In order to support this claim, Leibniz relies on his principle of sufficient reason, which  states “that nothing happens without a sufficient reason why it should be so rather than otherwise” (14). His axiom is essentially that nothing is arbitrary, and for Leibniz, this means that all things are the product of God’s reason. Leibniz’s argument proceeds by reductio ad absurdum:

1. Suppose that there is absolute space.
2. Whence, when God placed objects within space, there was no reason for him to place objects in a particular area of space and not in another, or in a different orientation. Hence, the placement of objects in the universe is arbitrary.
3. But, according to the principle of sufficient reason, nothing is arbitrary.
4. But this is absurd, so (1) must be false, and there is no absolute space.

If one accepts the principle of sufficient reason, it seems that one is committed to accepting the argument. Leibniz argues that as long as space is an absolute entity, it is impossible to imagine that the placement of objects within it is anything but arbitrary. The contents of the universe could be rotated by infinitely many degrees inconsequentially, and the reason that it takes any particular orientation cannot be explained causally. Notably, this does not entirely depend on Leibniz’s metaphysical claims about God. Although, for Leibniz, it is through God’s reason that things happen, the principle of sufficient reason can also be interpreted as referring to causality, claiming that nothing is uncaused, entirely spontaneous or arbitrary.

Hence, if space is absolute then the orientation of matter within it is arbitrary. This directly contradicts the accepted principle, and so space must not be absolute.

The fact that such rotation in the universe’s orientation would not cause changes to the physical universe is also mentioned by Leibniz, who asserts that the difference between orientations would be indiscernible (14). As Leibniz points out in a later letter, to “suppose two things indiscernible is to suppose the same thing under two names” (22). If all predicates corresponding to one object also correspond to another (that is, two objects share identical properties), then those objects are identical. This principle is one of second-order logic and can be symbolically represented as:

• ∀x∀y[∀P(Px ↔ Py) → x = y]

Since there could be nothing said about one orientation that differs from another, where a and b are any two universe orientations,

• ∀P(Pa ↔ Pb),

hence,

• (a = b).

The identity of the different universe orientations prompts Leibniz to write that “there is no room to inquire after a reason for the preference of one to the other” (15). This can be taken to mean that the very notion of absolute space is therefore meaningless, since we are left with infinitely many configurations and no reason to prefer any one. However, logic leaves room for one refutation of Leibniz’s position: one which also relies on the identity of indiscernibles. If all of the possible orientations of matter in the universe are in fact identical, then there is in fact reason to for the selection of the current orientation of the universe. For if all universe orientations are identical, then there is exactly one universe orientation – that is, the orientation of the universe is the necessary one. On this interpretation, Leibniz’s argument fails because the choice of orientation is necessary rather than arbitrary and therefore it is not in conflict with the principle of sufficient reason.

Nevertheless, some of Leibniz’s views against Newton have been vindicated. Physicists have since abandoned Newton’s absolute space in favour of relativistic spacetime. Spacetime sees space and time unified into a single manifold, much as Leibniz considers them to be very similar. The premise for Leibniz’s reductio argument, that space “is something absolutely uniform” (15), has also been shown to be false. Indeed, space seems to be flexible, such that the distance relationship between two objects can change without any motion of the objects themselves, due to the effects of gravity. Hence Leibniz’s view remains, to some extent, consistent with modern science.

Source: Leibniz, G. W. and Samuel Clarke. Correspondence. Ed. Roger Ariew. Indianapolis: Hackett, 2000.

First, Lucretius asserts that matter is known to exist by means of sensory perception. We see matter, we interact with it, and thus it must exist. He argues immediately for empiricism by saying that sensory perception must be the “unshakable foundation” (423) from which an epistemology begins. Otherwise, he says, any talk of what is unseen is meaningless, for it is only in contrast with sensory perception that we can reason about anything that is outside of our view. That is, we cannot make any sense of talk about what is hidden from view without having a view in the first place, and thus what we see in our view must be the case. So, matter exists.

Secondly, we observe some important traits about the matter we see. First, it is always situated somewhere. Second, it can be moved from one location to another. Both of these require the existence of space, what he calls the void, for things always move or are located in something. Lucretius refers back to a few lines before this passage[2], in which he has argued that without space existing between material objects, their force of obstruction would constantly be acting upon each other and there would never be movement at all. He also, in these earlier lines, anticipates an objection on the grounds that fish swim through water seemingly unobstructed. Here, Lucretius argues that water must give way and create space for the fish, thus in order for there to be movement the space must be ontologically present, in modern terms.

