 My laptop got stolen last night. I had my presentation on it, but being paranoid, I had backups. I walked back to my room, I was over at the hard rock, and I had a couple drinks. Come back to my room, I log in, use my laptop, I wake up about 7.45 and my laptop is gone. And of course, the first thing I think is, oh my God, I'm not going to be able to make my presentation. So Agent X loaned me his laptop, but I'm still a little bit shook up at having my laptop stolen. Stolen out of my room while I was asleep. Terribles, isn't that appropriate? Anyway, I'm going to start this off with a story. Last year, I managed to piss off my audience in about 5 minutes, and this year I'm going to do something a little bit different. I'm going to aim for 3 minutes this time. I got hacked. We're here at the DEF CON conference, and I'm sure everybody's thinking, well yeah, of course you got hacked here at the DEF CON conference. I got hacked about 4 or 5 months ago. I've been in a very strange online relationship with a woman for about 5 years, and it's filled with all kinds of strange things. It's filled with love and hate and obsession and domination and a lot of weird things. This one, trust me, I've described it to friends and they don't comprehend it. Anyway, I've been in this relationship, so I'm in Miami and I'm doing contract work, and I start looking for a new contract. And you know, how many people here do contract work? Wow, really? Most of you guys are regular employees? Wow. Okay, so if you don't know the contract world, you deal with a lot of anonymous recruiters. They come and they go. It's once in a while you see one again and he remembers you or you remember him, but for the most part it's pretty much like a free market. Come and go, come and go. So I start looking for another gig, and a recruiter calls me up and I start working with her for about 4 or 5 months, and she's helping me out more than recruiters normally do. She's giving me tips, telling me to do follow-up letters, change my resume, this and that, and it goes along for a few months. And then about 2 weeks ago I got a phone call late at night, and it's her and she wants to talk, and she starts rambling on on various things. We had ended up talking quite a bit about our own lives. She starts rambling on, and she asks me about my divorce and how's your divorce going? And then she says, I've got a friend. How would you like to meet my friend? She's a movie producer, scriptwriter, author down in Hollywood, and at that point my mind went, oh fuck. This woman knows the woman that I've been involved with for 5 years. And we go on for a little bit longer, and then I realize, and you know, you can't be sure, it's all perception, but I realize that it's probably her, and she basically inserted herself into my life 4 or 5 months ago, and I did not have a clue. And now she's got my resume, she's got all my contacts, all the people I know, she knows how much I make, she knows where I live. And everybody here is dead silent thinking about that. Oh crap. So I went to a few friends of mine, and I said, what do you think about this? What should I do? And I asked 6 of my friends, 2 of them here right now, and maybe more than 2. And to a man, all 6 of them said, run. Run away from her as fast as you can. But you know, it's the crazy ones that are the best ones, so we'll see what happens. Anyway, this presentation is going to be about perceptions. How many people know Casey Saren, and I am facing foreclosure? How many people have heard of that? The world's most hated blogger. Not that many people. You know, he was on Nightline, 10 days ago, before his website got shut down. Anyway, he's got a lot of notoriety as a guy who was a flipper, a house flipper. He bought a lot of properties, and it turned into a big circus on the Internet. He basically has generated a lot of traffic, a lot of opinions. I normally do trend tracking analysis off the Internet using keyword analysis, and I was trying to refine my process. So let's get into the presentation here. As I was trying to refine my... Well, you know what? Let's go through and do... Let's do the presentation exactly the way it says. Click fraud. What we're going to do is we're going to look at click fraud. Advertising click fraud. A lot of people don't think it's a problem. I never even heard of it until about a year ago. I didn't really grasp the ramifications of it, and then I accidentally ran into it. How many people are familiar with how Google makes their money? Why Google is worth, you know, a million dollars or whatever it is? Okay, they sell advertising, and the advertising is tied intimately to click through. How many times something gets clicked? How many people have heard anything about botnets? Okay, botnets. What I'm doing is I'm laying the groundwork of all the different pieces that are going to come together here. A botnet is a set of zombie computers that have been conscripted by somebody that are being used for, you know, spam, maybe to break into other systems. First thing we're going to