
how-to block ads
|
|
Share Topic  |
 |
|
|
|
 4 edits | reply to eburger68
Re: FTC Spyware Workshop: 1st Impressions Hi All:
Now that I've a bit more time, let me extend and expand upon my earlier comments on the FTC Spyware Workshop. I'll organize these comments around the six panels. Since I've now had a chance to see the panelists in action and listen to their contributions, I'll update where appropriate the "rating" that I assigned each panelist in a previous thread ( »FTC Spyware Workshop Panelists - Worries... ):
X - industry/corporate friendly U - unknown/undetermined P - privacy friendly
Panel 1: Defining, Understanding, and Disseminating Spyware
Panelists:
X - Ed Black, President & Chief Executive Officer, Computer & Communications Industry Association X - Mark Bohannon, General Counsel & Senior Vice President Public Policy, Software & Information Industry Association X - Marty Lafferty, Chief Executive Officer, Distributed Computing Industry Association X - Avi Naider, President & Chief Executive Officer, WhenU.com, Inc. X - Ari Schwartz, Associate Director, Center for Democracy and Technology
Note: see Bill Pytlovany's blog ( »www.mysteryware.com/blog.html ) for photos of the panel one participants.
Protecting Commercial Interests, not the Public
In the first post of this thread I described how this panel initially described the term "spyware" as too difficult to pin down, only to do a complete about-face when they sought to distinguish their own software (or the software of the interests that they represented) from "spyware."
This panel was not only predictable, but frustrating and even enraging. In my own comments on the term "spyware" ( »www.staff.uiuc.edu/~ehowes/junkware.htm ) I wrote: "Definitions and terms ought to help us understand the world and grapple with the problems that it presents, not stand in the way of our efforts to solve those problems." None of the panelists for panel one was interested in crafting a definition of "spyware" that would address the problems of consumers, however.
This panel should have been striving to define spyware (technologically, behaviorally, or otherwise) in order to help the FTC and legislators identify the kinds of software that consumers are complaining about so as to give those consumers relief from the obnoxious, destructive business practices of advertising software vendors. Instead what these panelists did was attempt to exempt their own software and the software of their clients from the category of "spyware" in order to protect their own interests. Indeed, that pretty much sums up this panel: instead of working to protect consumers, this panel was more interested in protecting themselves. And to its great shame and discredit, the Center for Democracy and Technology (CDT) did almost nothing to challenge that agenda (more on the CDT in a bit).
A few of the panelists were quite open about what they were attempting to do, stating flatly that "adware is simply different than spyware, and people have got to understand that" -- as if they alone could establish the difference through some sort of declarative fiat without the input or suggestions of others. This was but one of several moments during the day when the arrogant, obstructionist, anti-consumer agendas of those represented on various panels were nakedly on display and visible to all who cared to look.
Just why the FTC would choose for a panel charged with defining "spyware" panelists whose only contribution would be the plea "whatever it is, it's not what we're doing" is beyond me. The public was not represented on this panel at all (despite the presence of the CDT, for reasons I provide below), and the panel did nothing to protect or advance the interests of the public, only a narrow class of commercial interests.
WhenU's Avi Naider
One of those commercial interests was WhenU.com, represented by its chief executive Avi Naider, who insisted at one point that the word spyware "was never meant to include software-based advertising...It's pro-consumer; it's pro-competition; it's pro-competitive. (It's) one of the most promising technologies that exists on the Internet today" ( »zdnet.com.com/2100-1104_2-5195222.html ). Setting aside the fact that the term "spyware" was first used in this context during the summer of 2000 to describe advertising software from such companies as Aureate/Radiate and Cydoor, Naider's assertions are simply preposterous.
Nothing about WhenU's software is "pro-consumer." Rob Cheng and Dave Methvin of PC Pitstop have effectively demonstrated ( »www.ftc.gov/os/comments/spyware/···stop.pdf ) that the vast majority of consumers with WhenU's software are simply not aware of its existence on their computers. Moreover, Ben Edelman's research on WhenU ( »www.ftc.gov/os/comments/spyware/···lman.pdf ) strongly suggests that WhenU is likely violating its own privacy policy by collecting and transmitting personally sensitive data. Finally, Stephen Urquhart, State Representative in the Utah House of Representatives, showed WhenU's license box during panel 6 -- a box so small that it effectively discourages users from looking too closely at the terms of agreement. Given that Naider consistently maintained that what sets "adware" (and WhenU's software) apart from "spyware" is the provision of notice and disclosure during installation that allows consumers to make an informed choice to voluntarily install WhenU's software, these failings are quite damning.
