AppEsteem Blog

Build, Measure, Learn, Improve (our Deceptor Program)

(Dennis Batchelder and Hong Jia)

Today we were at Google’s Mountain View campus attending the Clean Software Summit, and Dennis presented the results of a study we conducted on our Deceptor program. By analyzing the data from the past year, we had four important findings:

  1. The AVs are doing a great job detecting the active Deceptors on our list, which in turn protects consumers.
  2. Merely informing apps when they violate Deceptor requirements is not effective at protecting consumers
  3. A low percentage of active Deceptors (less than 8%) eventually become paying customers
  4. We’ve identified additional ways we can make our operations transparent with the app vendor community

You can find more details in our presentation – we hope you find the data and findings as fascinating as we did!

 Note that in the deck, we also announced we’re taking four immediate actions:

  • Formalize AV Relationship: To showcase AV effectiveness even more, we’re going to align with the AV-driven initiative to formally ratify our Deceptor and Certification requirements. We believe this will make the Deceptor program even more effective at protecting consumers, and at the same time reduce the false positive detections of certified apps
  • Require Registration: Because of the proven ineffectiveness of merely informing apps of their violations, we will provide notifications to apps that violate our Deceptor requirements only if those apps have previously registered for notifications with us
  • Increase Transparency: To give app vendors assurance that we operate fairly, we’re providing insight and input to CleanApps.org, an app vendor-based non-profit organization
  • Provide Opportunities: We’re actively seeking monetization opportunities that certified apps can benefit from. A great example is BlackSwan’s EverCore program, which manages its risk by requiring all offers, carriers, and call centers to be certified by us

Finally, we gave a heads-up about a big upcoming Deceptor campaign; if you're an app vendor, it's worth checking this out.

Just a reminder: it’s free to register with us, and free to get your app certified. You can sign up at https://appesteem.com, or email us at register@appesteem.com

Here's a pic from my presentation... 

 

 

Deceptors wish we’d stop calling them out

Today CSA released a document containing a collection of vendor opinions about our Deceptor program. It seems several vendors took the time to add their thoughts, and we believe their views will be helpful as we keep improving our efforts to prevent consumers from getting infected by deceptive, harmful, and unwanted software.

Our take: we’re encouraged by the apparent effectiveness of our Deceptor program. The document is a great example of how the software monetization industry has been impacted by our work, and that there is now a strong sense of urgency in the industry to clean up. We understand that the process is disruptive, but we believe this approach results in better-protected and better-respected consumers.

Reading CSA’s document got us reflecting on those who have hijacked the software monetization industry and messed it up for the honest vendors. Just like we don’t want them to succeed, it seems these organizations want our Deceptor program to fail. We think this would be a real shame for consumers.

Running this Deceptor program is tough. It’s not easy to strike a balance between disrupting bad actors and encouraging honest vendors. We’ll scour the vendor comments in CSA’s document for new ideas we can use to get it right. We’ll continue to engage with and take input from our security partners, vendors, and consumer representatives. We’ll find ways to get regular input from vendors committed to doing it right. And we’ll try to make every decision based on what is best for consumers, even when these decisions are unpopular with the monetization industry.

While we’re happy that CSA’s document confirms that the Deceptor program works, we do understand that there are vendors out there who do want to treat consumers with respect, and who are shocked, offended, and even ashamed when they discover their app has landed on our Deceptor list.

If you’re a vendor who’s gotten entangled in an industry that spent the past decade telling you that your primary focus should be performance marketing instead of bringing your unique value to consumers, we want to get you back on track with as little fuss and as much help as possible. We have some great (and mostly free) services for you to consider:

  1. FREE: We’ll answer your questions and help you get your app off our Deceptor list.
  2. FREE: We’ll let you know (with up to 30 days’ notice) about Deceptor violations if you register your app to our Deceptor notification service.
  3. FREE: We’ll certify your app so you can show the world your app is safe and it respects consumers.
  4. PAID: We offer value-added subscription services like unlimited compliance consulting for your app, “insiders” access to requirements changes and industry trends, embedded electronic seals for your certified app, and assistance figuring out what to do when our security partners flag your certified app.

