how-to block ads
|
|
Uniqs:
7356 |
Share Topic
 |
 |
|
|
|
 Khaine
join:2003-03-03
Australia | reply to eburger68
Re: FTC Spyware Workshop: 1st Impressions Thanks Eric for all of your hard work.
I hope that the FTC in the future will make a clear decision about spyware/adaware/crapware/malware | | |
|
4 edits | reply to eburger68
Hi All:
Before I commence with my review of Panel 4 of the FTC's Spyware Workshop, let me point out that the FTC has posted a few more comments on its web site (#212-17):
»www.ftc.gov/os/comments/spyware/index.html
This new batch of comments includes a response from PC Pitstop to the submissions from WhenU and Gator.
# 216 PC Pitstop-2 (04/27/04)
»www.ftc.gov/os/comments/spyware/···onse.pdf
PC Pitstop points out that Gator's and WhenU's expressed interest in providing consumers forthright notice of installation (see »www.ftc.gov/os/comments/spyware/···-com.pdf and »www.ftc.gov/os/comments/spyware/···tion.pdf ) is completely undercut by PC Pitstop's research results on (unwitting) users of these software programs (see »www.ftc.gov/os/comments/spyware/···stop.pdf and »www.ftc.gov/os/comments/spyware/···stop.pdf ), who are largely unaware of the software running on their computers.
Also of interest in this small batch is the submission from Pest Patrol, which had two representatives at the FTC's Workshop, including one on Panel 2.
# 213 PestPatrol, Inc. (04/23/04)
»www.ftc.gov/os/comments/spyware/···ment.pdf
Pest Patrol's statement is short (4 pages), but it usefully makes several important points, the most noteworthy of which is a call for consumer protection legislation to buttress or supplement other efforts and solutions:
said by Pest Patrol:
We contend that only a combination of consumer education and protection, disclosure through legislation, and active prosecution will provide the answer needed to address the spyware threat, right now. None of these solutions by themselves is enough, and while we advocate and applaud industry self-regulation, we do not believe that it alone will be speedy enough or dramatic enough to address the spyware problem.
Unfortunately, Pest Patrol wasn't on Panel 4, which could have benefited from hearing a sober assessment of the prospects for "industry self-regulation" and "consumer education."
Panel Four: Industry Responses to Spyware – Industry Best Practices and Working
with the Government
Panelists:
X - Brian Arbogast, Corporate Vice President, Identity, Mobile and Partner Services Group, MSN and Personal Services Division, Microsoft Corporation
X - J. Trevor Hughes, Executive Director, Network Advertising Initiative
X - Chris Kelly, Chief Privacy Officer and General Counsel, Spoke Software
X - Fran Maier, Executive Director & President, TRUSTe
X - Andrew McLaughlin, Senior Policy Counsel, Google
X - Jules Polonetsky, Vice President, Integrity Assurance, AmericaOnline, Inc.
U - John Schwarz, President and Chief Operating Officer, Symantec Corp.
Note: be sure to take a look at the photos of Panel 4 as well as the other other panels at Bill Pytlovany's blog page and Declan McCullagh's site:
Declan McCullagh - FTC Spyware Workshop Photos
»www.mccullagh.org/theme/ftc-spyw···r04.html
Bill Pytlovany's Blog from the Workshop
»www.mysteryware.com/blog.html
Industry Technological Reponses
Although I had anticipated that the discussion on Panel 4 would be dominated by talk of "industry self-regulation" through voluntary "best practices," this panel did address one other important topic: technological responses within the industry itself -- esp. among ISPs and the like -- to "spyware." This discussion topic was clearly connected with some of the points made on Panel 2 regarding the cost of "spyware" to ISPs and OEMs, who shoulder significant and burdensome costs because of the technical support that they provide to end users, their customers. While the technological responses developed and deployed by industry are clearly worth discussion, I am still at a loss to explain why the FTC chose to place the panelists who took up this issue (primarily Arbogast of MSN, Polonetsky of AOL, and Schwarz of Symantec) on Panel 4, which was billed as a panel focusing on "best practices." By contrast, technological responses deployed by industry seem to have been a better fit on Panel 5, which directly addressed technological responses more generally.
Several of the panelists on Panel 4 echoed the complaints of those on Panel 2 in calling attention to the costs of "spyware" to businesses. Most importantly, Brian Arbogast not only reiterated the technical support costs borne by service providers like MSN, but he disclosed that roughly 50% of Windows crashes reported to Microsoft through the automated crash reporting facilities of later versions of Windows are attributable to "spyware" and "adware," confirming what those who work in the trenches every day combating "spyware" already know: that such software severely degrades the functionality and usability of PCs, a problem that goes well beyond any privacy concerns that might be raised by such software. Arbogast also previewed the presentation of Microsoft's Jeffrey Friedberg on Panel 5, who would present a short but useful summary of the problems with the installation process for ActiveX controls -- the key component in "drive-by-downloads" of "spyware" and "adware" -- and the changes that Microsoft is making to that process in Windows XP Service Pack 2, to be released in the very near future.
Google's Andrew McLaughlin also had a useful presentation (see »www.ftc.gov/bcp/workshops/spywar···hlin.pdf for a PDF version) in which he put a spotlight on what he billed a "Slimware Hall of Shame." McLaughlin gave several graphic examples of unscrupulous "spyware" or "adware" programs -- including CoolWebSearch and C2 Media's Lop.com -- that effectively "hijack" Google's pages and services on users' computers. McLaughlin noted that this not only damages Google's good name and degrades its brand in the market, but that it also generates a not insignificant volume of email from distraught and confused users who have come to rely on Google's search services. As with the comments of a few of the other panelsists, McLaughlin's presentation would have worked better on Panel 2, which addressed more fully the costs to businesses.
Such was also the case with the presentation and comments of Jules Polonetsky from AOL, who echoed the complaints of Dell, MSN, and Austin Hill (Zero Knowledge) regarding the volume of support calls and problems caused by "spyware" and "adware" among AOL's customers. Polonetsky also gave a short overview of the "spyware" protection to be incorporated into AOL's standard software package (see »www.ftc.gov/bcp/workshops/spywar···tsky.pdf ). Mike Healan notes ( »www.spywareinfo.com/newsletter/a···4/24.php ) that this software is based on Aluria's Spyware Eliminator, a reputable anti-spyware product. This decision by AOL, announced back in January ( »www.washingtonpost.com/ac2/wp-dy···=printer ), mirrors Earthlink's own efforts to provide its customers with "anti-spyware" software (Earthlink uses Webroot's software) and is an important step in distributing effective tools to hapless internet users who are besieged by unwanted advertising software.
As welcome as these contributions from major online entities are, these companies nonetheless have adopted stances and policies towards the issue of "spyware" that are deeply troubling. All three companies signed the NetCoalition letter opposing the Utah anti-spyware bill ( »www.netcoalition.com/index.asp?T···898DF83} ). In that letter the industry questions bill's prohibition against installing software without notice to the user and without providing a conspicuous, usable uninstallation method. This letter, which mirrors the several statements made by the BSA (Business Software Association, a Microsoft-dominated industry group -- see »www.bsa.org/usa/press/newsreleas···logy.cfm and »www.ftc.gov/os/comments/spyware/···mony.pdf ), also defends the use of "adware" and "popups" for targeted advertising, raising serious questions about the commitment of these companies to protecting consumers from unwanted and intrusive commercial software and messages. Indeed, Arbogast and McLaughlin both reiterated their companies' opposition to governmental regulation in their remarks on Panel 4 -- a depressing spectacle, given what both had already demonstrated about the nature of this invasive, destructive "spyware" and "adware."
Although the technological solutions discussed and previewed on Panel 4 are important contributions to the fight against "spyware" and "adware," they cannot be regarded as part of a larger industry response to the problem that would be an adequate solution to the complaints of consumers and internet users. At the very least, all of these companies have an uneven track record on consumer privacy, which should come as no surprise given the fact that these companies are in the business themselves of putting advertising before their customers. Thus, while these companies do have incentives to provide their customers with protection against some forms of unwanted advertising software, they are also in a position themselves to benefit from and exploit such software and advertising, putting millions of consumers in the uneasy position of seeking protection from intrusive advertising by relying on firms who have strong incentives to exploit it. That these firms have already gone on the record to defend certain forms of "adware" does nothing to inspire confidence in their ability to represent or defend the interests of their customers.
Indeed, the largest problem with the industry reponses to "spyware" and "adware" is that, coupled with their publicly expressed interest in defending advertising software, they move us closer to an online world in which consumers are utterly dependent on and at the mercy of paternalistic corporate entities who dominate and control every aspect of their online experiences, effectively nullifying the promise of the internet to provide citizens and consumers with an unprecedented level of autonomy in a communications medium. As the consolidation of large media firms into large oligopolies -- which already own most of the largest ISPs, cable providers, DSL providers, and content providers, not to mention phone companies who control large swaths of the hardware backbone of the internet itself -- proceeds at a breakneck pace, it is not unreasonable to anticipate that we are not that very far from an online world that is divided up into several large corporate fiefdoms. These proprietary online empires could set strict limits on the kinds of content or software allowed over their proprietary networks, structure every aspect of their customers' "online experience" to channel consumers into their own e-marketing services, and exploit advertising software themselves to push unwanted commercial content down on users, even as they provide protection against "unapproved"/"unauthorized" advertising software from other properietary networks and entities.
Indeed, as I remarked in a recent post here on DSLR/BBR ( »What's the *motivation* for hijack-ware? ), advertising software has the potential to be enormously attractive to such large online commercial entities because it represents an incredibly powerful means of "pushing" commercial content down on hapless users and establishing control over their "online experience" in order to advance the proprietary interests of corporations:
said by Eric L. Howes:
(This advertising) technology is promising -- at least from the perspective of the advertising community. This technology -- hijackware, spyware, ad-ware, or whatever you choose to call it -- has an enormous potential attraction for advertisers: the ability to put advertising right on users' desktops, to convert their computers into fancy direct marketing machines, and to capture eyeballs in a way no other form of online advertising has yet been able to do.
Remember the rage in the media some years ago over "push" technology? (And this enthusiasm for "push" technology was largely confined to the media -- ordinary actual users hated it.) "Push" technology promised to solve one nasty problem for traditional media folks -- esp. advertisers -- created by the internet: namely, the independence and autonomy of internet users. Commercial advertisers prefer a captive audience with little autonomy. Despite all the blather about responding to consumer demand, they'd rather control a medium where they can "push" content down to users rather than respond to the demands of users -- it's simply much easier and less expensive to do it that way. "Push" technology died a predictable death because users hated it -- they wanted to be in control of their online experience, not let their use of the internet turn into a high-tech version of TV.
In truth, "push" technology hasn't completely died: it went into hibernation or incubation and was reborn as "spyware" or "hijackware" or "ad-ware" -- whatever you prefer to call it. "Hijackware" is merely the latest incarnation of "push" technology. And it is enormously attractive to advertisers. This kind of software technology allows advertisers to grab eyeballs, so to speak, right on the desktop and push unwanted commercial content down on users who have tremendous difficulty escaping it. For advertisers it's a dream come true: the ultimate captive audience. For normal web surfers it's the ultimate nightmare.
As I said, the technology has a bad reputation right now, and many advertisers have stayed away -- for now. But that's changing. At the moment this kind of technology is more prevalent on porn sites and crackz/warez sites. But remember: it is well known that the online porn industry serves as a kind of "test bed" for new technologies and business practices. Technologies and practices that were once the exclusive province of porn sites just a few years ago are now commonplace on the "mainstream" internet. Moreover, as any number of spyware distributors themselves have argued, spyware could very well become an attractive means for large, "mainstream" online entities to push their commercial messages on users, especially given the problems that have plagued the online advertising industry over the past few years.
We're already seeing signs of this growing interest among "mainstream" commercial entities, as I pointed out above. Not only are outfits like WhenU and Claria attracting investors and clients, but very large and respected online entities have gone to bat against the anti-spyware legislation recently introduced into the Utah state legislature and the U.S. House of Representatives. (...) If you read carefully, you'll notice that once you get past the usual nonsense about "stifling innovation" and so forth their real concern becomes quite clear: that such anti-spyware legislation could kill the hijackware advertising market.
Thus, while such online giants would be expected to provide protection against advertising software from other online entities with whom it had no established commercial relationship, these giants would likely see fit to exploit the technology themselves to force their own commercial content down on users caught within the web of their oligopolistic networks. These online giants already see themselves as gatekeepers of sorts, controlling access to attractively large pools of consumers. In such an environment, the distinction that the industry seeks to make between illegitimate "spyware" and legitimate "adware" would simply be reproduced on a much larger level as these online media giants embedded their own preferred and protected forms of advertising software into the software layer of their networks and took steps to shield their captive customers from competing, external commercial messages. As I concluded in that earlier post:
said by Eric L. Howes:
At the risk of sounding alarmist, I would say that we stand on the threshold of a potentially enormous change in the way normal folks use the internet and the kind of autonomy they have -- the amount of control they can exert over their online experience. There are powerful entities who would prefer to turn the free, open internet into one vast corporate playground -- a high tech version of TV -- and "hijackware"/"spyware"/"adware" could very well be one of the technologies that allows them to realize their radical agenda.
We are not there yet, but the panelists on Panel 4 who discussed the technologies being deployed by large online businesses against "spyware" and "adware" did almost nothing to inspire confidence in their companies' larger, long-term commitment to protecting consumers from invasive advertising and marketing.
"Industry Self-Regulation"
The main focus on Panel 4 was not technological responses from industry, however, but rather "industry self-regulation" through the creation of "best practices" or standards that would enable businesses to interact with internet users and consumers in an ethical manner. As I noted earlier, this is the FTC's own preferred method for addressing the problem of "spyware." Although I've already expressed my contempt for such a concept in numerous other places -- including the first post in this thread where I disparaged it as "oxymoronic doublespeak at its bureaucratic finest" -- the idea of "industry self-regulation" deserves a few more words to help readers understand just what this term actually represents.
All of the panelists on Panel 4 expressed strong reservations about the potential effects of governmental regulation, recommending an industry effort to craft a set of "best practices" as a preferable alternative to legislation and governmental intrusion into the marketplace. Their comments echoed those of earlier panels, esp. Panel 1, which was similarly dominated by industry representatives and apologists. The most vocal supporters of "industry self-regulation" on Panel 4, however, were J. Trevor Hughes of the Network Advertising Initiative -- an industry front group at forefront of industry public relations initiatives to head off governmental oversight and regulation of the advertising industry ( »www.networkadvertising.org/ ) -- and Fran Maier of TRUSTe ( »www.truste.org/ ), the organization whose third-party trustmark initiative was loudly hailed a few years ago as the solution to privacy problems on the internet but whose toothless audit program has largely served as a public relations front for industry exploitation of consumer privacy (see »www.wired.com/news/print/0,1294,···,00.html ; »www.msu.edu/~larose/es2003post.htm ; and »www.staff.uiuc.edu/~ehowes/priv-···uarantee ).
What was remarkable about the discussion of "industry self-regulation" on Panel 4 was its utterly vaporous quality, even allowing for the thin and sorry history of co-opted public policy and corporate malfeasance on which the discussion necessarily had to build. The several enthusiasts for "industry self-regulation" largely repeated the term "best practices" over and over, breathlessly exclaiming over its wonderous potential for facilitating "consumer choice" and avoiding the evils of governmental regulation. What none of them did, however, is suggest what these "best practices" might look like, what they would do, or who would be following them. Nor was it explained what enforcement mechanisms might be put in place to compel compliance, though presumably Truste or some similar initiative might play some role.