Naider claimed that, contrary to the numbers presented by PC Pitstop, most users do knowingly consent to the installation of WhenU's software. As evidence he offered the fact that of 100 million WhenU installations, consumers had uninstalled WhenU's software in 80 million of those cases. Naider reasoned that if 80 percent of users who installed his software were able to uninstall it, then the consumers must have been aware of the software from the outset. This argument is extremely flawed, however, because Naider provided no information about the nature and performance of those uninstallations or even how WhenU managed to calculate the number of uninstallations (Does the uninstaller report back to WhenU? Is WhenU simply subtracting the number of active users from the number of known installations?).
I strongly suspect that the vast majority of those WhenU uninstallations represent consumers who discovered WhenU's software on their systems after the fact and somehow managed to uninstall it. Many of those users may have discovered WhenU's software through the use of an anti-spyware app such as Ad-aware or Spybot Search & Destroy. Still others may have discovered the software when they turned to a knowledgeable third party (a friend, a computer repair shop) for help with their computers. Whatever the case, the number of uninstallations tells us very little about the circumstances of the installations themselves and whether consumers were properly informed of the software installation and the functionality of that software. On this issue as with so many others, Naider was simply spinning fairy tales.
Naider's claim that his software is represents one of "most promising technologies that exists on the Internet today" would be laughable were it not indicative of the enormity of the threat that this class of software poses to consumer autonomy on the internet. As I remarked in an earlier post ( »What's the *motivation* for hijack-ware? ), this software technology is indeed regarded as "promising" by advertisers and media companies because it seems to offer commercial interests the ability to control consumers' experience of the internet through "push technology." For consumers themselves, however, nothing about this technology is "promising" -- it is an unmitigated disaster.
Indeed, in my own comments to the FTC ( »www.staff.uiuc.edu/~ehowes/ftc-comments.htm ), I told the story of helping one of my students remove unwanted software from her PC -- software that had all but trashed the computer and rendered it unusable. One of the more obnoxious pieces of software on that box was WhenU, which interfered with my student's use of her computer and which she no idea how to remove (much less an idea how it had gotten on her box in the first place).
That the first panel at the FTC's Spyware Workshop offered Naider's WhenU as a representative example of "adware" (as opposed to "spyware") is instructive, given what else was demonstrated about WhenU's software by later panelists and other workshop participants. Even this lame attempt to distinguish "adware" from "spyware" fell through because the software in question turns out to be exactly the kind of software that consumers are complaining about. Anyone working daily in trenches to protect the public against "spyware" could have explained this problem to the panel, but the panel did not have any reliable, recognized representatives of the public's interest.
Anti-Spyware Legislation
Almost all of the panelists expressed their strong disapproval of anti-spyware legislation such as the bill recently passed in the Utah House, citing potential problems with an overly broad definition of "spyware" that could make illegal perfectly innocuous, and even popular types of software. The examples offered up by the panel, were simply laughable. One panelist asserted that instant messaging software" would become illegal under the Utah bill, yet failed to explain just how or why such would be the case. Another example pointed to was security software and updates; again, the panelist failed to explain clearly how such software would be illegal under the Utah bill.
One other type of software offered up as an example of "collateral damage" resulting from the Utah bill was parental control software (i.e., software used by parents to censor porn on home computers to protect children). The panelist who used this example asserted that since the Utah bill requires software to "provide a method ... by which a user may quickly and easily disable and remove the software from the user's computer" ( »www.le.state.ut.us/~2004/bills/h···0323.htm ), parental control software would be illegal since it protects itself against uninstallation by children. This argument is, of course, absurd on its face because such software does provide an uninstallation method to the parents who install the software in the first place.