do is we're going to talk about the S-curve. How many people know about the S-curve? The S-curve is how an idea propagates through a population. I start off with one person, the origin of an idea, and he talks to a couple of people. Those two people may talk to three or four other people, so you get a progression, a wave, of the meme spreading through society, and it tends to look like an exponential function. This is a physical model of how it works. You know, one guy talks to a couple, a couple to four. This is what it looks like as a curve, a mathematical curve. If you understand the S-curve, you can determine certain points about it, about the exponential function, and when it is increasing and when it's decreasing. If you understand this curve, you can make pretty good guesses about what's happening with technologies based solely on keyword searches across different sources. I've been using Deja News for a long time. Google kind of messed up Deja News a couple of years ago, but this concept is fundamental. What you don't want to do is you don't want to get into a technology at the very beginning. It's very high risk. It has a very high chance of failure. You don't want to get into a technology at the end of its life because you're not going to make any money. You're going to put out a lot of effort. You're not going to get very much back. What you want to do is you want to get, best entry point, is sometime preceding the inflection point, but after there's enough foundation that you can be sure that it's going to last for a while. That's the S-Crib. That's what I use. That's basically what I have bound together with the original meme theory to be able to do determinations of certain things on the Internet. Meme theory is the idea that... The idea there. The idea that ideas... The idea that ideas traverse to a population and that they take hold and that there's a certain evolutionary niche... evolutionary aspect to them. Like a tattoo. If you went back 30 years ago, that tattoo was a bad thing. But now, if you don't have a tattoo, you're an old guy. One more definition. The idiosphere. What the idiosphere is, it's the sum of all thoughts that are in the population at any one time. It's all the ideas that are currently in circulation. What has happened over the last 15 years, which is unique and was not true before, is that the Internet exposes a very large subsection of all these thoughts and it's quantifiable. It's measurable. That hasn't been true before. So what I did was I took the original meme theory. The meme guys were very theoretical and they did a lot of noun-based approach. They didn't have the same background that I have. I originally did electronics. I dealt a lot with electron flow. I look a lot at network flows, things like that. So what I tried to do was bind the idea of memes to the idea of electron flow. Then I created a little tool. There's several little tools out there right now that do the same thing. There's a lot of data analysis going on. The kind of value that you can pull out of the Internet just on keyword searches and applying certain operations to them. So anyway, I wrote this little tool, Memminer. This is an idea right here of the S-curve. I used to write in Delphi. I got into Delphi at the beginning before it peaked. I got out of Delphi once I saw that it had ramped up and it was ready to fall apart. I got into Java because the Java meme was ramping up. So over the last 10 years, I've made a lot of my career decisions in the process of what's happening in technical trends based on keyword searches. I used to use Monster. I used to use Dice.com. Here's an example of the power. Everybody talks about the Easter Bunny at Easter. I mean, it's pretty obvious, right? But once you see it on a graph, you think, wow, there's a lot of things going on here that I could probably pull out data on. Now this, the idiosphere, the thought of all thoughts that are in circulation right now is subject to things just like a network. It's subject to quality of service. It's subject to bandwidth. It's subject to latency. So if you know those things, you can look for a switch. On 9-1-1, what happened, if you look at this graph right here, there's a certain amount of the time that we spend thinking about sex, right? And it's fairly constant. You can see from the graph there, although lately it's been getting really high. When 9-1-1 hit, everybody quit thinking about sex and started thinking about terrorism. See that switch? That is quality of service. That's a network with quality of service kicking in. Anyway, memes tend to propagate as an S-curve. It's very generalized. Once you work with it for a while, you realize that it's really flaky, but it gives you kind of something to go by. An assumption is that as memes propagate through the internet, they will be bound to some sites more than they are to other sites, but there will be a general progression, which you can make between sites to get an idea if there really is a true trend going on. I used to use Deja News because it's a very big set. It's millions of people. It's hundreds of, well, probably thousands of news groups, so it's a very good sample set that eliminates a lot of skews. But it doesn't give me true values for certain things. So what I did was I tried to refine the model. I tried to look at multiple sites and then measure that memes are propagating across them. I looked at Deja News. The communication site, a primary site, that would be like email, that would be MySpace, blogs. Anything with primary source where ideas are happening. Secondary source would be a measurement venue, like Alexa or Network, I can't remember now, Alexa. Somebody that's measuring other sites would tend to see some of those trends also. And then the third thing I wanted to look at was reference sites like Google, which do search engines, which also do searches of blogs and record information. So I should be able to see a trend occurring in all three of those venues if it's a true trend. So I started applying this model. I looked at MySpace meme. MySpace meme peaked out at rate of change, not in total growth, but in rate of change. It peaked out in 2006. I applied my model to it and I found out that Deja News showed a peak in January, Alexa shows a traffic peak in March, and Google shows a peak in July. So here's my tool. The rate of change is going way too high to be sustainable. Here's the inflection point for Alexa. Here's the inflection point for MySpace on Google Trends Tool. So my tool works. Wow, I've done something. I've refined the tool and it works. So then I started applying it to other sites to get a little bit more proof behind it, to get a better validation. This is what's really going on. The communication venue is the primary source. The measurement venue has a latency to it, and the reference venue has a little bit more latency to that. And the values here are relative. So I decided to test a new site that I had come across, iamfacingforeclosure.com. And it was growing really fast. It was a very rapid, very rapid growth, and I didn't see the same kind of pattern. It didn't match my tool set. I got nothing in my tool. Deja News doesn't know anything about KC. It doesn't know anything about I Am Facing Foreclosure. Google Trends doesn't know anything about KC, or I Am Facing Foreclosure. So now I've got a quandary. I have huge traffic more than any of the other sites I'm testing, but it's not showing up in two of my venues, so now there's something wrong with my model. So I started thinking about, how else can I test this? And this is the model right here. That basically, as a meme propagates, it tends to seep into other sites, and you can detect some kind of traffic difference. I may not see the same rate of change, but if KC's site increases 10 times in traffic, I should see reference calls in Google that go up some amount. It shouldn't go down, and it shouldn't remain the same. There should be some measurable change in the same direction. So here's I Am Facing Foreclosure. As their traffic goes up, what I did was I bound my site to KC's site. I posted to his site to see if I could slice off some of his traffic, this comment traffic, I've done this before. And I got nothing. I didn't get any kind of measurement at all. So then I started looking at another way I could do this. I did what I call a secondary binding. I bound my site to keywords that KC's site is also bound to so that on the search results for Google, I would be in the same top 10 list as KC. So now if KC's traffic to Google increases, if the queries to Google increase 10 times, and I'm on the top 10 of the page, I should see some kind of increase on my site. That all makes sense, doesn't it? Does it not make sense? And, like I said, once again, I didn't get a two-traffic measurement. I didn't see any kind of increase from Google, and I didn't see any increase from a direct binding into his comments. So now I'm wondering what's going on. And at first I thought maybe it's just some kind of skew to his traffic. Maybe it's just the skew of people that are hitting the site, but it just doesn't make sense to me. I posted to KC's site that the anomalous traffic was very odd. I posted that on his site. And about two days later, all of a sudden I get a flood of traffic, very strange traffic, and this is what I'm going to show you right now, is what came into my site after I had posted comments about how anomalous his site was. I've got one IP here, which is mimicking six different machines, at the very least, simultaneously. I know my traffic. I don't get traffic like this. It would be possible to have six different operating systems of a big corporation that was hitting my site, but I don't get traffic like this. The sizing of the pages that are being hit is too similar. See how it's working within a range? 39, 37, 35, 39, 37, 38, 36. Look at how the page hits are identical. And look at how fast the traffic's coming in. I mean, I got like 10 times my normal traffic in the space of about an hour. This is artificial traffic. This is being generated. That I'm sure of. See how rhythmic it is? And there's no entry point. It's not somebody that's reading my site. They're going right to a link. They're going right to a link, and they're going to old links. They're not going to new links. I know my traffic. 