Indeed, one of the industry reps on the panel remarked that "best practices" would necessarily have to be pluralistic and flexible -- that there could be no single set of "best practices" because we couldn't impose inflexible solutions on corporations. That kind of talk should leave no doubt in anyone's mind that "best practices" are simply not intended to set high standards for corporate behavior, but rather to allow corporations to make them into whatever happens to be convenient.
In one of the more nauseating moments of the afternoon, FTC Commissioner Mozelle Thompson quipped that the FTC was happy to hear the views of the large companies represented on the panel because they were truly the "elected" representatives of consumers. The corporate reps smiled at this bit of bureaucratic groveling before business interests, as Thompson was in fact chirpily parotting one of Corporate America's most cherished and noxious propaganda lines -- namely that the market is equivalent to democracy, and that the public, democratic institutions in which citizens actually participate (or are supposed to participate) are comparatively illegitimate. On this view, America is a democracy of consumers -- one dollar, one vote -- rather than a democracy of citizens.
Despite the vacuous discussion of "industry self-regulation" on this panel, we actually do have a good idea of what it means based on the history of earlier industry efforts at establishing "best practices." Industry self-regulation largely means that the industry will launch a massive public relations campaign to convince users that its software is not objectionable. The more massive the public relations campaign, the more successful it will be judged to be. This is completely consistent with Commissioner Swindle's estimation of the success of earlier "industry self-regulation" efforts. In his video-taped remarks shown before Panel 2 in the morning ( »www.ftc.gov/bcp/workshops/spywar···ndle.pdf ), Swindle noted:
said by Commissioner Swindle:
The debate that has ensued about spyware reminds me of the early dialogue we had about privacy policies, that was filled with a lot of emotion and calls for regulation. As a result of a continuing and energetic dialogue between industry, government, and consumer groups, industry responded to the public’s demand for greater disclosure and better privacy notices — without legislation. Today, almost 100% of the most frequently visited websites offer some form of privacy notice.
Anyone who is familiar with corporate "privacy policies" will know that these policies have almost nothing to do with regulating actual business practices -- they are merely public relations methods for companies to paint big smiley faces over their privacy-invasive practices ( »www.staff.uiuc.edu/~ehowes/priv-pol.htm#that ).
Notice that on Swindle's account, the mere posting of privacy policies counts as success and proves that a solution to earlier online privacy problems was in fact reached. It does not matter what those privacy policies say or what the behavior of the companies who post them happens to be. In this bizarre world, the public relations campaign is itself evidence of its own success.
If this industry fantasy of "self-regulation" is allowed to preempt strong governmental action to protect consumers, much the same will happen on the spyware issue. It will not matter how many people's computers are being hijacked, how many desktops are trashed with unwanted advertising, or how invasive corporate data gathering becomes -- it will only matter that the industry posts "consumer-friendly" notices on its web sites and in its license agreements to say in so many words: "We're not spyware, we're adware." (See »www.staff.uiuc.edu/~ehowes/priv-···#example for a comparative lesson in what weak protections current corporate privacy policies provide.)
Some would counter that earlier self-regulation initiatives were not just "public relations" campaigns, but were actually substantive efforts to change the privacy landscape by providing improved notice and disclosure, which are important parts of the four Fair Information Practices. But these privacy policies and related efforts simply cannot be regarded as substantive efforts to provide meaningful notice and choice because:
* these privacy policies almost always give the companies an "out" by allowing them to revise them without notice or penalty, rendering these documents well nigh worthless on an informational level;
* like so many of the EULAs used by advertising software companies, these privacy policies often consist of slippery, unreadable legalese designed to bury unpleasant information beneath a mountain of fine print;
* there is no strong monitoring to provide consumers with reliable information about the actual privacy practices of businesses, thus denying consumers the ability to make truly informed choices;
* there are no strong enforcement mechanisms to give potential corprorate offenders effective incentives to abide by their stated privacy practices instead of merely hyping them in an effort to persuade consumers to consent to their invasive software and services.
And indeed we have plenty of examples where companies have in fact: 1) revised their privacy policies when they became too inconvenient; 2) broken their privacy policies with no substantial penalty ( »www.staff.uiuc.edu/~ehowes/priv-pol.htm#that ). In this kind of environment those privacy policies DO NOT serve as adequate notice and disclosure because no consumer could ever be expected to seriously trust the information provided in those policies and make decisions upon them. They are nebulous, and function more as public relations efforts than anything else.
"Industry self-regulation" and "best practices" would almost certainly be just more of the same.
"Consumer Education"
Although billed as one of the topics for Panel 6, "consumer education" was an important part of the discussion on Panel 4 as well, because "consumer education" and "industry self-regulation" go hand in hand. Both are billed as means to improve "notice" and "choice." "Industry self-regulation" ideally means that companies will provide consumers will better notice and disclosure about their privacy practices, and "consumer education" (facilitated and promoted by public bodies like the FTC and private entities like Truste and the NAI) will give consumers the knowledge to make sense of these posted notices and make informed choices and decisions about their online behavior.
As with "industry self-regulation," the term "consumer education" deserves "scare quotes" because its actual meaning diverges significantly from what we mean by "education" in other areas of our lives. For most folks, education means a dynamic learning process or experience through which learners acquire ever more powerful means to make sense of the world and act intelligently within it so as to lead richer, more rewarding, fulfilling lives. At its best, education is an individual and collective endeavor that facilitates empowerment, growth, and community. It's the process through which individuals grow ever more capable of connecting with the world and around them and working productively within their communities for a meaningful life.
For the industry, however, it means something entirely different. "Consumer education" largely means a preferred body of knowledge or world view that the industry attempts to implant in consumers' heads in order to facilitate proper consumer behavior and consumers' good regard for corporations. Put baldly, when the industry talks of "educating consumers about spyware," "consumer education" effectively means two things:
a) "We're not going to change our business practices; you'll simply have to learn how to live with them."
b) "The problem isn't our software, it's what you think about it."
In other words, "consumer education" in this scheme of things isn't really education as we normally understand it; rather, it's public relations and propaganda -- manipulating consumers into the "correct" ways of thinking about the software. And this was made perfectly clear by the several industry representatives on Panels 1 and 4, who insisted over and over that we get it into our heads that their software is "adware" not "spyware." Indeed, one of the representatives on Panel 4 (though just who I am at a loss to recall) let the cat out of the bag when he or she helpfully explained that "we need to educate consumers so that they understand what this software really is." A more naked, forthright statement of just what the industry has in mind for consumers would be hard to come by.
Concluding Remarks on Panel 4
As anticipated earlier ( »FTC Spyware Workshop Panelists - Worries... ), Panel 4 was a depressing display of self-indulgent, corporate public relations. Panel 4 was useful though in highlighting two important issues:
1) It would be a mistake to regard the problem of "spyware" as a fringe issue that involves only dubious, fly-by-night scam artists, rogue web sites, and pushy marketers who nip at consumers' heels when they veer off the beaten track of the "mainstream internet." That may have been true a few years ago, when bewildering varieties of commercial malware began appearing on porn and warez sites and somewhat more polished forms of advertising software began piggybacking on "free software" downloaded from the internet. That time is long past, though, and the problems with "spyware" and "adware" are now better understood as part of a larger story or process that involves the ongoing consolidation of media interests and the threatened takeover of the free internet by corporate oligopolies. No longer a problem on the margins of the internet, obnoxious corporate crapware threatens to become increasingly central to the efforts of large media giants to control their customers' "online experience" and transform the internet into an e-marketing dystopia.
2) It would also be a mistake to regard the FTC's Spyware Workshop as being only or even primarily a public venue for exploring ways to offer consumers the protection they need from unwanted, invasive, destructive advertising software. Indeed, there is a good case to be made that the workshop actually served as a public relations vehicle for corporate interests attempting to get political leverage and mount public opposition against the spate of anti-spyware legislation at the federal and state levels. Coming right at the start of legislative debates over anti-spyware regulation, the workshop gave corporate entities a prominent stage on which to showcase their own preferred non-solution to the "spyware" problem. Put baldly, the FTC Spyware Workshop was less about protecting consumers from unscrupulous advertising software vendors than it was about protecting corporate interests with designs on consumers' desktops from governmental regulation.
Such remarks will undoubtedly raise the hackles of those sympathetic to commercial interests, however, I think this understanding of the workshop was only confirmed this past week by the performance of Commissioner Mozelle Thompson and FTC bureau director Howard Beales before the House subcommittee on Energy and Commerce (see »FTC Goes to Bat for Spyware Industry for the details). The performance of the CDT before the same panel was scarcely less contemptible.
In closing, I should remark that I am surprised that the FTC has not yet posted a transcript of the six panels, though perhaps it will be forthcoming this next week. I am already anticipating that the transcript will underscore the wiliness of human memory, and I will be happy to make corrections and emendations to these posted remarks where my own memory of the workshop has proved to be less than completely reliable.
-----
Note: those interested in an eye-opening discussion of the disturbing changes in the media landscape in this country and around the world -- both online and off -- could do worse than to consult the following works:
* Ben Bagdikian. The New Media Monopoly. Boston: Beacon, 2004. ISBN: 0-8070-6187-5
* Robert W. McChesney. Rich Media, Poor Democracy: Communication Politics in Dubious Times. New York: The New Press, 1999, 2000. ISBN: 1-5658-634-6
* Robert W. McChesney & John Nichols. Our Media, Not Theirs: The Democractic Struggle Against Corporate Media. New York: Seven Stories, 2002. ISBN: 1-58322-549-8
* Lawrence Lessig. Code, and Other Laws of Cyberspace. New York: Basic, 1999.
* Lawrence Lessig. The Future of Ideas: The Fate of the Commons in a Connected World. New York: Random House, 2001.
* Lawrence Lessig. Free Culture: How Big Media Uses Technology and the Law to Lock Down Culture and Control Creativity. New York: Penguin, 2004. ISBN: 1-59420-006-8. Online edition available: »www.helptools.net/netdoc/starthe···p=4&js=1
And for a hilarious, acidic critique of the "market as democracy" line, see:
* Thomas Frank. One Market Under God: Extreme Capitalism, Market Populism, and End of Economic Democracy. New York: Anchor, 2000. ISBN: 0-385-49504-8.
-----
Best,
Eric L. Howes | |
4 edits | reply to eburger68
Hi All:
Before I review the discussion on Panel 5 of the FTC's Spyware Workshop, I want to return briefly to a point that I made in my review of Panel 4 ( »FTC Spyware Workshop: 1st Impressions ), where I remarked that large online corporations like AOL and Microsoft could not be completely trusted to protect the interests of consumers because of their own continuing interest in putting advertising before their customers. These kinds of large online entities often see themselves as gateways between advertisers and the millions of customers who populate their networks and services. When such companies stand to benefit from putting advertising in front of their customers, then there are good reasons to be skeptical of their commitment to protecting consumers from unwanted commercial messages, esp. as the free, open internet becomes an increasingly privatized oligopoly of large proprietary networks owned by a few media firms.
If you doubt the potential dangers of this scenario or arrangement, then you ought to read the following report from Reuters about Microsoft's plans to sell space on a "whitelist" of "legitimate marketers" whose unsolicited commercial messages will be allowed past Microsoft's spam filters on Hotmail and MSN:
»money.excite.com/jsp/nw/nwdt_rt.···20040505
Replace "spam" with "spyware" or even "advertising software" and convert the "spam"/"legitimate marketing" dichotomy into "spyware"/"adware" and you'll begin to get a sense for why I am wary of the efforts of large ISPs to assume the role of protecting their customers from "spyware."
Panel Five: Technological Responses to Spyware
Panelists:
U - Steven Bellovin, AT&T Fellow with AT&T Labs-Research
U - Jeffrey Friedberg, Director of Windows Privacy, Microsoft
P - David Moll, President, WebRoot (maker of SpySweeper)
P - Wayne Porter, Co-Founder and Primary Editor, SpywareGuide.com (distributor of X-Cleaner)
U - Daniel Weitzner, Technology & Society Domain Leader, World Wide Web Consortium; Researcher at MIT
Key:
X - industry/corporate friendly
U - unknown/undetermined
P - privacy friendly
Note: be sure to take a look at the photos of Panel 5 as well as the other other panels at Bill Pytlovany's blog page and Declan McCullagh's site:
Declan McCullagh - FTC Spyware Workshop Photos
»www.mccullagh.org/theme/ftc-spyw···r04.html
Bill Pytlovany's Blog from the Workshop
»www.mysteryware.com/blog.html
A Familiar Discussion
Of all the panels at the FTC's Spyware Workshop of April 19, this is the panel that covered topics that would be most familiar to the readers of DSLR/BBR and other online security forums. The discussion of this panel was dominated by the topic of ActiveX controls -- a special class of browser plug-ins that are the primary components in the automated online installations of "spyware" by unscrupulous web sites and services, installations often dubbed "drive-by-downloads." The panelists discussed the problems with "drive-by-downloads" of ActiveX controls as well as a few potential solutions. While there was nothing overtly problematic or objectionable about the points made by the panelists (unlike Panels 1 and 4), Panel 5's discussion of technological solutions was lacking in some regard.
Microsoft & ActiveX Controls
The most important component of Panel 5 was the presentation by Jeffrey Friedberg of Microsoft, who offered a useful overview of the problems with automated installations of ActiveX controls as well as the changes that Microsoft is making to that download and installation process in Service Pack 2 for Windows XP, due to be released in the very near future. (See »www.ftc.gov/bcp/workshops/spywar···berg.pdf for a PDF version of Friedberg's PowerPoint presentation.)
Friedberg first demonstrated what he called the "normal download experience," which is user-initiated. Those familiar with "drive-by-downloads" of "spyware" will know that so many of the unscrupulous web sites that foist unwanted advertising software on users employ web pages that themselves initiate the download and installation of software, instead of users -- a large part of the reason that users find this software so disorienting and confusing.
Even with this user-initiated "normal download experience," however, there are still significant problems, because the ActiveX Security Warning box provides almost no useful information about the software to be installed or the potential security problems -- a point that I made in my "Anatomy of a Drive-by-Download" ( »www.staff.uiuc.edu/~ehowes/dbd-anatomy.htm ), which was one of the documents that I submitted to the FTC. Friedberg said almost nothing about this lack of useful information, though the gentleman sitting next to me at the workshop (identity unknown) provided a running commentary on Friedberg's presentation, muttering under his breath at such omissions.
Friedberg next presented what he dubbed "some common tricks" that software vendors use when foisting unwanted advertising software on unwitting users of Microsoft's Internet Explorer web browser (Microsoft's browser is currently one of the primary vehicles through which unwanted software is delivered to consumers' desktops).
Trick # 1 was "Program Name More Than Just a Name." MS designed the ActiveX Security Warning box to allow software vendors to insert the names for their programs into the box and provide a link which users can click on to get more information about the program, perhaps even the End User License Agreement. Some vendors, however, have gone well beyond supplying just a name for their software, inserting entire sentences of descriptions and information about their software, which I noted myself in my "Anatomy of a Drive-by-Download" ( »www.staff.uiuc.edu/~ehowes/dbd-anatomy.htm ). I understand why some vendors are doing this -- to supply consumers with more information about their programs right up front, though Friedberg is surely right to note that the ActiveX Security Warning box was simply not designed for this purpose, nor is it the ideal means or method for vendors to supply notice and disclosure about the functionality of their software. Still further, the practice of linking to the EULA through the Security Warning box is problematic because users might not know to click the link and thus may not ever see a license agreement, even though they effectively agree to its terms by clicking through the Security Warning box to consent to the software installation.