Next, Lucretius argues that there must be nothing else besides matter and void. His reasoning is simply that anything else that one may describe, in an effort to posit a third constituent of being, can be shown to be either matter or void. This is done by Lucretius by asking whether or not this new entity is tangible. If it is, and is “susceptible of even the lightest and faintest touch” (433), then it must add to the aggregate matter of the universe and thus count as matter itself. If it is not tangible, however, then it is nothing but “that empty space which we call void” (438). This amounts to the claim that everything exists is either tangible, and is therefore matter, for everything that is tangible is matter, or is intangible, and is therefore void, for everything that is intangible is empty space, that is, void.

Lucretius’ argument for the existence of matter is an ontological an epistemological argument, stating that matter must exist because we cannot meaningfully talk about anything besides matter without first admitting matter into our ontology. However, it is somewhat anthropocentric in its approach, since it relies on what human beings, or perhaps any sentient being, can talk about or count as existing, not what fundamentally exists independently. In this sense, Lucretius is merely categorizing entities into two groups, based on whether or not they are tangible. Since everything is either tangible or not tangible, due to the laws of non-contradiction and the excluded middle, everything can rightfully be said to fall into one of these two categories.

One can rightfully be sceptical of Lucretius’ claim that everything that is intangible is empty space. The tradition of philosophy before and after him posit many so-called intangible objects which are thought to be more than the void. Among them are the forms, or universals, which are thought by Plato to have greater reality than material things. Meanwhile, talk of God or gods both before and after Lucretius often involves an immaterial but certainly active being. Lucretius goes on, beyond this brief passage, to deny that anything can act upon matter without being corporeal[3], but more work must be done to overthrow alternative thought on this matter.

Yet, we can still praise Lucretius for a simple but elegant approach to two formidable views. The simple approach to an epistemological foundation predates the rampant empiricism of the modern era, and even reminds one of Quine‘s naturalized epistemology in its reductionist (and dismissive) approach. The view meanwhile that space counts as some entity in itself, and is needed for the situation and locomotion of matter is one common in modern science, if still debated. One can easily read contemporary developments into Lucretius’ ancient words.

1. God has the idea of infinitely many universes.
2. Only one of these universes can actually exist.
3. God’s choices are subject to the principle of sufficient reason, that is, God has reason to choose one thing or another.
4. God is good.
5. Therefore, the universe that God chose to exist is the best of all possible worlds.

The argument can be broken down into three parts. Premises (1) and (2) say that God has a choice to make, for there are infinitely many possible worlds, and only one can be chosen. Premises (3) and (4) state that God chooses things with reason (this is the principle of sufficient reason, that is that all things that occur occur for sufficient reasons which fully explain them), and is good – hence, when God makes choices, God chooses that which is most good, or most perfect. Finally, the conclusion puts these two ideas, concluding that in this choice, as with all other choices, God chose that which is best, the best of all possible worlds which could have existed.

The argument is valid, for if there is are infinitely-many choices, and a good, reasonable God has made a choice of one, then that universe is the best. For, if God chose another less-good universe, then God would not be good, God would lack the idea of some universe, or God would not be reasonable, and some premises would be false. (Arguably, one could claim that the argument is invalid on the grounds that its premises may yield a false conclusion if the goodness of universes were identical, and that God did not choose to make any world actual. Clearly, since we know of an existing universe, the claim that none exists would be false, but it is not logically false and hence the argument could have weakness here. However, we will grant Leibniz the tacit assumption that “a universe exists” is a premise.)

Leibniz explains that the reason for the choice of  a world is in its “fitness, or in the degree of perfection that these worlds contain” (76). Hence, the suitability for a world for selection is a function of its level of perfection, and God, being perfect, would choose that world which is most perfect.

Premise (1) follows from the notion of God. God is, by definition all-knowing – a view defended in §48 – and, hence, has the knowledge of what any configuration of the universe would be. So, if God exists, premise (1) is true. Leibniz argues that God must exist in §§44-45 with the argument that “he must exist if he is possible. And since nothing can prevent the possibility of what is without limits, without negation and consequently without contradiction” (74) then God exists. The argument can be symbolized by modal logic as (◊G → □G),  ¬□¬G ∴ G, where G means “God exists”, and is valid.

One may hope to attack premise (2) with the claim that there could be multiple worlds. For if God is a transcendent being, beyond this world, it would seem that he could create all of his possible worlds independently from one another. It may be argued that God would never create anything imperfect, as the other worlds are said to be, but imperfections exist within the actual world even if they are in order with universal harmony. It may be the case that the entire collection of worlds, including the most perfect one, is itself perfect. It is not clear why Leibniz would deny this possibility, though it should also be noted that in this case, we may extend “world” to mean the set of all universes which God is again supreme over, and say that this set is the best of all possible worlds, which would have to be the case since it is the only set in existence.

