/ 27 October 2000

Software that ‘spies’ on you

Rupert Neethling Invasion of privacy is a hotly debated topic on the Web. Which is not surprising, since surfers’ personal details are of interest to anyone from government agencies to marketers. This may not be a big deal to many users, but it is the debate between privacy advocates and marketers, in particular, which is helping define what is acceptable behaviour in terms of respecting user privacy, and what is not. Much of this debate has focused on cookies – until recently. Cookies, or electronic markers that identify you on return visits to the websites that “fed” them to your computer, are regarded nowadays as doing more good than harm. They play an important role in personalising the user’s experience of a site, especially when visiting search portals or news sites.

While agreeing on this, however, privacy watchdogs have pointed out that cookies can also be used by marketers to identify users as they surf from one site to the next. Thanks to cookies, marketers can build up individual profiles of users in order to present them with better-targeted advertising – and, sometimes, advertising off the Web as well. The problem, say the privacy advocates, is that such behind-the-scenes monitoring can happen without the user’s informed consent. But whether or not one feels sufficiently “invaded” to make an issue out of cookies, there is a somewhat newer phenomenon that could make a greater impact on the average user’s privacy.

The past two years have seen a huge increase in software packages that used to come with a price tag but that are now free thanks to being supported through advertising. The advertising, which resembles the banner ads found on many websites, is built into the program interface – hence the term “adware”. In most cases, the only legal way to remove the ads is to buy the program.

So far, so good. On the surface, everyone from the advertiser to the programmer to the user benefits from this arrangement. But there is more to most adware than meets the eye. Dial-up users with adware on their Windows computers have probably been mystified why, when they’re online but not surfing or checking their mail at a particular moment, the green monitors in their system trays start flashing by themselves. What’s probably happening is that the adware is talking to its sponsors, reporting back on the ads the user has responded to and downloading more ads. Some programmers and privacy whistle-blowers have argued that, as benign as such an activity may be, it generally happens without the user’s knowledge. Worse, the user is unable to monitor exactly nnnwhat information is being sent and received by her or his computer. Worse yet, the “phone-home” nncomponents of nnsome adware programs can remain behind on users’ computers nnnneven nnafter such programs have nnbeen uninstalled. Hence the term “spyware”.

As alarming as this nnmay sound, nnit would be wrong to deny adware per se its place in the sun. Ad-sponsored software, like cookies, has the potential to do more good than harm. Collectively, adware packages add immense value to the computing experience. And the more extreme cases of so-called spyware usually meet with a concerted outcry from users, which in some cases has prompted the distributors to make new versions of controversial packages less invasive, or at least less secretive. (It is almost certainly continued pressure that recently led Aureate/Radiate, one of the world’s biggest adware distributors, to announce that they will be giving users more control over the “phone-home” process.) The bottom line is that users can inform themselves about software distributors’ privacy policies (usually available on their websites) and read the EULA (End User Licence Agreement) to which they are required to agree when installing a program. Also, since it is not unknown for distributors to get a little vague about how much of your online life you’ll actually be sharing with them, it wouldn’t hurt to check up on a program at SpyChecker.com and read what other users have to say about it on the OptOut and alt.privacy.spyware newsgroups. There is, in fact, a positive upshot to educating oneself about specific adware and/or spyware programs. In the vast majority of cases, informed users may find that the trade-off between the lack of a price tag and the information they give up (basically their demographic profile and which ads they click on) is perfectly acceptable. That said, however, wilful ignorance on the user’s part is always going to benefit unscrupulous marketers.