How Google Map Hackers Can Destroy Small Business

As reported by Wired: Washington DC-area residents with a hankering for lion meat lost a valuable source of the (yes, legal) delicacy last year when a restaurant called the Serbian Crown closed its doors after nearly 40 years in the same location. The northern Virginia eatery served French and Russian cuisine in a richly appointed dining room thick with old world charm. It was best known for its selection of exotic meats—one of the few places in the U.S. where an adventurous diner could order up a plate of horse or kangaroo. “We used to have bear, but bear meat was abolished,” says proprietor Rene Bertagna. “You cannot import any more bear.”

But these days, Bertagna isn't serving so much as a whisker. It began in early 2012, when he experienced a sudden 75 percent drop off in customers on the weekend, the time he normally did most of his business. The slump continued for months, for no apparent reason. Bertagna’s profits plummeted, he was forced to lay off some of his staff, and he struggled to understand what was happening. Only later did Bertagna come to suspect that he was the victim of a gaping vulnerability that made his Google listings open to manipulation.

He was alerted to that possibility when one of his regulars phoned the restaurant. “A customer called me and said, ‘Why are you closed on Saturday, Sunday and Monday? What’s going on?’” Bertagna says.
It turned out that Google Places, the search giant’s vast business directory, was misreporting the Serbian Crown’s hours. Anyone Googling Serbian Crown, or plugging it into Google Maps, was told incorrectly that the restaurant was closed on the weekends, Bertagna says. For a destination restaurant with no walk-in traffic, that was a fatal problem.

“This area where the restaurant is located is kind of off the beaten path,” says Bertagna’s lawyer, Christopher Rau. “It’s in a wealthy subdivision of northern Virginia where a lot of government employees live on these estates and houses with two- or three-acre lots … It’s not really on the way to anything. If you’re going there, it’s because you've planned to go there. And unless you know that the place is going to be open, you’re probably not going to drag yourself out.”

Bertagna immigrated to the U.S. from northern Italy when he was young. He’s 74 now, and, he says, doesn't own a computer—he’d heard of the Internet and Google but used neither.

Suddenly, a technological revolution of which he was only dimly aware was killing his business. His accountant phoned Google and in an attempt to change the listing, but got nowhere.

Bertagna eventually hired an Internet consultant who took control of the Google Places listing and fixed the bad information—a relatively simple process.

But by then, Bertagna says, his business was in a nose dive from which he couldn't recover—service suffered after the layoffs, and customers stopped coming back. He shuttered the Serbian Crown in April 2013.

Bertagna puts the blame for his restaurant’s collapse on Google, and he’s suing the company in federal court in Virginia. His lawyer’s theory is that a competing restaurant sabotaged the Google Places listing to drive away the Serbian Crown’s customers, and he argues that Google turns a blind eye to such shenanigans. Google’s lawyers scoff at the lawsuit. “The Serbian Crown should not be permitted to vex Google or this Court with such merit-less claims,” they wrote in a filing last month. (Google didn't respond to repeated inquiries for this story)

For a number of reasons, the claim is probably doomed in court. But the premise of the lawsuit—that the Serbian Crown was sabotaged online—isn't as far fetched as it might seem.

Beneath its slick interface and crystal clear GPS-enabled vision of the world, Google Maps roils with local rivalries, score-settling, and deception. Maps are dotted with thousands of spam business listings for nonexistent locksmiths and plumbers. Legitimate businesses sometimes see their listings hijacked by competitors or cloned into a duplicate with a different phone number or website. In January, someone bulk-modified the Google Maps presence of thousands of hotels around the country, changing the website URLs to a commercial third-party booking site (which siphons off the commissions).

Small businesses are the usual targets. In a typical case in 2010, Buffalo-based Barbara Oliver & Co Jewelry saw its Google Maps listing changed to “permanently closed” at the exact same time that it was flooded with fake and highly unfavorable customer reviews.

We narrowed it down as to who it was. It was another jeweler who had tampered with it,” says Barbara Oliver, the owner. “The bottom line was the jeweler put five-star reviews on his Google reviews, and he slammed me and three other local jewelers, all within a couple of days.”