Premises (3) and (4) seem less controversial. God is defined as being the “ultimate reason” (73) in §38, and hence God is the sufficient reason for things existing. God’s goodness is explained by his perfection in §41.

Hence, it follows from these premises that the actual world is the best of all possible worlds.

Source: Leibniz, G. W. Discourse on Metaphysics and Other Essays. Trans. Daniel Garber and Roger Ariew. Indianapolis: Hackett, 1991.

Natural selection seems to have produced reification but is it truth proper to imagine the persistence of a single object between instances of its being observed? The question for the child is how much qualitative difference is acceptable between instances of Mama? If Mama changes her hair or her clothes, has cosmetic surgery or injures her vocal chords, will she still be recognizable as Mama to the child? She’s not strictly identical to the entire set of features previously observed. Observation sentences about her appearance will differ. The theory places her as the same object, but the stimulus meaning of “there’s Mama” has changed drastically since its last utterance. If “Mama” has changed enough, the child may not assent to the observation sentence.

This is where Quine later drew a distinction between perceptual and full reification. In a passage from a late manuscript cited by Peter Hylton in his text on Quine[2], by way of Leonardi and Santambrogio[3], Quine clarifies the terms:

Prior cognition of a recurrent body—a ball, or Mama, or Fido—is on par with our recognition of any qualitative recurrence: warmth, thunder, a cool breeze. So long as no sense is made of the distinction between its being the same ball and its being another like it, the reification of the ball is perceptual rather than full.

For Quine, the child is capable only of perceptual reification, rather than the full reification one that is present in a theory. I take this to be a sort of family resemblance between stimulus meanings. A child can recognize certain sets of stimuli that, in a criss-crossing mesh include various patterns that trigger recognition, representing something perceptually for that child even if the child lacks a theory of persons, minds, bodies or persistence of an object.

Hylton takes the question of reference to be “how we can get from observation sentences to a mastery of language that is clearly about particular entities”[4] My question is, in a world of bits where language refers to various arrangements of those bits, why must language be about entities in the strict sense? Why must we pass from the perceptual reification that occurs when those bits are arranged in familiar ways to the full reification that says that there is some entity there? It seems to me that we can preserve a tasty desert landscape without reification of anything beyond a fundamental bit. At the end of this chapter, Quine expresses his preparedness to bail on the traditional concept of existence (36). If existence can go by the board, the entity can follow.

I know I’m taking a step away from the point of this chapter when I zero in on this, and I had prepared a commentary on Quine’s indistinguishable, isomorphic ontologies but I read it over and wasn’t sure there was sense to any of it. Indeed we can build fairly successful theories with varying versions of the ontology. But I find the reification game a little superfluous, especially if we’re taking a behaviourist account of things. We can build our ontology around dogs, around sets of {dog} or their absolute complements like  ∁{dog}, and each adopt our own isomorphic ontology and I can talk about dogs meaning dogs, and Smith can talk about dogs meaning {dog} singletons and Jones can play around with his ∁{dog} complements – just as my red could be your blue and, I don’t know, maybe there’s magic. Perhaps I need to be reminded that reference even needs to be successful – why can’t it just be a game of resemblance and recognition? What seem to be entities over time swap out their bits with other bits and it barely matters if the bits are the same bits so long as whatever bits are there are behaving in similar ways. We’ll quickly assent to the same observations when the bits move around. Twin Earth is Earth or not Earth and, sure, XYZ can be water if you want it to be and now I sound like a pragmatist so I’ll fall just short of that and say that I don’t see a difference made.

We can all have our own brain-bits differently-arranged and equally assent to the same observation sentences and whenever we generally agree on the borders around sets of bits we’ll call it an entity. Or, better still, we’ll each list off all of the types of entities that we think actually exist as fundamental and with each one take a sip of scotch. Whoever is left standing wins.

Augustine says that the actions of infants are “reprehensible” (8), the way they cry loudly for nourishment, constantly demanding the attention of their mother. Infants become intolerant of others, their parents and strangers, who do not obey them, often lashing out “with sheer will to hurt” (9). They also complain and demand things that aren’t even in their best interests. Augustine remarks that such actions would not be tolerated of an adult; in fact, an adult behaving in such an infantile manner would rightfully be the subject of scorn and ridicule. One cannot blame infants for the way they cry, of course, since they do not know what is wrong with their behaviour. However, Augustine says that such behaviour is clearly wrong, for as the child grows up there is an attempt to put an end to such behaviour, creating a more calm and polite child. Were it correct, it would be allowed to continue as the child matures.