The Utah bill's requirement of an uninstallation method provoked still more comments from one of the panelists, who warned users to "be careful what you ask for." His argument was that most consumers are unaware of the vast majority of software that is installed on their systems because a good part of that software is installed as part of a larger program (e.g., Microsoft Office or Windows). Indeed, the uninstallation requirement raises the question of just how "software" itself, which is almost infinitely modular, is to be defined. (Interestingly, this very question was at the heart of the Microsoft anti-trust case because MS asserted that Internet Explorer was not a separate software program, but rather an integral part of the Windows operating system.) If software vendors were required to provide uninstallation methods for all software, it was argued, they might be forced to provide uninstallers for software that was critical to the functioning of programs that consumers knowingly installed and even the operating system and computer itself. Thus, consumers would be at risk of uninstalling critical software components and rendering their programs and computers inoperable.
This objection has some merit, but at the end of the day it cannot be taken as a reason to reject the uninstallation requirement. At best, it means that legislators need to take care that the uninstallation requirement apply only to uniquely defined software modules that are installed independently of other software on the computer, and that software manufacturers be given leeway to protect software modules that are indeed critical to the functioning of the PC.
Allowing software vendors to install software behind consumers' backs without providing an uninstallation method is simply bad business. Indeed, it is precisely because so many advertising software vendors have neglected to provide conspicuous, reliable uninstallation methods that consumers have resorted to questionable, ad hoc uninstallation methods that risk damaging their computers or rendering them unusable. An uninstallation requirement for advertising software would only reduce the likelihood that consumers would unwittingly damage their systems.
Bad Behavior vs. Bad Technology
Almost all of the panelists urged FTC to focus on "bad behavior" or "practices" instead of technology. Although this distinction does have much to recommend it, such a distinction still needs to be fleshed out with concrete examples, none of which were offered by the panelists themselves. Is homepage hijacking, for example, a technology or a behavior? Is the use of contextual pop-up advertising a technology or a behavior? Is the addition of porn-related toolbars to users' browsers a technology or a behavior?
I would argue that each of these examples represents behavior in the sense that they are business practices embodied in code. I strongly suspect, however, that the panelists who urged a focus on "behavior" over "technology" would prefer a much narrower definition of "behavior" so as to hamstring legislatures and governmental agencies and prevent them from taking action against the more obnoxious business practices of the advertising software vendors.
The Center for Democracy and Technology (CDT)
This seems a good point to address the performance of the Center for Democracy and Technology (CDT), represented on panel one by Associate Director Ari Schwartz. Careful readers of my previous comments on the workshop panelists ( »FTC Spyware Workshop Panelists - Worries... ) will note that I have changed the CDT's rating from U (unknown/undetermined) to X (industry/corporate friendly). There are several good reasons for that change.
In the several documents that the CDT has released over the past six months (see »www.cdt.org/privacy/spyware/ ), including its comments to the FTC ( »www.ftc.gov/os/comments/spyware/···tech.pdf ), the CDT has attempted to position itself as the leading representative of the public's interest on the issue of spyware. The CDT has even filed one complaint with the FTC against the company behind SpyWiper, a notorious software vendor that used deceptive scare tactics to stampede users into buying its "anti-spyware" product.
While it is tempting to regard the CDT as a potentially useful voice on this issue, its several actions and initiatives cast doubt on its ability to represent the public's interest. The CDT's performance on panel one was simply abysmal, as it did nothing to resist the agenda being advanced by the commercial interests represented on the panel, effectively leaving the public without a strong voice on a question (how to define "spyware") that is absolutely critical to addressing the problems with "spyware." Instead of challenging the other panelists' attempts to protect their own commercial interests, Ari Schwartz sat silently by, blithely allowing one panelist after another to exempt themselves and their software from the category of "spyware" and enabling them to promote an obstructionist agenda that threatens to prevent any action whatsoever being taken to protect the public's interest.
The CDT's preferred course of action, it would seem, is "industry self-regulation" -- an absurd concept that I disparaged in an earlier post. To this end, the CDT has put together a "Consumer Software Working Group," outlined in a position paper that it distributed at the workshop (also available online: »www.cdt.org/publications/pp_10.07.shtml ). At the outset of that paper, the CDT states:
said by CDT: The Consumer Software Working Group is a diverse community of public interest groups, software companies, Internet service providers, hardware manufacturers, and others that are seeking consensus responses to the concerns raised by practices that harm consumers.
The name of this "working group" is extremely misleading, though. Among the industry interests represented are:
America Online Business Software Alliance Claria Corporation Dell, Inc. Distributed Computing Industry Association EarthLink eBay Google Information Technology Industry Council Internet Commerce Coalition Microsoft Network Advertising Initiative Privacilla.org Sharman Networks TRUSTe WhenU Yahoo!