Trick # 2 was a "Pop-Under Exploit" in which web pages use a pop-under window (which appears behind the current browser window) that contains Object tags to initiate a "drive-by-download." What is so confusing about this "exploit" for consumers is that the software installation appears as if out of nowhere, with no warning whatsoever. Many consumers mistakenly assume that the software mentioned in the Security Warning box originates from the site they are visiting and mistake it for a plug-in of some sort necessary to view the content of the site. Indeed, so common is it for web sites to require the installation of special programs -- often in the form of ActiveX controls -- that it is completely understandable that many consumers would have gotten into the habit of simply clicking "Yes" whenever such a box appears. Nonetheless, this kind of installation arrangement is a dubious, even deceptive way for vendors to push their software on internet users.
Tricks # 3 and # 4 ("Cancel Means Yes" and "Faux Security Alert") were but two examples of the myriad ways that unscrupulous software vendors and web sites use deceptive GUI elements to trick users into "consenting" to the installation of otherwise unwanted advertising software. These kinds of abusive installation practices are really bottom of the barrel, but they are quite common among the advertising software industry, unfortunately.
Before turning to the changes made in Windows XP Service Pack 2 (SP2), Friedberg noted that IE users can unwittingly role out the welcome mat for unwanted software by lowering the Security settings for the Internet zone from the default "Medium" setting, which at least ensures that users see the ActiveX Security warning box. When users lower the Security settings for the Internet zone, they won't even see the Security Warning box -- unwanted software will simply install on their systems whenever they land on web pages that initiate the download and installation of ActiveX controls.
Friedberg's point was a good one, however, Friedberg didn't fully address the full range of problems with automated installations of ActiveX controls. Even at the Medium setting, users are being tricked into consenting to the installation of software they don't want or need. Still further, there is plenty of software that exploits security holes in Microsoft's software to bypass the Security Warning box altogether.
A better approach to Internet Explorer security is to lock down the Internet zone altogether -- making it at least as secure as the Restricted sites zone -- and add trustworthy sites that require the use of active content (ActiveX controls, Java applets, scripting) to the Trusted sites zone (see »www.staff.uiuc.edu/~ehowes/btw/i···opts.htm for instructions and »www.staff.uiuc.edu/~ehowes/resource6.htm for a small program to automate the configuration process). If users are loath to tighten the Security settings for the Internet zone (which can lead to a raft of burdensome, inconvenient warnings and notices), then they should look into a Restricted sites "blacklist," which adds web sites and domains associated with advertisers and advertising software vendors to the Restricted sites zone (see »www.staff.uiuc.edu/~ehowes/resource.htm for one such list). Once added to the Restricted sites zone, these sites and domains will be unable to perform automated installations of ActiveX controls (among other things).
And, of course, users of alternative browsers such as Mozilla ( »www.mozilla.org/releases/ ), Firefox ( »www.mozilla.org/products/firefox/ ), and Opera ( »www.opera.com/ ) will not hesitate to point out that not only have all of these non-MS browsers offered pop-up blocking for several years now, but they are simply not vulnerable to the ActiveX exploits used by advertising software vendors to foist their software on Internet Explorer users.
Friedberg next turned to the "enhancements" Microsoft has made to Windows XP SP2. First, Microsoft has added a pop-up blocker to Internet Explorer, though it is turned off by default. When turned on, most pop-ups are suppressed and a discrete notice about the blocked pop-up is provided in an information bar just under the URL Address bar. As with Mozilla's built-in pop-up blocker, users have the ability to configure pop-up blocking site-by-site. Given that so many "drive-by-downloads" are initiated by pop-ups, this feature alone will improve the security of Internet Explorer users.
Second, SP2's Internet Explorer will suppress all automated installations of software not initiated by the user. Instead of popping up the well-known Security Warning box, SP2's Internet Explorer will display yet another discrete notice in the information bar near the top of the main browser window, which users can click on for more information and options.
Even when users do decide to initiate the download of ActiveX controls themselves, they will see a new and improved Security Warning box. Of interest is the ability for users to specify that software from certain vendors (identified by the digital certificates used to sign ActiveX controls) always be installed or never be installed. (Internet Explorer currently does provide something resembling this feature through the "Publishers" box on the Internet Options "Content" tab, however, users only have the option to trust software vendors/publishers, not distrust them.)
This feature has enormous potential for anti-spyware activists and vendors, who could build lists of digital certificates from known spyware vendors and add them to the Registry to automatically block the installation of unwanted software, much as the SpywareGuide block list ( »www.spywareguide.com/blockfile.php ) and JavaCool's SpywareBlaster ( »www.wilderssecurity.net/spywareblaster.html ) do already by setting the "kill-bit" for the CLSIDs of known spyware.
SP2's Internet Explorer also comes with a new "Add-on Manager," which gives user a convenient and powerful way to view and control the ActiveX controls that are installed on their systems. (Although current versions of Internet Explorer do provide something like this already through the Downloaded Program Files folder, that functionality is difficult to find for most users and occasionally unreliable.)
All in all, these new enhancements should significantly improve the security of Internet Explorer users who download and install SP2. There are, of course, several important caveats to this picture, which I will return to shortly. Those interested in getting more information about SP2 for Windows XP should consult the following documents and web pages at Microsoft's web site:
Windows XP Service Pack 2 - Security Information for Developers
»msdn.microsoft.com/security/prod···ult.aspx
Windows XP Service Pack 2 - Technical Preview Program
»www.microsoft.com/technet/prodte···iew.mspx
Changes to Functionality in Microsoft Windows XP Service Pack 2
»www.microsoft.com/downloads/deta···yLang=en
or »www.microsoft.com/technet/prodte···sp2.mspx
Windows XP Service Pack 2: A Developer's View
»msdn.microsoft.com/security/prod···psp2.asp
Other Notes About ActiveX Controls
Although Friedberg's presentation was the highlight of Panel 5 and overshadowed almost everything else that was discussed, several of the other panelists did address ActiveX controls.
First, Wayne Porter of SpywareGuide ( »www.spywareguide.com/ ) explained the purpose and functionality of the ActiveX block list distributed by SpywareGuide. JavaCool, it should be noted, makes a similar block list available through his excellent SpywareBlaster program ( »www.wilderssecurity.net/spywareblaster.html ). Both of these block lists "inoculate" Internet Explorer against the installation of unwanted spyware by setting the "kill-bit" on the CLSIDs of known spyware programs distributed as ActiveX controls. Combined with strengthened Security settings in Internet Explorer (see »www.staff.uiuc.edu/~ehowes/btw/i···opts.htm ) or a Restricted sites block list (see »www.staff.uiuc.edu/~ehowes/resource.htm ), such a block list can provide strong protection against the automated installation of unwanted software on the internet, though these block lists must be updated regularly to keep pace with the new varieties of spyware that appear on the Net almost daily.
Second, David Moll of Webroot, maker of the anti-spyware program Spy Sweeper ( »www.webroot.com/wb/products/spys···ndex.php ) as well as the Spy Audit program used by Earthlink ( »www.earthlink.net/spyaudit/ ), discussed one of Webroot's new products. After dissing the "hobbyists" who had dominated the anti-spyware scene/market before the entry of Webroot with its Spy Sweeper product, Moll went on to describe a portable security scanner that Webroot has developed. It's an ActiveX control that users can download and run while on potentially insecure machines (a PC in an Internet cafe, for example). This portable security application scans the entire box for malicious code (keyloggers, system monitors, trojans, etc). Moll billed it as a way for users ensure that boxes they don't control are secure.
The irony of this "security application" was not lost on Steven Bellovin, Fellow with AT&T Labs-Research, also on the panel. Noting that mobile code is one of the biggest security problems in Windows, he quipped that Webroot's portable security scanner was one of the "scariest things" he had yet heard about at the workshop.
And Bellovin was right, of course, because what Moll had unwittingly pointed out is that ActiveX controls can be used to import and run completely foreign code of unknown provenance at the user's discretion on boxes that the user ostensibly shouldn't control.
Indeed, Moll was too focused on promoting his own products, unfortunately. Another of his gaffes was his off-hand remark to the audience that the topic of spyware was one that "none of us here had even heard about two years ago" (or something very close to that effect). DSLR/BBR regulars will know that "spyware" was a topic of discussion here almost four years ago. Where was Moll?
Wayne Porter also discussed Xblock's own X-Cleaner ( see »www.ftc.gov/bcp/workshops/spyware/porter.pdf ), yet another anti-spyware application ( »www.xblock.com/ ) distributed by SpywareGuide.
Misc. Topics
There were a few other topics that were discussed on this "technological solutions" panel. Steve Bellovin addressed the role of firewalls in network security. A few of the other panelists exchanged remarks on improving notice and disclosure during software installations, including P3P-like measures that could be used to provide more information about software functionality to users during installations. To his credit, Daniel Weitzner of the World Wide Web Consortium (W3C), one of the prime forces behind the P3P specification (see »www.w3.org/P3P/ ), expressed his skepticism of such an adaptation of P3P, though he said he wouldn't completely dismiss the idea.
DSLR/BBR readers will know that I have nothing but contempt for P3P as a solution to online privacy problems, esp. its partial implementation in Internet Explorer 6.0's Privacy controls (and I am not alone in this regard). See:
"IE6 & P3P Are Not Panaceas"
»www.staff.uiuc.edu/~ehowes/priv-···#ie6-p3p
"Internet Privacy w/ IE6 & P3P: A Summary of Findings"
»www.staff.uiuc.edu/~ehowes/ie6-p3p.htm
Internet Explorer 6.0 Resources
»www.staff.uiuc.edu/~ehowes/resource5.htm
P3P & Internet Explorer 6.0 Privacy Info
»www.staff.uiuc.edu/~ehowes/info2.htm
To my thinking, regarding P3P as a solution to consumer privacy problems is a bit like thinking the solution to shady car dealerships and crooked mechanics is to give all consumers an 800 page Chilton's Auto Repair manual, with the idea that they could learn about cars and "negotiate" their "choices" with businesses from a strong position.
Problems Not Addressed
As useful and informative as the discussion of technological solutions on Panel 5 was, it failed to address several key issues.
First, all of the discussion of automated ActiveX control installations overshadowed the fact that another major route for the installation of spyware is through software bundling, where unwanted advertising software piggybacks on other "free" software that consumers want. I have yet to see a good proposal for improving notice, disclosure, and choice during the installation of bundled software.
Second, as welcome as Microsoft's Windows XP SP2 will be, its immediate effect will be limited. Many consumers with Windows XP will not know to download and install it. Still further, many consumers are still running older versions of Windows, and MS will apparently not be incorporating the enhancements to IE detailed above into older versions of Internet Explorer for other versions of Windows, leaving millions of consumers vulnerable. Even after OEMs begin pre-installing Windows XP SP2, the percentage of consumers who benefit from these new IE features will be comparatively small, so I don't anticipate that advertising software vendors will dispense with "drive-by-downloads" in the foreseeable future.
Third, none of the panelists discussed the problems with current anti-spyware software, which many consumers find too complex and confusing, and which must be updated constantly in order to be effective against the heavy barrage of new spyware on the Net. As I noted in my comments to the FTC (see Myths #5 and #6 in »www.staff.uiuc.edu/~ehowes/ftc-c···tm#myths ), even computer savvy users who diligently keep up with spyware developments struggle to keep this class of unwanted software off their systems. And anti-spyware vendors themselves often struggle to provide protection against the deluge of new advertising software on the Net.
All of these problems should have been addressed more forthrightly on Panel 5 in order to give the audience and the FTC a realistic picture of the potential uses of anti-spyware technology in the fight to keep users' desktops free of unwanted advertising software.
Concluding Remarks on Panel 5
Panel 5 offered some small amount of hope for users of Windows XP SP2, however, there was nothing from Panel 5 to suggest that radical improvements in anti-spyware technology may be in the offing, which is what is needed if such technology is to play a decisive role in solving the problems with spyware. Anti-spyware technology currently resembles that used by the anti-virus industry for its software. Indeed, I often tell beginning users that anti-spyware applications like Ad-aware ( »www.lavasoft.de/ ) and Spybot Search & Destroy ( »spybot.safer-networking.de/ ) work much like an anti-virus program, only they scan for spyware, not traditional malware (viruses, trojans, and worms).
As such, anti-spyware technology has all the same vulnerabilities and shortcomings as anti-virus software, which has been around much longer, achieved much higher levels of market penetration and consumer adoption, and which is much more mature in some respects. Anti-spyware programs can provide strong protection against unwanted advertising software for a certain class of technically proficient users, but it is hardly a panacea -- at least not in its current forms. Those tempted to place too much faith in anti-spyware technology as a non-regulatory solution to the spyware problem would do well to remember the problems with anti-virus technology the next time a worm or virus swamps the internet and infests the computers of their friends, family, and co-workers, all of whom will probably have an anti-virus program.
On an unrelated note, I should report that my earlier comments on the Center for Democracy and Technology (see »FTC Spyware Workshop: 1st Impressions ) have prompted the CDT to get in touch with me. Not surprisingly, the CDT was less than thrilled with my assessment of their contributions to the fight against spyware. I am currently considering posting a more detailed explanation of my skepticism of the CDT's several actions and positions on the topic of spyware. If I do decide to post, it will be in this thread.
Also, I discovered that my name appears on one of WhenU's web pages:
»www.whenu-advertising-info.com/other.html
On that site -- which is primarily devoted to presenting WhenU's software as "consumer friendly" -- WhenU reprints an article from The New York Times (without attribution, by the way) for which I was interviewed almost two years ago. Presumably WhenU reprinted that article on its site to hold up its own software as an alternative, "consumer-friendly" form of "adware" that is radically different from the "spyware" discussed in that article. That's certainly not a distinction that I would make, though.
In fact, in my comments to the FTC (see »www.staff.uiuc.edu/~ehowes/ftc-c···#typical ) I told the story of having to clean yet another of my students' computers of unwanted software ("spyware," "adware," whatever you choose to call it). One of the more obnoxious programs on that student's box was WhenU's advertising software, though she had no idea how or when it was installed. That's not too surprising, given the results of PC Pitstop's survey of WhenU users, most of whom were unaware of the software on their PCs (see »www.ftc.gov/os/comments/spyware/···stop.pdf ).
There is but one panel left for me to discuss: Panel 6 (Government Responses to Spyware). This was an important panel, given the current amount of legislative activity on the issue of spyware. See the news links on my FTC Spyware Workshop page for more information on the several bills currently winding their way through Congress as well as several state legislatures:
The FTC's Spyware Workshop
»www.staff.uiuc.edu/~ehowes/ftc-spyware.htm
I anticipate that I will be posting my comments on that panel in the next few days.
All the best,
Eric L. Howes | |
4 edits | reply to eburger68
Hi All:
Over four weeks after the FTC's Spyware Workshop on April 19, I will finally review the last of the six panels at the workshop. This review will go beyond discussing the particular comments and points made by the panelists, however, and will discuss the issues surrounding governmental action generally and anti-spyware legislation specifically.