But we also want to be clear: if you think it’s fine to treat consumers as exploitable targets for deceptive and aggressive software, we totally understand your desire for us to leave you alone. We strongly suggest you either get on board or find something else to do with your time, as we’re going to continue to tune our Deceptor program to find even more effective ways to disrupt your ability to hurt consumers.

Good guys and bad guys, but don't forget it's our birthday

Today is AppEsteem’s second birthday. To celebrate, I spent yesterday afternoon on the witness stand in a federal courtroom in Austin Texas, advocating for one of our customers. I explained to the judge that we work so hard to punish bad guys and reward good guys because we’re convinced this is the only way consumers can be protected from unwanted software.

I told the judge that there are plenty of bad guys building unwanted software in the software monetization space. He could look at our Deceptor list and find many examples of apps and bundlers cheating, tricking, and unpleasantly surprising consumers in their quest to gain market share. 

But I also told him that the good guys aren't just the AVs; good guys are also building apps, and not everybody on our Deceptor list remains a bad guy. Some companies, when we point out their mistakes, fix their app’s issues and ask us to remove it from our list. Some of these companies take another courageous step and choose to certify their apps, showing the world that they are committed to building apps that respect consumers, and that they are good guys.

I explained that we love it when companies reach this level of commitment, and we work hard to help their certified apps thrive. Because this is our grand experiment: if we can identify the clean apps made by the good guys, our security partners can fight that much better against the bad guys, and we’ll end up in a better world where consumers don’t have to worry about that the apps they install will hurt, trick, or cheat them. 

We don’t yet know how the judge will rule. I hope he can find a way to help certified apps thrive without weakening the regulations that allow security companies to protect consumers.

Today I’m back in the office, and I’m reflecting on the last two years. We have over sixty apps that have made it through what can be a grueling certification process, and we have at least that many more in our certification pipeline. We’ve called out almost four hundred Deceptor apps and services, and we’ve been thrilled that this approach has been super-effective at driving change in both the vendors and the AVs. We’ve adjusted our business model, and last month we got the best second birthday present we could have imagined: our monthly billings exceeded our monthly expenses, and we reached break-even.

It hasn’t been easy, though. Getting the software monetization industry to try a new approach has sometimes felt impossible. Even two years later, we still are dealing with trust issues with a couple of the AVs. We haven’t figured out a productive relationship with the Clean Software Alliance. Some app companies remain on the sidelines, wondering if we’re going to survive. We’re still struggling to raise urgency with the browsers and search platforms so they’ll take action against Deceptor browser extensions, and we haven’t yet solved how we’re going to be able to drive change against Deceptor affiliate networks.

But now we’ve proven our business is viable, we know every challenge is surmountable. Our cause is righteous, and it’s also desperately needed. Consumer-hurting apps must disappear, and the bad guys who make and distribute them need to either change their ways or find a different line of work. 

If you’re still sitting on the sidelines, come and join us! It’s time to show the world that you’re committed to consumer protection and clean apps. Just like yesterday when we supported a good guy’s certified app in court, we’ll work as hard as we can to help certified apps thrive. We’ve proven that we won’t crumble under the pressure, and we promise that we won’t relent in our fight to protect consumers by stopping the bad guys and driving better behavior.

How we'll stop bad bundlers from tricking you

(see updates at the end)

You searched for an app, you downloaded it, and then you scrutinized the prompts to be sure that you installed only the app and the additional offers you wanted. And still you were unpleasantly surprised with what happened to your PC: your search engine changed to one that's filled with ads. You have new browser extensions, and apps that seem to bug you or scare you into to upgrading to a paid version.

Bad news: you got tricked by an unethical software bundler. And you're not alone. We also get tricked.

We want this to stop, so we're going to do something about it. The antivirus companies too: we worked together to identify some of the worst bundler behaviors that we all think should be stopped so we can better protect you, the consumer. We agreed to start acting against the violating bundlers: we'll get them added to our Deceptor list and feeds. Once the antivirus companies verify, they'll detect, block, and prevent these unethical bundlers from running on your PC.

