OTTAWA and GATINEAU – The CRTC has caught and fined two online advertising companies for allegedly aiding in the distribution of malware through online ads, the first time it has done so under Canada’s anti-spam law.
The Commission said Wednesday that Datablocks and Sunlight Media have been served with violation notices for purportedly helping to help spread malicious computer programs (malware) through the distribution of online advertising. The companies were fined $100,000 and $150,000, respectively.
Using its anti-spam powers, the CRTC said that the “highly complex investigation” found that the companies allegedly violated Canada’s anti-spam law in the following ways:
- Sunlight Media accepted unverified, anonymous clients who used their services to distribute malware.
- Datablocks provided Sunlight Media’s clients with the necessary infrastructure and software to compete in real-time for the placement of their ads, which contained malware.
- Neither Datablocks nor Sunlight had:
- written contracts in place with their clients that would bind them to comply with Canada’s anti-spam law
- monitoring measures in place governing how their clients use their service, or
- written corporate compliance policies or procedures in place to ensure compliance with Canada’s anti-spam law.
- After being alerted in 2015 to reports by cybersecurity researchers, and made aware in 2016 by the CRTC, neither company implemented basic safeguards, which are well known to the industry.
“As a result of Datablocks and Sunlight Media’s failure to implement basic safeguards, simply viewing certain online ads may have led to the installation of unwanted and malicious software”, said CRTC chief compliance and enforcement officer Steven Harroun, in a statement. “Our enforcement actions send a clear message to companies whose business models may enable these types of activities. Businesses must ensure their commercial activities do not jeopardize Canadians’ online safety.”
Datablocks and Sunlight Media now have 30 days to file written representations to the CRTC or pay the penalties.
