Digg this story   Add to del.icio.us   (page 3 of 3 ) previous 
Windows Genuine Disadvantage
Mark Rasch, 2006-07-05

Story continued from Page 2


In fact, the class action lawsuit against Microsoft, in addition to alleging violations of the Washington State and California deceptive and unfair trade practices statutes, alleges that the WGA software violates the Washington State anti-spyware law which makes it a crime to:
(1) Induce an owner or operator to install a computer software component onto the computer by intentionally misrepresenting the extent to which installing the software is necessary for security or privacy reasons or in order to open, view, or play a particular type of content; and

(2) Deceptively cause the execution on the computer of a computer software component with the intent of causing the owner or operator to use the component in a manner that violates any other provision of this section.
The lawsuit also alleges a violation of the California anti-spyware statute which also says that you cannot:
(1) Induce an authorized user to install a software component onto the computer by intentionally misrepresenting that installing software is necessary for security or privacy reasons or in order to open, view, or play a particular type of content.

(2) Deceptively causing the copying and execution on the computer of a computer software component with the intent of causing an authorized user to use the component in a way that violates any other provision of this section.
So what about the promise that the information cannot and will not be used to identify individual users? Not so fast. Lets see exactly what information Microsoft is having its OS call home with. Sure, it sends the key, and configuration information. But it sends it over the Internet. This adds one more piece of information to the mix – the system's IP address. The government is increasingly demanding that ISPs – and now entities like Myspace.com – retain information for years about IP address holders specifically so that it (and private litigants) can use the IP information to determine the true identity of users. Does Microsoft's promise that it does not collect information from which it can learn your identity mean that it doesn't collect the IP information for millions of computers that connect to its servers? I think not. Or that it doesn't retain (at least briefly) that information? Somehow I doubt it.

This problem is not unique to Microsoft. Many companies proudly exclaim on their websites that they "do not collect personal information" or that they only collect that information that people voluntarily provide. They also eschew any attempt to find out who you are – ever, for any reason – really and truly – we mean it.

What this really means is that, if a hacker or attacker were to attempt to access the system, or was truly able to break in, the company's privacy policy pretty much says we won't use the information on our system (your IP address, keystrokes, and so on) to try to identify you. I mean, isn't that what it means when you say you wont collect any information and wont attempt to use it?

In the case of Microsoft, are they really saying that, if the FBI came to them pursuant to a criminal investigation of software piracy, they would not and could not turn over the IP information to help the FBI determine the identity of those committing piracy? Does this mean that Microsoft has never collected it? That if they really wanted to, they could never find out who had unlicensed products? Somehow, I don't think so.

In fact, Microsoft's head is writing checks its body can't cash. On July 2, 2006, Microsoft's PR flack responded to rumors in the blogosphere that, in addition to annoying pop-up ads, Microsoft would soon deactivate any unlicensed copy of Windows. The Redmond giant quickly, but in my opinion unconvincingly, quashed these rumors. According to a spokeswoman with Waggener Edstrom, from Microsoft's public relations firm, "Microsoft antipiracy technologies cannot and will not turn off your computer." Hmmm... Microsoft cannot turn off your computer? Well, um... of course they can. When the software phones home to see if it is licensed and it receives a "no" signal, it could simply cease to operate. It is technologically feasible, isn't it? Perhaps she meant that the computer's power will still be on (it won't turn off your computer...), not that it will continue to function. Moreover, as we have learned from past experience, the fact that Microsoft says now that software will behave in one way doesn't mean that this is the way it will behave in the future. Just download another EULA – or another update.

What all this means is that whenever you collect personal information – whether actively or passively – that could be used to identify people, you need to let them know in clear, unambiguous and easily accessible language. Don't worry, nobody is going to read it anyway. And in the case of Microsoft, do they have any meaningful choices? Sure... that little Antarctic bird...


Mark D. Rasch is an attorney and technology expert in the areas of intellectual property protection, computer security, privacy and regulatory compliance. He formerly worked at the Department of Justice, where he was responsible for the prosecution of Robert Morris, the Cornell University graduate student responsible for the so-called Morris Worm and the investigations of the Hannover hackers featured in Clifford Stoll’s book, "The Cuckoo’s Egg."
    Digg this story   Add to del.icio.us   (page 3 of 3 ) previous 
Comments Mode:
Windows genuine disadvantage 2006-07-06
Chris (5 replies)
Re: Windows genuine disadvantage 2006-07-06
Mark D. Rasch
Re: Windows genuine disadvantage 2006-07-06
Rob (1 replies)
Copyright Infringement vs. Theft 2006-07-06
Mark D. Rasch
Re: Windows genuine disadvantage 2006-07-12
Anonymous
Re: Windows genuine disadvantage 2006-07-17
Anonymous
Windows genuine disadvantage 2006-07-06
Anonymous (1 replies)
Re: Windows genuine disadvantage 2006-07-07
Anonymous
Windows genuine disadvantage 2006-07-06
Anonymous (1 replies)
Re: Windows genuine disadvantage 2006-07-06
Mark D. Rasch (1 replies)
Re: Re: Windows genuine disadvantage 2006-07-06
Anonymous (1 replies)
Windows genuine disadvantage 2006-07-08
Anonymous
Windows genuine disadvantage 2006-07-08
Anonymous
Windows genuine disadvantage 2006-07-14
Anonymous
Windows genuine disadvantage 2006-07-16
Anonymous
Windows genuine disadvantage 2006-07-20
From Canada
Windows genuine disadvantage 2006-08-28
Tony B
Windows Genuine Disadvantage 2006-10-05
Anonymous
Windows Genuine Disadvantage 2007-03-24
Anonymous


 

Privacy Statement
Copyright 2010, SecurityFocus