The spy who loves you

LOOKING TO SCORE something for nothing on the Internet? You may discover too late that there’s a price to be paid for the spyware that winds up on your system.

Even during the dot-com boom, the “free” Web services provided us with many examples of why you really do need to look a gift horse in the mouth. With today’s emphasis on profitability, though, the e-business model of choice increasingly appears to involve building a revenue stream around spyware agents that users download unknowingly. Internet services of various types are cutting deals with spyware companies to include the agents in customer downloads. In turn, the spyware companies can sell customer data they collect to those who want it for marketing, billing, or copyright infringement-detection purposes.

At least once a week, The Gripe Line gets a spate of messages about yet another piece of spyware that readers have just discovered on their computers. “I’ve been chasing a mysterious event on my new Win2K Server and found a thoroughly obnoxious marketing ploy,” wrote one reader. Noticing a mystery program that had suddenly appeared in his Java Console, the reader discovered it was sending log files to an obscure spyware company (which we’ll try to keep that way by not naming). “So I wrote them asking for help in identifying the product or site that installed their [software] and requested instructions to remove it from my system. Their response was to modify my hosts file to redirect their messages back to my server! I can’t believe this level of audacity. … I want this trash off my server!”

Traditional spyware vendors with ad-server or browser-tracking agents have certainly been more aggressive of late. This was amply demonstrated recently when it was discovered that one agent was, upon installation, scanning the system and removing Ad-Aware, the spyware detection program from Lavasoft. Even more aggressive, however, is an emerging class of spyware agents that are often downloaded when using popular Napsterlike file-sharing programs.

“I recently had a problem with a spyware program that was installed along with Audiogalaxy Satellite,” wrote a reader who, after discovering the agent (which is apparently no longer downloaded with Audiogalaxy), followed the removal instructions that came with it. “What the instructions did not say was that if the spyware were uninstalled the computer would no longer be able to connect to the Internet for Web or e-mail use. … I call this kind of software ‘maliciousware’ because it seems that the company behind it has said, ‘Fine, if you want to uninstall our software we’re going to make your system unusable.’ ” As is typical, the spyware company claimed that all users opted in to download their agent by accepting their license agreement, but the reader was certain he had not been presented any warning of the agent’s existence. “Even assuming there was a request for permission buried somewhere in the fine print, that still does not excuse the results.”

Given the nasty things we’ve seen lurking in license agreements from Microsoft and other big fish, it should come as no surprise that the spyware companies have horrors buried in their fine print. One company that has ceased to be obscure, because of what its license terms revealed about its intentions, is Brilliant Digital Entertainment. Some 20 million people are estimated to have downloaded Brilliant’s ad software in conjunction with the Kazaa file-sharing program. Most were probably unaware they were downloading Brilliant’s software at all, much less that the easy-to-miss license agreement gives Brilliant “the right to access and use the unused computing power and storage space on your computer/s and/or Internet access or bandwidth.” In other words, Brilliant’s agent also contains technology that allows the company to use your computer for its purposes.

Brilliant officials have publicly acknowledged the company’s plans to employ this technology in forming what they call the Altnet resource-sharing network, but they have promised that only the computing resources of those who explicitly elect to participate will be used. Those 20 million folks who could be said to have already granted Brilliant the right to use their computers had better hope Brilliant officials keep their word.

Another aspect of Brilliant’s plans have gone largely ignored. Although it has not yet been made completely clear how it will be used, Brilliant’s software is also going to include Microsoft digital rights management technology, presumably making sure that no liberties are taken on the Altnet network with anyone’s intellectual property rights. So Kazaa users who fail to pay close attention to the fine print may soon find their computers are but a cog in a Microsoft-policed network.

Of course one could say that’s just the price people must pay when they look to get something for nothing. After all, it’s hard to have much sympathy for those who are using these file-sharing networks just to grab some illegally copied music.

But it’s not only those with dishonest intent who can get ensnared in these webs the spyware companies are weaving. And it’s not only those looking to rip off some music or DVDs whose intent may be questionable. Are companies that hide the truth about what customers are going to get and what they’re going to pay deserving of our trust? I don’t think so.

File-swapping technology does have its legitimate uses today, and no one can say for certain what ground-shaking applications it might lead to in the future. The great danger is that this future could be constrained by the petty greed of those who are using spyware agents to quietly build a paradigm of their own. And, as we’ll see next week, spyware is not the only tool being used by some who wish to put restrictions on technology’s horizons.