It seems appropriate, then, to note that at the time of this writing legislative pressure is mounting on the spyware industry. Not only has the Utah bill passed, but the first enforcement action under its provisions has been taken by Overstock.com, whose web site was targeted by contextual advertising:
Utah sees first spyware case
»www.theregister.co.uk/2004/05/19···spyware/
The text of the Utah anti-spyware bill can be found here:
Utah Spyware Control Act
»www.le.state.ut.us/~2004/bills/h···0323.htm
Additionally, the California anti-spyware bill moved a step closer to enactment when the California State Senate sent the bill to the Assembly on May 18:
Consumers would have to be told before installation
»msnbc.msn.com/id/5014546/
The text of the California anti-spyware bill can be found here:
California SB 1436: CONSUMER PROTECTION AGAINST COMPUTER SPYWARE ACT
»www.leginfo.ca.gov/pub/bill/sen/···sen.html
As a recent Washington Post article noted, vigorous state action only increases the pressure on lawmakers in Washington D.C. to pass a federal anti-spyware bill:
States Speed up Spyware Race
»www.washingtonpost.com/wp-dyn/ar···y13.html
But state legislators aren't the only ones driving the fight against spyware. Several other actions have been taken by private parties, putting still more pressure on the spyware industry. L.L. Bean recently sued several companies for using contextual pop-up advertising, such as that delivered by Claria's Gator and WhenU's SaveNow software, to target its web site:
L.L. Bean sues pop-up advertisers
»www.cnn.com/2004/TECH/internet/0···dex.html
What sets the L.L. Bean law suit apart from some of the other well-known law suits over contextual advertising (such as that by Hertz and others against Claria) is that the aggrieved party is going after the companies who took out the advertising (Nordstrom's and others), not the company who delivered it (Claria). L.L. Bean isn't the first company to do so, but it is a large, prominent company and its actions should get the attention of the advertising industry.
And still further, Google has stepped forward to insist on better behavior from advertising software vendors. Last week Google booted WhenU from its search listings for engaging in banned behavior ("cloaking") to improve its rankings:
Search engines delete adware company
»news.com.com/2100-1024_3-5212479.html
This "cloaking" behavior was uncovered by Ben Edelman of Harvard University, who has testified in several anti-spyware law suits and who was at the FTC's Spyware Workshop:
WhenU Spams Google, Breaks Google "No Cloaking" Rules
»www.benedelman.org/spyware/whenu-spam/
Shortly after exposing WhenU's "cloaking" tactics on Google, Edelman also brought to light a significant number of copyright violations on WhenU's sites, which improperly reproduce news articles from a variety of news agencies and web sites:
WhenU Copies 26+ Articles from 20+ News Sites
»www.benedelman.org/spyware/whenu-copy/
And, finally, the FTC has indicated that it is interested in pursuing enforcement action under existing federal law against companies that engage in "unfair" and "deceptive" behavior. The Center for Democracy and Technology has already filed one complaint against MailWiper, the company behind the notorious "anti-spyware" product SpyWiper, which used heavy-handed scare tactics and browser hijacking on its web sites to stampede clueless users into accepting "drive-by-downloads" of its software (see »www.cdt.org/privacy/20040210cdt.pdf ). No official action from the FTC has yet been taken in response to the CDT's complaint, though.
Needless to say, spyware is now a national issue, and it will be difficult for the spyware or advertising software industry to avoid reform and action of some kind. Just what those reforms ultimately will be, though, is an open question, and it is not at all certain that the reforms enacted will be useful ones that significantly change the unscrupulous practices of the spyware industry and provide consumers with strong protection against its invasive software.
The FTC's Spyware Workshop of April 19 is best understood as one attempt to get ahead of the legislative reform game and shape its movement and direction by giving the advertising software industry and its allies a prominent platform on which to showcase its own preferred non-solution -- "industry self-regulation." The final panel at the workshop, though, did offer panelists the chance to discuss potential governmental actions, including legislation.
Panel Six: Government Responses to Spyware - Law Enforcement, Consumer
Education, and Coordinating with Industry
Panelists:
P - Jennifer Baird, Legislative Counsel, Office of Rep. Mary Bono
U - Mark Eckenwiler, Deputy Chief, Computer Crime and Intellectual Property Section, Department of Justice
U - Mary Engle, Associate Director, Division of Advertising Practices, Federal Trade Commission
U - Elizabeth Prostic, Chief Privacy Officer, U.S. Department of Commerce
P - Matthew Sarrel, Technical Director, PC Magazine
P - Stephen Urquhart, State Representative, Utah House of Representatives
Key:
X - industry/corporate friendly
U - unknown/undetermined
P - privacy friendly
Note: be sure to take a look at the photos of Panel 5 as well as the other panels at Bill Pytlovany's blog page and Declan McCullagh's site:
Declan McCullagh - FTC Spyware Workshop Photos
»www.mccullagh.org/theme/ftc-spyw···r04.html
Bill Pytlovany's Blog from the Workshop
»www.mysteryware.com/blog.html
A Divided Panel
The panelists on this last panel of the workshop generally fell into two camps: those in favor of new legislation to address the threat of spyware, and those opposed. All the panelists agreed on the need to enforce current laws against "unfair" and "deceptive" practices in order to reign in the more objectionable practices of some advertising software vendors, however, they disagreed as to whether current laws were adequate to the job of making a significant difference in the fight against spyware.
A Strong Call for Legislation
Two of the panelists made clear, unambiguous calls for strong, new legislation to address the spyware issue: Jennifer Baird, Legislative Counsel in the office of Rep. Mary Bono (the principal sponsor of one of the major anti-spyware bills currently before Congress), and Steve Urquhart, State Representative from the Utah House of Representatives (the major force behind the anti-spyware bill that was recently passed in Utah).
Although at times appearing a bit uncomfortable with speaking to such a large audience, Ms. Baird nonetheless made her boss's position quite clear: that new legislation is needed to protect consumers against the invasive, destructive software currently being distributed by the advertising software industry. While she acknowledged the potential benefit of "industry self-regulation," consumer education, and enforcement of existing laws against the more unscrupulous spyware distributors, Ms. Baird firmly and unambiguously insisted that those actions were simply not adequate to the job. Moreover, she rejected calls from the industry and others to study the issue more and allow the industry itself to address the problem. "That's just not how things work in Congress," she said, and went on to describe Rep. Bono's work on her own anti-spyware bill, the text of which can be found here:
HR 2929: Safeguard Against Privacy Invasions Act (S.P.I. Act)
»thomas.loc.gov/cgi-bin/bdquery/z···.r.02929
Rep. Bono's S.P.I. Act is but one of three different bills in Congress right now. The others are:
H.R. 4255 (Rep. Jay Inslee): Computer Software Privacy and Control Act
»frwebgate.access.gpo.gov/cgi-bin···55ih.txt
S. 2145 (Sen. Conrad Burns): SPY BLOCK Act
»thomas.loc.gov/cgi-bin/query/z?c108:s.2145
The Bono bill and the SPY BLOCK bill have both received a fair amount of press coverage, esp. after the House subcommittee hearings a few weeks ago, where several committee members angrily responded to the FTC's insistence that no new legislation was needed:
»FTC Goes to Bat for Spyware Industry
The Inslee bill has received much less attention, though, as it was the last to be introduced (April 30). While all three bills have problems of one sort or another, my initial review of the Inslee bill suggests that it may actually be the most promising (more on which later).
The industry, of course, has stubbornly rejected all calls for legislation, including the first anti-spyware bill of its kind to pass anywhere -- the Utah bill:
NetCoalition Letter Against Utah Anti-Spyware Bill
»www.netcoalition.com/index.asp?T···898DF83}
And see also the Business Software Alliance's statement to a Senate subcommittee back in March:
Testimony of Robert Holleyman, Business Software Alliance (BSA)
On E-SPYING: BAN BEHAVIOR NOT TECHNOLOGY
»www.ftc.gov/os/comments/spyware/···mony.pdf
Thus, it was helpful and encouraging to listen to the remarks of Utah State Rep. Stephen Urquhart, the principle force behind the Utah bill. Urquhart was quite impressive throughout his comments. Demonstrating a firm grasp of the issues, Urquhart rejected the flim-flam objections and diversions from the industry, quickly batting them down. Describing his own experience drafting the Utah bill, Urquhart remarked that he and his colleagues in the Utah House received no useful input from the industry, which simply wanted to kill the bill, as should be apparent from the several industry comments publicly available (see the NetCoalition above, for example).
Notice & Disclosure During Software Installation
Although the majority of his comments concerned the Utah bill, Urquhart did address the question of installation practices -- a critical topic for those struggling to find solutions to the problem of spyware. At the start of his remarks Urquhart went through a short PowerPoint presentation, using screenshots to highlight the inadequate forms of notice and disclosure provided by firms such as WhenU, who shoehorn the long, dense blocks legalese from their EULAs into tiny, confusing scroll boxes in order to pressure users to click through and consent to the installation of software they do not fully understand (see my "Anatomy of a Drive-by-Download" for an extended consideration of this problem: »www.staff.uiuc.edu/~ehowes/dbd-anatomy.htm ).
Given these kinds of installation practices -- which are primarily designed to cover the legal backsides of spyware vendors without actually impacting their installation rates -- no one should be surprised that most "users" of Gator and WhenU are completely unaware of the software on their systems, because the EULAs provided by those companies simply do not serve as adequate forms of notice and disclosure. (See PC Pitstop's surveys of Gator and WhenU users for the numbers: »www.ftc.gov/os/comments/spyware/···stop.pdf and »www.ftc.gov/os/comments/spyware/···stop.pdf ).
Urquhart contrasted these shady installation practices with those used by Google for its popular Google Toolbar ( »toolbar.google.com/ ). As Urquhart pointed out, the difference between Google's installation and the installations of so many advertising sotfware vendors is that Google does not regard the mere presentation of information about software behavior as adequate notice and disclosure. To craft adequate forms of notice and disclosure that actually ensure that users understand the software to be installed on their computers, the installation practices themselves much change. Put another way: we've got to stop regarding the notice/disclosure problem as merely one of the amount and kinds of information provided to users. In addition to the quality of the information provided, we've also got to consider the manner in which that information is presented, and that means taking a hard look at installation practices.
Google has done just that with its Google Toolbar, taking several steps to ensure that users are presented helpful, usable information in an easy-to-read format that simply cannot be missed. Google's installation practices ensure that the notice and disclosure afforded users is not simply full and forthright, but "clear" and "conspicuous."
Interestingly, Google announced yesterday a set of "software principles" that it thinks the industry ought to adopt to guide the provision of notice and disclosure during software installations:
Google defines good manners for adware
»news.com.com/2100-1029_3-5215941.html
Feedback requested: A proposal to help fight deceptive Internet software
»www.google.com/corporate/softwar···les.html
Unfortunately, the majority of those "software principles" address only the amount and type of information provided, not the actual practices through which that information is delivered. While Google's document does insist on "clear" and "conspicuous" notice, it largely neglects to lay out just what that would mean. Indeed, I strongly suspect that companies like Gator and WhenU would claim that they already abide by these principles and point to their EULAs, which are presented to users during the installation of Gator, SaveNow, and their other software applications. In my own analysis of the automated, online installation of C2 Media's Lop.com software (see »www.staff.uiuc.edu/~ehowes/dbd-anatomy.htm ), it was clear that C2 Media's collection of EULAs and privacy policies had in fact covered all of the major functionality and behavior of the software installed, just as Google's "software principles" insist. The problem was that the notice and disclosure of such functionality took the form of a 9400 word EULA that most users could make no sense of and that the EULA was presented in a completely confusing, even misleading, context.
While insisting on "clear" and "conspicuous" notice and disclosure, Google's "software principles" document does not outright reject such installation practices and does almost nothing to spell out what it would consider an adequate alternative. Until such proposals start addressing installation practices beyond the amount and kind of information provided, companies such as WhenU and Claria will continue to be able to insist that they do provide users with adequate notice and disclosure, despite the fact most users don't even know the software is installed on their systems.
And we should be clear that these companies have every reason to resist providing notice and disclosure that would actually allow users to understand the software to be installed on their systems. It is simply not believable that most users would knowingly consent to the installation of software that clearly and conspicuously disclosed the fact that users would be subjected to:
* frequent, annoying, disruptive pop-up advertising on their desktop
* re-configured browser home page and search settings
* monitoring and reporting of their online behavior
* obnoxious new toolbars and other widgets on their browsers and desktops
* significant decreases in browsing speed and system responsiveness
* scads of new icons and links, many of them pornographic, on their browsers and desktops
* outrageous phone bills from premium rate porn dialers
Were advertising software vendors to disclose such functionality and behavior in a truly clear and conspicuous manner, they would be out of business in no time because most folks simply don't want that kind of software. One of the surest indications of this came from WhenU's own Avi Naider on Panel 1, who noted that of 100 million WhenU installation, 80 million had been uninstalled by consumers. In other words, after putting up with WhenU's obnoxious desktop advertising for some amount of time, 80 percent of users finally managed to remove it. And I strongly suspect that over well over 90 percent of the remaining 20 million installations will be uninstalled once those unwitting victims figure out how to give Mr. Naider's software the boot.
Unfortunately, current law -- at least as it has been explained to me -- allows companies like Gator, WhenU, and C2 Media to persist in the fiction that they provide users with adequate notice and disclosure without actually doing so or cutting into their installation rates. Until we have laws on the books that make it clear that merely sticking a 9400 word EULA in front of confused users does not constitute adequate notice and disclosure, the spyware problem will continue, just as Google itself noted when it remarked, "We do not see this trend reversing itself. In fact, it is getting worse."
Enforcing Existing Laws
Unfortunately, three members of Panel 6 rejected calls for new legislation to address these inadequate installation practices, insisting that current law is adequate to the task of addressing spyware problems. Mark Eckenwiler of the Department of Justice, Mary Engle of the Federal Trade Commission, and Elizabeth Prostic of the Department of Commerce all disputed the need for new legislation and claimed that U.S. regulatory agencies have sufficient authority and leeway under current law to go after spyware vendors for "unfair" and "deceptive" trade practices. Each was asked the same question: "Do you think new laws are needed to address the spyware problem?" Each looked straight at the audience and said clearly and firmly, "No."
While it was interesting to hear their discussion of current laws and the enforcement actions that might be possible under those laws, none of these government officials squarely addressed the real problems with the installation practices used by most advertising software vendors. Instead they talked about marginal or tangential cases, including keyloggers and dangerous porn dialers.
Although the examples offered clearly fit the description of "unfair" and "deceptive" trade practices -- or even, in some cases, outright fraudulent, criminal behavior -- these examples were of software and installation practices far different the typical offerings of the advertising software industry. Moreover, as dangerous and destructive as keyloggers and other such system monitoring software applications are, they are a diversion from the central issue in the "spyware" debate: unwanted advertising software, which is installed by companies not nefarious individuals and which is protected behind EULAs and other confusing installation practices. As I noted in my discussion of Panel 2 ( »FTC Spyware Workshop: 1st Impressions ), McAfee's numbers clearly demonstrated that it is advertising software (adware) that is fueling consumer problems with unwanted software, not keyloggers. Thus my frustration with the term "spyware," which continually distracts public officials and the media from the central issues at hand and which leads to "spyware" discussions that meander into handwringing over keyloggers, identity theft, and other outright criminal actions by individuals. Such discussions simply fail to address the largest problems with advertising software and the installation practices used to foist such software on unwitting victims.
The key question is whether the FTC, under current laws against "unfair" and "deceptive" trade practices, will be able to reign in the advertising software industry, which by and large does present users with EULAs. Even a month now after the Spyware Workshop we have heard nothing whatsoever from the FTC to indicate: a) whether it thinks it can pursue enforcement action under current law against companies that use EULAs and other inadequate forms of notice and disclosure; or b) under what criteria and in what situations it thinks it could go after such companies. Although current law does allow the FTC to go after companies for "unfair" and "deceptive" trade practices, the presence of a EULA such as that used by WhenU, Gator, and C2 Media during installation enormously complicates the picture, casting doubt on the ability of the FTC to address the widespread problems with advertising software.
