How “Kessler’s Flying Circus” Made $5.2M from eBay

 Between May 2006 and June 2007, Brian Andrew Dunning made $5.2 million—all of it from eBay. Dunning wasn't selling Velvet Elvis posters and antique dinner plates through the auction site, however. He earned the money from affiliate commissions, getting paid whenever he directed people to eBay and they made purchases or won auctions. He was so successful at driving this traffic to eBay that his company, Kessler's Flying Circus, became the number two eBay affiliate in the entire world.

His numbers grew so high and so fast that eBay began asking awkward questions almost immediately. How exactly, eBay wanted to know, was Dunning driving all of this traffic to the site? The company was well aware of the wide variety of tricks that affiliates could use to boost their stats, including one called "cookie stuffing." With cookie stuffing, affiliates would surreptitiously "stuff" their own eBay cookie into user computers. The next time the user visited eBay, the cookie would credit any sales commissions to the affiliate's account. (Each cookie contained an affiliate ID number; if a computer already had an eBay cookie on it, the most recently created one was used to pay out affiliate commissions.) These commissions weren't measured in pennies, either. At the time, eBay was offering $25 to affiliates for every single new "active user" and a whopping 50 percent commission on any user's auction wins so long as they exceeded $100 within a week's time.
eBay worried that Kessler's Flying Circus had cookie-stuffed its way into the second place affiliate slot. But Dunning told an eBay employee looking into the matter that he was "absolutely confident" that he was operating "in line with the intended spirit of the terms." Dunning's partner told eBay separately that any problems were simply "coding errors."
eBay wasn't convinced. So in 2008, it sued Dunning in federal court. The litigation proved frustrating for the auction giant, which at one point sought sanctions against Dunning for not turning over discovery materials in a timely fashion. Two years later, the case still hadn't reached trial.
In the meantime, eBay had convinced the FBI to investigate. In June 2010, a grand jury returned a criminal indictment against Dunning that accused him of wire fraud. His crime? Cookie stuffing.

Stuff it

The indictment laid out an ingenious scheme to spread eBay cookies linked to Kessler's Flying Circus widely across the Internet. Dunning developed free applications like WhoLinked, which displayed a list of sites linking to the site where WhoLinked was installed. This appealed to people's vanity and desire to show how credible their site was—"See, readers, I receive the most external traffic from PrestigiousWebsite.com!" The tool came in flavors for WordPress, Blogger, Movable Type, and other blogging platforms. Installation was dead simple.

WhoLinked in action.

Ed Kohler

Did it work? Those who installed it weren't sure, but it was still cool to see a list of your best linkers. Some users noted the little "What's this?" tag at the bottom of the WhoLinked widget and wondered why it triggered a drop-down box with an odd-looking link to eBay of all places. One early user wrote in May 2006 that this was a "cloaked" affiliate link, and he wrote Dunning to ask why it was there. (According to eBay, obfuscated JavaScript was used to disguise the link.)
Dunning replied that the link followed eBay's rules and that it helped "offset only a small percentage of the thousands of dollars he spends each month in hosting WhoLinked." The user concluded, "Sounds like a fair trade for a free service."
But according to the feds, Dunning used free programs like WhoLinked to do far more than this. When a blog page containing WhoLinked was loaded, WhoLinked generated a silent "ad clickthrough" to eBay in the background. Users would see nothing, but eBay would serve up a cookie containing the Kessler's Flying Circus affiliate link. The user's Web browser would dutifully save the cookie and, the next time that user visited eBay, any affiliate revenue generated went to Dunning and company. In such cases, users had never seen an eBay ad, nor had they clicked on anything eBay-related. These were not cases in which eBay wanted to pay affiliates.
Dunning took steps to make this activity harder to detect. According to the government, his programs would not stuff cookies on any computers that appeared to be located in San Jose or Santa Barbara, California (the respective headquarters of eBay and of the outside company eBay used to manage the affiliate program). eBay further alleged that Dunning had programmed his tools not to double stuff machines that had been targeted before. After all, the presence of two eBay cookies bearing the same affiliate ID numbers might have raised a flag in eBay's anti-fraud systems.
The complex case has moved slowly toward trial—until today, when the now 47-year old Dunning pled guilty to a reduced charge.
The government wanted Dunning to forfeit "all property constituting, and derived from, proceeds the defendant obtained, directly and indirectly, as the result of those violations." In other words, it wanted the full $5.2 million. While admitting to the general contours of the eBay cookie-stuffing scheme, Dunning insisted that these only accounted for some portion of the $5.2 million total. A separate evidentiary hearing on August 8 will determine exactly how much of that amount was fraudulent.
Cookie stuffing isn't new; neither are eBay lawsuits to stop it. But the sheer success that Kessler's Flying Circus achieved with the technique was, admittedly, remarkable.