Aug 21, 2020 7:00 AM

How One Man Broke Through Google's Election Ad Defenses

A Long Island search marketer found a way to exploit Google search ads and spread misinformation about candidates. The company pledges to fix the issue.

Illustration: Elena Lacey; Getty Images

Ever since the 2016 election, Google has promised to police political advertising on its platforms more closely. Today, if you want approval to run an election ad on a Google property, you have to first verify your identity. (Google uses the term “election ad,” not “political ad.”) Once you’re verified and your ad is approved, you can only target by location, age, and gender. Microtargeting, based on granular stuff like demographics, interests, voter file data, and so on, is unavailable.

But what, exactly, counts as an election ad? Recently, Patrick Berlinquette tried to find out. A search marketer from Long Island, Berlinquette has a penchant for experimenting with Google ads. (Last year he wrote in The New York Times about the power of targeted mental health support for people searching for suicide-related terms.) In July, he ran a series of ads pegged to election-specific search terms, targeting people who might be using Google to figure out whom to vote for.

“I wanted to test how easy it was to run political ads,” he said. “It was that simple. I didn’t know much about the political space. From what I understood, it was a high hurdle, you had to get a certificate. I expected to get disapproved right away, and I was going to move on.”

Google’s policy says that election ads “include ads that feature” a candidate, officeholder, party, or ballot measure. When Berlinquette used candidates’ names, like Trump or Biden, in the text of the ad itself, he indeed got disapproved. This left a question in his mind: What if you targeted an ad at people who search for a specific candidate, but avoid mentioning that candidate’s name in the actual ad?

In one example, Berlinquette put in the search keywords “should+vote+Biden” for an ad that read, “You Shouldn’t | He’ll destroy this country.” Other ads used the phrase “Say No To Joe.” He ran similar, anti-Trump ads keyed to search terms like “why+vote+Trump.” In those cases, Google approved the ads and let them run until Berlinquette disabled them. (Berlinquette set a very low budget and targeted his ads narrowly to make sure few people would see them. The ads ran for about a week, racking up a few hundred impressions and a few dozen clicks.) Because these weren’t flagged as election ads, the full suite of microtargeting options remained available. All he had to do, it seemed, was avoid using a candidate’s full or last name. Moreover, he was able to use any URL he wanted. (Google search results, including ads, have to include a landing page.) Most of the time, he used well-known news sites, adding a layer of credibility. Users who clicked the ad would be taken to an article on that site about the candidate. Berlinquette seemed to have uncovered a serious weakness in Google’s election ads policy.

Google agreed—partially. After I shared Berlinquette’s experiment with the company, members of the policy and enforcement teams reviewed the ads and concluded that they should have been disapproved. The reason: An ad that doesn’t mention Trump by name can still count as a Trump election ad, or an anti-Trump election ad, if it links to an article about him. According to a Google spokesperson, Berlinquette had identified an enforcement gap. In response, Google says it plans to increase the amount of human review that goes into evaluating landing pages for ads that potentially fall under the election policy.

Berlinquette was delighted to hear that news. He has long considered the ability to run ads with any URL to be one of Google’s biggest vulnerabilities. “The advertiser can basically bring you wherever you want, with no check, when the entity you’re sending the traffic to did not write the ad,” he said. “To the end user that’s using Google, they have no idea. Hopefully not only with political ads, but across the board, Google will take that more seriously.” (In April, Google announced that it plans to implement a political-ad-style verification requirement for all would-be advertisers, though the company says this “will take a few years to complete.”)

But Google doesn’t intend to close the gap entirely: Search terms are still not considered part of an ad, for the purposes of election enforcement. Outside experts disagreed with that choice.

“This sound to me like it is a loophole in the policy,” said Laura Edelson, a PhD candidate at New York University who studies political ads on social media. She argued that the search terms are precisely the kind of context that informs how people interpret the results they see. A phrase that might not be obviously political on its own—like “You shouldn’t”—takes on a different meaning if it comes as the answer to a query like “Should I vote for Donald Trump?”

“Part of what goes into the impression of the user, in the case of a search ad, is the thing they just searched for,” Edelson said. “I think it’s pretty important to take that keyword search into account when making that determination of whether an ad is political or not. Any determination, if it’s not factoring in the context, is missing a pretty big piece of the puzzle.”

Eric Wilson, a Republican digital strategist who has experience running Google search ads for campaigns, agreed. “If you’re searching for voting and someone’s bidding on those key words, you might want to see what they’re saying,” he said. “That’s a ripe target for disinformation about voting.” The kind of search queries that Berlinquette used are a campaign’s bread and butter. “What Google always talks about is ‘intention.’ So if there’s an intent to vote in that query—like ‘how to vote,’ ‘mail in voting,’ ‘absentee voting’—and I’m the candidate, I want to be running on that term,” Wilson said. “That is, for most voters, their primary point of entry for learning what’s on their ballots, learning about candidates, learning about the issues. So it’s a very important gatekeeper, Google search.”

Berlinquette worries that search ads can seed disinformation even if people don’t click on them. Some of the ads he ran contained specific, harshly negative false claims about candidates. And thanks to recent design changes, Google search ads look nearly identical to organic search results, other than the word “Ad” in small type above them.

“If you were just bombarding people in the US with this, dropping, like, a thousand bucks, and tens of thousands of people saw it, all it takes is someone to go on social media and say, ‘I saw on Google that so-and-so happened,’” Berlinquette said. “They might not even say they saw it on Google; they’d say, ‘I heard that.’ That’s how things spread on social media.”

It’s hard to say whether, or to what extent, the search-term workaround is being taken advantage of—in part because ads using this technique can be microtargeted, making it easier to avoid detection, and won’t be included in Google’s political ad libraries. Wilson thought it might be too expensive for outside actors to use widely. But if they did, it would be a problem. “Let’s say someone has the money and inclination to work around this loophole,” he said. “One, it’s driving up my costs as a campaign because we’re bidding on the same keywords, same terms, same searches. But, two, I have to spend more money to protect myself from that attack.”

Google search ads have been part of election-related misinformation schemes before. An internal investigation reportedly found evidence that Russian agents bought political ads during the 2016 campaign. More recently, scammers have targeted users with ads for fake voter registration sites.

The loophole Berlinquette found raises a broader issue. As Michael Posner, the director of the Center for Business and Human Rights at NYU, put it, “They’ve never really defined what a political ad is.” Google says the policy “includes” certain categories, but doesn’t say exactly where it draws the line between election and non-election advertising. It wouldn’t tell me exactly how it intends to take more account of landing pages. The company has an understandable reason to be vague: It doesn’t want to give bad actors a blueprint for how to evade enforcement. But that makes it hard for the rest of us to evaluate what it’s actually up to—except when concerned citizens like Patrick Berlinquette take it upon themselves.

But Berlinquette has had enough of the Google enforcement beat. “I think this is the end of the road for this,” he said. “I have two different paths I’ve gone down the last couple years. One path is using the experiments to show how messed up everything is. And then the other path, which I’m much more interested in, is using this stuff to help people.”