90% of my traffic is things that I post new. People rarely go back and look up something. And when they do go back and look up, they're a minority. They are not the majority of my traffic. They're not 90% of my traffic. So all these things came together, and I started thinking about this, and I realized this is artificial traffic. I'm not the smartest guy in the world. I got a little bit out of my range here. So this is where I tried to induce a secondary seepage. I basically bound my site to the Google search results that Casey was getting so I could test and see. And now I'm getting a slice of traffic directly from my IF, I am facing foreclosure, and from Google search results, and I still am not getting the traffic that I should see. Now, if anybody knows about Casey, they know that he got kicked off of, about a month after I realized all this, he got kicked off of Google for click fraud, and he got thrown off Yahoo for click fraud. I cannot prove that Casey was involved in click fraud, but I can show a strong association to him. So anyway, what I believe is happening, we'll go through about gaming Google. This is what the bad guys are doing. They're using a botnet to control a bunch of bots, generating artificial traffic against Google in order to boost clicks so that people make advertising money. And Google published a paper earlier this year that went into detail about a thing that they call ClickBot Network A. And it goes into much, much greater detail than this of exactly how they're exacting the money and how the fraud is going on. Google claims that the fraud is about one or two percent. The way that they're gaming Alexa, the way that they're making Alexa look like it's working okay, is the fact that just by sheer sampling of the number of machines that they're hitting, they're getting some with Alexa Toolbar, so Alexa mirrors the clicks that Google's getting. I don't think this is purposeful conduct by the master bot. I think that this is just a side effect. And the one place where Casey is not showing up is in Google Trends, and I think that's because nobody who's running the bots ever thought that anybody would actually sit down and try comparing sites like this. But it would be extremely easy to game my model. It would be very easy to just add another bot that hit the Google Trends and duplicated the same kind of calls. So the ability to propagate fraud here is so simple. That's the thing that struck me when I saw those logs. I could write code to do a bot to generate that kind of code. I could write that code in a couple days. And they did an extremely poor job. It was easy for me to see it. Anybody with any sophistication could write, anybody that had more than a few years of experience programming could write something that would be undetectable. That's my conclusion now. I could write something that would be undetectable. This is some of my theories that I was floating around to try and explain why Casey's meme wasn't going through the venues. There's a lot of manipulation going on on the Internet. I talked about it last time. There's an overdriven meme. Breitbart was one, Rocket Logs was another, where they push out a lot of traffic and they try and force a certain amount of thought. They grab your attention and force you to think about certain things. And what that does is it typically falls flat on its face. People have got a certain amount of things that they think about all the time. And it's very hard to dislodge those things. They think about their kids a certain amount of time. They think about work a certain amount of time. Their time is filled up, so to wedge something in there and take away a little bit of slice of time is much more difficult than you think. I've done it. I've tried to do it with my own side. It's very hard. You can typically grab somebody's attention for a few seconds, it kind of flips back again and you lose it. Now this is something I added in here. It was something I realized after I started looking at the kind of hits that the bot was doing on my system. And it's another sign of fraud. Typically, a website will get hits on its new material. And so the curve looks like, you know, the hit curve looks like this right here with normal curve. The great majority of hits are on new material and a trail off as material gets older. The way that the botnet was hitting my site is the blue curve. It was referencing old material and referencing it in a linear pattern, which tells me that they were going to my site, they were sampling all the pages equally, and then just running it through an engine where it just picked them out at random. They're not even trying to match this curve. So this is another venue that you could find to detect curves by looking at the decay curve of how web pages are being called. And