Because of this clear wrongdoing on the part of infants, Augustine wonders why it is that infants are thought to have innocence. He concludes that it must not be anything having to do with the mind of an infant, since as has been shown, infants are not in possession of finer human qualities like humility and patience. Quite to the contrary, infants are selfish, impatient and impolite, and thus can rightfully be labelled as sinners. Instead, Augustine says, they must be innocent only in the sense that they are helpless.

He goes on to provide further evidence that the state of the infant’s mind is sinful, by means of demonstrating infant jealousy. He says that he has seen a case of a baby who was watching another feeding at a breast. The child who was watching was “livid with anger” (9), despite being too young to even speak. This jealousy shows an unwillingness to share readily-available milk with a child that will not survive without it, though the child likely doesn’t understand this. Still, this shows that infants can be guilty of jealousy and of gluttony. For Augustine, referring to infants as innocence seems to refer to “an odd kind of innocence” (9).

On this account, infants get away with their behaviour and allowed to act in the manner they do not because their behaviour is correct or sinless, but because it “will pass with the years” (9). Adults only allow infants their sins because they are short-lived.

So how about that? Normally we think that infants are innocent because of their ignorance — though ignorance doesn’t count as a defense later in life.

It turns out, they’re just awful.

The proper naturalist position counts the mind as part of the world, as McDowell wants to do. What a naturalist proper cannot coherently talk about is the Kantian subject. Instead, there are only objects. For those who would say that things are only objects in the sense that they are the object of some subject, then we may use the word ‘substance’, in the earlier Greek sense, to talk about physical things. Thus, the naturalist position is that everything is a substance; in Heidegger’s terminology, everything is essentially present-at-hand[1] and though further supposed properties or features of substances (readiness-to-hand, the existence of Dasein, the mind, intentionality, subjectivity) are reducible to that raw substance. In contemporary physics, that substance is identified with particles, though the details may be somewhat more complex than that[2]. The manifest image of the world[3], the normative space in which intentionality and morality are thought to lie, is composed of that same physical substance that makes up the brains of those who experience and project outwards.

So, for the naturalist proper, the space of reasons is not a realm outside of the natural or physical world, as it is in rampant platonism, nor is it an autonomous space within the world as it is in McDowell’s naturalized platonism. Rather, all rationality, normativity and intentionality is identical with brain states. There is no one space of reasons with which human beings have a connection; rather, each human being can be thought to have their own space of reasons. This space is not especially private, though. It can be seen physically by examination of the neurological states of the brain, and with the proper technology, those states may even be translatable into intelligible images. In another sense, it is not fully private, since glimpses into its content can be seen through behaviour.

‘Content’ needs qualification in that last remark. Intentional mental states are mental states that are about something else in the world. But they are neither a metaphysical link through some imaginary (or real) space to other substances which they are about, nor are they really representations of the substances they seem to be about. They are not the former because such space doesn’t exist in any important way. They are not the latter because, of course, the neurological features of our brain do not form a structure that mimics the outside world. Rather, they form a structure that allows us to have a mental state (which is identical with that brain state) such that we think we have a representation of the substance we are thinking about. So, when I close my eyes and picture the CN Tower, I do not obtain or summon some representation of that object. That object may be gone, moved, or different than I remember. Instead, my brain generates a certain arrangement such that it looks like the CN Tower to itself.[4] All of the qualia, ‘what it’s like to be’[5] and private world phenomena that philosophers expect to find in a separate mental world are  merely what the brain’s activity looks like from the point of view of that very brain.

Against the rampant platonist, the naturalist’s response is brief. Whatever attitudes one has towards the empirical observations with which one is presented, one does not survive without indulging in them. With a proper account of naturalism, any reason to favour a platonic account dissolves. Naturalism proper offers an explanation of intentionality, removes the “spookiness” (McDowell 92) of a separate space of reasons that McDowell complains of. We don’t need to add anything ontologically, and we have a hope to answer the how questions about mental states and intentionality through study of the brain. Spontaneity doesn’t need any explanation here, either, because it is not sui generis, if it’s counted as existing at all. We’re better off with the naturalist account.