In fact, two of these members were on panel one with the CDT (the DCIA and WhenU).
There are several other members of this "working group":
Center for Democracy and Technology Consortium of Anti-Spyware Technology Vendors Consumer Action CryptoRights Foundation Electronic Frontier Foundation Lavasoft Peter Swire, Moritz College of Law of the Ohio State University2 Webroot Software
Several of these individuals, organizations, and companies certainly do represent the public's interest in some way. Still others are of dubious and questionable value as advocates for the public interest, however, either because their stance on spyware is unknown (Peter Swire) or because their statements to date cast doubt on their ability to fully understand the threat of spyware to the public interest (EFF, CDT).
However one chooses to tally up this list of members, it is clear that this is not a "consumer" group that represents the interests of the public, but rather an industry protection racket whose sole goal is to use the false promise of "industry self-regulation" as a roadblock to strong governmental action that might give consumers relief from the bad practices and intrusive technologies of commercial interests.
As I have noted in several other places (see »www.staff.uiuc.edu/~ehowes/priv-pol.htm#that) "industry self-regulation" initiatives -- including privacy policies, as well as such complementary efforts as 3rd party trustmarks (e.g., Truste and the like) and P3P compact policies -- are best understood not as strong policy initiatives designed to curb unscrupulous business practices, but rather as public relations efforts designed to allow the advertising and marketing industry to continue using its preferred practices and technologies with a minimum of public protest. Rather than reigning in objectionable corporate behavior, these efforts are designed to minimize public resistance to invasive advertising technologies and thus support the ability of commercial interests to use those technologies, of which one of the more "promising" instances is "spyware" or advertising software itself.
These public relations campaigns need the support of other reputable organizations, however, to lend such PR efforts credibility and give the appearance that "industry self-regulation" might be a viable alternative to governmental regulation and consumer protection. And that is the role the CDT appears to be playing on this issue. The CDT's working group gives commercial interests the public relations cover they need in order to protect their technologies and business practices from governmental oversight and regulation. Crucially, the CDT's working group provides these companies with the "positive," "consumer friendly" umbrella they so desperately desire when facing critical scrutiny from the media.
I don't doubt that the CDT would take strong exception to these criticisms of its role to date on the spyware issue. Indeed, I would expect that the CDT would protest that their working group is an attempt to find common ground on an issue that threatens to divide commercial interests from the public and that this "common ground" has a much better chance of building solutions that protect the public's interest without crippling the commercial potential of the internet.
It is difficult to discount the value of finding "common ground" on a vexing issue like "spyware," which implicates the interests of a wide variety of people, companies, and organizations. Given the past results of "industry self-regulation," however, it is even more difficult to take this kind of "self-regulatory" effort seriously. The industry headed off previous attempts to provide consumers with strong privacy protection online by using the promise of "industry self-regulation." As I noted in my comments to the FTC ( »www.staff.uiuc.edu/~ehowes/ftc-comments.htm ):
said by Eric L. Howes: What the industry came up with...has been something less than a smashing success. Faced with serious consumer complaints about privacy violations, the industry essentially declared, "Let them eat privacy policies!" Even the addition of a meager supplementary diet of P3P compact policies and third-party trustmarks has done little to satisfy or assuage consumers' privacy concerns.
There is very little evidence that these earlier "self-regulatory" initiatives have done much of anything to change the way businesses, esp. those in the advertising industry, ply their trade on the Net ( »www.staff.uiuc.edu/~ehowes/priv-pol.htm#that ). If anything, the advertising industry has become even more aggressive in its efforts to swamp consumers with intrusive advertising, turning even now to "spyware" technology itself to convert users' computers computers into fancy direct marketing platforms. Given that sorry history, there is no reason to think these latest examples of "self-regulation" on the "spyware" issue will be any different. It is difficult to believe that companies the industry groups involved in the CDT's "working group" are at all interested in changing their business practices; it is much more believable that they are simply interested in changing the public's perception of their practices and technologies.