Here's some examples of the kinds of bad bundler behaviors we're going to focus on fixing:

  1. Download managers who don't make it clear to you that they're not the app you were trying to get, but a wrapper that's going to offer you additional apps.
  2. Offers that don't make it clear to you that they're offers, or try to make you think that they're part of app you wanted, or act like they're specifically recommended.
  3. Unclear and inconsistent ways for you to accept, skip, or decline offers and each component in the offers.
  4. Bundlers and download managers that don't stop when you ask them to, leave remnants on your desktop, or don't uninstall their offers when you cancel installing the app you wanted.
  5. Bundlers that ignore you when you say "no".

The complete list of Deceptor behaviors, as well as examples and prescriptive guidance on how to avoid violating them, can be found on our Requirements Page.

Over the past few weeks we've been notifying as many bundlers that we can to prepare them for this change and to answer the questions they have. We have free programs available: bundlers can register with us for notification of Deceptor violations, and they can also get free certification from us.

We're encouraged with the changes that some bundlers and download managers are already making, and we're hoping that come April, there won't be many bad actors for us to call out, because they've already decided that cleaning up and not tricking you is the right thing to do.

(updates follow)

1 March 2018: This is the press release regarding our program.

8 March 2018: This is the deck we presented in our open industry call.

Finally some carrots for clean monetizers!

Today we gave a talk during ASW in Las Vegas, where we presented updates to our Deceptor program, made a pitch for our premium services, and showed some cool monetization opportunities from our partners.

That last piece: the "cool monetization opportunities," is very exciting for us. For a while now we've harped on how our Deceptor program will drive urgency for apps to clean up, but now we're also able to demonstrate some clear wins for clean monetizers.

Both of these monetization opportunities are relying on us to help them get the compliance right. And both of these opportunities will lead to a better and safer world for consumers. We hope both Chip.de and Blackswan Ventures' EverCore programs will flourish.

Here's a picture of our customers/partner panel talking about the value of our premium service. Thanks David for leading this, and to Amir (Blackswan), Paul (AbeApps), Kyle (SafeBytes), and Bogdan (PC Drivers HQ) for showing their partners and competitors how AppEsteem is helping certified apps to thrive.

 

Updated Deceptor Requirements

Just a quick notice that we've updated our Deceptor requirements to address additional areas of consumer abuse.

Here's the requirements that we've promoted to "Deceptor-level" during the month of October. If we find apps failing these (or any) Deceptor requirements, we'll call them out on our Deceptor website.

  1. ACR-046, because we found that apps were making it difficult for consumers to find their disclosures and install options. 
  2. ACR-071, because we found download managers and bundlers "grouping" their offers behind a single accept button, making it impossible for consumers to select them individually.
  3. ACR-086, because we found apps capturing user clicks, searches, and other data from consumers when this wasn't the purpose of the app.
  4. ACR-116, because we found apps were making it difficult for consumers to remove the app
  5. ACR-103, because we found many browser extensions that offered no accessible value beyond changing search or launching existing web pages
  6. ACR-075, because we found download managers and bundlers making offers to consumers, yet failing when installing the carrier app

A big thank you to our security partners for helping us get these requirements right and for agreeing to enforce against violations. Together we'll make downloading apps much safer for everybody.

If you're an app vendor, we know you want to get it right. Please consider registering your app with us. If you register and commit to fixing any Deceptor violations, we'll notify you a month before we tell our security partners about your violations.

Busting the Barriers to Clean Behavior

(Dennis Batchelder)

(tl;dr: we removed a big barrier to getting certified or requiring certification: the fee. read on for more...)

Buenos Dias from Madrid, Spain! David, Jaimee, and I attended the Clean Software Alliance Summit, and we spent two days hearing from software monetizers, most of the major AV vendors, Google, and Microsoft about the state of the software monetization industry.