Against McDowell’s naturalized platonism, the proper naturalist has to say that McDowell is wrong about naturalism. He argues against his ‘bald naturalist’, saying that “knowing one’s way around the space of reasons, the idea of responsiveness to rational relationships, cannot be reconstructed out of materials that are naturalistic” (McDowell 77). But the naturalist proper doesn’t want to reconstruct a space of reasons, really. The naturalist proper holds that all reasoning, all intentionality, all communication—the entire manifest image—takes place between physical substances across physical substances. The naturalist isn’t committed to reconstructing any intentional state beyond this because she doesn’t hold it to exist. What counts as intentionality for a naturalist proper is evidenced through behaviour, and it consists of a brain processing incoming information. The space of reasons, the finer points of language, art, morality, knowledge and so forth can be talked about as abstractions. They are useful in the processing that the brain must do; they result in digestible inputs. But the naturalist proper is ever-mindful that these are not things in themselves, but that they are always identical with and reducible to the states of the brain. The same holds of spontaneity. The naturalist counts human judgments to be determined (in a deterministic or indeterministic sense[6]) by the physical processes that cause them. Thus, spontaneity can be said either to not really exist, or at least to be denied status as sui generis, as is the case with the other ideas McDowell wants to preserve. Where McDowell wants to say that human beings are free to choose their beliefs, to take their experiences and spontaneously form judgments about them, the proper naturalist denies this. For the naturalist proper, sometimes brain states will have the disposition to respond to the stimulus of a red bench and form the belief that there is a red bench. Sometimes, because of other beliefs, brain states will not have such a disposition and will not form such a belief. Whether or not this happens is not an act of spontaneity, but a function of the states of the brain, including the stimulus received and the beliefs already held.

By positing an autonomous space of reasons, and a second nature with which humans can access it, the naturalized platonist gains little in the way of explanation and much in the way of recalcitrant philosophical questions. McDowell thinks that he gets out of the “threat of supernaturalism” (78) by saying that scientific advancements don’t clarify nature as a whole, but only the realm of law. This step does not work; it only redefines “nature” to include what the naturalist counts as supernatural. McDowell renames nature as the realm of law, says that the platonic heaven, the space of reasons, also exist, and says that there’s this new thing, now called nature, previously called existence, which encompasses all of them. The connection between the realms of laws and reasons is as sketchy as ever, and it is only through proper naturalism of intentionality and spontaneity that the confusion is finally dissolved.

⊨(P → Q) ∨ (Q → R)

Try throwing that into English. Here’s a reading using some propositions I just came up with:

“I’ll die if I’m immortal, or I’ll live if I die.”

Obviously, neither of those are the case. But this formula, (P → Q) ∨ (Q → R), is both provable and self-implied in classical propositional logic.

Here’s a syntactic proof by means of natural deduction using some basic rules of inference:

Ok, there are definitely shorter proofs, especially if you let other equivalencies into your rules of inference, but this spells out quite a bit and gets the job done.

So, ⊢ (P → Q) ∨ (Q → R)

The reason this is provable, despite being formally contingent in English, is that the material conditional, →, does not represent the English “if/then”. If you’ve taken a course in logic, you’ve probably heard this. The reason is that the truth conditions for the material conditional are a little different. Specifically, a formula of the form (α → β) is true on every valuation except those that make α true and β false.

Look at our formula again. It states, semantically, that either (P → Q) is true, or (Q → R) is. If (P → Q) happens to be true, then the whole formula is true, so that case is covered right off the bat.

If (P → Q) is false? Well, there’s only one valuation that makes (P → Q) false — the valuation where P is true, and Q is false. So, if (P → Q) is false, then Q is false as well. But, if Q is false, then (Q → R) is true, because (Q → R) can only be false when Q is true and R is false. If Q is false, then (Q → R) is true.

Going the other way, if (Q → R) is false, then Q is true and (P → Q) can’t be false, because it can only be false if Q is false.

As a result, whenever (P → Q) is false, (Q → R) is guaranteed to be true, and vice versa. So, (P → Q) ∨ (Q → R) is a tautology.

My point here is just a friendly reminder: be careful with translation. Expressing the English “if/then” with the material conditional (→) may sometimes get you into trouble.

This objection has probably been made before, but for the sake of my notes I’m spelling it out as I read it.

In the paper, Sellars runs through a set of three propositions that he believes that sense-datum theorists must hold, but that Sellars believes is inconsistent.

A. X senses red sense content s entails x non-inferentially knows that s is red.

B. The ability to sense sense contents is unacquired.

C. The ability to know facts of the form x is Φ is acquired.

Sellars then states that “A and B together entail not-C; B and C entail not-A; A and C entail not-B” (132).

However, I think he makes a crucial misstep in his formulation here. Namely, in C Sellars refers to a fact, that knowledge “of the form x is Φ is acquired”, but I do not believe that what is stated in A truly takes this form.

On my reading of A, when we say that x non-inferentially knows that s is red, we are not saying that x knows the fact “s is red“. It may entirely be the case that x is unable to form the sentence “s is red”. Suppose that x has been living in Mary’s Room and is experiencing red for the first time — x would not be able to know that what x sees is red. Hence, x does not have knowledge of the form x is Φ  in the sense that x can categorize his or her sense perception. But x still has some knowledge from this experience, and for the sense-datum theorist this is a recollection of that given sense data.