Moreover, while I think it is certainly possible to go after spyware distributors who either fail to use a EULA or who do not disclose certain key software functionality in a EULA, those companies are marginal at best. With the shining exception of CoolWebSearch -- which is in a category all its own ( »www.spywareinfo.com/~merijn/cwsc···les.html ) -- most of the worst actors spring up out of nowhere, wreak havoc on users' computers for a month or so, and then disappear -- probably because their destructive practices angered enough people that they were effectively run out of town. (Howard Beales of the FTC noted himself in recent testimony before a House subcommittee that the worst actors are often fly-by-night con artists who "ride off into the cyber-hills" -- see »cbs.marketwatch.com/news/story.a···t=google .) The larger, more established advertising software vendors endure, however, racking up tens or even hundreds of millions of installations and attracting mainstream advertisers and venture capitalists ( »What's the *motivation* for hijack-ware? ). Until we address the unscrupulous practices of the largest players in the advertising software industry, we will be simply nibbling around the edges of the problem.
The Complexity of Crafting Effective Legislation
Whatever the limits of enforcing current laws against "unfair" and "deceptive" trade practices, the FTC should be encouraged to do so where possible. (See the CDT's "Consumer Software Working Group" document for examples of "unfair" and "deceptive" software practices that might be actionable under current law: »www.cdt.org/privacy/spyware/20040419cswg.pdf )
If we are serious about addressing the problems with spyware, however, then we will need new legislation to tackle the "tough cases" -- the cases in which advertising software vendors do provide some form of notice/disclosure but in a way that is inadequate and that doesn't truly allow most internet users to make sense of the software they encounter on web sites. But crafting legislation to address the problems with spyware can be tricky business, and casual observers of the debate over spyware frequently underestimate the difficulties involved.
All too often I see online comments from people who are justifiably outraged by spyware and who say something to effect that, "It's my computer! If software is installed without my permission, then it should be illegal! How tough is that!"
The answer is: "Actually, it's a bit tougher than you think, and righteous indignation doesn't even begin to tell us how to make spyware illegal." Put quite simply, the question becomes: "How are we to determine what software was installed without your permission, esp. given that most advertising software presents users with a EULA of some sort?"
Even beyond the question of determining what constitutes adequate notice and disclosure, there are other difficulties that involve targeting unwanted software or software behavior in a way that doesn't unwittingly affect legitimate software that users do want. Still further, we must be careful to construct solutions that don't so severely burden legitimate software vendors that their software becomes unbearably complex and difficult for users to install and use.
In the space that remains, I want to summarize some of the key issues in crafting effective anti-spyware legislation so that those following the debates in Washington over the several anti-spyware bills currently before Congress can make sense of what is going on.
Two General Approaches
There are two broad approaches to crafting anti-spyware legislation, each with its own advantages and disadvantages:
1. The "Go-for-the-Jugular" Approach: this approach cuts to the root of the problem and bans certain key spyware practices outright -- e.g., drive-by-downloads, software bundling, and contextual advertising. The advantage of this approach is that it is unambiguous and allows no wiggle room whatsoever for advertising software vendors. The most objectionable and confusing software practices are simply banned outright. Not only does this approach put a stop to the installation practices so often used to bamboozle users into consenting to the installation of otherwise unwanted software, but it outlaws one of the key revenue sources for this industry, effectively cutting off its financial blood flow.
As attractive as this aggressive approach is, it has several significant problems. First and foremost, it risks making the online installation of legitimate software much tougher, because automated installations (drive-by-downloads) are banned. This could prove to be a significant problem for web sites that depend on special software to provide key functionality or content, and webmasters want to make the experience of using their sites as trouble-free and transparent as possible for users.
Second, though it is difficult if not next to impossible to craft language that bans software bundling (e.g., bundling third-party advertising software with popular, "free" applications such as KaZaA) without severely burdening legitimate software makers, whose software packages are inescapably modular and whose installations often include a wide variety of software modules from several different sources, including third parties. A ban on software bundling could make the distribution of completely legitimate software incredibly difficult and burdensome.
Finally, though, it can be anticipated that many legislators will simply be reluctant to ban outright whole classes of software practices, which comes uncomfortably close to outlawing whole classes of technology. While there is certainly a good case to be made that software practices that are ripe for abuse and prone to causing substantial harm to normal internet users ought to be banned -- whatever the ill effects of the ban on innocent software vendors and users -- most legislators will probably prefer another more flexible approach.
2. The Notice/Disclosure/Choice Approach: this approach seeks to improve notice, choice, and disclosure so that users have a better chance of understanding the software that is installed on their systems. The idea behind this approach is that by requiring better notice, choice, and disclosure from software vendors, we can reduce the likelihood that users are surprised by unwanted software which is installed without their full knowledge, consent, and understanding. All of the legislation currently before Congress takes this approach to solving the spyware problem, though in slightly different ways.
The advantage to the notice/disclosure/choice approach is that it is more flexible because it allows all manner of software to be distributed and installed, provided users are given adequate notice of key functionality and the ability to control the installation. The disadvantage to this approach is that if the requirements for improved notice, disclosure, and choice are not crafted properly, we could wind up with a situation that resembles what we have now -- an online environment in which unscrupulous advertising software vendors use forms of notice, disclosure, and choice that don't truly allow internet users to understand the software to be installed on their systems. The advertising software vendors would effectively be able to continue pushing their software on confused users, only now with the defense that they meet strict federal requirements.
As the notice/disclosure/choice approach is the preferred approach used in the bills currently before Congress, I will next lay out some of the key issues and conundrums for attempts to improve notice, disclosure, and choice for users.
Three Classes of Software
Improving notice, disclosure, and choice largely means that we need to reform the installation processes used by software vendors. When we consider problems with installation processes, there are currently three classes of programs:
1. Stealth installers -- programs that exploit security holes and use other rogue, deceptive installation methods to completely bypass all forms of warning, notice, and disclosure or trick users into installations. Still other programs fail to disclose key functionality in EULAs or provide no EULAs whatsoever. The FTC and others (e.g., the CDT -- see »www.cdt.org/privacy/spyware/20040419cswg.pdf ) suggest that most of these "devious" are probably illegal already. These are likely to be the kinds of programs that the FTC finds it easiest to target for enforcement because the nature of their "unfair" and "deceptive" practices is much clearer than others.
2. Obfuscated installers -- programs that do use do present a EULA and/or privacy policy of some sort, but which do so in confusing circumstances, which present agreements that few users can make any sense of, and which exploit users' impatience and/or confusion to pressure them into installation. These EULAs and installation practices are, for the most part, currently considered legally adequate means of notice and disclosure, however, experience and evidence suggest that they are not adequate means for providing users with meaningful notice and disclosure.
3. Clear and conspicuous installers -- installers (like that for Google's Toolbar) which not only disclose key terms and practices, but which also employ carefully constructed installation processes to force users to notice this information. This kind of "clear" and "conspicuous" notice protects users by ensuring that software cannot be installed without their full knowledge, consent, and understanding.
Currently Class 2 is the one giving users the biggest problem because it allows unscrupulous software vendors to exploit users' ignorance and confusion while remaining on the right side of the law. They give just enough notice to stay on the right side of the law, but not enough notice that they damage their installation rates.
Current law makes EULAs a minimally sufficient contract for notice and consent, however, this form of notice and consent is clearly insufficient for most consumers. Junkware vendors cling to this minimal standard because it gives them wide leeway to push installations on hapless users -- through contexts and environments that consumers find confusing -- and secure the widest possible distribution of their software, which is critical to their business models. They then insist that their satisfaction of this minimal legal standard ought to mean that consumers have no legitimate complaint and that nothing ought to be done.
But this is a specious argument. Once cannot argue that the law ought not to change by insisting that one is already following the current law itself. We insist that this minimal legal standard no longer serves its intended purpose, and the complaints of consumers -- not to mention the damage inflicted on individuals, businesses, and organizations -- ought to tell us as much. We insist on a change in the law to reform the installation practices used by software vendors so that they actually provide adequate notice and secure meaningful consent. When installation practices no longer provide for meaningful knowledge and consent from users, the laws governing notice, choice, and consent need to be strengthened to reflect that reality of the environment in which they are used.
The Difficulties w/ Improving Notice, Disclosure, & Choice
As we have seen, any legislative approach to the spyware problem must address the difficult cases -- the software that uses a EULA of some sort to satisfy a minimal legal standard for notice, choice, and disclosure but which doesn't actually provide users the information they need in a usable fashion to allow them to make an informed choice about the software they encounter on the Net. Even when we define the problem in these narrow terms, we are still left a number of issues, some more serious and problematic than others.
1. Spyware vs. Adware
The first issue arises from a distinction that the advertising software industry makes between "adware" and "spyware." On this definitional distinction, "spyware" is said to be unwanted software that installs without providing users notice and disclosure and which gathers and transmits personally identifiable information (PII) without users' knowledge and consent. By contrast, it is argued, "adware" is an innocuous form of advertising software that does provide notice and disclosure of key functionality and which usually doesn't gather and transmit PII -- if it does, full notice and disclosure is provided.
The problem with this adware vs. spyware distinction is that it seeks to use the inadequate forms of notice and disclosure currently employed by advertising software vendors as an excuse to exempt a whole group of software from critical scrutiny. Put another way, the adware vs. spyware distinction essentially declares closed the entire question of whether installation practices currently used by advertising software vendors actually provide meaningful notice and disclosure, when the question ought to remain open to investigation and action. Thus the industry seeks to short-circuit efforts to improve notice and disclosure by insisting that current forms of notice and disclosure used by advertising software vendors are adequate, when we have good evidence to believe they are not.
The industry's adware vs. spyware distinction doesn't help us address consumer complaints with abusive installation practices -- it is merely a dodge. The self-serving distinction between adware vs. spyware urged by advertising software vendors simply needs to abandoned by those serious about reforming installation practices and providing consumers protection against unwanted software.
2. Technology vs. Behavior
A second issue raised by advertising software vendors and the computer software industry more generally is the insistence that we avoid banning or mandating particular technologies and instead focus on reforming behaviors. The distinction between technology and behavior is usually coupled with the observation that it is difficult to define a particular class software known as "spyware."
This distinction between technology and behavior does have something to recommend it. Not only is it completely uncontroversial among most folks that we would not want to ban whole classes of technology, but an unduly narrow focus on particular technologies could actually undermine reform efforts by making notice/disclosure/choice requirements too specific.
For example, a bill that required software vendors to supply an uninstallation entry in the Add/Remove Programs Control Panel applet would neglect to cover other operating systems without that particular applet, making it impossible for some software vendors to satisfy the requirement. Moreover, if the Add/Remove Programs applet were to disappear or change in future versions of Windows, the law would essentially mandate the impossible. By turns, a ban on using certain defined JavaScript commands to hijack web pages would fail to cover other forms of browser hijacking, including those not yet invented.
As useful as such observations about particular technologies are, the more general technology vs. behavior distinction is not as clear-cut as its proponents would have us believe. Is homepage hijacking, for example, a technology or a behavior? Is the use of contextual pop-up advertising a technology or a behavior? Is the addition of porn-related toolbars to users' browsers a technology or a behavior?
I would argue that each of these examples represents behavior in the sense that they are business practices embodied in code. It is not the particular combinations of code that we seek target; it's the larger behavior that such code embodies. I strongly suspect, however, that those who urge a focus on "behavior" over "technology" would prefer a much narrower definition of "behavior" so as to hamstring legislatures and governmental agencies and prevent them from taking action against the more obnoxious business practices of the advertising software vendors.
Moreover, an exclusive focus on "behavior" risks becoming overly broad in its focus (as opposed to the overly narrow focus on "technology"). For example, a simple ban on the practice or behavior of transmitting personally indentifiable information (PII) could ensnare completely legitimate types of software, as Declan McCullagh recently pointed out ( »news.com.com/2010-1014_3-5209091.html ):
said by Declan McCullagh:
A bill sponsored by Rep. Mary Bono, R-Calif., to ban spyware, goes much further. Bono defines spyware as "any software" that "transmits" personal information -- a category that would include any e-mail client (because it transmits a "From: address") and many Unix utilities. FTC officials recently criticized it as a bad idea.
Where a technology-specific focus risks becoming too narrow, a behavior-specific focus risks becoming too broad.
Ironically, the proponents of the technology vs. behavior distinction can't seem to keep the distinction straight themselves, as the quote from McCullagh just above demonstrates. In his article, McCullagh actually uses the above example to illustrate risk of focusing on technology, when the problem illustrated by the example is actually that of focusing on behavior. Moreover, those who advocate going after behavior over technology are prone to making ridiculous claims and comparisons to ward off governmental intrusion. McCullagh quotes Will Rodger of the industry trade association the Computer and Communications Industry Association (CCIA) on the problems of addressing problems with technology through law:
said by Will Rodger:
Sometimes, it feels good to pass these laws, but they're not going to have an effect on the problem...We often see bills come through with the greatest of intentions. But as they say elsewhere, you can't suspend the laws of physics.
But that is a specious comparison. Software technology, as McCullagh just got through explaining to us, is a human creation that is "infinitely malleable and resists being pigeonholed by lawyers." It is not immutable, fixed, and given like the laws of physics, and thus the problems that arise when we use an overly broad focus on behavior that risk ensnaring all kinds of technologies we didn't intend to cover by targeting behavior.
The proponents of the technology vs. behavior distinction use similarly muddled logic when they talk about the difficulty of defining a class of software technologies known as "spyware." On the one hand, as we saw on Panel 1 ( »FTC Spyware Workshop: 1st Impressions ) industry representatives and allies often complain that current legislation is counterproductive because it focuses too narrowly on technology, and that a narrow focus on technology makes it impossible to define a class of software known as "spyware." Much better, they tell us, to focus on "behavior." On the other hand, they are all too happy to define "spyware" in contradistinction to "adware," leading us to believe that perhaps the problem of defining "spyware" isn't quite as difficult as they would have us believe. Indeed, if one is going to urge a focus on behavior over technology, it is difficult to understand why one would then insist on a distinction between adware vs. spyware, which only puts the focus back on technology. The industry's position on these several issues and terms is completely self-contradictory, self-serving, and confused.
Still worse, some opponents of anti-spyware legislation even attempt to play both cards at once, as we saw in the remarks of Howard Beales of the FTC before a House subcommittee recently ( »cbs.marketwatch.com/news/story.a···t=google ):
said by Michael Cowden, CBS Marketwatch:
Beales also argued that the Bono bill didn't provide a workable definition of "spyware." "We need to determine if there is a definable class of software that can truly be called 'spyware,' " he said.
In other words, "spyware" is probably just too tough to define, but Bono bill needs to define it anyway. And what happened to the insistence that we focus on behavior instead of technology, we might well wonder? If the Bono bill were to clearly and satisfactorily define a class of software as "spyware," its opponents would likely complain that it focused too narrowly on technology.
Some proponents of the technology vs. behavior distinction might object that by "behavior" they mean practices that are not technologically specific, and that we ought to craft laws that outlaw fraudulent practices in general and allow the FTC to prosecute companies on a case-by-case basis. Allowing the FTC to prosecute cases under general fraud provisions of the law has the advantage of great flexibility in that it allows the FTC to make fine judgment calls about ever changing installation practices. But such an approach has several downsides, not the least of which is that it could lend itself to arbitrariness, leaving software companies to wonder just what constituted an acceptable set of installation practices. Still worse, though, such an approach is not likely to be useful in addressing the tough cases that we discussed above -- the cases in which companies do supply a EULA of some soft and thus have a presumptive claim to have given users notice and choice.