once again, this would be very easy to mimic if you're aware of it. Once you realize, oh, you know what? I should be hitting the new material and I should apply an exponential function that I choose pages from. It could be very easy to mimic this. Money. It's all about money. Yeah, right. That's one of the frauds. Yeah, exactly. Oh, I was saying Casey's case, adding a disclaimer here that I can't prove that Casey was doing click fraud. I would say that his total goal, he admitted his goal, was to make a lot of money off of his website. He was trying to get it up so it was generating, you know, like $7,000 to $8,000 a month. Yeah. And then that was the theme of his website almost from the start. And that's been done. Actually, that's an actual case. There was a lawsuit last year on that. Now, actually conducting click fraud directly, I'm not sure what the legality of it would be from Google's standpoint. I'm a little bit surprised. I expected Google to be more paranoid about the click fraud. Like I said, I wasn't aware of it a year ago. I just stumbled into this completely by accident and I wrote this thing up and submitted it to DEFCON and I wasn't really sure it would be accepted as a presentation. I figured, while I did this, I'll write it up, see what happens. But I am shocked at how easy it was to find click fraud and I am shocked at how easy it is to propagate it. I realized, looking at the logs there and what they're doing, TCPIP and the web were never designed to assign a unique identifier to a person. They were never designed to enforce identity and what Google has done is they have bound their advertising model to what I believe is a fairly flawed model. But it hasn't shown up yet in their stock. It hasn't shown up anywhere. What we really need to be able to detect if there's a bot behind a click, I sat there and I thought about it for several days, several weeks. How can I identify a person? How can I know that there's a person behind this system? How can I know that my advertising is truly giving me money? How can I know that I'm doing advertising and it's being effective? And the more I thought about it, the more I realized there's virtually nothing that I can't duplicate programmatically. The only thing I can't duplicate programmatically is an actual sale. So my theory, and I'm not an expert on this, but I don't see how the advertising model that Google is following can't eventually be tied back directly to sales. I think there's going to have to be a direct connection back to real sales and they're going to have to abandon the by click model. It hasn't happened yet. I'm sure Google would deny it or not want to talk about it, but it's just too easy to mimic this stuff. Click fraud is more pervasive than it's been reported. I was able to detect it by accident just by looking at the traffic across sites and comparing it. But I think bot nets are much more serious than anybody's been led to believe. I didn't hear about bot nets until about two years ago, and I didn't pay a lot of attention to them until I got involved with this. And then when I'm getting traffic from a bot net, I'm thinking, wow, that's, you know, that's like a couple hundred lines of code. And I do think Google will have to address this eventually. I went way too fast, didn't I? Oh, he could have masked the traffic. Yeah, I could. About the fraud, I know I'm right about the fraud. What we can do real quick is we can go through a couple other ideas I got floating around. Basically, this conference attracts a certain type of person. We all know that. They're very detail-oriented. You've got to be detail-oriented to find the kind of bugs and the exploits that people here do. I'm on the other side of the spectrum. What I try to do is I like to look at the internet as an abstract entity and try to apply theories and ideas to it that work from an effective structure, not from a technical structure. Yeah, yeah, right, right. You know, it's like Google AdSense. You'd still be able to spoof it, but you'd still have the ability to detect it. If there's a comment section, or if there's search pages being done, you should be able to detect the fact that traffic is not symmetrical. You should be able to see that the comments are not getting the same increase in traffic that the site is getting, or that Google search pages, certain links, are not getting the same amount of increase in traffic they should be getting. I'm surprised if you see Google start doing this. They essentially put in a honeypot in. They could insert their own link in there, some false link in their top 10 list, and see how much click-through there is and compare it against the two sites. I mean, that would be very easy to do. Probably be detectable after a while. They'd have to swap it in and out a lot. That was one of the ideas that went through my mind. You could essentially do a honeypot kind of idea. That's for next year. You know, there's a lot of things you can do to manipulate Google. And I probably shouldn't say that because I haven't done it. There's