The difference here is a logical distinction between a de re and a de dicto formation. These two Latin phrases basically mean “of the thing” and “of what is said”. Symbolically, we can represent “x knows that” as K_x. We can also symbolize “α is red” as R(α).

Now, in the case of A, we have the claim that X senses red sense content s entails K_xR(s). This is a de re claim — what x knows is that, of s, that object is of a certain colour, which we call red. The claim is that x knows that s has some property. We can argue a bit over whether this must be knowledge by acquaintance in the sense that Sellars talks about in this paper, but the idea here is that this is not knowledge of a fact, but rather the knowledge you would acquire whether or not you knew of the category “red” to begin with.

However, in C, we have the claim that knowing facts of the form K_x[Φ(α)]. This form translates in our example to K_x[R(s)]. This is the de dicto claim — what x knows here isn’t that s is red, but the sentence “s is red”.

So, the sense-datum theorist can simply agree that knowledge of de dicto facts in this form are acquired, but deny that A includes such a fact, since what is known can be expressed as a de re claim. Hence, the triad of propositions that Sellars attributes to the sense-data theorist is not inconsistent.

Cited:
Sellars, Wilfrid. “Empiricism and the Philosophy of Mind”. Science, Perception and Reality. London: Routledge & Kegan Paul, 1963. pp. 127-164.

However, this philosophy comes at a price. Because it indiscriminately accepts any data it’s given, it accepts any data it’s given. The result is that, if someone with the right skills is feeling particularly malicious, they can vandalize and seriously distort your business’ data. There are two ways this can be done.

We’ve been aware of these potential issues for some time now, but we wrestled a bit with the decision of whether or not to post this. On one hand, we like to share our knowledge and, since this is a very real fact about Google Analytics, it’s good for GA users to be aware of it. On the other hand, we’re potentially teaching people how to mess with someone’s GA deployment. Ultimately we decided on transparency and honesty — after all, we’re also going to tell you what you can do to protect yourself from these. But we must begin with a caveat: we do not endorse doing anything like this. We offer this information so you can be aware of potential security risks with your own data, and take the necessary steps to protect your data integrity.  We are strong supporters of the Web Analyst’s Code of Ethics, and though that code doesn’t say much about messing with others’ data, the idea is generally to be open and honest with data.

(Update: I should also point out that Google Analytics is not alone in being vulnerable to some of this. The approach to campaigns and ease of copying other data makes it easier than with some tools, I think, but those stem from Google’s strengths rather than weakness. I offer Google Analytics up because they don’t have a service level agreement for everyone, and hence it’s up to you to protect some of your data. Despite any vulnerability, I do want to be clear that Google Analytics is a fine tool and this alone is not cause for alarm, just something to be aware of when implementing this tool, and by extension, others like it.)

With that out of the way, here are the potential exploits we’ve seen:

Campaign Vandalism

Google Analytics makes campaigns tracking easy. Unlike tools like Adobe SiteCatalyst which store campaign tracking codes and convert them into useful data, Google Analytics sets campaign names directly in the URL query parameters, accepting any campaign name that it receives. This saves you time managing all your campaigns and channels, and makes setting up Google Analytics significantly faster. But with GA merely accepting any campaign names it gets, what’s to stop me from visiting your site using a bogus campaign name?

What’s the problem?

Campaigns in Google Analytics work by adding the names of campaigns, media and sources to URLs. For instance, if you want to track a summer email campaign that links to www.example.com, you may enter a URL like this:

In this example, you’re pushing though three pieces of information: the source of your list (newsletter), the medium over which you’re marketing (email) and the name of the individual campaign (SummerBlast). This data will be recorded in Google Analytics, no questions asked. You don’t even have to tell Google about the campaign ahead of time.

But what’s to stop me from visiting your site on this URL?

The answer is nothing. If I were to visit a GA-tracked website with those query parameters attached, their Google Analytics implementation would show that someone came to their site magically, by means of a spaceship, through a campaign called Stupidhead. I did this to one of my own sites, and here’s what I got.

How dangerous is it?

The most someone can do is create a bunch of meaningless data. The effect of a single vandal acting alone would be minimal, though an extremely determined vandal could set up a sort of vandalism bot — an automated software that repeatedly visits your website using falsified campaign data.

If you’re smart about your reporting, you’re probably more concerned about your converting campaigns. In order for vandals to mess with those reports, they’d have to become converting visitors. They may not have a problem with filling out a lead generation form, but if you are running an ecommerce site, these reports have a built-in protection: vandals will have to pay for the opportunity to seriously mess up your reports. (However, you’ll still need to account for the second scenario below.)

How do you fix it?