While it will be more productive to focus on objectionable practices as opposed to specific technologies, the language defining those practices must be carefully crafted so as not to be overly broad.
3. Information vs. Practices
As we have already discussed, it is simply not enough to focus on the amount and types of information provided to users during the installation of software. We must also pay close attention to the particular installation practices through which that information is delivered. If we focus only on defining the amount and type of information provided, many advertising software vendors will simply be able to continue their usual installation practices, most of which simply fail to actually provide clear, conspicuous notice.
4. Objectionable Practices
Contrary to the claims from the industry, most anti-spyware legislation does focus on a core set of problematic behaviors, not particular technologies. It is important that anti-spyware legislation address the full range of objectionable practices and behaviors used by spyware vendors.
a) PII vs. PSI
All the bills target software that gathers and transmits personally identifiable information (PII) -- information that uniquely points to individuals (name, SSN#, address, et al). But anti-spyware legislation should also target software that gathers what we can call personally sensitive information (PSI) -- information about users' behavior on the Net, for example. The gathering and transmission of both PSI and PII represents an intrusion into users' privacy unless such monitoring is clearly and knowingly consented to in advance by users.
The harms inflicted by spyware goes beyond "spying," however, and we need legislation that targets more than just the collection and transmission of PII (or PSI).
b) Desktop Advertising
One of the biggest complaints of spyware victims is intrusive, disruptive advertising on their desktops, usually in the form of pop-up advertising. Some of this advertising is contextual -- that is, determined by the web sites users happen to visit and which are monitored by advertising software such as Gator or SaveNow. Other advertising is not contextual. Whatever the case, advertising that is delivered by client software on users' systems (not by web pages or online services) should be targeted by anti-spyware legislation.
c) System Additions & Modifications
Another big complaint from users involves unwanted additions to their systems -- such as searchbars, toolbars, and animated characters -- and unwanted modifications to key user settings -- such as the default browser home page or search engines. All of these additions and modifications are designed to drive users to use certain online sites and services, and such commercial practices should be targeted by anti-spyware legislation. In targeting such commercial practices, however, anti-spyware legislation needs to be carefully crafted so that it doesn't target all manner of systems changes, which would needlessly ensnare almost every kind of software currently built.
d) Uninstallation Methods
The final serious complaint from spyware victims is that advertising software or spyware often does not provide a reliable uninstallation method. Either the uninstallation method is hidden, or it doesn't work properly. In some cases there is no way to uninstall the software whatsoever. Still worse, some spyware resists being uninstalled, employing tactics to thwart user attempts to remove the software. Anti-spyware legislation should insist on the provision of a conspicuous, reliable uninstallation method.
Some have objected to this proposed requirement, invoking hypothetical horror stories in which software vendors are required to provide uninstallers for software components vital to the basic operation of the system, thus allowing users to unwittingly sabotage their own systems. Still others have wondered about the effect of such a requirement on parental control software, which prevents children from removing the software themselves.
None of these objections can ultimately stand at the end of day as legitimate reasons to avoid requiring uninstallation methods for spyware or advertising software. Not only can we craft the language appropriately -- for example, to require that an uninstallation method be provided to the authorized administrator of the computer -- but we can carve out exceptions for certain classes of operating system software modules. Still better, we can limit the uninstallation requirement to software that uses any of the three previously noted practices (collection/transmission of PII/PSI; desktop advertising; system additions/modifications), thus exempting system-critical software entirely.
5. The Standard Legislative Formula
When we turn to the specific bills in Congress (the Bono bill, the SPY BLOCK bill, and the Inslee bill), we find that they all tend operate with the following formula:
Step 1: Define a covered class of software which employs certain objectionable practices (collection/transmission of PII/PSI; desktop advertising; system additions/modifications).
Step 2: Require certain notice/choice practices for this covered class of software.
Put negatively, the bills ban software which meets the definition of the covered class of software but which does not meet the practices requirements.
Step 3: Provide for enforcement.
The problem with this formula is that it is too rigid in linking Step 1 with Step 2. The key is in linking the covered class (Step 1) with the required behavior (Step 2) in a more flexible fashion. Put another way, when we enshrine certain behaviors in law -- whether those be the behaviors of the covered class of software or the required installation practices for notice/choice/disclosure -- we risk imposing an overly rigid framework on software vendors. We want a framework that that clearly targets certain objectionable practices and requires robust notice/disclosure/choice, but we don't want that framework to be too rigid and inflexible in the face of evolving technology.
As long as anti-spyware bills rely exclusively on an approach that fixes behaviors and practices in law, it will risk targeting legitimate, innocuous software and burdening software vendors and users with unfeasible requirements. Still worse, such legislation could also risk circumvention by unscrupulous spyware distributors who carefully craft their software to side-step the defined, covered class of software or who tailor their installation practices to fulfill the installation practice requirements without providing users with adequate notice, choice, and disclosure.
6. A Better Legislative Formula
Interestingly, the Bono bill ( »thomas.loc.gov/cgi-bin/bdquery/z···r.02929: ) does provide a hint at what might be a better formula for anti-spyware legislation. This alternative approach can be called the "FTC Guidelines" formula.
Sec. 2.(b) of the Bono bill requires the FTC to draft guidelines for notice/choice/consent, however, this section doesn't provide advice or guidance on how the FTC would expand upon the specific standards provided in the bill itself for notice/choice/disclosure practices beyond the very specific requirements of Sec. 2. In other words, its mandate for the FTC is too vague. Sec. 2.(a) suggests a more general requirement for "clear and conspicuous request for such consent or through an affirmative request for such transmission," however, the FTC needs to be given clearer guidelines for establishing required information and practices that meet this standard:
1) The bill should specify that these guidelines for "clear and conspicuous" notice/choice/disclosure be drafted, published, reviewed, and enforced by the FTC through a deliberate, formal, public process. The bill needs to direct that the FTC shall hold a comment and input period on the specific guidelines, publish a set of specific guidelines (which can be more technologically specific because they can be periodically revised), review those guidelines every 6 months or a year, and revise those guidelines as needed. The bill could even mandate empirical research, study, and testing.
2) "Clear and conspicuous" should be fleshed out a wee bit more to indicate what that means in cyberspace. Moreover, the FTC should be given a list of principles/priorities/parameters for determining/drafting that list of guidelines. For example, these principles/priorities/parameters might specify that the guidelines: a) must give priority to ensuring that consumers receive adequate notice and choice; b) must impose requirements that are technologically feasible; c) must not mandate the use of proprietary technologies/closed standards; et al.
3) The bill should specify that revisions to the guidelines be driven by: a) changes in technology; b) indication that notice and choice are not being adequately created by present guidelines; c) indication that the guidelines are putting an undue burden on businesses without getting any clear benefits to consumers, et al.
In other words, the Bono bill's required set of FTC guidelines for notice/choice/disclosure is potentially productive, however:
1) it needs to be fleshed out into a more deliberate public process;
2) it needs to be grounded in and driven by particular parameters, priorities, and principles;
3) it needs to provide for a review, study, and revision process;
4) it needs to be drafted in such a way to hold the FTC's feet to the fire and prevent the usual suspects from crooking the whole process.
Under this alternative approach, the formula for anti-spyware legislation would become:
Step 1: Specify a covered class of software behaviors, but not frame this covered class as "spyware" (collection/transmission of PII, collection of non-PII, advertising, system additions/modifications).
Step 2: Direct the FTC to establish a set of guidelines for behavior/practices, which would cover notice/choice/disclosure. The key would be to specify: 1) a general set of principles/parameters/goals to frame/constrain/drive the drafting of these guidelines; 2) a revision and review process that would inject some flexibility into the guidelines.
Note that this Step 2 differs from the standard Step 2 (above) in that instead of enshrining a set of required practices in law, it allows the FTC to set guidelines for those practices within a certain set of parameters. Put another way, it says: "FTC, you shall have leeway to establish guidelines for required notice/choice practices, but those guidelines must do the following..."
Step 3: Provide for enforcement.
The difference in this arrangement is that Step 2 is not only more flexible, but allows us to avoid the evils of a) too much narrow technological specificity in the law itself; b) collateral damage from an overly broad focus on behaviors that unwittingly wipes out legitimate software.
If this "FTC Guidelines" formula could be made to work, it would allow us to negotiate the Scylla and Charybdis of not regulating particular technologies without being so overly broad in regulating behavior that we unwittingly regulate/ban "legitimate technologies." In fact, we COULD get a bit more particular in regulating technologies, as long as those technologies weren't cast in the stone of law but were rather embedded in revisable FTC guidelines that were guided by broader principles/parameters that were themselves set in the law.
Concluding Remarks on Panel 6
As I noted at the outset of this long discussion of Panel 6, there are many encouraging signs in the fight against spyware. Things are happening both inside and outside of government, and events are moving so swiftly that the FTC's preferred approach ("industry self-regulation," consumer education, enforcement of existing laws) may well be swept aside in the coming months. As encouraging as such a prospect might be, we must not lose sight of the difficulty of crafting effective anti-spyware legislation.
In saying that I am mindful that some may regard this admonition with suspicion. That suspicion is not unwarranted, because the industry itself has attempted to throw roadblocks in front of the legislative process by coming up with endless excuses to oppose anti-spyware legislation. I think it is important to recognize that many of their objections and warnings do have some merit, and we ignore the difficulties they point to at our peril.
Unlike industry obstructionists, however, I think we can work through these difficulties and craft a good bill that provides consumers strong protections against spyware without unduly burdening software vendors or end users. In other words, instead of looking for excuses to reject legislation outright -- which is what the industry is doing -- I think we need to look at the bills currently in Congress, recognize flaws and problems where they do exist, and work to improve the language of the bills to correct those flaws and problems.
Although I have reviewed all three bills before Congress and have specific comments on them, I will save those comments for another day.
Best,
Eric L. Howes | |
 SnowymIRC unix.ro UnderNetPremium
join:2003-04-05
Kailua, HI
kudos:5
 ·Clearwire Wireless
 ·RoadRunner Cable
| Mahalo for the wealth of information in this most recent update. It's great to see that actions relating to "Unfair & Deceptive" trade practices are coming into play regarding crapware.
I believe it's only a matter of time before some State Attorney General ups the stakes & prosecutes with the power & flexibility of the RICO Act.
--
Dave said "By the way, 4294967295 is just another way to write -1". | |
1 edit | reply to eburger68
Hi All:
At the end of my review of Panel 4 of the FTC's Spyware Workshop, I looked forward to the release of the official transcript of the workshop's sessions and noted that:
said by Eric L. Howes:
I am already anticipating that the transcript will underscore the wiliness of human memory, and I will be happy to make corrections and emendations to these posted remarks where my own memory of the workshop has proved to be less than completely reliable.
Having now looked over the entire transcript, I see that I was not wrong in thinking that I would have some corrections to make. Thus, I want to call attention to claims I made about the workshop, its participants, and what was said that were either wrong or not entirely correct. I'll also offer a run-down of the claims that I made that were correct and provide pointers to the appropriate pages from the transcipt where you can find the discussions I was referring to.
Note: the official transcript of the Spyware Workshop can be downloaded from the FTC's site here:
»www.ftc.gov/bcp/workshops/spywar···ript.pdf
The transcript is 298 pages long and lacks bookmarks or hyperlinks. For a more navigable, easy-to-use version of the transcript with bookmarks, use this version:
»www.staff.uiuc.edu/~ehowes/trans···-idx.pdf
**What I Got Wrong...**
First, the errors that I made.
In my review of Panel 1, I complained about the performance of Ari Schwartz of the Center for Democracy and Technology (CDT). I wrote:
said by Eric L. Howes:
Indeed, that pretty much sums up this panel: instead of working to protect consumers, this panel was more interested in protecting themselves. And to its great shame and discredit, the Center for Democracy and Technology (CDT) did almost nothing to challenge that agenda (more on the CDT in a bit).
Having reviewed the transcript of Panel 1, I now must admit that my characterization of the CDT's performance was not entirely fair. Late in the discussion of Panel 1, Ari Schwartz noted that the spyware vs. adware distinction urged by all the other panelists had problems (pp. 38-39):
said by Ari Schwartz:
MR. SCHWARTZ: I do think that there's a reason that Adware has gotten a bad name. And a lot of it has to do with the fact that some companies have basically decided that they will do anything they possibly can to get their software onto the user's computer, and that they don't really -- and we found that a lot of those are Adware companies. (...)
And so therefore, when Marty says, you know, there's no overlap between Adware and Spyware, I don't think that that's true. There is certainly companies that are engaging in bad practices. It's not Adware itself that makes it a bad practice, but we have seen -- Adware companies seem to push the lines by using these affiliate kind of programs in order to make it happen.
Still later, after listening to Avi Naider's response to a question about PC Pitstop's findings that over 80 percent of users were not aware of the software on their systems, Mr. Schwartz summarized the problems with software bundling and concluded (pp. 55-56):
said by Ari Schwartz:
MR. SCHWARTZ: We haven't done our own research on this yet, but, I mean, anything in the 80 percent sounds very high. If it's really that high, there is a major problem.
Now, I wish that Mr. Schwartz had taken a stronger, more unambiguous stance on the question of adware vs. spyware and simply rejected the definitional distinction outright, as several participants on other panels did (see Bryson Gordon's rejection of this distinction on p. 85; see also the discussion on pp. 97-102 of the connection between adware/spyware and traditional malware, Austin Hill's discussion of consumer confusion with adware on p. 106, Ray Everett-Church's questioning of the privacy claims of adware on pp. 120-121, and Steve Urquhart's characterization of adware "victims" on p. 270). And I still have strong reservations about the CDT's work with the Consumer Software Working Group, the CDT's advocacy of P3P-like self-regulatory measures, and its enthusiasm for "industry self-regulation" more generally. But the CDT did not completely cave in the industry representatives on Panel 1, who were all too eager to exempt their software from the discussion of spyware, and I am happy to note that here.
In my review of Panel 4 I decried one of the statements made by a panelist about the "flexibility" of "best practices" and "industry self-regulation":
said by Eric L. Howes:
Indeed, one of the industry reps on the panel remarked that "best practices" would necessarily have to be pluralistic and flexible -- that there could be no single set of "best practices" because we couldn't impose inflexible solutions on corporations. That kind of talk should leave no doubt in anyone's mind that "best practices" are simply not intended to set high standards for corporate behavior, but rather to allow corporations to make them into whatever happens to be convenient.
To my embarrassment, no such comment exists in the transcript of Panel 4, though Panel 4 does include a discussion about preventing any single company from monopolizing the establishment of "best practices" and using them for competitive advantage (see pp. 192-194). Rather, the comment I was thinking of comes from Daniel Weitzner on Panel 5 (pp. 235-236):
said by Daniel Weitzner:
MR. WEITZNER: I'm going to just make one suggestion. I think that best practices are great if they describe a set of practices among which application writers and users can choose.
I think that it would be unfortunate even if a diverse group, an open group, got together and said here are the things we'll allow; here are the things we won't allow. And I don't think you're suggesting that, Jeffrey, but just to be clear. Best practices doesn't mean a single list of the good things and the bad things.
Best practices I think means doing the sort of thing that the now much-mentioned CDT report -- it should have been on Amazon. It would have done really well today -- would identify a set of problematic behaviors and could identify a set of other behaviors and then let people make choices.