I also gave an update on changes we're making to AppEsteem to help drive faster adoption of clean practices. I've attached the presentation so you can see them for yourselves... we're super excited about these changes, and we think it's going to give many more vendors the incentive they need to get off the sidelines and make a commitment to clean behavior.

Here's the presentation.... and just as a teaser to get you to read it, here's some of the cool barrier-busters we announced:

  • Certifications are now free. If you're on a budget, or if you're happy with your compliance team, no worries: we'll evaluate your app at no cost. If it meets our requirements, we'll issue you a certification and inform the security companies that you're compliant. (wow wow wow!)
  • Software vendors who commit to following our requirements can register their apps with us, and we'll provide early notification if we happen to find violations that would land the app on our Deceptor page.
  • We've made it even easier to follow our application certification requirements with a new checklist page that provides prescriptive guidance and shows examples.

 

Our Better World Network has its first certified call center

(David Finn and Jaimee King)

Constant learning. This is among AppEsteem’s most important values, and six months ago, we learned a lesson culminating in the certification today of our Better World Network's first call center, Advanced Technical Support

Last November we launched our pilot program and certified our first set of apps. We proudly advised our partners in the security community, but one partner continued to block one of the newly certified apps. They showed us how the app directed consumers to a call center, and the call center falsely declared their computers were infected with viruses and scared consumers into buying technical support services.

Our big lesson from that: if we want to protect consumers from bad apps, we must look beyond the app. If the app uses a call center, the call center must be clean and compliant. We needed to pore over the entire software monetization supply chain (we’ll be doing more of this in the future, so stay tuned as we start to certify payment processors and ad networks).

And that’s what drove the hard work. We developed a set of call center requirements, following the process we used to finalize our app requirements. We researched best practices, reviewed judicial rulings in call center cases, and consulted with various experts and stakeholders, including a number of call centers, security companies, government agencies, consumer groups, and app vendors. The result of that collaborative work is a comprehensive, consumer-oriented set of 39 call center requirements that will change how the software monetization industry engages with call centers, and how call centers engage with consumers.

Any call center that meets this set of 39 requirements can be trusted to support interactions with AppEsteem certified apps. You’ll see that we marked eight of the requirements in red; if a call center violates any of these requirements, we’ll label that call center a Deceptor, and we’ll ask our partners to double-check, then block access to these Deceptor Call Centers. While we want call centers to meet all our requirements, we’ve set a minimum bar so our partners can protect consumers, and so call centers engaged in particularly bad conduct are discouraged from continuing such insidious practices.

We also made it a requirement that any certified software application that relies on a call center must either a) use a certified call center, or b) use a call center that is branded with the app’s name, and that follows our call center requirements. It’s high time for a program that rewards good call centers and isolates bad call centers.

It’s against this background that we announce today our first certified call center: ATS Digital Services, also known as Advanced Tech Support (“ATS”). We visited ATS’ operations in Jamaica and Florida, and we reviewed their compliance with each of our call center requirements. We analyzed business records and call logs, and we listened to live and recorded calls. ATS demonstrated a commitment to ethical practices, and they modified some of their internal procedures to comply with our requirements.

ATS has joined our Better World Network and committed not to do business with Deceptor Apps. We’ll monitor ATS to ensure continued compliance by conducting reviews of records and calls, making mystery shopping calls, visiting onsite, and consulting others in the industry. We believe that ATS is committed to protecting consumers, and we’re thrilled that they’ve become our first certified call center within the Better World Network.

The call center sector, along with other parts of the software monetization supply chain, has been under regulatory scrutiny and in the midst of a broad clean-up for the last three years. In 2014, the FTC took enforcement actions against software apps and several call centers, including ATS, for allegedly misleading marketing practices. ATS cooperated and settled their case in 2016. By putting consumers first, we believe ATS is a great example that companies can dedicate themselves to the highest standards of conduct, and offer remote technical services to consumers in a compliant manner.

Certifying call centers demonstrates, once again, that private and public-sector collaboration can produce great results for consumers. It’s up to the industry, the Clean Software Alliance, and AppEsteem to magnify regulator actions, leverage market forces to further protect consumers, and to innovate in ways that drive sound practices and root out harmful ones.

