Good Idea! Now find a better one.

Bruce Schneier, in an essay published at Wired News and on his blog, addresses the challenges faced by Google in detecting click fraud in AdWords and AdSense. The most sophisticated abusers use automation to create false ad impressions and revenue for themselves or increased costs to their competitors. In response, Google develops more and more sophisticated means of detection.

Click fraud has become a classic security arms race. Google improves its fraud-detection tools, so the fraudsters get increasingly clever … and the cycle continues.

This is conflict at its lowest level. It’s a clash between tools, machines, things. It’s like getting into a price war with Walmart, it’s possible to win, but don’t ask how much it’ll cost.

The ultimate tool in this fight would be a software program that could determine, without error, that an actual human being was clicking on an ad. Quite the tall order.

There is a principle that an ace pilot by the name of Col. John Boyd discovered during his career in the US Air Force. In dealing with Pentagon bureaucracy for developing new weapons and tactics, he said: People, Ideas, Technology - In that order. People are more valuable than Ideas, which in turn are more valuable than Technology.

People trump ideas because it is only through people that any idea has value. If no person values an idea, it may as well not exist.

Ideas are more valuable than Technology because ideas determine how to use Technology. Technology, tools, when wielded improperly, with the wrong ideas if you will, can wreak havoc.

The Air Force had, and still has some would say, a tendency to look to shiny new tools to meet new challenges and as Boyd proved many times in his career, inferior technology combined with better ideas and better people, could consistently beat superior technology.

So if Google is to make true progress in this fight with click fraud, they must move away from pure tools and technology, and focus more on People and Ideas.

Google is testing a new advertising model to deal with click fraud: cost-per-action ads. Advertisers don’t pay unless the customer performs a certain action: buys a product, fills out a survey, whatever. It’s a hard model to make work — Google would become more of a partner in the final sale instead of an indifferent displayer of advertising — but it’s the right security response to click fraud: Change the rules of the game so that click fraud doesn’t matter.

Change the game, indeed. Instead of trumping technology with technology, look at what the person who commits fraud values and what the person who advertises values.

The person who wants to game the system values his revenue, or his competitor’s costs, being associated with an event that he can automate with little cost.

The person advertising values the event or transaction that occurs after the click.

If the fraudster has to purchase and take delivery of a product that costs much more than his little slice of revenue, what he values has been destroyed. Without the value, he won’t wield the tool.

The person advertising would place an even higher value on paying for advertising only when it actually makes money.

Increase the value for your customers, decrease the value for your enemies. Find ideas and develop technologies to advance these two principles.