Web Scraper Sets $1 Million ‘Bug Bounty’ As Industry Scrutinized

Bright Data Ltd., an Israel-based startup that sells web scraping tools and datasets, is set to announce a $1 million “bug bounty” to root out bad actors as law enforcement steps up scrutiny of its industry.

The company, one of the largest web data collection services, wants to reward ethical hackers who identify flaws or potential abuses within the industry, including its own networks, Chief Executive Officer Or Lenchner said.

Business for Bright Data and its peers has surged as the data these companies collect from around the internet becomes a key information source for artificial intelligence companies, which use it to train their models. At the same time, law enforcement is looking more closely at how some companies in that space acquire the data and whether those methods put customers at risk. Lenchner warned a broader crackdown on data collection services could hinder AI advancement.

“You will have a less knowledgeable model because it can’t retrieve real-time information about something that just happened a few hours ago,” he said. “You will have price increase across e-commerce websites because there won’t be any more transparency.”

For more than a year, the US Federal Bureau of Investigation has been looking into whether a Bright Data competitor, Netnut, has potential links to a software that’s allegedly used to co-opt people’s devices, Bloomberg News reported last week.

The investigation has been looking at whether Netnut, a subsidiary of data-collection firm Alarum Technologies Ltd., was involved in linking customers’ home internet devices to a “residential proxy network” without their consent. These networks route internet traffic for users to show it coming from a different location. Businesses commonly use these networks to customize their websites for different geographies or pull price comparisons with their competitors.

But in the hands of a hacker, they’re like stolen passports. Cybercriminals can use them to put a local disguise on malicious traffic that could in reality be coming from anywhere in the world.

The Department of Justice said last week that the FBI seized multiple internet domains as part of a “coordinated law enforcement targeting infrastructure associated with NetNut’s residential proxy platforms, its administrators and its users.”

Alarum didn’t respond to request for comment but previously told Bloomberg it would cooperate with the FBI to help ensure those responsible are held to account. The company said in a statement Monday that it was pausing traffic through some of its networks for several days as part of its own investigation. It said it’s working to restore normal operations as soon as possible.

Bright Data said it operates with users’ consent and has safeguards that include allowing users to opt out. It also said it vets all partners, has a system of governance that blocks abuse as it happens, and has submitted to an independent audit. The company has more than 400 million monthly “ethical residential IPs” from 195 countries, it said on its website.

Researchers at Include Security last month said Bright Data code was turning smart televisions into nodes for web scraping, albeit with consent. In response, Bright Data underlined that the users agreed to the data collection, are compensated for it and that the company vets its customers to ensure its systems aren’t misused.

The startup, which markets itself as the second-largest data collection firm after Alphabet Inc.’s Google, has grown significantly on demand from data-hungry AI companies. Lenchner said Bright Data is set to surpass $400 million in annualized revenue this year. It also expanded its head count by a third in just over a year and opened an office in San Francisco.