That the CDT would support these kinds of "self-regulatory" initiatives is both depressing and unsurprising. The CDT has been a strong supporter of P3P (see »www.cdt.org/privacy/pet/p3pprivacy.shtml ), for example, despite the lack of evidence that P3P has done anything to protect consumers' privacy online some three years after its implementation in Internet Explorer 6.0 (see »www.staff.uiuc.edu/~ehowes/priv-···#ie6-p3p ). Thus, when the CDT then goes before Senate Communications Subcommittee on the issue of "spyware" and advocates a P3P-like standards initiative to address the problems with spyware (see p. 9 of »www.cdt.org/testimony/20040323berman.pdf ), that organization effectively forfeits any claim to be taken seriously as a representative of the public's interest.
Concluding Remarks on Panel 1
At the end of FTC's Spyware Workshop on Monday I happened to chat up someone else in the anti-spyware camp who had been to several meetings on the "spyware" issue, including at least one meeting of the CDT's working group. Her remarks on the Spyware Workshop and those in attendance were striking. She pointed out that the Spyware Workshop was filled with industry representatives and lobbyists of one sort or another. This group of representatives and lobbyists has participated in many other similar events: they have been at the FTC's previous workshops on online privacy; they have been in the offices of Senators and Representatives whenever legislation was being considered that might threaten the interests they represent; they have been at all the Congressional hearings conducted over the past few years on these kinds of issues. Wherever and whenever things were happening in Washington that might threaten their interests, they've been there to ensure that absolutely nothing happened that might stop their clients from doing exactly what they're doing right now.
The first panel at the FTC's Spyware Workshop was a striking example of how successful these interests can be in protecting their preferred business practices and technologies. This outcome was not unexpected. In the first remarks that I made back in February on the FTC's Spyware Workshop ( »Tired of being hijacked? TELL the FTC! ), I noted that
said by Eric L. Howes: the FTC workshop ... could mean that we're at the start of a Federal discussion of the "spyware" problem, which until now has received almost no attention.
What are the potential outcomes of that process? There are three broad outcomes, so far as I can see:
1) Nothing gets done
The FTC wrings its hands over the problem but eventually agrees with the commercial crapware industry that government regulation is a bad thing; that the industry "self-regulation" is much more effective and even preferable; that consumers are being offered "choice" in the form of EULAs, commercial anti-spyware applications, browsers settings, and vendor provided uninstallers; that consumer education is all that is needed from the FTC for the "spyware" problem to solve itself. Everyone involved will give themselves a pat on the back for protecting consumer choice, respecting the beauty of the market, for committing themselves to self-regulation and consumer education, and then they will go home, having done absolutely nothing.
2) A CAN SPYWARE Act
The FTC works with the commercial crapware industry to craft legislation for Congressional adoption. This legislation will distinguish between "spyware" and "adware" by imposing a minimal set of requirements for software installation (a EULA for example). This minimal set of requirements will not stop the usual suspects from doing what they're already doing, but it will allow the industry to proclaim that their software conforms to strict government regulatory standards. It will also allow the FTC to prosecute a small number of the more unscrupulous "spyware" pushers, thus giving the larger players protection from unwanted competition.
3) Real "Spyware" Regulation
The FTC actually responds to consumer outrage (as it did with the Do Not Call legislation) and, to the horror of the commercial crapware industry, pushes Congress to adopt legislation that would place real restrictions on the abusive tactics of the commercial crapware industry.
Outcomes #1 and #2 are the preferred outcomes for the commercial crapware industry. Outcome #3 would be a disaster.
So far, the industry has succeeded in achieving outcome # 1. Several of the news articles written about the Workshop noted just this:
Few solutions pop up at FTC adware workshop »zdnet.com.com/2100-1104_2-5195222.html
What's the Best Way to Stop Spyware? »www.pcworld.com/news/article/0,a···5,00.asp
FTC Urges Industry Solutions to Spyware »www.internetnews.com/xSP/article.php/3342471
FTC commissioner opposes anti-spyware laws »washingtontimes.com/upi-breaking···186r.htm
'Spyware' Eludes Easy Answers »www.washingtonpost.com/wp-dyn/ar···r19.html
The FTC's Workshop is but one step in a longer process, though, and I would urge those who care about protecting consumers and Netizens from obnoxious, invasive commercial crapware not to become too discouraged at the outcome of this Workshop, which was entirely expected. There are still two anti-spyware bills in Congress. Moreover, Utah has passed its own anti-spyware bill, and other states are still considering bills of their own.