We hope that today’s announcement helps usher in a new era for call centers supporting certified apps. And that this marks another step toward a healthy software downloading industry – one with less fraud, fewer bad actors, more clean businesses, and far more satisfied and happy app consumers around the world.

Helping China's software monetizers get it right

(Dennis)

As you may have seen in our Deceptor page, we've listed a number of China-based software monetizers who are distributing their apps globally.

We see an opportunity to help China's software monetizers figure out clean ways to distribute their software world-wide. Our goal is that when they want to take their products to a global market, part of their process is to get certified first. This would save them the hassle of going through a Deceptor set of detections and then cleaning up.

Therefore, we announced at the 5th China Cyber Security Conference this week that we'll be publishing our App Certification Requirements in Chinese. We'll also devote some publicity to letting China's software monetizers know that we can help them get their apps right before the launch. We're hoping that by doing this, we'll save consumers (and the software monetizers) a lot of headaches.

I've attached an excerpt of the presentation I gave at the conference. Check out the second to last slide for the Chinese vendor offer.

Here I am with Christine, my translator. Jesse Song, the conference's organizer, realized that we needed to translate Deceptor, so he worked with Hong to come up with something. I think it ended up being called "cheating software" in Chinese. We'll have to come up with another catchy logo...

AppEsteem Goes to Washington

(David Finn, COO)

Last month Jaimee King (AppEsteem’s General Counsel) and I traveled from Washington State to Washington, D.C. to meet with law enforcement officials, prosecutors, and Capitol Hill staffers. Our agenda: to collaborate on new ways to protect consumers from the deceptive and harmful apps that plague the software downloading industry.

We met with eight of the top cyber officials in the FBI and Department of Justice; more than a dozen division heads, attorneys, and investigators at the FTC; and staffers at the Senate Majority Committee on Aging. 

Our primary message was simple – through collaboration, the private sector and government can make tremendous strides in protecting consumers. This message rides on the 2005 industry workshop and report from the FTC that discussed malware, spyware and adware. The FTC made a series of recommendations in that report, including that 

  • “The public and private sectors should work separately and in concert” to reduce the harm this fraudulent software causes;
  • Industry should develop common standards to help the industry self-regulate and better protect consumers; and
  • Industry should refer cases to the government for civil and criminal prosecution.

Unfortunately, the private sector didn’t get it together right away – leaving the problem of fraud and malware from harmful apps to reach epidemic proportions over the next decade. As the industry failed to control itself, the race to the bottom in making and distributing deceptive apps intensified. And the losers turned out to be millions and millions of consumers. 

But that’s now changing. As we discussed with our government hosts in D.C., stakeholders across the private sector proudly came together last year to finally do what the FTC recommended: collaborating to develop the most comprehensive, clean software standards ever, which are now publicly available under Creative Commons.

And with the launch of the AppEsteem Deceptor Program, AppEsteem is working with the security industry to call out the worst apps that trick and defraud people. We hope – and expect – that most Deceptors will clean up their act and stop harming consumers once we’ve named them. 

As for those who persist in preying on consumers, these Deceptors will be among the most appropriate targets for prosecution. Our meetings in D.C. were a big step in adding accountability for the makers and distributors of dirty apps.

Everybody we met in D.C. was engaged and responsive – it was wonderful to be reminded how mission-oriented and committed law enforcement and other government officials in this area are. They clearly recognize that when your average consumer pushes the install button for a free computer app, the experience remains far too risky. But that shouldn’t be – and it doesn’t have to be. 

A big thank you to everybody who met with us from the FBI, FTC, Department of Justice, and U.S. Senate, and to our new friends at the National Cyber Security Alliance and National Consumers League, too. Our trip further convinced us of the founding principle behind AppEsteem’s existence: that together, law enforcement, government agencies, security companies, consumer advocates, and software developers can make the internet safer for everybody.

Copyright © 2018 - Design by FS