The first step is to identify vandalism. Chances are, it will be obvious — if someone has decided to vandalize your site, it’s probably because they want you to see it. So a bogus campaign name that shows up in your reports will be clear. If you’ve been smart about maintaining a convention for your campaign naming, you should have an easier time detecting falsified campaign information, though a determined vandal could spoof your own conventions.

Getting rid of the campaign data isn’t as easy. In fact, it’s impossible. What you can do instead is segment it out, so that you see only data from non-vandals. To do this, you need to create an advanced segment. Creating a new custom segment (using the ‘Advanced Segments’ area at the top of a report in the new Google Analytics interface), you can choose to exclude campaigns, media or sources that contain the offending terms.

The problem here is that if you’re the victim of serious vandalism, such as from the bot scenario given above, you have to use this segment every time you look at a report in Google Analytics. That’s a pain.

If you’re a large organization and you’re afraid of receiving an attack to your Google Analytics account, you may consider running more than one analytics solution, or copying the relevant data to your own datamart. The larger you are financially, the more likely such an attack is, but the more resources you’ll have to back-up your data.

What should Google do?

Probably nothing. I think that the fact that you don’t have to do campaign management within Google Analytics is a plus. It cuts down the overhead — every organization should have some method to the madness of creating campaigns and campaign names, but the extra work of punching data into your web analytics tool isn’t always worth the benefit, especially for smaller organizations.

Given the fact that traffic has to convert, and actually spend money if you’re an ecommerce site, in order to mess with valuable reports. If someone really wanted to hit your site hard with this, the most they could do is become a nuisance. It won’t destroy your reporting, but it will make it harder to pull clean data.

However, since Google is gradually approaching the enterprise market with its Analytics product,  its product team may consider providing two options for campaign management: both the current consume-everything version, and an internally-managed campaign list in the style of SiteCatalyst. The benefit would be for large customers, who have the resources to properly manage their campaigns, to be able to do so risk-free.

Fake Data Injection

Ok, so, if I want to, I can mess up the campaign data a bit. And if I want to mess up your revenue sources, then at least I have to pay you for the opportunity to do so, and it may not be so bad.  But what if I want to mess up the rest of your data? Surely, I wouldn’t be able to do that, right?

Wrong. Unless you’ve set up filters to prevent this, Google Analytics will accept data for your Google Analytics tracking account from any server, as long as it sends the web property ID for your website.

What’s the problem?

Because Google Analytics accepts this data from anywhere, anyone can create a web page using your Google Analytics tracking code, view it, and have traffic, events or ecommerce data show up in your Google Analytics report.

For example, what happens to your reports if I create a fake transaction, using your Google Analytics tracking code, with a transaction of -$90 million? Here’s what happens:

The other days in that report aren’t at zero dollars. They range from $50,000 – $100,000, but you can’t see the trends because the fake transaction has skewed everything.

How dangerous is it?

The damage here is greater, in that it will severely distort any reports. Someone could take an obvious step, like the above examples, of pushing huge transactions into your Google Analytics account. However, the vandalism could be more subtle: one could push several smaller transactions with false source data to try and misguide you, or push events that you can’t reconcile with your order management system.

The effect of this and the campaign vandalism method I mentioned above can be compounded. Recall that you’d have to buy something to mess with revenue source data with the method above? It turns out that, if you fake realistic-looking transactions while using spoofed campaigns, you can make an even bigger mess of things.

One limiting factor here is that the visits have to be run from a server that’s connected to the Internet and can host web pages. As a result, you can use the Hostnames report in Google Analytics to identify where the fake data came from. This does mean that if someone wishes to vandalize your data in this way, they will have to do so carefully, otherwise they may be identifiable. Potential vandals would have to go to greater lengths to ensure their anonymity.

How do you fix it?

Finding the fake data could be tricky. In the case of revenue and transaction data, you probably have an order management system with which you can compare the data. However, when you’re strictly looking at Google Analytics, the fake data may not be obvious if the vandal has chosen to be sneaky about it. The first step is to check your Hostnames report. Hostnames are the domain names or IP addresses from which your website is viewed. In the new Google Analytics, you can find the list of hostnames that have been used to view your site from the Visitors > Technology > Network report.

If Google Analytics code executes on hostnames that you don’t own, you’ll want to investigate the problem. In some cases, those hostnames will simply be search engine caches or translation services that are copying your analytics code. However, if you notice transactions or strange events and campaign data from suspicious hostnames, then you may want to look into the matter.

There are a couple of ways to actually fix the problem. The first is an ad hoc approach — if someone drops a fake transaction into your system, simply remove it by executing some JavaScript. This requires you to write a custom JavaScript that basically makes an inverted version of the transaction, with negated quantity, revenue, shipping and tax values. This is annoying, but quick enough to get rid of a single transaction.  You can also handle it the way I suggested handling vandalized campaigns above, using custom segmentation.

