‘We’re not phishing’: Youth climate change group defends manipulating sceptics’ browsing

The Australian Youth Climate Coalition’s online campaign has been compared with phishing and malware but it insists its behaviour is morally acceptable.

Australian Youth Climate Coalition’s explainer website.

The youth climate change group altering the browsing experience of climate-change sceptics, by luring them to a website disguised as an innocent cookie recipe, has defended its campaign as “voluntary” because users click accept in order for it to work.

Rich Williams, who co-created the idea, told The Australian that the outcome of the campaign outweighed any moral concerns over its strategy and the whole idea was “a testament to our dedication to combating the global challenge of climate change”.

“The campaign implements a clear and transparent cookie consent statement. Before any transient alterations to a user’s browsing experience occur, they must explicitly agree to this statement – therefore emphasising the voluntary nature of users to engage with the content and ensures they are informed about the campaign’s objectives,” he said.

“We believe that the greater good of addressing climate change and ensuring that individuals receive scientifically supported information outweighs any concerns about the nature of our strategy.”

Rich Williams who co-created the Australian Youth Climate Coalition's false cookie campaign.

The cookie recipe.

However, that view has been contested by technology lawyers and internet ethicists who say the nature of the campaign is closer to phishing than it is to the typical use of cookies on the internet.

The Australian last week reported that the Australian Youth Climate Coalition, a registered charity with a revenue of $3.2m, had begun a campaign in which it encouraged young Australians to send their climate sceptic relatives a website link, which at first appears to be a one-minute cookie recipe.

When a user clicked accept to a request to store cookies, their device would store several cookies from websites, including Facebook and Vimeo, which would suggest to servers they wished to see pro-climate-change news articles and videos.

Eaglegate technology and IP lawyer Nicole Murdoch said there were two main issues with the campaign; that people were being tricked into visiting the website initially and that the use of cookies in this instance was to target the user by giving them adverts on climate change or by indicating to other sites that the user wanted to see climate change material.

“In short, they are using cookies as a weapon to identify a class of consumer, rather than using them as a tool to indicate interest,” she told The Australian.

Brisbane cyber lawyer Nicole Murdoch.

Ms Murdoch said it would depend on the content served up to users who clicked on AYCC’s link as to whether their campaign was considered an “educational tool” or a form of “harassment”.

“As for deliberately causing people to go to a website in order for them to be affected by the cookies – this action is a concern as it is effectively a phishing attack – except the payload is cookies, not a virus. That said, malware is something that is harmful. Here, depending on how it is used, it may be harmful,” she said.

“In short, I think they are playing a dangerous game, but in all likelihood a game they will win.”

Mr Williams rejected that claim, saying he believed that “this campaign unequivocally does not resemble phishing activities”.

“We have just leveraged the fact that digital media platforms are always tracking consumer behaviours,” he said.

“We have used existing technology to create a functionality that signals to suggest a visitor is interested in receiving more news on the climate. The site itself does not capture or request any data from visitors.”

Internet ethicist and honorary associate in digital cultures at the University of Sydney Mark Pesce said that if AYCC’s technique had been used by cyber criminals without a user’s knowledge, it would be considered as malware.

“Obviously that is not all right if you go to a page expecting a recipe and it’s then attempting to change your worldview,” he said.

“If that were a state actor doing this or if it were a cyber criminal, both of which could just as easily be using the same technique, we would absolutely identify that as malware.”

Mr Pesce, who is the author of a new book on generative AI and ChatGPT which is due to be published in January, said that AYCC’s campaign was the kind most companies would be embarrassed to admit they had engineered.

University of Sydney digital cultures honorary associate Mark Pesce.

“If someone thinks they’re getting a nice cookie recipe and then a website is changing their cookie settings in their browser, that feels like something that you would be embarrassed about if people found out you were doing it,” he said.

Mr Williams said the content displayed to users who had clicked the link would be “accurate and reputable information”.

“The essence of our actions, driven by the imperative to address climate change, distinguishes us in both intent and outcome,” he said. AYCC has not said who chose the stories and videos which would be displayed to users.

“Our campaign does not retain any personal data of visitors, nor do we engage in any data collection practices,” he said.

“Our primary mission is to disseminate scientifically backed information, foster awareness, encourage meaningful conversations about climate change and help mitigate misinformation.”