a lot of keyword stuff you can do. My illusion of traffic on my site is, like, 10,000 hits a day. My actual real traffic is 100... No, not 100 hits. You know, it's 50, 60 people. There's a lot of things you can do to manipulate Google. And I probably shouldn't say that because I haven't done it. There's a lot of keyword stuff you can do. You can do to make the system look different than what it really is. One thing I'd like to talk about since I got some extra time, one of the things I look at is memes. I spend a lot of time on memes. I spend a lot of time on manipulating things. Most people look at things from a passive sense. A passive device. They look at ways they can measure things. I look at how... I look at active stuff. I look at how I can force things to be a certain way. There's things that you can do to manipulate information. And the Casey site was very... It was very instructive. I got to watch a certain... Him take a slice of people's attention, a meme, take a slice of it, and grab it and hold on to it. And then towards the end, as the site was falling apart, I tried to measure how it diffracted out and how it got sliced up and taken by other people, kind of like sharks. And this is all very... This is all very flaky theory. One of the nice things about DEF CON is they let somebody like me talk. Because a lot of this stuff is... It's all empirical based. It's not provable. But after a while, you get an idea of what... You get an idea of what was really going on. I mean, I can't prove it. This is an idea I worked up last... almost two years ago. I call it diffraction. It's just that it's moved through the network. What happens is that when there's an event, when there's a significant event, if you think of it in terms of a network, quality of service, bandwidth, latency. When there is an event that takes people's attention, you've got an automatic expansion of bandwidth. You've got a reallocation of bandwidth from lesser things to the thing that's bothering people, to the thing that grabbed their attention. And that's what Casey did, was he managed to grab a chunk of people's attention, and he managed to aggravate the hell out of a lot of people. I call that diffraction. It's measurable. That's what's different now than what 15 years ago. Nielsen was taking samples from people for television, but the internet is far more pervasive, far more granular, and it's quantifiable. So what I look for now is... What I'm going to do is I'm going to float a theory for you, which is very subversive. But I think you'll eventually see something like this happening. It is possible to take and measure keywords as people are talking and look for a diffraction. This is a diffraction when the pope died. There's normally a certain amount of bandwidth that's being allocated. If you look through before the peak there, it varies up and down, but there tends to be a steady bandwidth of what people are talking about with the pope. Pope dies. Now there's suddenly a reallocation of bandwidth. People are talking a lot more about the pope. They're talking about his death. But if you do manipulations on the data, you can see that the pope's death is not the only idea that gets spawned. There's several additional ideas that are spawned at the same time, like who will replace the pope? What did the pope do in 1987? There's a whole range of things. I call it diffraction. There's a certain amount of bandwidth which is popped. I've got a bunch more bandwidth now, and it's doing a bunch more things. And one of the things I want to do, not me, but maybe subversive people want to do, is I want to grab that bandwidth, and I want to reallocate it to my stuff. I want people to read my stuff. I don't want them to read about the pope. If I can find a diffraction, if I'm monitoring a site, let's say that I'm reading live journal, let's say that I'm looking at a small group of people, two or 300 people that have some kind of shared interest, and I monitor their keywords and I wait for a diffraction. What a diffraction tells me is that they are now at a susceptible point. There is bandwidth that's been freed up that's in flux. And that's a point where I can inject my ideas and I can sway opinions. It would be very easy to set up a feedback loop. You could automate a lot of it. Where you'd monitor a small group, watch for certain keywords. When keywords were triggered, you inject certain keywords and try and walk people over into other ideas. It's very subversive. And I can't prove that I've done this, but I'm fairly sure I have. I wouldn't have thought of using it for stock prices, but you see, you can't be direct. You can't... The meme structure is very subversive. It's been refined over hundreds and thousands of years. So the things that are in place that people think about have a lot of strength. They have a lot of stick. It's very hard to knock them loose. That's why you want to look for a point where something else has already knocked them loose, where something has already freed up mind width. Yeah, that's probably