Oliver’s Google Maps listing was repaired, because she had something Bertagna didn't have: a web consultant on retainer feeding and caring for her Internet presence. That consultant, Mike Blumenthal, says he’s countered a lot of similar tampering over the years.

“I had a client whose phone number was modified through a community edit,” says Blumenthal, who closely tracks Google Maps’ foibles in his blog. “It was a small retail shop—interior design. I traced it back to a competitor who left a footprint.”

These attacks happen because Google Maps is, at its heart, a massive crowd-sourcing project, a shared conception of the world that skilled practitioners can bend and reshape in small ways using tools like Google’s Mapmaker or Google Places for Business.

Google seeds its business listings from generally reliable commercial mailing list databases, including infoUSA and Axciom. Once it’s in Google’s index, a business owner can claim a listing through Google and begin curating it for free, adding photos, hours of operation, a website address. Once your have that relationship with Google, the company will up-sell you on paid advertising, which, after all, is Google’s financial lifeblood.  

But if you ignore your Google Maps listing, you’re inviting trouble. Ordinary users can submit community edits to your listing with details like operating hours—as Barbara Oliver discovered.

A screenshot of a spam locksmith positioned in the ocean three miles off the San Francisco coast.

Blumenthal says Google has gotten much better at policing malicious edits, to the point where they’re rare today. “Most of these problems of community edit abuses were in the 2010 and 2011 range,” he says. Fake map listings are a less tractable problem. Google allows anyone to enter a new business into Maps, and to place it wherever they like. The company keeps the listing invisible until it’s been verified through old fashioned snail-mail. Google sends out a postcard with a PIN code, and the business owner activates the listing by typing in the PIN.

The system has loopholes though, and troves of money-hungry spammers looking for weaknesses. In February, an SEO consultant-turned-whistle-blower named Bryan Seely demonstrated the risk dramatically when he set up doppelganger Google Maps listings for the offices of the FBI and Secret Service. Seely channeled the incoming phone calls through to the real agencies while recording them.

The stunt got a lot of attention. The Secret Service told Seely he was “a hero” for showing them the vulnerability. But despite the coverage Seely says some of his methods remain operable today. He proved it to me by creating a cheeky Google Maps listing in my name at 1600 Pennsylvania Avenue. “The heat died down and almost all of the holes are still open,” Seely says.

Seely’s guess is that Serbian Crown was indeed a victim of Google Maps sabotage. “People do it all the time—people have even offered me money to get listing spammed or banned,” he says. “There are legitimate businesses being put of out business.”

Demonstrating causation between a bad Google Maps listing and Serbian Crown’s decline is going to be hard, though. For one thing, the restaurant’s Yelp listing—also a big factor in choosing a dinner reservation—is packed with abysmal, almost frightening, reviews. And there are any number of reasons a restaurant—even an old, established one—can fail, as Google’s lawyers pointed out an angry June 17 motion to dismiss the lawsuit.

“As the complaint tells it, The Serbian Crown restaurant was forced to close its doors not because of rising rents, difficulty sourcing ingredients, declining quality, poor service, changing tastes, poor business decisions, increased competition, or any of the other myriad reasons that can cause an established restaurant to struggle,” wrote attorney Creighton Macy, of the law firm Wilson Sonsini Goodrich & Rosati.

“Rather than accept that restaurants, even longstanding ones, sometimes fail, the owner of this particular restaurant looked around for someone to blame,” the lawyer wrote. “Who did he settle on? Google.”

Even if Bertagna can prove the facts, as a legal matter Google is probably untouchable because of Google Maps crowdsourced nature. A federal law called CDA 230 gives Internet services broad immunity from claims stemming from user-contributed content.

For his part, Bertangna says he hopes to reopen his restaurant some day and begin serving lion again. “It’s like a veal. We served it with a white mushroom, sauce and vegetables.”  Google Maps is not optimistic about his chances. Today Serbian Crown’s listing reads simply, “Permanently closed.”