As noted above, our findings coalesced around the macro issues of (a) flaws in the deceptor program’s design and implementation, and (b) abuse of the program as an overly aggressive business development tactic. That said, specific concerns were at times more granular, and at times broader. Indeed, what we found were concerns touching upon most aspects of the program. A common refrain was that AppEsteem was acting as judge, jury and executioner. Some felt it was even more problematic than that, with AppEsteem additionally acting as the legislature and law enforcement, as well.

 

What follows are our specific findings regarding the deceptor program and associated practices based on the inputs received:

 

1. There is an apparent lack of industry involvement or consensus on deceptor criteria, and the criteria themselves suffer scope “creep” and subjectivity.

 

In the words of our respondents:

 

• “more deceptor criteria [being introduced] without input”

• “things have gotten subjective”

• “concerns that there is no approval process or communication to make determinations. No critical mass achieved to make something a deceptor criteria.”

• “the way ACRs are created and moved into deceptor status is problematic.”

• “AE says [certain products] are malicious, but [INTERVIEWEE] doesn’t see it that way; that is why there is a PUP program.”

• “[Deceptor pogram] should be based on industry rules, not AppEsteem rules.”

• “Implementation and execution are problems. Lack of consistency and transparency.”

 

While we note that AppEsteem holds calls with various groups that it works with, our findings show that only a limited audience is apprised of changes to the deceptor criteria; that this audience is not necessarily representative of the industry at large; the changes themselves are often presented as being final, rather than true (open) proposals; and the opportunity to provide feedback is often on an unreasonably tight timeframe.

 

1. AppEsteem is deploying questionable targeting and enforcement tactics for its deceptor program.

Multiple respondents expressed their belief that AppEsteem specifically targets companies or classes of software in a manner designed to generate business or punish those unwilling to work with AppEsteem. At least one respondent, who was being pitched by AppEsteem to become a client, reported being asked which of their competitors they would “like to see on the deceptor list.” Other respondents reported conversations during which AppEsteem identified specific companies it was considering targeting as part of the deceptor program without any sound basis or jusitification.

 

1. AppEsteem is engaging in aggressive marketing tactics, including leveraging the program to pressure companies into working with AppEsteem –

   1. pressuring monetization companies to sign up for AppEsteem services;

   2. pressuring AV industry members to adopt the deceptor construct as an industry standard;

 

 

In the words of our respondents:

• “Deceptor program is a scare tactic in itself.”

• “[Deceptor program is] a tactic to convert as many people as possible into a paid program.”

• “[Deceptor program is] a huge tool for business development [for AppEsteem]”

• “[Deceptor program] is a horrible way of generating customers.”

• “No question AE is using the [deceptor] program for business development.”

 

In fact, a clear majority of respondents believed the program is being run by AppEsteem as a business development tool, with some calling the program the “ultimate scareware tactic” to generate customers. This was precisely the view of one industry member who took to scambook.com to air his complaint. And another who forwarded an anonymous email to the CSA. A copy of these complaints are included as Appendix 1 and Appendix 2 to this Report.

 

Some other respondents were concerned that AppEsteem might be overstating its capabilities or potentially misleading prospective customers in its own marketing messages, in an effort to secure paying customers. This concern was most recently raised due to statements made by AppEsteem employees suggesting a deep, trusted relationship between AppEsteem and Microsoft. In the words of an AppEsteem employee:

 

“…As far as how Microsoft’s announcement will impact AppEsteem, we interpret the MS changes as largely aligning with AppEsteem’s approach and requirements. We’re in constant touch with them, and they trust us.

 

It’s certainly possible that they will decide to be even stricter than we are. The good news is, given our relationship with them (we meet with them frequently), I think we’ll find out immediately and be able to work with our Premium Customers to find out exactly what needs to be changed. That said, if you are on the Free program, if they decide to block any of your certified apps for any reason, you’ll just need to contact those folks on your own.

 

We are encouraging App Developers to get ahead of this Microsoft change by getting Certified as soon as possible…” (emphasis added)

 

The above was part of an email message sent to a prospective AppEsteem client. A copy of the email is included as Appendix 3.

 

When the CSA reached out to Microsoft for a clarification of its relationship with AppEsteem, the official response was as follows:

 

Microsoft does not have any special relationships with any third party data suppliers. Our detections are based on our own independent research and are within our sole discretion. Our research may include data and information from third party sources; however, our policy decisions and corresponding enforcement are independent, and third parties do not have the authority or permission to ‘white list’ any programs on our behalf. In addition, only Microsoft — and no third party — has the authority to clear Windows Defender detections.

 

With regards to AV companies, virtually all expressed concerns and frustrations with regards to AppEsteem’s “AV testing” initiative, which is seen by most in that sector as an attempt to force the consumption and automatic detection of items on the deceptor list. AppEsteem has stated that the AV testing is designed to “encourage AV efficiency by running comparative tests for detecting Deceptors and allowing Certified apps.” On its face, this statement clearly suggests that an AV would only be considered truly “efficient” if they detected so-called deceptors and allowed AppEtseem certified products as a matter of course (i.e., in an automated “consume and react” fashion). This largely contradicts AppEsteem’s other statements that they “recommend that security companies complete an independent review of any apps or services that we have designated as a Deceptor.,” and, only “[i]f they agree with our designation, we encourage them to detect, block, remove, or disable the app or service so it cannot harm consumers.” While these concepts are not wholly irreconcilable, the clear message as understood by AV companies is that the tests are being used as a forcing function, especially when it comes to detecting a “deceptor” whether an AV independently agrees or not.