However, if you want to prevent yourself from these attacks entirely, then you’ll need to add some filters to your Google Analytics profiles (or create new filtered versions of your main profiles). The goal here would be to create a list of hostnames — the domain names and subdomains that you use for your website — and ONLY accept data from those hosts. Now, you’ll probably want to set up your filters on a new profile, which is a filtered version of your original. That way, you have 100% of the data collected by your site, but also a clean/safe copy to work with.

The example filter I’ve given here will only count traffic, events and transactions from the domain name ‘example.com’. A better way might be to only include traffic from specific IP addresses, if you know the IP addresses of your website(s)–this could prevent attempts to spoof your hostname and push vandalism that appears to be legitimate. In either case, be sure to keep this up-to-date! If you change your domains, subdomains or IP addresses, it may affect your filtered profile and cut out some legitimate, valuable data.

One quick note: Sometimes you’ll see additional domains in your list that are from hostnames that have a legitimate purpose. For instance, Google will serve up your site when it shows either a cached version or a translated version — in both cases, the hostname includes ‘googleusercontent.com’. Bing also shows page caching on cc.bingj.com. You may want to exclude data from caches or translated versions of your pages, but if you’d prefer to see all of it, include data from those domains as well.

What should Google do?

Google should provide these filters as standard options. You should be able, when creating a profile in Google Analytics, to specifiy what host names and/or IP addresses you’re willing to accept data from, and be able to provide an on/off switch for accepting data from other sources. Making this option more prominent may help businesses be aware of the issue and protect themselves from day one.

The are more technically complex, and secure, methods of limiting these kinds of problem that Google could consider. One option is to make use of server-side code in conjunction with the JavaScript to authenticate an API key before data is accepted.

At any rate, rumblings of a paid, enterprise-focused Google Analytics can be heard from the horizon. If a service level agreement becomes available to some Google Analytics customers, data integrity and security will be chief concerns.

Until next time,

Colin

UPDATE: Just a quick note of clarification. Although I focused this post on Google Analytics, I should clarify that GA is not the only tool vulnerable to this — especially the second method of vandalism. The first method is the easiest thing, and that’s more specific to GA. This post came out of an internal discussion about the campaign vandalism. To be clear, this kind of thing isn’t particularly common, and as Emer mentions in a comment below, it tends to be a result of negligence when people copy code or designs, rather than a malicious attempt. So, there’s no need for immediate concern for most people, but I think it’s worth being aware of what you can do to protect yourself from this inherent vulnerability in most analytics tools.

The method of tracking for LinkedIn buttons differs a little bit from the others I’ve posted so far. Currently, LinkedIn does not provide a callback function that executes when an action is completed — there’s no flag in the code that says “visitor shared something, now what?”. Instead, we have to build our own JavaScript function that we can bind to an action. In order to do so, this example uses jQuery, a popular JavaScript library.

The first step is to get your button code snippet from LinkedIn. LinkedIn calls this service LinkedIn for Publishers. When you generate the code, it will look something like this:

This script from LinkedIn above generates new HTML which is inserted into the page in order to create the ‘Share’ button and its functionality. The code generated includes a new <div> element, which has the class name IN-widget.

This gives us the chance to reference the generated button with a little code of our own. Using the jQuery .ready event handler — to ensure that the code does not execute until LinkedIn is finished building the button — we construct a new function that binds to the “click” event for all objects with the class name ‘IN-widget‘. In this function, we include the Google Analytics social tracking code, to create a new social event.

This new code can be added pretty much anywhere on your page — you may want to include it right after the code LinkedIn gives you to keep them together, or put it in your header if that’s how you prefer to organize your site.

Note that in this example, the last parameter, window.location.href, will send the current URL along as the resource shared. In different systems, you may prefer to output the URL directly, rather than through JavaScript. For instance, in WordPress, you may replace the last parameter with the permalink for a post:

Now, there is one issue which must be kept in mind. In the case of the Facebook and Google +1 buttons I’ve previously shared, the social event code only fires after something has been shared. That’s the benefit of the callback function provided by those services. In the case of LinkedIn, however, what we’re really tracking are clicks to the share button — it’s possible for someone to cancel sharing after clicking the button, so you may get an inflated total.

With that caveat in mind, you’re all set! Once you’ve added this JavaScript, your LinkedIn shares will appear in the new social reports in Google Analytics. You can find these reports under “Visitors > Social” in the new version of GA. With this, your web analyst can help you determine what impact these buttons have on your site and your business. For instance, whether frequently-shared articles get much more converting traffic from LinkedIn, and whether the people who share things are also the people who convert themselves.

Until next time,

Colin