Policy —

Google caught pilfering Kenyan business directory in sting operation

After getting some weird phone calls, a Kenyan business directory found that …

Google caught pilfering Kenyan business directory in sting operation
Photo illustration by Aurich Lawson

Google's "don't be evil" motto has already come under scrutiny once this week after the company was found to be profiting from advertisements placed by fraudulent retailers. The search company is under fire again, amid claims that it has been harvesting data from a Kenyan business directory, contacting the businesses, and telling them that the directory plans to charge them a listing fee, while also claiming to be working in partnership with the directory's operators.

Mocality Kenya operates the largest business directory in Kenya. The directory uses an innovative crowdsourced business model to ensure that its contents are comprehensive and accurate: any Kenyan with a mobile phone can submit entries to the database, and when these entries have been validated, rewards are paid using M-Pesa, a mobile payment system used in a number of developing nations.

Mocality lists businesses of all sizes, and for many companies in the directory, a listing on Mocality is their first or only Web presence. The company does not offer Web sites or Web hosting; just a listing of the business's particulars in a directory. Mocality also operates a call center that business owners can contact should they need assistance in updating their listings.

Mocality's business is its database. The data is all published on the Web, and looking up companies through the Web site is free and unrestricted, but the company guards against automated attempts to harvest the data.

In October last year, Mocality was surprised to start receiving calls from business owners wanting help with their websites. These were initially dismissed—Mocality doesn't offer websites—but the calls continued through November and into December.

This prompted the Mocality team to start doing some detective work. It analyzed the log files of its Web servers to see if there was any common link between the companies that had called asking for assistance with their websites. Indeed there was: the directory listings for those businesses had all been visited by users from a single IP address that belonged to a Kenyan WiMAX ISP.

All of the page requests from that IP had the same unusual Web browser user agent string, indicating the use of Google Chrome on Linux. The records also showed that the pages were accessed during regular working hours, which suggested that the organization behind the mystery IP address was using a team of humans to trawl through Mocality's database. This left the company wondering what they were doing, and why.

To find out, it decided to set up a sting operation. 10 percent of all requests from the IP address in question would show the wrong data—instead of getting the businesses' phone numbers, the people harvesting the data would be given Mocality's number.

The sting was in operation for just three hours. During that time, Mocality received seven calls. Each time the callers claimed to be working for Google Kenya, and that Google Kenya was working with Mocality on a project called Getting Kenyan Business Online.

Getting Kenyan Business Online is actually a legitimate part of Google's Getting Business Online effort. GKBO gives Kenyan businesses a free website and Web hosting, along with training on how to build an effective online presence. Over the past two years, the Getting Business Online initiative has connected to 400,000 companies across 20 different countries.

But Mocality is not part of the project, and has not partnered with Google to provide this data.

More troubling was that some of the calls Mocality received claimed that Mocality wanted to charge businesses Ksh20,000 (about $230) for being included in its directory, and further that GKBO charged the same amount for Web hosting. Neither of these things was true. Mocality's listings are all free, as is GKBO's hosting (with one exception; businesses using a custom domain name must pay a small fee).

Though the callers identified themselves as working for Google Kenya, this could have been a simple scam. After all, as all my fellow winners of the Microsoft lottery know, scammers are quite willing to exploit the names of respectable businesses.

But such doubts would shortly be laid to rest. The traffic from the Kenyan ISP stopped, only to be replaced by an identical pattern of traffic from 74.125.63.33—an IP address assigned directly to Google. Mocality repeated its sting operation and once again the calls started rolling in, with Google staff, this time from Google India, offering Web site services and claiming to be working in partnership with Mocality.

With the evidence collected, Mocality CEO Stefan Magdalinski went public, making a blog post, Google, what were you thinking?, detailing the company's findings, and asking the advertising giant three questions:

  1. If Google wanted to work with our data, why didn't they just ask?
  2. Who authorised this?
  3. Who knew, and who SHOULD have known, even if they didn't know?

All fair questions. Pillaging Mocality's database (and violating the site's terms of use in the process), claiming to be working in partnership with Mocality, and trying to scare businesses with directory listings with stories of monthly fees all seem quite at odds with Google's Don't be evil motto.

Google says that Magdalinski's blog post was the first time it learned of the problem. Nelson Mattos, Google Vice-President for Product and Engineering, Europe and Emerging Markets, has issued a statement saying that "We were mortified to learn that a team of people working on a Google project improperly used Mocality's data and misrepresented our relationship with Mocality to encourage customers to create new websites. We've already unreservedly apologized to Mocality."

That a team working for Google on the GKBO project was harvesting Mocality's data and lying to businesses is clear. How and why that happened remains uncertain. At the moment, Google is still uncertain as to who is responsible for what happened. Google Kenya has partnered with local firms as part of the GKBO program, and Google is not sure if it was Google Kenya or one of these partner organizations responsible for the abuse of Mocality's data, the dishonest claims to have a partnership, or the claims that Mocality wanted to charge companies to be featured in its directory.

The attempt to collect Ksh20,000/month for GKBO Web hosting adds another layer of intrigue; as well as trading off Mocality's good name to help recruit businesses to GKBO, it suggests that someone involved in the GKBO operation is attempting to pocket some cash for themselves by charging for something that should be free.

The action by the party or parties violated Google's business practices, and Google says that it was not sanctioned. The cold calling scripts that Google thought GKBO was using makes no mention of Mocality. The company promises that as soon as it has "all the facts" it will be "taking the appropriate action with the people involved."

Listing image by Photo illustration by Aurich Lawson

Channel Ars Technica