Why I can never agree with adware and spyware

Absurdly complex licences and a raft of underhand techniques means the tide of pop-ups and tracking programs keeps growing. In 2001, a colleague asked me to fix her computer, which was acting "strange". She spent most of her time on websites she knew should be advertisement-free - including the site of the university where we both then worked. Yet she'd get annoying pop-up ads anyway. These ads couldn't be coming from the university; it didn't sell ads at all. So who delivered them? Her computer turned out to be infected with Gator - the first of a series of programs that track users' online behaviour and show extra pop-ups. It was my first encounter with adware-type spyware - programs that watch what users do online, then try to exploit it for their own benefit. Adware vendors defend their practices as "targeted advertising". True, their ads are generally related to what a user is doing. But that doesn't make them useful or desirable to the user. Uninformed consent Adware also compromises users' privacy. To decide which ads to show, programs must track what websites users visit. But users have no way to know where this data will be stored or who will be able to access it. Some adware vendors boast of terabyte-sized databases of users' online activities. Adware vendors are devious, particularly in their attempts to get their software on to users' computers. Rarely does a user grant informed consent to receive pop-ups. Instead, adware vendors resort to trickery to infiltrate users' PCs. Many bundle their adware with programs users actually want - hoping that they won't read all the fine print. In other cases, the fine-print mention is too convoluted, euphemistic or hidden for any user to understand. I've dissected dozens of spyware and adware programs and their legal agreements. I've videoed what happens when you "agree" to their installations. Often you don't get what you expected. Or agreeing to one program somehow lands you with dozens. If a user grants "consent" via a provision buried 10 pages within a 50-page document, has the user really agreed to the installation? If a program describes its features in vague euphemisms ("targeted offers") rather than clear admissions ("pop-up ads"), can a user be expected to understand? I say no. But US law operates under the fiction that these terms are valid. Truly fixing spyware will require reminding judges that hidden terms have no proper place in consumer contracts. Clicking "agree" to an "agreement" that's hundreds of pages long and written in obscure legalese isn't what users would call acceptance. It's more like defeat. Meanwhile, adware vendors continue to use licence agreements to their advantage. Massachusetts's Clickspring requires users to agree to install "additional ... third-party applications" - without telling users what those programs are. To date, vendors have largely got away with this sleight of hand. But litigation against Direct Revenue, a New York-based company that promises to provide "useful content and free software in exchange for the opportunity to deliver highly targeted behavioural messages and optimized [sic] search results" may yet rule these tactics impermissible. Other adware installs without any consent, by exploiting defects in Windows or Internet Explorer. And a few vendors install even if users specifically refuse it: pressing "no" is ignored. At the height of the adware mess, an NCSA survey found that 61% of computers were infected - and only 8% of users knew they were. Security researcher Richard Stiennon estimated in 2004 that advertisers paid more than $1bn (pounds 500m) a year for spyware placements. Fortunately, there are some signs of contraction in the adware world. Gator (later renamed Claria) last year left the business, realising it could never clear its reputation while serving annoying pop-ups. Litigation - such as a major investigation by the American Federal Trade Commission of Washington-based Zango that yielded millions of dollars in fines - put other vendors on the defensive. Nonetheless, new adware vendors are ready to step into the gap. Last year saw the rise of Netherlands-based DollarRevenue, whose huge adware bundles often crashed users' computers. In addition, new programs continue to appear. But spyware isn't just about serving up unwanted and intrusive ads: other developers have more worrying designs on your PC. One natural project is stealing users' passwords. If an attacker gets a user's eBay password, he can sell items under the user's identity. Thanks to the user's good reputation, buyers will be willing to pay for the promised merchandise. But the attacker simply pockets the payment without ever sending anything. Others target passwords to stock brokerages. A typical strategy is to buy preselected small-cap stocks via hacked accounts, bidding up the value of those companies and yielding profits to attackers who purchased other shares in advance. Stealing bank passwords and PINs allows an even more direct theft. The rise in spyware also helps fuel other online scourges, most notably spam. Using spyware-infected PCs makes detection harder: with more spam-sending computers, it's difficult to identify spam based solely on where it comes from. Many spyware programs take extreme steps to escape detection. Last year security experts at Sunbelt Software studied an Italian program called Gromozon which modifies Windows with a rootkit to cover its tracks, creates its own user account, and automatically renames its files. The longer Gromozon and kin stay on users' computers, the larger their profits. I've seen much of the spyware onslaught first-hand - in part as a researcher testing spyware, but also especially in litigation. There were early successes, such as the New York Times and Washington Post winning an injunction to stop Gator. But these days litigation has progressed to improper installation methods. The US Federal Trade Commission has sued half a dozen vendors for spyware-related practices. State attorneys general in New York and Washington have also brought major cases, and private attorneys jumped in too. These efforts have helped to curb the practices of the most well-known spyware vendors, but so far they've largely left lesser companies unchecked. Would new laws be helpful? Draft US federal legislation was initially slated to prohibit a variety of deceptive practices. But special interests sought to water down the legislation. Similar changes occurred in the handful of US states that ultimately passed anti-spyware laws. It turns out that spyware vendors have powerful allies: ad networks want the freedom to track users' activities in great detail, and even mainstream software vendors aspire to install software without thorough disclosures. Weak legislation Ultimately no US federal bill was passed and state laws have been narrow and weak. Outside the US, legislation has been even more limited: drafts were considered in Australia and the Netherlands, but none was enacted. So you have to fend for yourselves. My advice? Install all available security updates to Windows and other software, as these close holes that might otherwise let attackers in. Then modern antispyware software can find and remove any infections that slip through. Finally, think carefully about what software to install. Ask a tech expert whether a program can be trusted; or Google the program's name to see what others say. These steps won't stop spyware, but they can help to keep unwanted programs off your PC. • Ben Edelman studies web advertising as a Ph.D candidate at Harvard University. benedelman.org No responsibility can be taken for the content of external Internet sites.

print this article

Return to internet news headlines
View Internet News Archive

Share with: