The Google-Kenya ripoff

Mocality is an African startup that has a Kenya-wide business directory. There is no Kenyan yellow pages, so the directory was crowdsourced, paying thousands of Kenyans to help create and validate its database.

When the businesses in Mocality's database started asking them about the premium service they were offering with Google, Mocality was puzzled. They had no joint venture with Google, and they had never charged any business for inclusion in their database. When they examined their server logs, they saw a large number of hits to the records for the businesses that had been cold-called from the same IP range.

So Mocality laid a trap: when that IP range next visited the Mocality site, they fed it fake phone numbers that went to Mocality's own call center, where a Mocality operator pretended to be a business-owner and recorded the conversation. In that conversation, the caller identified himself as a Google employee, calling about a joint Google-Mocality venture, and asking the business to pay Google for a Kenya Business Online website with its own domain on that basis. This was, of course, absolutely fraudulent. There was and is no Google-Mocality joint venture.

Shortly after, that IP range stopped visiting Mocality's servers, but another range, this one registered to Google's Mountain View headquarters [edit: this address has previously been used to conduct official Google business in India], began to query its database. Again, Mocality served a fake result with its own call-center number, and an hour later, they received a call from someone identifying herself as working on Google's behalf, asking for money for a joint Google-Mocality product.

The conclusion is hard to escape: Google -- or people working on its behalf, with its knowledge and cooperation -- took the numbers of tens of thousands of Kenyan businesses from Mocality's database, then fraudulently solicited money from them by claiming to be in a joint venture with Mocality. This seems to me to be outright criminal activity, and Google has a lot of explaining to do.

Update: I have contacted Google Africa's press address and asked for an on-the-record response from a named spokesperson.

Update 2: Julie Taylor from Google has replied saying that Google will have a statement soon.

Update 3: Nelson Mattos, Google's Vice-President for Product and Engineering, Europe and Emerging Markets, writes:

We were mortified to learn that a team of people working on a Google project improperly used Mocality’s data and misrepresented our relationship with Mocality to encourage customers to create new websites. We’ve already unreservedly apologised to Mocality. We’re still investigating exactly how this happened, and as soon as we have all the facts, we’ll be taking the appropriate action with the people involved.

Here's Mocality CEO Stef Magdalinski on the subject:

Since October, Google’s GKBO appears to have been systematically accessing Mocality’s database and attempting to sell their competing product to our business owners. They have been telling untruths about their relationship with us, and about our business practices, in order to do so. As of January 11th, nearly 30% of our database has apparently been contacted.

Furthermore, they now seem to have outsourced this operation from Kenya to India.

When we started this investigation, I thought that we’d catch a rogue call-centre employee, point out to Google that they were violating our Terms and conditions (sections 9.12 and 9.17, amongst others), someone would get a slap on the wrist, and life would continue.

I did not expect to find a human-powered, systematic, months-long, fraudulent (falsely claiming to be collaborating with us, and worse) attempt to undermine our business, being perpetrated from call centres on 2 continents.

Google, what were you thinking? (Thanks, Stef!)


    1. Certain people will be hired and will use tactics unknown and against Google’s own policies to bolster their own personal success within Google; They should be fired if Google cares to legitimately maintain “Don’t be evil.” Mocality should be given compensation as well as their name was used to present a false partnership.

    2. Google is a publicly traded US corporation, and so their axis of “good” to “evil” is a matter of law rather than normal ethics. The highest good for a corporation is shareholder value. Roughly, that means “make money any way you can that won’t come back to cost you more later.”  

      Note that this doesn’t include all of “don’t make money in ways that someone will eventually make you stop doing.” As a creature of law, corporate “ethics” should always be bounded by following all relevant laws, but that isn’t always a sharp line. It is possible (although far-fetched) that in this case Google just fed leads to affiliates or employees who independently stretched the truth that Google mined Mocality’s public directory of customers for leads into a claim that Google was working with Mocality. That would absolve Google of being “evil” (i.e. intentionally engaging in fraud) as a corporate entity. My bet is on Google HQ coming back with that far-fetched story: “our overseas contractors misunderstood what we told them about getting leads from the Mocality directory.” That could have been more plausible if it hadn’t been a definitively Kenyan IP address that was “caught” first. 

      1. The sentiment that a corporation’s main purpose is to maximize shareholder value is a maxim brought about by Jack Welsh back in the early eighties. Creating shareholder value, however, isn’t a legal requirement. Many Corporations, especially those pre eighties, would tell you a companies main purpose was to serve it’s customers. 

        Some people who use Google services make the mistake of thinking they are Google’s customers when in fact they are the product. Google sells the users of its products information to its real customers,  advertising companies. 

        Regardless, a company is generally (but not always) held liable for the actions of its employees. Google taking the work of others without permission or compensation seems to be an ingrained corporate Moto. If Google didn’t specifically direct the behavior, through its own actions it encouraged such behavior. 

    3. Should any of your agents be caught or killed, the Secretary will disavow any knowledge of their actions.

  1. There has to be more to this. While I haven’t bought the “don’t be evil” motto for a while there’s a difference between corporate shenanigans and fraud. This moves clearly into the fraud category and I thought Google management was generally too smart and wary of bad press for that.

    1. Not only that, but it seems pretty inevitable that this would be caught exactly like it has been.  If you are a fly by night fraudster then that doesn’t matter, you just take the money and run, but if you’re google you’ll get bad press and lose the money and face law suits.

      So has google been asked to comment?  

    2. for quite a while now it seems like they have become incredibly arrogant, to the point where I’m totally willing to believe they thought they could get away with this because, like, Africa?

    3. Google isn’t a small company. This wouldn’t have even been caught or seen within Google unless Mocality brought it to light, and now that it has I imagine the top management will do what they need.

      1. Kind of falls in line with what’s quickly becoming Google’s new motto… “We’ll do what we want, and apologize later”.

        1. So you’re saying that every single company should review/verify every piece of marketing material all the way up the chain of command before it’s used to ensure it is in line with core values? I would agree that it should happen at the boutique-size level, but going further up the chain would hamper efficiency too much and they really could be no more reliable. Who knows, maybe even the higher-ups were lied to that there was a Mocality-Google partnership, or perhaps it was indeed an outsourced service but were using Google services, thus on Google’s IPs.

          1. Is that what I’m saying?  Really?  I thought I said what I said.

            As for assuming something that has NO bearing on what I wrote, I understand the basics of corporate structure enough to know that there are more than one or two layers of management between a Google Kenya employee and Sergey & Larry.

            But thanks for the education.

          2. @AlanStrangis:disqus – Can’t reply to your comment below so doing so here..

            What I was trying to infer is that you’re expecting that ‘Google’ as a massive entity is purposely allowing this to happen, instead of allowing the assumption (valid as your own assumption) that this wasn’t a malicious purposeful act by All of Google, and trying to imply that it runs rampant within the company. It’s an easy way to get support when generalizing and good-versus-evil’ing things.

            Here’s Google’s current response:

      2. Uh oh, Google fanboy coming to defend his idols. If you read the entire post by Mocality, you’ll see that this was an operating going on in two different continents. As the CEO of Mocality said, they would have originally assumed this was just a small band of employees involved, but when they realized this was an operation going on in two different continents, that immediately proves otherwise.

        So, yes, Google is a big company and not every action can be monitored inside the company. But this was a months long fraud operation in two different regions of Google. This isn’t just a small rogue team, this was something being perpetrated higher up in Google. Obviously not at the CEO level, but fairly high up.

        People like you who will defend every single slimy tactic of Google need to pull their heads out of the sand. The “Don’t be evil” motto is complete bullshit. 5 years ago I believed it, but not anymore. Not only is Google NOT an ethical company, they are actually one of the most unethical “evil” companies in corporate America.

        And their size has nothing to do with it. There are many large corporations who still have the slightest bit of ethics and integrity. They have quickly become today what Microsoft was like in the 90s. Anticompetitive, engaging is questionable antitrust behavior, and highly unethical. Remember what they also did to Skyhook? Imagine all the other bullshit going on there that hasn’t even been brought to light.

        1. Most businesses have the same bullshit associated with them. Businesses are for profit and save their own asses, nothing more. That doesn’t mean everything is maliciously done. “Profits” aren’t good for society and business isn’t good for the soul – but they exist because organization is needed.

          Google is doing business within the boundaries that law and society currently has set, but I believe you will find a heart somewhere in the big engine of theirs – and it’s noticeable compared to other large companies like Facebook who blatantly do things people don’t want, repeatedly, primarily around trust/privacy – which is arguably the most important thing a person has.

          “Multiple Month Long Fraud” — The higher-ups might not have even known about this until Mocality raised their voice. Unless you’re privy to their structures, a simple assumption that could be made is that it was one or a few offices managed by an individual, who perhaps reported to another individual, who reports to other people about the progress..

          Yup – Google’s big so you hear about it. You mention “there are many large corporations who still have the slightest bit of ethics and integrity,” though just following it you mention “Imagine all the other bullshit going on there that hasn’t even been brought to light” – which truthfully can be applied to every other ‘ethical’ business you’re purporting exist in the purest way possible; Of course some exist but they too can have dirt and you not know about it.

          Final note – Calling me a Google fanboy you immediately diminished yourself to a name-caller, pretty lame argument tactic.

          Here’s Google’s current response:

          1. Ask Joe Paterno about following the letter of the law (e.g. reporting to his supervisors suspected child abuse). Even though he followed the letter of the law, he was scorned, and fired. 

            By embracing a phrase, “Don’t be Evil” Google decided to hold itself up to a higher standard. It is failing miserably. 

        2. The moral of this thread seems to be that geeks root for their favorite corporations the way that jocks root for their favorite sports teams (which are, of course, also just corporations.)

    4. There are at least two plausible explanations that aren’t refuted by anything here.

      1) Mocality is lying about some or all of this, for reasons specific to the company. (Publicity? Setting up a David vs. Goliath frame? Covering up internal wrongdoing?)

      2) Mocality is honestly mistaken about the IP address data, either because they are being successfully tricked, or there is a rogue black-hat inside the company covering his own tracks.

      Google is what Google is, and what Google is is certainly capable of committing crimes. But Google is far more likely to accidentally commit atrocities than it is to deliberately defraud a tiny fraction of the business community of a tiny market (in global terms).

      Put another way, Google’s cash on hand is much larger than Kenya’s GDP. Google could literally buy and sell Kenya, or at least buy everything made in Kenya for over a year.

      1. > There are at least two plausible explanations…

        And they’d both be wrong, it seems.

        There are probably more facts to come, but Google’s statement in the update seems to confirm the allegations.

        1. Yep, they were both wrong. Still, I do think those are pretty plausible explanations, given what we knew way back when. And at the risk of being wrong yet again, I’ll predict that when the dust settles we’ll find that this does not go particularly high on the Google org chart.

          Google’s one of those companies where saying anything either way makes you a straight up hater or a pathetic fanboi white knight. But while gigantic richer-than-God corporations can be both crazy and evil, they just aren’t this kind of crazy or evil. 

  2. I’m pretty sure that this is not strategy – it’s peanuts in revenue against an avalanche of bad press, but it does mean that someone comparatively high up in Google is driving the fraud without having yet been caught for it.


      someone comparatively high up in Google is driving the fraud

      Or that Google isn’t involved, and this hitherto unknown entity is making false claims.  It will be interesting to see what happens.

        1. Did you read coryf’s post? Or “this hitherto unknown entity is making false claims.”

          So far we only have Mocality’s word on this.

          1. Stefan Magdalinski is quite well known in London tech circles – he was involved with mysociety and If nothing else, he deserves to be given the benefit of the doubt.

        2. I am puzzled as to how exactly Google is getting the blame for this. A hacker would be clearly, to me, able to spoof his IP to appear as if Google is up to something, to complete the ruse, as a trail-throwing technique. .

  3. I realize one of the IP ranges was registered to Google Mountain View, but has anyone contacted them or their legal department about this?

    This sounds like someone pretending to be Google running some kind of scam. I cannot imagine their company doing something like this. Beside being unethical it doesn’t make economic sense.

    1. Yeah, it’s like finding out your uncle’s a mobster.  It’s so extraordinary that I think I’d need extraordinary evidence.

      Mind you, if it does turn out not to be google, but somebody playing clever with addressing, then it’s going to be one of the best demonstrations yet of the unworkability of SOPA.

      1. Are they, though? I read the transcript and clicked through to the GKBO page. GKBO provides only addresses for free, *not* addresses as the caller was promising (“custom addresses”, which I assume are, are Ksh 1,000 through GKBO, not 200/mo) . Also, GKBO seems to require making your own website (through some kind of automated wizard), instead of designing it for you.

        They could very well be scammers profiting off Google by using GKBO — creating a bunch of free websites using easy tools and then reselling them. That makes them a bunch of profit for 10m spent putting some things in a web page.

        Second, those access patterns are pretty weird for a business which is built around automatically scraping content on the internet. As the post says, it looks like humans, not robots. Why would Google use humans to do something a computer could do much better, especially something within their specialty?

        I’m skeptical, but not convinced either way. Specifically, the G+ post from Google about it is weird — they’re not saying it’s a bunch of scammers, at least not yet. Also, I don’t know if the Google IP could be spoofed.

  4. Doesn’t wash. I find it very difficult to believe Google would do something like this. It is not difficult to use Google’s servers as a cache/proxy to visit websites and pretend to be Google.

    I would want to hear from Google before I published this kind of accusation publicly. That there has been no effort to speak with Google, not even an acknowledgement that Google “failed to respond,” takes a lot of the validity out of the story and puts it squarely in hear-say territory.

    1. Yeah, I’m not getting where the evidence for the “people working on its behalf, with its knowledge and cooperation” bit is supposed to be here. A Google IP address is all you got? Seriously? Have I wandered onto Mirror-Universe BoingBoing, where you actually infer some kind of guilt based on IP address?

      1. When an IP address registered to Google HQ’s internal network is fed a unique phone number, and one hour later that phone number rings from someone who claims to represent Google, and repeats fraudulent claims that have been made for months from entities selling a Google product (that has no affiliate program), it is reasonable to infer that this is taking place with Google’s cooperation.

        The most reasonable alternative hypothesis is that a rogue Google contractor has been given access to Google’s internal network, tunneled from Africa (where the first round of human-driven scraping started) to that server, and then conducted the fraud without Google knowing about it.

        I, too, am generally inclined to trust Google’s business ethics. But as between a hypothesis that relies on unethical behavior by Google and one that relies on grossly incompetent systems administration and security practices by Google’s security team, I believe bad business-ethics to be the most likely explanation.

        1. The ip is not used at Mountain View, that location is only in the WHOIS record because it’s Google’s headquarters. If you search online for the ip, you’ll find lots of evidience that the ip is used in India, same place as the call center. Previous activity from that ip includes visiting blogs on Blogger then suspending those considered spam so it does seem to be a part of official Google operations (as opposed to a third party using some sort of Google proxy). GKBO (which is associated with Google but not run by them) must be involved to some degree and I think at least one person at Google Africa must also be to arrange for the services in India (the call center people don’t have to know this is fraudulent) but these actions don’t require any more involvement from the rest of Google.

        2. I’m pretty sure publishing a serious accusation like this without first seeking comment is bad journalistic ethics.

          This story has an IP address and a person on the phone claiming to be from Google as evidence that Google has decided to go into online fraud as a business move.  It isn’t an accusation of bad business ethics, it’s an accusation of outright criminality.

          It also doesn’t make any sense, this kind of scam will always be caught eventually.  Who ever is doing this demanded money for a thing that doesn’t exist, people who paid money will realise the thing doesn’t exist and they will be angry.  Doing this only makes sense if you can disappear with the money before that happens.  Google can’t just disappear.

          Most likely explanation is Google are now in the business of petty fraud in Africa?  To what end?  Do you think this kind of thing is going to make an amount of money that would even show up on their balance sheet?

          1. BoingBoing is not news media. Sometimes it posts journalism and sometimes BoingBoingers do journalism but most of its content is standard blogging where the rules of journalistic ethics don’t apply. When doing journalism, one should follow its code of ethics. If the preponderance of what a blog publishes is journalism then the code should be applied to all of what it publishes. BoingBoing only dabbles in journalism. Because of its immense popularity I think BoingBoing does have a greater responsibility to be fair and seek other sides to a story but that’s still not the same thing as journalism. 

        3. “But as between a hypothesis that relies on unethical behavior by Google and one that relies on grossly incompetent systems administration and security practices by Google’s security team, I believe bad business-ethics to be the most likely explanation.”

          Are you serious? You’re more likely to believe that a conspiracy of fraudulent activity has been officially proposed and executed by several of google’s employees and management, than you are willing to believe that just maybe–in all their vast array of systems and network infrastructure–just maybe, there is a back-door someone is exploiting?

          That logic is… astounding.

          edit: It’s also strange to me that you’re coming to this conclusion without a thorough (or even -any-) vetting of the facts given in this instance. Just saying… I guess when you want to see a conspiracy, you see one.

          1. You’re more likely to believe that a conspiracy of fraudulent activity has been officially proposed and executed by several of google’s employees and management…

            Because if we’ve learned anything from the banking crisis, it’s that managers never deliberately set out to….oh, wait.

        4. What I find reasonable to infer when dealing with a scammer, is to doubt all evidence as potentially trail-throwing. The caller obviously lied about his identity, so casting immediate suspicion about his or a partner’s IP address seems perfectly reasonable. Any 4channer has at least a vague understanding of proxies — that you can make your activity appear as if were being made from an IP not directly tied to your own.

          1. So, we have a scammer that is spoofing their IP Address to appear as though it comes from google-kenya, who then calls and attempts to sign people up for google-kenya services (which has no affiliate program).

            Demonstrate a non-google profit-motive here, and you might have a shred of a leg to stand on.

        5. I’m based in Nairobi, but one of my laptops normally connects through my employer’s VPN.  I’m using the Asia VPN but I could easily have configured it for the US VPN.

        6. I’d like to provide some perspective from the Africa side of things.

          I am Kenyan. I live and work in Kenya.  if you read the original post, you learn that Mocality has built the largest verified business listing database in Kenya via crowdmapping.

          Google Kenya in conjunction with other business entities have an initiative called  Kenyan Businesses Online ( which aims to have business create their own websites and eventually buy their own domains.

          Google’s primary drive in the Kenyan market has been  to increase internet usage. Stuff done in the past include partnering with Safaricom (of MPesa fame) to offer subscribers email addresess on gmail. There however has been little happening on the commercial end of things.

          I share similar sentiments with many of you – that an overzealous contractor, seeing an opportunity to monetise a google product may have aggressively pursued a risky strategy to gain the trust of Mocality customers and turn that part of the business into a revenue center.

          I suspect the person taking this decision did not expect to get caught.

          Bad call.

    2. “I find it very difficult to believe Google would do something like this.”

      Google isn’t an person, it’s a company; a company full of individuals.  Is it easier to believe when you consider that one bad manager might have done this?

      1. I could definitely believe that, although I would doubt it’s someone as senior as a manager.  But the article says

        The conclusion is hard to escape: Google — or people working on its behalf, with its knowledge and cooperation — took the numbers of tens of thousands of Kenyan businesses from Mocality’s database, then fraudulently solicited money from them by claiming to be in a joint venture with Mocality 

        Which the more I think about it, the more libellous it sounds.

      2. Bingo. If a Google manager anywhere in the world authorized or encouraged this behavior, Google is guilty of engaging in this behavior. Google is a collective of people. 

  5. If only you guyz could understand the stuff in the recordings! Google utterly misrepresented themselves. it was a proper sting operation.

  6. Curious to see everyone rushing to defend Google. They are a huge organisation. Is it not conceivable that some executive within the organisation has come up with this scam either to drive up some stats on which said exec has a bonus pending or even using his position in Google as a cover to run a personal bit of fraud.

    Seriously people, you have got to stop thinking of corporations as persons. They are not. They are companies of many people each of whom has their own agenda, is more or less personally good/evil and has more or less power to drive that organisation in their direction. As humans we like to anthropomorphise because it helps us understand but as primates we also like to pin everything on a few examplars – such as the myth of the great CEO when all you are doing is reaching back to those old primate instincts and trying to pick an alpha to crown as king.

    1. The thing that makes me give Google the benefit of the doubt is that it’s such a dumb scam,  in that the perpetrator is so easily caught. As others have said, I may not believe Google’s morals are all that great, but surely they have more common sense than this?

      Whatever it ends up being, I’m keen on hearing how the story turns out.

    2. “Seriously people, you have got to stop thinking of corporations as persons. They are not.”

      According to the Roberts court, I’m afraid they are.

    3. Exactly. And in that situation you’re identifying someone who is running counter to Google’s position/framework as a corporation. This smacks of individual corruption, but it’s not a vast and labyrinthian conspiracy that implicates everyone from the canteen staffer through to the CEO. 

      So, it’s fair to say ‘Hai, guys… hold up here, Google hasn’t done anything evil here…’

      EDIT: Preciction 1 (okay, the only prediction) is that the traffic in the spoofed google IP bloc accessing mocality’s database isn’t going to tally with the US 9-5 workaday hours. It’s going to mesh with people 10 hours ahead of that timezone… in… say… Nairobi.

      Also, more to the point, GKBO doesn’t even offer a premium subscription service. Most of the interaction is lead by the client – there’s no cookier-cutter site form that’s done in five minutes over the phone. The most that they do is charge for domain registration (which is entirely optional, and only kicks in if you don’t want to be a subdomain on the parent domain). In their words “Your website must be hosted in order to be accessed by users. Your website and the hosting of it are free for as long as you own the site.” ( – which kind of hits home how laudable the GKBO partnership actually is…)

      The scam is using awareness of GKBO and the existing Mocality database to shiest businesses, hitting them for a non-existent website and monthly ‘maintenance charge.’

      1. I suspect the scammers are making real websites on GKBO — that’s doable and it looks like there’s an easy tool to be able to do that — and then charging the “hosting fee” for something which costs no money for them.

  7. Um, since Google is not a person, people working for Google at Google headquarters who identify themselves as Google are considers Google. So there isn’t much need to say “Google or someone representing themselves as Google”. This is definitely Google doing something, especially if the IP is moving around their IP ranges. It’s not just one guy at a desk who thought it would be a cute idea.

  8. Among the reasons why it would make sense for this to be anyone high up in Google or technically-minded: The database is already entirely crawled by Google bots, which means the entire content of their database is also mirrored on Google’s servers.

    This means that anyone who wanted to engage in subterfuge at Google need only consult their own database  — for the rest of us, this is the equivalent to cached page. For example, here is a cache of a Mocality business page that can be found entirely on Google’s servers. If you or anyone else visit that link, Mocality will never know you did so.

    So there’s no need to go to Mocality’s search bar and type in the names of businesses — Google’s already got all that information, and their bots now do multiple scrapes a day for most big websites in the world.

    Point being: while I guess there’s still the possibility of “lone, dumb contractor operating within Google’s walls without their knowledge,” it would be utterly nonsensical for Google itself to be doing this, not least of all because they could do it so much easier without being caught if they really wanted to.

    Even the lowliest Google engineer fresh out of school knows how to write a script to automatically collect and process all the business information found on their own cache of Mocality’s database. The very fact that Mocality’s post claims “No evidence of automated scraping, this appears to be a team of humans” is actually powerful evidence that this was not Google. Just try to imagine people at Google — Google! — thinking they need to sit around a computer and type in business names into Mocality’s search bar to find information!

    1. Lone, dumb contractors rarely have the sign-off power required to hire an Indian call centre to do something. Even if that call centre is actually Google-owned, there would still be an internal charge (and thus sign off) required to use it. 

      Plus the number of calls suggests at least a small group, not just one or two people. 

      1. Do most firms own call centers outright, or do they have some kind of contract? A friend of mine works at a call center near me, and as I understand it they support a number of products there. If a scammer contacted them for work claiming to be from Google Kenya, would that get checked?

    2. Just because they didn’t use their cache entries, doesn’t mean they didn’t write a bot… Maybe accessing the search cache is harder than writing a special scraper for this site?

      1. No, as a software engineer who knows something about databases, it really isn’t. Do you think they work out their pagerank algorithm by repeatedly searching over the external internet for everyone’s links, or by searching on their own superfast servers?

        Once the content is on Google’s servers, they don’t need to go outside to do any processing of the data.

        1. Since callcenter operators are software engineers that knows something about databases?

          You’re not going to give access to a production db to sales people.

          And THAT db is google biggest traesure, you’re not going to give access to anyone.

        2. seems unlikely that the search database is just sitting there ready and willing to be searched by any moke with an internal Google IP address. plus, the schema is probably so abstract and complex that it would be completely meaningless to anyone but the search team themselves.

          you’re not going to just open a PhpMyAdmin session and start browsing it…

        3. Having built a spider and indexing system myself at one point – for an internet search company I worked for – there are likely 3 basic software elements. The first is the spider which will go and scan all webpages (usually to a specified depth only) on a domain, and then store the raw data in a database (the cached version of each page is likely stored this way). The second package would analyze and index the data and store it in another database in the format used by google’s search services. At this time the data would be pageranked against all other data already sorted into the database. Lastly there is the search service we utilize when we do a search on google, which looks at our keywords, filters out a set of words that are ignored by the search engine (Stop Words, such as “the”, “a”, “to” etc), and then searches the second version of the database to return the best values according to their pageranking system.
          Its the 2nd stage that will be the most intensive, since it is taking the page data and analyzing the crap out of it to index it all and put in a form that is the fastest to retrieve.
          Google’s spider is constantly searching the web and returns to a given location from time to time. How often it returns is based on how often the webpage appears to be changing, and of course it is affected by the choices a webmaster makes when they list their pages with google (assuming they do, and they should).
          The thing we built was no where near as complex as google’s system, but I read the original paper on their development design and it was very involved even at an early stage.

          As for someone else using google’s information. It wouldn’t be all that hard to cobble together a php script (for instance) that would perform searches on google for a given set of elements (Mocality related terms etc), and then index the results itself. As someone said, only a percentage of the websites involved were contacted. If they had access to google’s database information directly, why wouldn’t most of the sites have been contacted? If on the other hand they were scraping google, a mediocre script would likely gather only a percentage of the available sites.

           Oh, and indexing 15000 websites using such a script? If they aren’t huge that would likely take a relatively short period of time, perhaps an hour or so. They are only needing to pull up the site name and IP etc after all. Not much more than that.

  9. I’ve just been reading through the linked article a bit more and I’m now more confused.  Correct me if I’m wrong here but the article seems to say they had reports of someone trying to scam their clients claiming to be from Google.  They found a (non-google) ip address they thought was the culprit and stung it to receive the same call.  So far, so anyone is involved scam.  They then say

    “We found another IP address and User-Agent that accessed two businesses that had been contacted ” – this one turns out to be from a Google IP.  This IP address looked at lots of different records, although it doesn’t say that these matched those being contact as part of the scam.

    Then businesses report the same thing happening from India and an Indian IP address (which isn’t whois’d as from Google, or at least they don’t say so) starts looking at their records.

    This doesn’t seem to mount up to much of a case against Google at all.

    1. I’ve asked Stef for clarity on this. First Mocality saw an African IP block. Then they saw queries from a Google IP block. Then they fed that Google IP  a fake number. A few hours later, a self-identified “Google representative” called the fake number.

      In other words, a unique token was given to someone who accessed their server from within a Google IP block. Shortly after, a human being identifying herself as working on Google’s behalf called the number in that unique token.

      1. That doesn’t tally with what the graph on their website shows.  The Google IP stops accessing at the end of December and a new IP from India accesses into January, it is that one that is spoofed.

        For some reason that IP addresses is the only one they haven’t supplied on the blog post.

        1. Where the graph refers to “Access starts from India,” they mean the ip they provided, WHOIS shows that address is part of a block that belongs to Google but searches online for that ip indicates that its used in India by a Google operation or people hired by Google who have been lent Google ips. The phone callers also self-identified as calling from a Google call center in India (their paychecks may not say Google but I think its very likely that they are working for Google in some sense and have been for years).

          1. Just done a little bit of digging around to. This is quite interesting
            Identifies it as a spider used “Google uses this spider to crawl AdWords campaign Quality Pages.
            Thus, if you’re cloaking your Quality Page by looking out for a regular Googlebot User Agent, more likely than not you’ll soon be found out and possibly penalized.” which would explain why it was crawling these pages.
            Not quite sure where that gets us though

    2. You’re not wrong.

      That’s why there’s so many people ‘leaping to defend Google’. It has nothing to do with Google. If it was Yahoo,  Ask… name a company, it’d be the same response.

      Google indexes data on the internet.

      Their ‘sting’ consists of seeing Google access 15,000 entries. At that point, I vote web spider. 

      Stage 2 is, one of those dummy phone numbers is contacted.

      This is like saying…

      A Google Street View car drove past 15,000 businesses last week and then one of them got robbed! Google is running a burglary ring! Then when a spate of burglaries is tracked to an Indian company… Google has outsource their burglary ring!

      It is the literal meaning of coincidence. Two incidents happening at the same time. That’s it.

      I bet you one of those 15,000 businesses also got a call with someone asking for the Kenyan equivalent of ‘Seymour Butts’ – that doesn’t mean Google is recording a Jerky Boys album.

      1. The IP address that accessed the site 15,000 times did so between Monday – Friday 08:00 18:00 and occasionally on Saturdays, but NEVER on a Sunday.

        Do this appear to be the actions of a Spider? Does this appear to be an ‘accident’?  Seems a bit fishy as we all know Google Spiders can crawl and any hour and any day.

        Doesn’t something seem a little odd about this?  

        1. So we have a team of very devout web hackers – definitely goyim (working on a saturday!) and probably some form of pentecostal Christian, given the religious sabbath observance (and geography)

          That would be my best indication that it’s got nothing to do with google, as we all know that Google-ites are godless, soul-less heathens who spend Sunday’s lying in…

          1. So we’re all agreed that we can at least rule out this ‘Google Spider’ coincidence that a few people are talking bout.

            After reading the transcript of one of the calls I’m more inclined to agree with you that oogle doesn’t have anything to do with this (I may be wrong).

            It just seems so low tech for Google. Couldn’t they have just scraped the entire site with one of their spiders and then kept a copy of it on one of their private servers to access when needed?

            No need to keep pinging the Mocality website 15,000 and leave traces.  At least that’s how I would do it.

    3. My guess — and it will be interesting to see what’s known when the dust clears — is that, at worst, it’ll be a case of Google being scammed by some contractor. Sure, that’s bad (or at least not good), but it’s an entirely different level of “evil.”  It’s the difference between an incompetent action of subcontractor management and outright fraud, and those things aren’t the same.

      Of course, it doesn’t make too much sense speculating. I’m pretty sure that more information will be forthcoming.

  10. Hey, working previously in the software business in Kenya, I can tell you for sure that I know that Google Kenya had an Indian-Kenyan contracor for the Google Kenya business. This contractor could have had access to the internal Google Kenya network. I believe these contractors engaged in rogue practices, but Google will have to pay the price as they let them do business on their behalf.

  11. Two salient points.

    One, GKBO *does not offer any premium subscription products, monthly maintenance charges, or any other hidden or exploitative costs.* Nor do they offer website construction over the phone in the amateurish and slipshod fashion detailed in the calls/transcripts.

    Secondly, and… Mr Doctorow et al, this is what surprises me most – GKBO is exactly the kind of thing that BB likes – it’s bigger than just business, it’s a good old fashion broad spectrum programme that addresses access, and education, and percolation of technology.

    What we have here is a scam that plays on the reputions of two sterling initiatives – the Mocality database, and the nascent GKBO project. Nothing more, nothing less.

  12. Ok, I’ve found the obvious answer: (1) 15,000 searches from Google simply means that the Google bots were spidering the site. (2) Mocality then decided to feed that IP a fake phone number. Dumb! Why? Because this is the phone number that then appeared on Google’s cache and in Google’s searches.

    When Mr Evil Scammer decides to search Google for the Kenyan business information, he got a cached Google page just like this one. Guess what, that page now has a fake number because Mocality decided to feed Google fake information.

    Scammer calls the fake number. Mocality puts 2 and 2 together and gets 5.

    This is like giving the phone book a fake number, and then when someone calls you on it you assume it must be a scammer working at the phone book company.

    1. Any problem with me quoting you on my Google+ post about all this?

      I’m confused, I just got up, and I’m tired of people slamming Google the Company for what Google (a few employees) may or may not be up to.

      Personally not all that sure just what the frak is going on.

  13. There is a Kenyan Yellow Pages, like there is one in most countries, only that no one uses it. That’s probably because very few people actually use landlines.

  14. So is this what Google folks do in their “20 percent time”? Only kidding, I don’t really think that Google is involved in anything other than spidering. If Google really wanted that business it already has the resources to take over a market by legitimate means. It will be interesting to see how this story develops.

    1. I raise my eyebrow at Google’s “20 percent time.” If you work 50+ hours per week, as Google employees are reported to, that 20% is entirely extracurricular. It’s the same as working 40 hours per week on regular tasks, then carving an extra 10 hours per week from your personal life to create projects for Google to benefit from.
      I am suspicious of Google’s perks. If they provided one meal per day, I’d be impressed. But they provide three.

  15. You can spoof any IP on the planet.  

    Especially google IP’s,  the scraping script for numbers could have been run on Google App Engine for example.

  16. Also would be possible if the collection mechanism was using google cached pages.  

    In which case the geniuses at Mocality fed google search robots bad pages and in return there customers not a scammer.  

  17. A petty fraud involving one particular startup in Kenya? When you’ve got something that could make one dude pretty wealthy, but would globally taint the good name of Google while producing profits that wouldn’t even show up as a rounding error on Google’s balance sheet, I would be inclined to believe that it would be just some rogue guy.

    It’s like accusing Coca-Cola of filling their cans with water to fraudulently sell to Namibians. There’s so little to gain from it, their corporate income is so large, and the marginal cost of actually providing the real service is so small, that there’s no way that the corporation is somehow conspiring to defraud.

    1. Tinfoil Hat says it’s an attempt to make Google look bad before the SOPA crap starts up when congress re-opens.

      I keep insisting Tinfoil Hat is crazy but y’know. Congress trying to pass bills through over the protests of the voting public plus all the other Crazy going on.

  18. You can say what you want but I did get a call from someone saying to be google reps promoting their site.

    I know it hurts when your venerated Google is caught by a start up in Kenya doing this. But they did and must pay. Google owns the GKBO site. Someone from the GKBO site called me and told me to host with them.

    Someone from the same site told me that Mocality were in the know.

    So unless you are trying to suggest that Mocality was trying to con itself, the evidence on this part of the world where people are poor and silly is clear. Google was caught cheating.

    As we say here in Kenya….mpende msipende ( whether you like it or not)

  19. There’s an interesting twist in this tale.Have a look at:…
    It says: “OMG!!!!! We received a call on the office line (the one listed on Mocality) from India stating that they were offering website services. I think the guy on phone was Deepak or something (it sounded almost like a scam) the guy said he was from Google Kenya blah blah, we refused the offer as we already have a site. Then few days ago I was just searching our page when I stumbled upon our site on site…I mailed them n told them to take it down! aaaaaaaarg!!!!!!”

     This is one of the small businesses contacted by ‘Google’. SO it seems that after they got the call, they later saw their business website put up on (which is Google owned).Doesn’t this sound like further proof that this is Google sanctioned?

    1. Just because Google can register domains, doesn’t mean they sanction them.$ whois

      Billing Contact:
      Name: EAC Directory
      Organisation: EAC Directory Limited
      Kiungani Road, OFF Mombasa Road
      Opposite Nation Newspapers
      Next to Mastermind
      Nairobi P.O. Box 3543- 00200
      Email Address: info@EACDIRECTORY.COM

      1. LOL you clearly have NO idea what you are talking about!! is a “Google Product”!!!!


  20. I get telemarketing calls from people claiming to represent Google here in the US. They’ll call and leave messages saying  “This is Ted from Google. I’m calling to offer you premium placement in search results in your area for Google, Yahoo, and Bing.”

  21. Yes. Yes it does. Computer daemons are scheduled. They’re not autonomous entities with their own will. My DVR records Comedy Central only 5 days a week. Because thats all it is programed to do.

    Occhams Razor, already.

