By accident, journalist Jack Poulson discovered Google had completely de-listed two of his articles from its search results. “We only found it by complete coincidence,” Poulson told 404 Media. “I happened to be Googling for one of the articles, and even when I typed in the exact title in quotes it wouldn’t show up in search results anymore.”
Poulson had stumbled on a vulnerability in Google’s search engine that allowed people to maliciously delete links off of Google, which is a reputation management company’s dream and which could easily be used to suppress information. The SEO trick had allowed someone to de-list specific web pages from the search engine using Google’s Refresh Outdated Content tool, a site that lets users submit pages to URLs to be recrawled and re-listed after an update. The vulnerability had to do with capitalizing different letters in the URL in this tool, which ultimately caused the delisting.
In 2023, Poulson published an article about tech CEO Delwin Maurice Blackman’s 2021 arrest on a felony domestic violence charge.
After Poulson published Blackman’s arrest records in 2023, the CEO has attempted to suppress the story in various ways, including lawsuits and DMCA takedown requests. Eventually, the stories disappeared from Google, using this vulnerability. As far as Poulson could tell, the only two articles on his newsletter that had been de-listed by Google using the trick were related to the CEO.
Google confirmed the problem in an email to 404 Media. “This tool helps ensure our search results are up to date. We’re vigilant in monitoring abuse, and we worked quickly to roll out a fix for this specific issue, which was only impacting a tiny fraction of web pages.”
Poulson’s work has appeared at the Center for Investigative Journalism, Drop Site News, and his personal newsletter All-Source Intelligence.
The Freedom of the Press Foundation—a nonprofit dedicated to protecting the rights of journalists—has chronicled Poulson’s fight against censorship and Ahmed Zidan, its Deputy Director of Audience, told 404 Media that an article about that fight had also been de-listed from Google.
When Poulson noticed this, he alerted Zidan, who did some digging and figured out the problem. The owner of websites can access a Google Search Console (GSC) to tweak and optimize their site’s place in the search engine. Digging around in GSC, Zidan discovered someone had made repeated requests, starting in May and ending in June, to recrawl its article about Poulson and Blackman.
In every instance, the capitalization of letters in the URL had been changed. “So the first request that comes in, the ‘a’ of anatomy is a capital ‘A’ and the rest of the slug is the same. And apparently after this request would expire, the attackers would make another request, this time capitalizing the ‘n’ in anatomy,” Zidan said. When Google tries to index the URLs with tweaked capitalization, it gets a 404. “Then, Google, instead of indexing only the 404 page, would de-index all the variations including the live, valid, legitimate article,” Zidan said.
Zidan contacted Google who confirmed the bug to him. The company wouldn’t tell him or 404 Media how many pages had been affected or give further details about the incident. “We would really love Google and other social platforms to be more transparent with advocacy and press freedom organizations,” Zidan said.
It’s hard to know who, exactly, made the re-indexing requests. Anyone can use the Refresh Outdated Content tool and it doesn’t tag the person who made a request in GSC. But the only articles on Poulson’s newsletter affected by the issue were two related to Blackman and the one on the Freedom of the Press Foundation site was about Blackman’s fight with Poulson.
It is easy to imagine a celebrity, high-profile politician, or even a government using this bug to suppress negative information about themselves in a targeted way. Reputation management companies exist to help the rich and powerful do just that.
Discoverability is vital to a journalist and getting de-listed from Google search can crush a story’s impact. “It’s basically just silent censorship and who knows if there’s some other variant of this that exists…any child could do this. And it’s just shocking to me that a company as technical as Google would have such a simple bug,” Poulson said. “If your article doesn’t appear in Google search results, in many ways it just doesn’t exist.”