Feeds

Windows genuine disadvantage

A step too far?

Security for virtualized datacentres

In fact, the class action lawsuit against Microsoft, in addition to alleging violations of the Washington State and California deceptive and unfair trade practices statutes, alleges that the WGA software violates the Washington State anti-spyware law which makes it a crime to:

(1) Induce an owner or operator to install a computer software component onto the computer by intentionally misrepresenting the extent to which installing the software is necessary for security or privacy reasons or in order to open, view, or play a particular type of content; and

(2) Deceptively cause the execution on the computer of a computer software component with the intent of causing the owner or operator to use the component in a manner that violates any other provision of this section.

The lawsuit also alleges a violation of the California anti-spyware statute which also says that you cannot:

(1) Induce an authorised user to install a software component onto the computer by intentionally misrepresenting that installing software is necessary for security or privacy reasons or in order to open, view, or play a particular type of content.

(2) Deceptively causing the copying and execution on the computer of a computer software component with the intent of causing an authorized user to use the component in a way that violates any other provision of this section.

So what about the promise that the information cannot and will not be used to identify individual users? Not so fast. Let's see exactly what information Microsoft is having its OS call home with. Sure, it sends the key, and configuration information. But it sends it over the internet. This adds one more piece of information to the mix - the system's IP address. The government is increasingly demanding that ISPs, and now entities like Myspace.com, retain information for years about IP address holders specifically so that it (and private litigants) can use the IP information to determine the true identity of users.

Does Microsoft's promise that it does not collect information from which it can learn your identity mean that it doesn't collect the IP information for millions of computers that connect to its servers? I think not. Or that it doesn't retain (at least briefly) that information? Somehow I doubt it.

This problem is not unique to Microsoft. Many companies proudly exclaim on their websites that they "do not collect personal information" or that they only collect that information that people voluntarily provide. They also eschew any attempt to find out who you are - ever, for any reason, really and truly, we mean it.

What this really means is that, if a hacker or attacker were to attempt to access the system, or was truly able to break in, the company's privacy policy pretty much says we won't use the information on our system (your IP address, keystrokes, and so on) to try to identify you. I mean, isn't that what it means when you say you won't collect any information and won't attempt to use it?

In the case of Microsoft, is it really saying that, if the FBI came to them pursuant to a criminal investigation of software piracy, it would not and could not turn over the IP information to help the FBI determine the identity of those committing piracy? Does this mean that Microsoft has never collected it? That if it really wanted to, it could never find out who had unlicensed products? Somehow, I don't think so.

In fact, Microsoft's head is writing checks its body can't cash. On July 2, 2006, Microsoft's PR flack responded to rumours in the blogosphere that, in addition to annoying pop-up ads, Microsoft would soon deactivate any unlicensed copy of Windows. The Redmond giant quickly, but in my opinion unconvincingly, quashed these rumours.

According to a spokeswoman with Waggener Edstrom, from Microsoft's public relations firm: "Microsoft antipiracy technologies cannot and will not turn off your computer."

Hmmm... Microsoft cannot turn off your computer? Well, um... of course it can. When the software phones home to see if it is licensed and it receives a "no" signal, it could simply cease to operate. It is technologically feasible, isn't it? Perhaps she meant that the computer's power will still be on (it won't turn off your computer...), not that it will continue to function.

Moreover, as we have learned from past experience, the fact that Microsoft says now that software will behave in one way doesn't mean that this is the way it will behave in the future. Just download another EULA, or another update.

What all this means is that whenever you collect personal information - whether actively or passively - that could be used to identify people, you need to let them know in clear, unambiguous and easily accessible language. Don't worry, nobody is going to read it anyway. And in the case of Microsoft, does it have any meaningful choices? Sure...that little Antarctic bird...

This article originally appeared in Security Focus.

Copyright © 2006, SecurityFocus

SecurityFocus columnist Mark D Rasch, JD, is a former head of the Justice Department's computer crime unit, and now serves as senior vice president and chief security counsel at Solutionary Inc.

Internet Security Threat Report 2014

More from The Register

next story
ONE MILLION people already running Windows 10
A third of them are doing it in VMs, but early feedback focuses on frippery
Netscape Navigator - the browser that started it all - turns 20
It was 20 years ago today, Marc Andreeesen taught the band to play
Sway: Microsoft's new Office app doesn't have an Undo function
Content aggregation, meet the workplace ... oh
Sign off my IT project or I’ll PHONE your MUM
Honestly, it’s a piece of piss
Do Moan! MONSTER 6-day EMAIL OUTAGE hits Domain Monster
Customers freaked out by frightful service
Ploppr: The #VultureTRENDING App of the Now
This organic crowd sourced viro- social fertiliser just got REAL
Return of the Jedi – Apache reclaims web server crown
.london, .hamburg and .公司 - that's .com in Chinese - storm the web server charts
NetWare sales revive in China thanks to that man Snowden
If it ain't Microsoft, it's in fashion behind the Great Firewall
prev story

Whitepapers

Forging a new future with identity relationship management
Learn about ForgeRock's next generation IRM platform and how it is designed to empower CEOS's and enterprises to engage with consumers.
Win a year’s supply of chocolate
There is no techie angle to this competition so we're not going to pretend there is, but everyone loves chocolate so who cares.
Why cloud backup?
Combining the latest advancements in disk-based backup with secure, integrated, cloud technologies offer organizations fast and assured recovery of their critical enterprise data.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
Saudi Petroleum chooses Tegile storage solution
A storage solution that addresses company growth and performance for business-critical applications of caseware archive and search along with other key operational systems.