I made a similar error in my review of Panel 5, where I discussed a portable ActiveX-based security scanner that I thought had been announced by David Moll of Webroot:
said by Eric L. Howes:
Moll went on to describe a portable security scanner that Webroot has developed. It's an ActiveX control that users can download and run while on potentially insecure machines (a PC in an Internet cafe, for example). This portable security application scans the entire box for malicious code (keyloggers, system monitors, trojans, etc). Moll billed it as a way for users ensure that boxes they don't control are secure.
In fact, that portable security scanner is being developed by X-Block, not Webroot, and was described by Wayne Porter of SpywareGuide.com -- see pp. 216-217 for Porter's discussion of the X-Block portable security scanner.
Finally, in my review of Panel 6 I incorrectly attributed a claim about there being no need for new legislation to cover spyware to Elizabeth Prostic, formerly of the Dept. of Commerce:
said by Eric L. Howes:
Unfortunately, three members of Panel 6 rejected calls for new legislation to address these inadequate installation practices, insisting that current law is adequate to the task of addressing spyware problems. Mark Eckenwiler of the Department of Justice, Mary Engle of the Federal Trade Commission, and Elizabeth Prostic of the Department of Commerce all disputed the need for new legislation and claimed that U.S. regulatory agencies have sufficient authority and leeway under current law to go after spyware vendors. Each was asked the same question: "Do you think new laws are needed to address the spyware problem?" Each looked straight at the audience and said clearly and firmly, "No."
In fact, only Mr. Eckenwiler of the DOJ and Ms. Engle of the FTC were asked that question, and both gave the answer I described (see p. 261 for Mr. Eckenwiler's answer and pp. 262-263 for Ms. Engle's answer). Ms. Prostic was likely not asked the question because, as was noted at the start of the discussion on Panel 6 (see p. 255), Ms. Prostic had left the Dept. of Commerce 4 days earlier for a private law practice.
Finally, when discussing the problem of enforcing existing laws with advertising software vendors who use EULAs, I wrote:
said by Eric L. Howes:
The key question is whether the FTC, under current laws against "unfair" and "deceptive" trade practices, will be able to reign in the advertising software industry, which by and large does present users with EULAs. Even a month now after the Spyware Workshop we have heard nothing whatsoever from the FTC to indicate: a) whether it thinks it can pursue enforcement action under current law against companies that use EULAs and other inadequate forms of notice and disclosure; or b) under what criteria and in what situations it thinks it could go after such companies. Although current law does allow the FTC to go after companies for "unfair" and "deceptive" trade practices, the presence of a EULA such as that used by WhenU, Gator, and C2 Media during installation enormously complicates the picture, casting doubt on the ability of the FTC to address the widespread problems with advertising software.
While it is true, strictly speaking, that the FTC has not offered specific comments on the application of existing law to these "difficult" cases in which inadequate notice and disclosure is provided, Mary Engle of the FTC did address the issue (pp. 291-292):
said by Mary Engle:
MS. ENGLE: And can I just follow up on that from -- from our perspective. The FTC law is pretty clear that, if you're going to give notice to consumers of something, it has to be clear and conspicuous, and we have actually issued a long -- you know, several years ago now, guidance to the online community called "Dot Com Disclosure," that gives you a pretty good understanding of how to make disclosures clear and conspicuous to consumers, and that includes things like, if they've got to click on a button to find out the information, that the button has to be clearly labeled, and also, labeled with the import, so that they know why they should be clicking, not -- not just click here for more info, or something like that. So, from our perspective, just because some term is buried in a four-page ULA doesn't mean that consumers have necessarily given their consent to it.
The "Dot Com Disclosures" document that she refers to can be found here:
Dot Com Disclosures: Information About Online Advertising
HTML: »www.ftc.gov/bcp/conline/pubs/buspubs/dotcom/
PDF: »www.ftc.gov/bcp/conline/pubs/bus···ndex.pdf
That document was the product of another workshop that the FTC conducted back in 2000:
Rules and Guides: Electronic Media Issues
»www.ftc.gov/bcp/rulemaking/elecm···ndex.htm
Just before Engle's remarks, however, Mark Eckenwiler of the DOJ seemed a bit more skeptical of using existing law with these kinds of cases (pp. 290-291):
said by Mark Eckenwiler:
MR. ECKENWILER: I think the point is well taken that, if we were to try to charge somebody with, you know, a Computer Fraud and Abuse Act violation for putting up -- you know, one of these "Do you want to accept this" screens that's, you know, 25 pages long in six-point type, in a very narrow column, totally unreadable, it's not the most attractive circumstance for us to bring a criminal prosecution, remembering that we actually have a Constitutional burden to prove beyond a reasonable doubt that, as I said before, this was under 1030, without or in excess of authorization.
I think the first line of defense in such a case is going to be that the defendant was, in fact, acting within the scope of authorization, and that becomes a kind of ugly jury question. If we're going to pick and choose cases to prosecute, I think we are more likely to take cases like the Jon case, or this newly- indicted case, the Ropp case, where there just -- there's no argument that that was -- there was never any constructive notice. Never even any attempt at notice. This was, you know, purely a -- a clandestine installation.
Those interested in notice and disclosure issues should see the following documents on the FTC's web site:
FTC Policy Statement Regarding Advertising Substantiation
»www.ftc.gov/bcp/guides/ad3subst.htm
FTC Policy Statement On Deception
»www.ftc.gov/bcp/policystmt/ad-decept.htm
FTC Policy Statement On Unfairness
»www.ftc.gov/bcp/policystmt/ad-unfair.htm
So far as I can tell, that is the extent of the outright errors that I made in my review of the six panels at the FTC's Spyware Workshop.
**What I Got Right...**
Throughout my reviews of those six panels I described or summarized a number of comments made by panelists. In the space that remains, I want to provide pointers to the comments I was referring to in the transcript of the workshop.
In my original post about the workshop, I noted:
said by Eric L. Howes:
Panel 1 (definitions of spyware/adware) was as bad as I expected it to be. Dominated by industry representatives or those friendly to the industry, the panel came to a consensus very early (and even noted that they were all essentially in agreement).
Indeed, Avi Naider of WhenU noted early in the discussion (p. 21):
said by Avi Naider:
MR. NAIDER: And speaking for WhenU, I can say that we're quite pleased that there's unanimity on this on the panel in the sense that we're also a member of this working group.
Still later in the original post, I described Mr. Naider's claim that the number of uninstallations of WhenU's software indicated that users were being given adequate notice and choice:
said by Eric L. Howes:
Avi Naider from WhenU pursued exactly this line, claiming that most WhenU users were quite aware of the installed software on their computers. In a somewhat bizarre move, Naider attempted to back this claim up by pointing out that of roughly 100 million WhenU installations, 80 million had been uninstalled. He claimed that the fact that users had uninstalled WhenU demonstrated that they were aware of the installations. There are all kinds of problems with this argument, which I won't bother to cover here.
Suffice it to say it was at that moment that Rob Cheng and Dave Methvin of PC Pitstop (the outfit sued by Gator/Claria last fall, by the way) began distributing their new survey of WhenU users that tells quite another story: over 80% of WhenU users are NOT even aware that the software is installed on their computers.
Here is Mr. Naider's reasoning (pp. 53-54):
said by Avi Naider:
MR. NAIDER: I'm not sure that the PC Pitstop refers to WhenU specifically. I haven't seen that information. But just answering the question in general, there are certainly software applications out there that are not installed with user consent. We would agree to it. Very specifically, it's all in how you do it. (...)
And what I can say very specifically is in the case of WhenU, we've done over 100 million unique installations of our software. Eighty million consumers have removed it.
Now, what does that tell you? What it tells you is that we still have to make sure that the software that we bundle with is better and better value for consumers, because not all consumers want to see advertising supported by software if they don't value the software highly enough.
But what it tells you is that 80 million people can remove it. Clearly, 80 million people means that you have a mass market audience that makes a choice and makes a decision, and consents both upon the installation and consents on an ongoing basis to the software. And by that definition, if you adhere to standards, it's a very consent-driven type of model.
Still further, I called attention to Chris Jay Hoofnagle's discussion of Ben Edelman's finding that WhenU may have violated its privacy policy:
said by Eric L. Howes:
The low point for WhenU must have come during Panel 3, when Chris Jay Hoofnagle from the Electronic Privacy Information Center (EPIC.org) pointed out that Ben Edelman's research, which reported the results of some extremely clever and tenacious packet sniffing, raised the prospect that WhenU was violating its own privacy policy by collecting and transmitting certain personally sensitive data.
You can find Mr. Hoofnagle's discussion of Ben Edelman's research on pp. 151-152.
Also in my original post, I noted that one of my questions was put to Panel 4:
said by Eric L. Howes:
Audience members (including this author) were allowed to put questions to the panelists, but we had to do so via question cards submitted to an FTC employee for vetting. Of the five questions I submitted over the course of the day, one was accepted and read to one of the panels. (I asked how panelists could place such faith in consumer education when 10 plus years of education on viruses and antivirus software has been a demonstrable failure. None of the panelists addressed the question square-on.) Some of the other anti-spyware folks got some of their own questions accepted as well, though the answers they received were often less than responsive.
You can find Panel 4's response to that question on pp. 194-198.
Panel 1
While reviewing Panel 1's sorry performance, I denounced the agendas being pursued by several of the panelists:
said by Eric L. Howes:
A few of the panelists were quite open about what they were attempting to do, stating flatly that "adware is simply different than spyware, and people have got to understand that" -- as if they alone could establish the difference through some sort of declarative fiat without the input or suggestions of others. This was but one of several moments during the day when the arrogant, obstructionist, anti-consumer agendas of those represented on various panels were nakedly on display and visible to all who cared to look.
To understand what I was reacting to, see the comment from Marty Lafferty on pp. 33-34:
said by Marty Lafferty:
MR. LAFFERTY: And I'll just add that there is no overlap between Adware and Spyware. They're mutually exclusive. Adware is presumptively legitimate. It's a terrific business model for providing valuable software to consumers at no cost in exchange for accepting some advertising.
Other panelists made similar claims. I called attention to Avi Naider's similar comments:
said by Eric L. Howes:
One of those commercial interests was WhenU.com, represented by its chief executive Avi Naider, who insisted at one point that the word spyware "was never meant to include software-based advertising...It's pro-consumer; it's pro-competition; it's pro-competitive. (It's) one of the most promising technologies that exists on the Internet today."
Mr. Naider's full comments appear on pp. 32-33:
said by Avi Naider:
MR. NAIDER: Spyware was never meant to include software-based advertising, which is what legitimate Adware is. And very specifically, it's software on a consumer's computer that has been installed at the consent of the computer -- of the consumer, makes it very clear to the consumer what it's doing, can be removed easily by the consumer, and effectively gives the consumer potentially relevant valuable information. Specifically, as the consumer traverses the web, software-based advertising can deliver things like retail coupons. (...)
So in theory, the concept of Adware or software-based advertising is extremely pro-consumer. It's pro-competition. It's pro-competitive. And if done with proper notification, consent, and the consumer's ultimate control over the computer, which is the key point -- and I think Ari said it before -- the consumer has to understand that they have this type of software, has to have the ability to remove the software, has to be made clear when the software is generating coupons and ads. In that case, you have a very legitimate, a very promising technology that actually promises to reduce prices for consumers and to make the Internet a more competitive place. (...)
But it's very important to understand that legitimate software-based advertising, not only is it very clearly not within the definition of Spyware, but it's actually one of the most promising technologies that exists on the Internet today. And if allowed to evolve, it will make the Internet a very, very exciting place over the next decade.
Later in my review of Panel 1, I described how several of the panelists claimed that there would be collateral damage from the Utah anti-spyware bill because of the overbroadness of its definition of spyware. For that discussion, see pp. 23-27 of the transcript.
One of the other common objections to anti-spyware legislation is the requirement for an uninstallation method. I noted:
said by Eric L. Howes:
The Utah bill's requirement of an uninstallation method provoked still more comments from one of the panelists, who warned users to "be careful what you ask for."
The comment I described angered many people, including Mike Healan of SpywareInfo, who wrote that he "wanted to rise up out of my chair at that rubbish" ( »www.spywareinfo.com/newsletter/a···4/24.php ). Here is Mark Bohannon's actual comment (pp. 58-59):
said by Mark Bohannon:
MR. BOHANNON: Ironically, if you give across-the-board ability to uninstall, we have got to have a very strong caveat emptor. Because many things are put in place to insure the continued functionality of software, and that the ability of a consumer -- and because I believe this issue is about more than consumers, but also about business users uninstalling. Just be careful what you're asking for here, because you could, in fact, lead to greater frustration, less security, less ability to manage your personally-identifiable information if it is, in fact, a categorical right to uninstall.
Panel 2
Moving on to Panel 2, readers will be interested in taking a look at both the comments from some of these panelists as well as their presentations, which are available in PDF format.
* Maureen Cushman, Dell: Comments, pp. 69-72.
* Bryson Gordon, McAfee: Comments, pp. 72-76; Presentation ( »www.ftc.gov/bcp/workshops/spyware/gordon.pdf ).
* Austin Hill, Zero Knowledge: Comments, pp. 96-97.
In my review of Panel 2 I also called attention to several other comments from panelists:
* Roger Thompson on the number of new additions to Pest Patrol's database: see p. 76
* Roger Thompson on impact of spyware boot times: see p. 78.
* John Gilroy on consumer difficulties with spyware: see pp. 78-80.
And, as I also noted, Commission Swindle's videotaped remarks were shown to us just before the start of Panel 2 -- see pp. 62-67 of the transcript and »www.ftc.gov/bcp/workshops/spywar···ndle.pdf for a separate copy.
Panel 3
As I remarked in my review of Panel 3, the discussion on this panel was at times a bit dry and abstract. Nonetheless, there were a few noteworthy moments.
Chris Jay Hoofnagle's contributions were esp. useful, as I noted:
said by Eric L. Howes:
Chris Jay Hoofnagle of the Electronic Privacy Information Center (EPIC.org) did manage to bring the discussion around to several useful points, though. First, Hoofnagle was the only panelist at the entire workshop to point the finger at Microsoft for providing the technological means for advertising software vendors to confuse and bamboozle users, install software without their full knowledge and understanding or meaningful consent, and hijack their browsers and PCs. Hoofnagle rightly noted that Microsoft's overly powerful ActiveX technology -- with its integration of mobile code straight into the operating system as well as the confusing manner in which ActiveX controls are installed through Internet Explorer -- opens too many doors for advertising software vendors to walk through and puts users on the defensive.
Mr. Hoofnagle's actual comments on Microsoft (p. 130):
said by Chris Jay Hoofnagle:
MR. HOOFNAGLE: One, I think it's hard to look at this issue without looking at Microsoft. I think it's probably too easy to write to the critical areas of the registry that allow programs to start at boot. Similarly, it's too easy and there is not enough user understanding of the start up folders, which trigger software that you might not want to run.
I also appreciated Hoofnagle's comments on Fair Information Practices:
said by Eric L. Howes:
Second, though, Hoofnagle usefully pointed out that Panel 3's discussion of privacy principles -- or, more formally, Fair Information Practices -- tended to reduce those principles to but two of four (notice and choice), when in fact internet users ought to be extended protection through a full range of Fair Information Practices.
In Mr. Hoofnagle's own words (p. 132):
said by Chris Jay Hoofnagle:
MR. HOOFNAGLE:The Federal Trade Commission defines substantive privacy rights as notice, choice, access, security and accountability.
I think it's very important that we not allow privacy to be watered down to this idea of notice and choice in this debate or in others.
