, “groupon”, and “wsj”, the affiliate programs direct the queries to the corresponding brands’ websites or to search assistance pages instead of providing the intended search engine results page. Advertisement
The rerouting of traffic was discovered by researchers from the International Computer Science Institute in Berkeley, Calif. and has resulted in a class-action lawsuit filed Monday against Paxfire and RCN, based in Herndon, Va. The New Scientist broke the story last week and has details on how the system worked. It said that since reporting on the lawsuit being filed, RCN and at least 10 other ISPs doing this kind of redirecting have stopped. Meanwhile, Senator Richard Blumenthal (D-Conn.), a member of the Senate subcommittee on Privacy, Technology and the Law, said this week he is interested in investigating the practice . Advertisement
I’ve reached out to Google, (s goog), Microsoft (s msft) and Yahoo to see if they were aware of the issue and how they view such actions by a service provider. A Google spokesperson said that when the company discovers DNS or query hijacking like what Paxfire and RCN are alleged to have done, it contacts the ISP and/or DNS provider and asks them to stop. The spokesperson said Google isn’t currently aware of any companies that are doing this. A Microsoft spokesperson emailed the following:
Advertisement
We view the redirection of search queries without user consent as inappropriate. The security and privacy of our customers is very important to us at Bing. We recommend people use OpenDNS to protect themselves from being unknowingly redirected. Advertisement
Google also provides a free DNS service users can try if their ISP DNS server is not returning the right results. Paxfire has also issued its own denial of sorts about the allegations. Advertisement
If this kind of behavior seems familiar, it’s because ISPs have tried similar efforts to take advantage of their privileged position in the Internet value chain. For example, in 2008, a U.K.-based ISP called BT tested equipment from a deep packet inspection vendor called Phorm without informing its customers . Phorm allowed BT to deliver targeted advertising based on the sites a BT subscriber went to. The U.K. absolved BT and Phorm , but the EU thought the practice of viewing a customer’s IP traffic for the sake of offering ads without letting that customer know, was problematic . Advertisement
Phorm was similar to a company called NebuAd that had gained traction in the U.S. around the same time, and even had Charter and Embarq (now part of CenturyLink (s ctlk)) using its services. In July 2008, Congress called a hearing asking for more information on the practice and after an outcry from consumers, the company fizzled. Yet its legacy lives on in Paxfire, and even companies such as Kindsight , which are still trying to monetize ISPs’ customers through some form of advertising. Even Phorm is still around, selling its services to ISPs in Brazil as recently as last year. Advertisement
The accusations against Paxfire are a bit more problematic, however, than ISPs doing DNS hijacking — which sends a user to a branded page when they type in an incorrect web site. Consumers can opt out of this practice, and it’s also fairly clear what is happening (although plenty of people still have issues with it). But monitoring a person’s traffic and then redirecting them to deliver results that come from somewhere other than their intended search page is a little like having someone intercept your order for Kobe beef at a fine restaurant and then deliver a plain old steak from a different restaurant. Advertisement
The issue here is that ISPs, in their quest for revenue, are once again interfering with users without their knowledge or consent. Folks may wish they were dumb pipes, but ISPs are still gatekeepers to the Internet and as such it’s unfortunate that consumers can’t trust them to do the right thing — whether it’s not blocking P2P files and Skype, or trying to sell access to their paying customers to the highest bidder. Advertisement
Tags


If you can&#8217;t trust your ISP, who can you trust?

