Windows Genuine Disadvantage, 2006-07-05
Story continued from Page 2
“
Indeed, the [Microsoft] EULA here is more onerous and less clear than that which the FTC found actionable for online spyware manufacturer Odysseus, who purported to allow people to download software to make Kazaa P2P software anonymous, but which actually collected personal information and sent adware to the users. In plain terms, spyware EULAs aren't enforceable, and the WGA license sure sounds like a spyware EULA.
”
In fact, the class action lawsuit against Microsoft, in addition to alleging violations of the Washington State and California deceptive and unfair trade practices statutes, alleges that the WGA software violates the Washington State anti-spyware law which makes it a crime to:
(1) Induce an owner or operator to install a computer software component onto the computer by intentionally misrepresenting the extent to which installing the software is necessary for security or privacy reasons or in order to open, view, or play a particular type of content; andThe lawsuit also alleges a violation of the California anti-spyware statute which also says that you cannot:
(2) Deceptively cause the execution on the computer of a computer software component with the intent of causing the owner or operator to use the component in a manner that violates any other provision of this section.
(1) Induce an authorized user to install a software component onto the computer by intentionally misrepresenting that installing software is necessary for security or privacy reasons or in order to open, view, or play a particular type of content.So what about the promise that the information cannot and will not be used to identify individual users? Not so fast. Lets see exactly what information Microsoft is having its OS call home with. Sure, it sends the key, and configuration information. But it sends it over the Internet. This adds one more piece of information to the mix – the system's IP address. The government is increasingly demanding that ISPs – and now entities like Myspace.com – retain information for years about IP address holders specifically so that it (and private litigants) can use the IP information to determine the true identity of users. Does Microsoft's promise that it does not collect information from which it can learn your identity mean that it doesn't collect the IP information for millions of computers that connect to its servers? I think not. Or that it doesn't retain (at least briefly) that information? Somehow I doubt it.
(2) Deceptively causing the copying and execution on the computer of a computer software component with the intent of causing an authorized user to use the component in a way that violates any other provision of this section.
This problem is not unique to Microsoft. Many companies proudly exclaim on their websites that they "do not collect personal information" or that they only collect that information that people voluntarily provide. They also eschew any attempt to find out who you are – ever, for any reason – really and truly – we mean it.
What this really means is that, if a hacker or attacker were to attempt to access the system, or was truly able to break in, the company's privacy policy pretty much says we won't use the information on our system (your IP address, keystrokes, and so on) to try to identify you. I mean, isn't that what it means when you say you wont collect any information and wont attempt to use it?
In the case of Microsoft, are they really saying that, if the FBI came to them pursuant to a criminal investigation of software piracy, they would not and could not turn over the IP information to help the FBI determine the identity of those committing piracy? Does this mean that Microsoft has never collected it? That if they really wanted to, they could never find out who had unlicensed products? Somehow, I don't think so.
In fact, Microsoft's head is writing checks its body can't cash. On July 2, 2006, Microsoft's PR flack responded to rumors in the blogosphere that, in addition to annoying pop-up ads, Microsoft would soon deactivate any unlicensed copy of Windows. The Redmond giant quickly, but in my opinion unconvincingly, quashed these rumors. According to a spokeswoman with Waggener Edstrom, from Microsoft's public relations firm, "Microsoft antipiracy technologies cannot and will not turn off your computer." Hmmm... Microsoft cannot turn off your computer? Well, um... of course they can. When the software phones home to see if it is licensed and it receives a "no" signal, it could simply cease to operate. It is technologically feasible, isn't it? Perhaps she meant that the computer's power will still be on (it won't turn off your computer...), not that it will continue to function. Moreover, as we have learned from past experience, the fact that Microsoft says now that software will behave in one way doesn't mean that this is the way it will behave in the future. Just download another EULA – or another update.
What all this means is that whenever you collect personal information – whether actively or passively – that could be used to identify people, you need to let them know in clear, unambiguous and easily accessible language. Don't worry, nobody is going to read it anyway. And in the case of Microsoft, do they have any meaningful choices? Sure... that little Antarctic bird...