I also contrasted Hoofnagle's constructive comments with those of others:
said by Eric L. Howes:
Hoofnagle's comments were a refreshing change from those of several of the other panelists, who enthused over the privacy initiatives of industry front groups like the Network Advertising Initiative (NAI), as if these organizations could be trusted or expected to do anything substantive to protect users' privacy in the face of voracious industry demands for access to users' desktops -- the next frontier or market in online advertising -- and all manner of data about users and their online behavior.
Ronald Plesser provided one of the better examples of this when he at once dismissed the issue of notice as not that big of a deal and recommended the Direct Marketing Association's (DMA) work on standards for notice (p. 138):
said by Ronald Plesser:
MR. PLESSER: I don't know that I -- I think a notice is a notice. Some are better than others. I think we have seen -- I don't know that I've seen any in the privacy area, in spyware. I've seen some where the computer will serve you ads that they think will be of interest to you. I think those are usually pretty straightforward. When those ads come in, those alternative ads come in, they have little logos on them, or some of them do, that say this is being served to you by XYZ network, and it's different from where you originally went.
I don't think it's all that difficult, but I think there can be notices that can be workable. Again, I think the DMA is working on this stuff. I think it's important. I think one of the principles that we are working on with the DMA is to make sure these notices are obviously out there before the stuff comes onto the system, that the notice is given prior to installation.
"Notice is notice" fairly sums up the industry's attitude toward the problem of inadequate notice and disclosure during the installation of advertising software.
Panel 4
As readers of my comments will have noticed, Panel 4 was chock full of interesting moments.
First, there were two sets of comments by industry representatives on the impact of spyware on businesses:
* Brian Arbogast, MSN: Comments, pp. 161-163
* Andrew McLaughlin, Google: Comments, pp. 163-167; Presentation ( »www.ftc.gov/bcp/workshops/spywar···hlin.pdf )
Second, however, the majority of the discussion of Panel 4 focused on "industry self-regulation" and "best practices." Esp. bad were Commissioner Thompson's comments on the industry generally. I wrote:
said by Eric L. Howes:
In one of the more nauseating moments of the afternoon, FTC Commissioner Mozelle Thompson quipped that the FTC was happy to hear the views of the large companies represented on the panel because they were truly the "elected" representatives of consumers. The corporate reps smiled at this bit of bureaucratic groveling before business interests, as Thompson was in fact chirpily parroting one of Corporate America's most cherished and noxious propaganda lines -- namely that the market is equivalent to democracy, and that the public, democratic institutions in which citizens actually participate (or are supposed to participate) are comparatively illegitimate. On this view, America is a democracy of consumers -- one dollar, one vote -- rather than a democracy of citizens.
Thompson's comments appear in his closing remarks on the panel (p. 198-199):
said by Mozelle Thompson:
COMMISSIONER THOMPSON: At the same time, you have many of those same pressures, because even though you're not elected, they elect you every day when they decide whether to buy or not to buy or to participate or not to participate. And that's where we have the same challenge.
I also called attention to one of the panelists remarks about "consumer education":
said by Eric L. Howes:
In other words, "consumer education" in this scheme of things isn't really education as we normally understand it; rather, it's public relations and propaganda -- manipulating consumers into the "correct" ways of thinking about the software. And this was made perfectly clear by the several industry representatives on Panels 1 and 4, who insisted over and over that we get it into our heads that their software is "adware" not "spyware." Indeed, one of the representatives on Panel 4 (though just who I am at a loss to recall) let the cat out of the bag when he or she helpfully explained that "we need to educate consumers so that they understand what this software really is." A more naked, forthright statement of just what the industry has in mind for consumers would be hard to come by.
In fact, two panelists made comments along that line:
1. Chris Kelly (p. 183):
said by Chris Kelly:
MR. KELLY: So I think that that can go hand-in-hand with a consumer education campaign oriented towards explaining to people the difference between client software and spyware.
2. Jules Polonetsky (p. 184):
said by Jules Polonetsky:
MR. POLONETSKY: I'd comment on a couple of different levels, one on the comparison to some of the other self-regulatory processes. I think one of the reasons why on the network advertising initiative side of the world things end up working is you could really could sit most of the relevant players who were doing this on any scale around the table.
They all were public or soon-to-be public companies that were, you know, part of the civil debate part of the world, and you could say to them, look, you all need to do an awful lot more to explain your business practices, because people have concerns about them. So step up, do more, work harder, bother your customers, make them do more.
Panel 5
The highlight of Panel 5 was the presentation by Microsoft on ActiveX controls and the upcoming changes in SP2 for Windows XP:
* Jeffrey Friedberg, Microsoft: Comments, pp. 201-213; Presentation ( »www.ftc.gov/bcp/workshops/spywar···berg.pdf ).
By far the most entertaining panelist of the day, though, was Steven Bellovin, who quipped at one point, "It seems to be my role here to be disagree with people" (p. 250). One of his more notable disagreements with another panelist concerned the portable security scanner application announced by Wayne Porter of SpywareGuide (but which I mistakenly attributed to David Moll and Webroot). As I reported:
said by Eric L. Howes:
The irony of this "security application" was not lost on Steven Bellovin, Fellow with AT&T Labs-Research, also on the panel. Noting that mobile code is one of the biggest security problems in Windows, he quipped that Webroot's portable security scanner was one of the "scariest things" he had yet heard about at the workshop.
And Bellovin was right, of course, because what Moll had unwittingly pointed out is that ActiveX controls can be used to import and run completely foreign code of unknown provenance at the user's discretion on boxes that the user ostensibly shouldn't control.
Mr. Bellovin's actual comments (p. 250):
said by Steven Bellovin:
MR. BELLOVIN: I think there are a number of mistakes we can point to, but to me the biggest mistake the industry made was deploying mobile code without adequate safeguards.
The scariest thing that I heard today was it's possible to write an ActiveX control to scan a machine for spyware. You have a control that's that powerful that can roll with those permissions, my God, what else could it have done?
As I noted, Daniel Weitzner had useful comments on P3P-like solutions to spyware:
said by Eric L. Howes:
To his credit, Daniel Weitzner of the World Wide Web Consortium (W3C), one of the prime forces behind the P3P specification, expressed his skepticism of such an adaptation of P3P, though he said he wouldn't completely dismiss the idea.
Mr. Weitzner's actual comments (pp. 231-232):
said by Daniel Weitzner:
MR. WEITZNER: I have to say, I'm slightly on the fence here about how much a labeling approach can really accomplish when it comes to spyware. And I think it can probably help some, but the history of trying to label things on the web I think is really instructive here. I think if you look at both privacy on the one hand and things like pornography and spam on the other hand, you see the sort of limits and benefits of labeling.
See pp. 228-235 for the complete discussion of P3P-like anti-spyware solutions, problems w/ labeling schemes, and the similarity of problems with spyware and spam.
Panel 6
Though Panel 6 was a long time in coming (or so it seemed at the time), it too had its noteworthy moments.
In my review of Panel 6 I called attention to the remarks of Jennifer Baird of Rep. Mary Bono's office:
said by Eric L. Howes:
Although at times appearing a bit uncomfortable with speaking to such a large audience, Ms. Baird nonetheless made her boss's position quite clear: that new legislation is needed to protect consumers against the invasive, destructive software currently being distributed by the advertising software industry. While she acknowledged the potential benefit of "industry self-regulation," consumer education, and enforcement of existing laws against the more unscrupulous spyware distributors, Ms. Baird firmly and unambiguously insisted that those actions were simply not adequate to the job. Moreover, she rejected calls from the industry and others to study the issue more and allow the industry itself to address the problem. "That's just not how things work in Congress," she said, and went on to describe Rep. Bono's work on her own anti-spyware bill...
Ms. Baird's actual comments (pp. 266-267):
said by Jennifer Baird:
MS. BAIRD: Another thing has been -- another thing that we heard from industry has been, you know, self-regulation is the answer, but we can't really come up with best practices yet.
So, in other words, what we're hearing is, this is a problem, it needs to be solved, but we don't know how, so just hold on.
And that's not how it works in Congress, and, you know, as a member of Congress, my boss has the responsibility to do all she can to protect her constituents from downloading onto their computer that they use for personal, you know, banking and for credit - - you know, buying things through their credit card and so on and so on. She has the responsibility to make sure that they have confidence when they're using their computer, and that that information won't be shared.
And another thing that, of course, has been said is, legislation is just the wrong answer. This can only be done through self-regulation.
I would say that we can't sit around and just think about it and talk about it for days and nights in a year, we do have to act. But that being said, I do think that industry self-regulation is a very important aspect of this, and my boss understands that legislation by itself will not stop the problem, but it is a step in the right direction. It is a step in the right direction that people know what they're downloading onto their computer before they download it.
I also applauded the remarks of State Rep. Steve Urquhart of Utah:
said by Eric L. Howes:
Thus, it was helpful and encouraging to listen to the remarks of Utah State Rep. Stephen Urquhart, the principle force behind the Utah bill. Urquhart was quite impressive throughout his comments. Demonstrating a firm grasp of the issues, Urquhart rejected the flim-flam objections and diversions from the industry, quickly batting them down. Describing his own experience drafting the Utah bill, Urquhart remarked that he and his colleagues in the Utah House received no useful input from the industry, which simply wanted to kill the bill, as should be apparent from the several industry comments publicly available (see the NetCoalition above, for example).
Here are two choice quotes from Mr. Urquhart:
1. p. 274:
said by Steve Urquhart:
MR. URQUHART: I mean, constituents, they demand results. They're sick of this stuff. And so I've heard a lot of handwringing here today, and I think it is great that we do need best practices, we need education, we need technology, but we also need regulation.
I mean, how do you stop bad guys? You have a neighborhood watch? You have education to pick up your newspapers. Don't leave them sitting around. You have technology, you have alarms and bars, but at the end of the day, you've got to have laws and a cop on the beat. And so we've put a cop on the beat.
2. pp. 287-88
said by Steve Urquhart:
MR. URQUHART: Yeah, let me point out that, in Utah, like in most states, we don't write our laws into - - in stone. We don't chisel them in stone, we write them on paper, and so, we have made it plenty clear to industry, and to all parties, that we wanted their input.
And about the only input we got during the sessions was, don't do it. Let -- for Heaven's sake, let the feds deal with this, and, you know, that -- that's not acceptable to my consumers. And so, this was brought forward by an industry member, saying put in an operating system, and currently, in the law, they could argue that this is a vital component of the operating system, then it would be exempted out.
For more of Mr. Urquhart's comments, see pp. 269-275 and pp. 287-290.
**Errors in the Transcript**
Yes, the transcript itself does contain a few errors that readers should be aware of, though most of them are minor.
p. 78: here Roger Thompson of Pest Patrol is misidentified as "Commissioner Thompson." (Commissioner Thompson did actually offer remarks just after Panel 3 and went on to host Panel 4. The Thompson on Panel 2, though, was Roger Thompson.)
p. 218: "sharistic" should be "heuristic"
p. 223-224: the transcript misattributes David Moll's comments to Daniel Weitzner. That this is so should be clear from context, because the remarks cover the partnership between the maker of Spy Sweeper and Earthlink (misspelled "Earthlinks" in the transcript).
p. 226: "wy" should be "way"
pp. 257-258: these two pages contain a series of interconnected errors of attribution. The transcript attributes question on p. 257 ("Could you just sketch out for us,...") to Mary Engle by tacking on the question to the end of Engle's response to a previous question, and the answer ("Well, to bring a case,...") to Beth Delaney, who was actually the host asking the questions. The next question on p. 258 ("Mark, we'd like to hear about...") then bleeds into the end of the response and is correctly attributed to Beth Delaney, however, the preceding response is Engle's. In other words, 257-258 should have question by Delaney, response by Engle, question by Delaney. Instead what we get is question by Engle (at the end of her response to a previous question), a response by Delaney, and then a question by Delaney.
There are undoubtedly other minor errors, but those are the ones I spotted.
**Concluding Remarks**
In going through the transcript for the FTC's Spyware Workshop I happened across a number of interesting comments that deserve attention, and I'll be posting a list of them in the next few days. You can think of that list as my own selection of key highlights from the workshop for those who don't have the time or inclination to plow through all 298 pages of the transcript.
Also, the FTC has finished posting comments from the public about "spyware," and the comment period is now closed (the last day to submit was May 21). Here's a short breakdown of the comments posted in the past few weeks (#212-359):
# 212-349: these are mainly short comments from consumers, many of them angry and frustrated at spyware and, occasionally, the FTC itself
# 350-359: the last ten submissions include a number of comments worth noting.
(Note: see »A Guide to Spyware Comments Filed w/ the FTC for pointers to earlier comments posted to the FTC's site.)
# 350 Recording Industry Association of America (04/23/04)
»www.ftc.gov/os/comments/spyware/···peer.pdf
The RIAA weighs in with a hefty document linking spyware to P2P file sharing software.
# 351 Lavasoft (05/17/04)
»www.ftc.gov/os/comments/spyware/···soft.pdf
Lavasoft, makers of Ad-ware, provides straightforward answers to the main questions on the FTC's agenda.
# 352 Association of Shareware Professionals, Inc.-2 (05/20/04)
»www.ftc.gov/os/comments/spyware/···ff-2.pdf
In its second submission this industry organization dismisses the purported difference between adware and spyware.
# 356 The National Network to End Domestic Violence (05/21/04)
»www.ftc.gov/os/comments/spyware/···viol.pdf
Providing an object lesson on the problems with the term "spyware," which leads people to confuse advertising software with system monitoring programs, this non-profit organization advises the FTC on why keyloggers are a threat to battered women.
# 357 Webroot Software, Inc. (05/21/04)
»www.ftc.gov/os/comments/spyware/···ware.pdf
Like Lavasoft, Webroot addresses all the main questions on the FTC's announced agenda.
# 358 WhenU.com (05/21/04)
»www.ftc.gov/os/comments/spyware/···ents.pdf
A "must read": WhenU finally replies to Ben Edelman's finding that WhenU's SaveNow software transmits URLs in violation of its privacy policy (see »www.benedelman.org/spyware/ftc-031904.pdf ) and PC Pitstop's survey of WhenU users, which revealed that over 80 percent of WhenU "users" were unaware of the software installed on their systems (see »www.ftc.gov/os/comments/spyware/···stop.pdf ).
Edelman has already posted a response to WhenU's reply on his web site:
WhenU Violates Own Privacy Policy
»www.benedelman.org/spyware/whenu···response
PC Pitstop will undoubtedly be posting a response of its own.
Having looked over WhenU's reply, I must say that WhenU's attorney isn't the sharpest knife in the drawer. Her argument against Edelman's findings is completely inadequate, as she seeks to downplay the plain language of the EULA itself, which WhenU was forced to revise in the past few days. Moreover, her reply to PC Pitstop's survey effectively supplies the reasoning necessary to underscore the ultimate point of PC Pitstop's survey. In other places, she contradicts herself, misstates or misdescribes PC Pitstop's survey, and simply ignores evidence when it isn't convenient. All in all a sorry performance.
# 359 Howes-2 (05/21/04)
»www.ftc.gov/os/comments/spyware/···es-2.pdf
My response to C2 Media's reply to its critics -- see # 181 Lucas-2 (04/14/04) ( »www.ftc.gov/os/comments/spyware/···cas2.pdf ) -- is the very last posted comment for the workshop. I should have an HTML version of this up on my FTC Spyware Workshop page in the next few days:
The FTC's Spyware Workshop
»www.staff.uiuc.edu/~ehowes/ftc-spyware.htm
Best regards,
Eric L. Howes | |
urankjj
join:2004-05-31
Forest Falls, CA | reply to Link Logger
spyware on my pc is certanly the begining of the end of my on-line purchasing, you can `count^ on it. | |
|