    What is more likely, a scammer is using Google to search for contact info and contacted a number from the honey pot that Google had skimmed… Or Google decided they are so desperate to break into the 86th largest economy worldwide that they will commit corporate espionage and expose themselves to legal action?

    Extra ordinary claims require extra ordinary evidence.

    If they could prove only Google had that phone number, and Google never served it to the public at large, and there was a call… Thats more damning.

    This, again, is literal coincidence. Two incidents together. Everything else is inference.

    1. I concur.  As someone with search engine experience (not at Google, and not working for anybody affiliated with Google): this is WAY too heavy-handed and crude for anyone who actually knows what they’re doing…and Google’s engineers know what they’re doing.   One of the telling factors is the reported repeated crawling of the site (why?) and the reported, rather odd schedule for it (why?).   Those observations aren’t consistent with what we’d expect to see — which would be infrequent crawls run at relatively fixed intervals via cron(1) or similar.  Moreover, as others have observed (above), someone running this scam would have very little need to crawl the directory more than once.  (That is: until you’ve attempted to scam everyone listed in the crawl you’ve got, why go back and look for more potential victims?)

      I suspect either a data leak, a security breach, an inside-assisted scam, or similar.  The risk/reward ratio for this is far too unfavorable for it to be an officially blessed effort, and it’s being executed very poorly.

    2. You seem to be unaware of both the proper spelling and the meaning of Occam’s Razor, which is that the explanation that requires the fewest logical leaps is the one to be preferred. “Google would never do this, therefore [convoluted speculation about spoofing, caching and whatever]” isn’t that explanation.

      1. OK How about ‘WHOIS info wasn’t updated after IP-Range was sold and new IP address holder seeing said info not updated decided to pull a half-baked scam.’

          1. I haven’t read the transcript or listened to the call because — if we’re operating under the hypothesis that they’re scammers — then nothing they say has any value as evidence.  NOTHING.  They could be anyone, calling from anywhere, saying anything.

  22. If you believe that an IP-address is proof of ownership of a data channel then you, of course, believe all of the copyright troll robo-lawsuits from the recording industry.  A blog called “Boing Boing” has cast serious doubt upon this assertion in the past.   Evidence value of the IP-address: 0.

    The other “evidence” is that a person telling lies (about joint ventures) said that they were from Google.  But what if this liar was lying? Evidence value of assertion on phone: 0.

    Two zeros add up to zero.

  23. If this was a Google employee, shouldn’t the IP be from Google’s Coporate Network, instead of their Production Network?

    The IP has an origin ASN of 15169 (their production network)

    BGP routing table entry for (4 available, best #1)  15169  AS-path translation: { GOOGLE }

    Should it not have one from one of their Coporate ASNs?
    AS45566AS number for Google Corporate Network in APACAS41264Google Ireland LimitedAS36987Google KenyaAS36492Google, Inc.AS36385Google IncorporatedAS36384Google IncorporatedAS36040Google Inc.AS36039Google Inc.AS22859Google Inc.AS22577Google Inc.

    Also based on traceroutes from various ISPs, it appears the IP  in question ( is on their production Network in India.


  24. There’s a simple question that I seemed to have missed in all  of this discussion.  Surely one of the businesses that got the sales call did business with the caller, whether Google, a rogue agent, or a scammer.  Where did their money go?

  25. Also, as one of the comments on their own blog points out, anything seen through google translate, will appear to come from google. 

  26. Okay I’m not the most technical person, but I’m not completely understanding what the issue is here (other than the alleged slander re: bait-and-switch). The point of Mocality, it seems, is to list contact information for Kenyan businesses. It looks like Google (if it was Google, and I doubt it would be considering they’re good enough at this internet stuff to not get caught doing something like this) created some sort of script that trawled the content of the Mocality website for contact information for businesses, and then called them offering a completely different service than what Mocality offered. 

    It’s like if I wrote a script that searched or whatever for business info and offered to design and host a site for those businesses. YellowPages exists to get business information to consumers and other segments of the public at large. 

    So, maybe I’m being unforgivably dense, but what’s the real issue, here? It looks like whoever used Mocality for the purpose it is trying to serve – getting business information to the public.

    Is it the portion of Mocality’s data that was trawled? 

    1. All you need to know is exactly what Google said about the privacy breach scandal, “mortified”. Standard M.O. at Google. 

      Not hard.

  27. Wow. And I thought I was a bad Apple Fanboyzors. So many posters here will invent ANY possible story to protect their beloved Google from some pretty clear cut evidence. Yeah, this Mocality is a company that could be lying. They could be making all of this up. But this isn’t some 30 year old guy living out of his parents basement that blogged this. This is one of the largest internet companies in Africa. The CEO personally put his name and reputation on the line.

    Now Google has responded and confirmed that their company (perhaps unknowingly), has defintely had a hand in this ordeal. Where are your convoluted descriptions of a “hacker” who ONLY is attempting to sell Google products who has committed fraud and deception?

    And then to use Occam’s Razor…….LOL…..

  28. When a major figurehead states “We were mortified to learn that a team of people working on a Google project improperly used Mocality’s data and misrepresented our relationship with Mocality to encourage customers to create new websites” you can be guaranteed their OWN investigation uncovered the (scam).  He doesn’t say “may have, might be”, or “allegedly”, his response is solid in the affirmative. Therefore, there should be no arguments surrounding the validity of 
    Mocality’s  claim, Mattos’s response confirms it all.

Comments are closed.