I do plan to discuss the remaining five panels, though my comments on those later panels won't be nearly as extensive as these comments on the first panel. The first panel was perhaps the most important of the panels; it was also the most discouraging and enraging.
Comments on, criticisms of, and questions about this long post are, as always, most welcome.
All the best,
Eric L. Howes | |  | Thanks Eric for _all_ of your many efforts, including taking the time for such informative updates as these. It's tough to find the positive in such experiences when they only serve to highlight just how far every aspect of life has been commodified, and democracy distorted. We are no longer even citizens, as much as "consumers" "between the forceps and the stone." So few seem sufficiently aware enough to care, far less to resist.
Do you think the chances of success of taking the Utah statue as a starting point in a net-based campaign to gather support for lobbying for serious legislation are as dismal as they may appear? | | |
|  1 edit | Bobby:
You wrote:
said by Bobby_Peru: Do you think the chances of success of taking the Utah statue as a starting point in a net-based campaign to gather support for lobbying for serious legislation are as dismal as they may appear?
As depressing as some aspects of the FTC Workshop might appear, I'd be wary of drawing hasty conclusions about the prospects for anti-spyware legislation based solely on the outcome of that workshop.
In some respects, the FTC Workshop was one of the spyware industry's stronger cards. They had an agency that is largely not supportive of a regulatory approach to protecting consumers' privacy, and the workshop was designed to showcase the industry's preferred "solution": "industry self-regulation." I'm not so sure that the spyware industry will get such a friendly hearing in other venues.
One thing to keep in mind is that this industry is its own worst enemy. Try as it might to portray itself as a mainstream, consumer-friendly form of advertising, most if not all of its core practices are deeply offensive, and people tend to recoil in horror when they actually understand how this industry does business and treats consumers.
Still worse, the industry is damaging other businesses -- not only businesses who bear the costs of cleaning up their networks, but other businesses who are seeing their web sites and services hijacked and their brand names damaged in the public eye. Still other businesses (OEMs, ISPs, et al) are incurring significant costs as spyware causes trouble for their customers. In quite a number of ways, the spyware industry imposes significant costs on a wide range of businesses and organizations that are not its customers, clients, or primary victims, and these "negative externalities" (that is, bad effects on those outside of the core market transaction) are gaining the industry many enemies.
Thus, I think it instructive that the Utah state legislature passed its anti-spyware bill, whatever flaws some folks may think it has. Stephen Urquhart, State Representative in the Utah House of Representatives, spoke on Panel Six, and he was quite impressive. Urquhart was one of the prime movers behind the Utah legislation, and he wasn't buying any of the flim-flam objections and diversions from the industry, quickly batting them down. He spoke directly and authoritatively to the issues, taking the audience through a PowerPoint slide show of some industry's shadier tactics.
Coming at the end of a long day, his comments caused me to sit back in my seat and think, "Wow! This guy really gets it!" I wish we could clone the guy about 500 times over and slip the clones into office somehow. You'll have to wait for the official transcript (out in 10 days or so) to see those comments in full.
Change won't happen overnight, obviously, and it will require the efforts of many to get the message to legislators and others in a position to do something about the problem. We're at a very early stage in the process of seeking governmental action and redress on this issue.
The spyware industry has powerful allies and proven set of tactics for advancing its obstructionist, anti-consumer agenda. Though such tactics worked in the past to head off previous privacy legislation, I'm much less confident those tactics will work in the future for them on this particular issue.
The industry might succeed in putting off action this year, but the problem will only get worse because this industry simply can't help itself when it sees vulnerable internet users ripe for exploitation. Industry self-regulation won't work, because the vendors involved won't be able to restrain themselves, and public relations campaigns (which is what "industry self-regulation" amounts to) can only do so much to convince people that they are not in fact be used and abused. Moreover, this industry is increasingly being challenged in the court of law, and its legal bills are mounting. Though Gator and WhenU have been largely successful in fending off lawsuits, they are at the point where they face a bleak, expensive future of endless litigation fraught with potentially dangerous, unexpected outcomes. The lawyers for WhenU, Gator, and other similar companies will not lack for billable hours.
Ultimately, this issue will come to a head. It's just a matter of when.
Best,
Eric L. Howes | |
|