from the then-what-does-it-do? dept
Last week, we wrote about a lawsuit filed against Paxfire for supposedly teaming up with ISPs hijacking browser searches for profit. The idea was that search terms never made it to the search engine in question, but rather automatically directed users to pages paid for by marketers. That is, if you searched for "Apple" via your browser search, rather than having that search Bing (if Bing is your search engine) for "Apple," it would automatically take you to an Apple page -- and the search would never even touch Bing. The story was based on a New Scientist story about some researchers highlighting these practices and a class action lawsuit filed over the practices. New Scientist has updated the story to note that:
all the ISPs involved have now called a halt to the practice. They continue to intercept some queries  those from Bing and Yahoo  but are passing the searches on to the relevant search engine rather than redirecting them. However, Paxfire's CEO sent us an email in which he not only refutes the entire story, but claims that he's planning to seek Rule 11 sanctions against the lawyers who filed the class action lawsuit:
This lawsuit is without merit, and harmful to our business and that of our partners. Let me respond to the two major accusations in the lawsuit. "First, the lawsuit alleges that Paxfire collects, analyzes and sells user information. This is completely false and has absolutely no basis in fact. "Paxfire does not and has never distributed or sold any information on users, either individually or collectively. Paxfire does not analyze end user searches, does not hold any history or database of user browsing or search, and does not profile users in any way. Moreover, Paxfire has no plans to change this policy. To repeat: We never, ever collect, monitor, store or sell personal data on users, collectively or as individuals, and we never have. "Second, Paxfire does not hijack searches or 'impersonate search engines. '
"This would be fundamentally contrary to our service mission, which is to improve the user experience by helping users arrive at their intended website after having mistyped a web address. We are all about helping customers navigate the web, and not about searches. We partner closely with our ISP customers to ensure the service is operated not only in full accordance with the law and end user agreements, but also in a way that provides a good user experience. For example, when we have to guess the intended destination from a bad address, our results page includes an explanation of how they landed there and provides an option to opt-out of the service. "Finally, we want to make clear that while it is without merit, this lawsuit and its allegations are extremely harmful to our reputation and those of our partners. Under Rule 11 of the Federal Rules of Civil Procedure, a party has an obligation to ensure a foundation for his or her allegations. Clearly, this was not done adequately by the plaintiff in this case. Accordingly, Paxfire intends to seek the full sanctions available to it under the law, to vindicate the organization and to make it whole from the damages caused by this lawsuit. It appears that they're saying they didn't hijack searches so much as hijack typo searches, and they claim they do it nicely. I guess we'll find out the details as any lawsuit goes on, but I find it highly unlikely that even if Paxfire prevails that it will be able get Rule 11 sanctions. It's pretty rare for such sanctions to be used, and the conduct has to be pretty egregious.


Paxfire Responds: Says It Doesn&#8217;t Hijack Searches, Will Seek Sanctions Against Lawyers

Vector Development

Ticketmaster Entertainment

Bloomberg

USA Today

Companies offering tech-enabled marketing and advertising services.

Ad Tech

Unattributed VC

Paxfire is the proven industry leader in monetizing Address Bar Search and DNS Error traffic for Network Operators. Through the company's carrier-grade technology, the company generate millions of dollars a month in new advertising revenue for the company's partners by enabling them to participate in the booming $20 billion a year search advertising market. The company's service aims to improve the end-user browsing experience and can be deployed rapidly across all network types at no cost to the Network Operator.n

Name	Work History	Title	Status
Mark Lewyn	Vector Development, Ticketmaster Entertainment, Bloomberg, and USA Today	Founder	Current
Subscribe to see more	Subscribe to see more	Subscribe to see more	Subscribe to see more
Subscribe to see more	Subscribe to see more	Subscribe to see more	Subscribe to see more
Subscribe to see more	Subscribe to see more	Subscribe to see more	Subscribe to see more
Subscribe to see more	Subscribe to see more	Subscribe to see more	Subscribe to see more

Name	Mark Lewyn	Subscribe to see more	Subscribe to see more	Subscribe to see more	Subscribe to see more
Work History	Vector Development, Ticketmaster Entertainment, Bloomberg, and USA Today	Subscribe to see more	Subscribe to see more	Subscribe to see more	Subscribe to see more
Title	Founder	Subscribe to see more	Subscribe to see more	Subscribe to see more	Subscribe to see more
Status	Current	Subscribe to see more	Subscribe to see more	Subscribe to see more	Subscribe to see more

Wells Fargo Success Story

Professional Services

Platform Overview

PaxFire

Executives

PaxFire Management Team

6 Team Members

This profile has not been claimed.

Discover the right solution for your team