being done. There's a lot of things going on on the internet that I don't think people are aware of, like the Breedpart meme. There's definitely companies out there. Once again, I can't prove it. All I can do is read the trails, read the entrails. But there's been memes that have been forced where people have tried to do a broad push and then it's died out because there's just... You know, there isn't real demand there in people's minds. They're not willing to dial into it and listen to it. That's why something like this, when you're doing a quantitative measurement of stuff and looking for changes, this is the Pope's death. You can see that the Pope set off a big diffraction. Now let's look at SARS. This is the opposite side. SARS virus. Does everybody remember SARS when SARS came out? Nobody remembers the SARS virus? Does anybody remember what the mortality rate of the SARS virus was? It was somewhere in the 15 to 20% range. That's huge. I mean, that's the black plague. But that tells me a lot about the media. See how SARS came along. But when you look at the bandwidth of everything that's allocated to virus, it doesn't budge. What happened was existing bandwidth, existing bandwidth that was already being used for virus thought, thinking about viruses, was reallocated to SARS, but no new bandwidth was added into it. People didn't want to know about this. There's a cultural bridge here. There's a cultural resistance here to listening or thinking about it. The Pope was a big thing and everybody talked about it. SARS, nobody wants to know about it. The only people that dialed into it were specialists that were already working with virus. And you can see it in the graphs here. What? You know, I used to buy that. I went down that path. SARS was global, and the Pope was global. So these were taken almost at the same time, and they're very similar populations. I have played around with the international stuff. You can subset DJ News by U.S. groups, Denmark groups, and you know what, since I still got some time? Yes, I'm searching English keywords, and yeah, yeah, yeah, I know, I know. Here, since you guys have interest, then we'll go ahead and look at it. Since two people have interest. This is DJ News. This is the Iraqi war subsetted by country. You can fingerprint culture. This is western culture. This is England, Australia, Canada. This is how my Iraqi war has been talked about. This is frequency count. And if you could look at it, see how very similar it is? Right? That's angle culture. Now let's look at a different culture. Let's look at the exact same keywords. And the population sizes are very similar. That was one of the things I took a look at. See how much different this is? The things that concern England are not the things that concern France or Italy. They're different things, and they react differently to it, and you can detect it. This one's not quite as good of an example. Let's look at the Japanese. The Japanese couldn't care less about the Iraqi war. They don't talk about it at all. Like I said, the sample sizes are very similar. All the population sets on here were between 8,000 and 16,000 records. So there's no more than a two times difference anywhere. But you can see this is a logarithmic graph. That is something I looked at, was cultural differences and keyword differences. And you're right, there's things going on in other languages, but they're a minority and I don't speak them. And I'm just looking for my own... I'm looking for my own stuff. You know, I'm sure that there's trends going on in other languages that are detectable. Look, buddy, if you do a search... That's good. And I gotta say again, thanks Agent X for bailing me out. For giving me a chance to come here and do something. This fascinates me. I have been dealing with the data graphs like this for 13 or 14 years. But it's only been the last three or four years that I've got a lot more quantitative about it. And when I saw the kind of information you could pull out, it's just, it's stunning. There are patterns. Google put a paper out on click.a. That's it right there. So that's what you look for. And it goes into a lot more detail. It's a very technical paper written by two guys at Google that know a lot. They know what they're talking about. They identified a botnet that was defrauding Google. It was running about 100,000 systems. And their estimate was that it was defrauding them of maybe $50,000. I question the numbers. I think the fraud was probably... And they didn't give a time frame on that. They said $50,000 per some period. But they didn't specify the period. So it could be $50,000 a week. But I think the fraud is more... It's so easy. I think it must be more widespread than what Google says. If I stumbled into it accidentally without even trying to find it, simply because I'm trying to refine a measurement technique, that says something to me that I fell into it. If it's only 1 or 2% of the traffic, I'm just having a hard time buying that. Any other questions? Sure? Oh, okay. Thank you for your question.