GCP – Bitly: Protecting users from malicious links with Web Risk

Bitly’s partnership with Google Web Risk helps enhance Bitly’s ability to protect users and build trust as they generate millions of links and QR Codes daily. 

Over the last decade, Bitly has solidified its reputation as a multiproduct connections platform, generating millions of links, QR codes, and mobile landing pages every day. Bitly enables users to shorten and customize long URLs for easier sharing, management, and tracking. Its capabilities in link tracking and analytics make Bitly a powerful and essential tool for brands and businesses of all sizes. As the company continues to scale, it’s constantly exploring new ways to enhance its trust and safety program. 

Bitly’s trust and safety principles

Bitly’s commitment to trust and safety unfolds in a three-pronged approach. First, the company uses its proprietary technology, including the Bitly Abuse Prevention System and its Threat Detection Service (TDS) and Abuse API, to monitor and remove harmful URLs, ensuring a safer online experience for all users. 

Next, Bitly supports its users by fostering innovation, upholding core values, enforcing an Acceptable User Policy (AUP), and developing user-friendly tools including the Bitly Trust Center.  

Finally, Bitly forges partnerships with technology experts and NGOs to combat online threats such as terrorism, child sexual abuse materials (CSAM), and phishing campaigns, including its partnership with Google Web Risk.

Google Web Risk and Bitly

To strengthen its already robust trust and safety program, Bitly partnered with Google Web Risk to evaluate linked URLs in real-time against Google’s consistently updated database of unsafe web resources and URLs that violate any of the company’s Safe Browsing policies. Web Risk includes data on more than 1 million unsafe URLs, and continually updates this information by analyzing billions of URLs daily. These unsafe URLs typically include social engineering sites — such as phishing and deceptive sites — and sites that host malware or unwanted software. 

“Our goal is to keep users safe and earn their trust by leveraging Google Web Risk’s enterprise security service to validate the safety of millions of generated links and QR Codes in real-time. Given the scale and speed of our users generating millions of links each day, Google Web Risk’s ability to handle this type of volume while delivering real-time verdicts is crucial to ensure seamless and safe online experiences,” said Ben Kleiman, director of Trust and Safety, Bitly.  

Some of the key features that Bitly and Google Web Risk bring to customers include:

• Checking millions of links and QR codes automatically every day, in real-time, for signals of abusive or malicious content.

• Delivering high-fidelity confidence scoring for near real-time automatic, programmatic blocking, or warnings of abusive content.

• Providing actionable insights on common types of abusive content such as phishing, malware, spam, and other threats targeting users.

• Surfacing patterns of abuse that point to bad actors for strategic response.

• Strengthening the competitive advantage around brand trust in the safety of Bitly links.

Web Risk confidence scoring avoids false positives

One key area of content safety that can be the trickiest for companies is the calibration of confidence scoring to avoid false positives in threat detection for URLs. 

Google Web Risk’s enterprise-grade features include risk scoring and confidence levels, a unique capability that interested Bitly and added value to the partnership. Web Risk’s confidence scoring helps organizations evaluate the maliciousness level of a URL based on blocklists, machine learning models, and heuristic rules. Web Risk ranks URLs as low, medium, high, very high, and extremely high risk. 

“We put a significant focus on confidence scoring within Web Risk to maintain customer trust,” said Kleiman. “Failing to block a malicious URL can undermine that trust, just as false positives can hurt user confidence in our links. We meticulously calibrate confidence scoring with Web Risk and have fine-tuned our threshold where our false positive rate has been remarkably low, particularly given the scale of links and QR codes we generate daily.”

Bitly continues to evolve its security stack to protect its users

Navigating the constantly shifting Internet environment proves to be a challenge for every technology company. Bitly recognizes the importance of adopting cutting-edge technology to safeguard its users effectively. 

Bitly has a unique vantage point on the Internet since it captures a lot of signals from many different users in many different industries. 

“Our goal is to enhance our security infrastructure to make smarter, faster, and more impactful decisions – not just around websites, but also around our users and their associated accounts. Web Risk is now a core part of this effort, and we are looking forward to leveraging more Google resources, like reCAPTCHA, which will be the next big thing to enhance Bitly’s capabilities,” said Kleiman.

As Bitly’s product offerings grow, so does the complexity of the threat landscape faced by the company’s Trust and Safety team. Kleiman said, “As we continue to evolve, Google’s suite of solutions can provide the necessary tools we need to address our evolving needs so that we can stay ahead of the curve.”