 

1. Double standards — inconsistent (and subjective) application of criteria –

   1. as applied to AppEsteem customers;

   2. as applied to security vendors;

 

 

Per AppEsteem, detection as a deceptor happens when a product engages in behaviors AppEsteem believes are “deceptive and risky behaviors that could harm consumers.” Further, “An app that violates one or more of our Deceptor Requirements will be designated a ‘Deceptor,’ published on our website, and reported to our security partners.” And finally, “we hold everybody accountable and build a level playing field…” This does not always seem to be the case, however.

 

With regards to certified versus “deceptor” products, the CSA has conducted a review of nearly all AppEsteem certified products and contrasted those products with products characterized as “deceptors” by AppEsteem. This exercise was done for the limited purpose of identifying whether standards seemed to differ when applied to products offered by AppEsteem customers versus products from companies who have not associated with AppEsteem. Whether any particular behavior was problematic or not was not a part of the assessment. In 20+ cases, AppEsteem customer products were left unscathed (and often enough, AppEsteem certified) while behaving identically or substantially similar to products deemed “deceptors” by AppEsteem. A consolidated version of the CSA’s comparison is included as Appendix 4.

 

Often, when confronted with this fact, AppEsteem notes that certified products (i.e., AppEsteem customer products) retain their certification for a full year and will not be held accountable during that year long period for violating deceptor criteria introduced since their certification. This, of course, raises the important question of how sound the deceptor program can be if some deceptor-level behaviors are hidden behind AppEsteem certifications. There is no more deceptive or risky behavior than that.

 

With regards to AV companies, much was brought to light during and then immediately following AppEsteem’s 2018 Affiliate Summit West meet-up in Las Vegas. Notably, AppEsteem’s presentation opened with the statement that, “[w]e hold everybody accountable and build a level playing field so clean monetizers can thrive,” however, when inquired about AppEsteem’s role in keeping AV companies accountable when they engage in “deceptor” behaviors, the response was that “holding AVs accountable is very tricky,” and “we rely on AVs to drive urgency, so [AppEsteem] won’t bash AVs.” It was further stated that the “cost of publishing AV deceptors” would be “blowing up” their program.

 

As noted above, in the week following the Las Vegas meet-up the CSA received a PDF purporting to show products from AV companies engaging in some of the very same behaviors as so-called “deceptors.” Upon receipt of the PDF, the CSA shared the materials with AppEsteem and its security partners. Some changes to AppEsteem ACRs ensued, but there has yet to be an AV product of consequence included in the deceptor list. This is notwithstanding the fact that specific examples had been shared with AppEsteem, and notwithstanding AppEsteem’s own repeated statements to the industry that it was running AV products against its criteria.

 

As part of its review, the CSA went through various AppEsteem materials and was reminded that in May 2017 AppEsteem communicated to its Security Partners about one particular behavior that AppEsteem calls out when engaged in by non-AVs. At that time, the message to the AV companies was that AppEsteem needed them to “clean up their own houses.” Now, approximately 11 months later, the CSA took screenshots of two of the three products depicted in AppEsteem’s materials. Nothing obvious has changed. Including the fact that neither product is listed as a deceptor by AppEsteem. A copy of the original May 2017 slide and April 2018 screenshots are included as Appendix 5.

 

1. The program is lacking in adequate oversight and an appropriate dispute mechanism.

 

In the words of our respondents:

 

• “a lack of trust and a lot of concern around the AE program”

• “[deceptor program] is a divisive thing, really.”

• “Nobody likes deceptor program.”

• “Deceptor program just feels wrong on multiple levels.”

 

All indications through the CSA’s review process are that the deceptor program lacks oversight or an appropriate dispute mechanism. As most respondents were acutely aware, the deceptor criteria are ultimately determined and then interpreted by AppEsteem, and any appeals regarding a finding that a product is a “deceptor” must be lodged with AppEsteem and will be determined by them. Of additional concern is the fact that some respondents were under the mistaken impression that the CSA had endorsed AppEsteem and/or were providing oversight or dispute resolution for AppEsteem and the deceptor program. This is a notion that both the CSA and AppEsteem should dispel.

 

1. The idea of a well-designed and run (and appropriately overseen) “deceptor program” which acts more as a source of “trusted leads” of problem software, is something AV companies reacted favorably to.

 

1. AppEsteem’s certification program, and in particular its compliance-related services, are well regarded by numerous monetization companies.

 

Of the respondents currently working with AppEsteem, most, if not all, found the certification process, and especially the liaison services with regards to AV companies, quite valuable. While some were initially skeptical, most expressed having had a good experience overall, with a constructive back-and-forth in making their products compliant. In the case of companies converted into AppEsteem clients after initially being on the deceptor list, while all expressed distaste for the tactics used to get them to engage with AppEsteem, at least some are now willing to look past that and focus on the assistance they are now receiving from AppEsteem to engage in more compliant practices.