Feeds

Windows genuine disadvantage

A step too far?

Security for virtualized datacentres

In fact, the class action lawsuit against Microsoft, in addition to alleging violations of the Washington State and California deceptive and unfair trade practices statutes, alleges that the WGA software violates the Washington State anti-spyware law which makes it a crime to:

(1) Induce an owner or operator to install a computer software component onto the computer by intentionally misrepresenting the extent to which installing the software is necessary for security or privacy reasons or in order to open, view, or play a particular type of content; and

(2) Deceptively cause the execution on the computer of a computer software component with the intent of causing the owner or operator to use the component in a manner that violates any other provision of this section.

The lawsuit also alleges a violation of the California anti-spyware statute which also says that you cannot:

(1) Induce an authorised user to install a software component onto the computer by intentionally misrepresenting that installing software is necessary for security or privacy reasons or in order to open, view, or play a particular type of content.

(2) Deceptively causing the copying and execution on the computer of a computer software component with the intent of causing an authorized user to use the component in a way that violates any other provision of this section.

So what about the promise that the information cannot and will not be used to identify individual users? Not so fast. Let's see exactly what information Microsoft is having its OS call home with. Sure, it sends the key, and configuration information. But it sends it over the internet. This adds one more piece of information to the mix - the system's IP address. The government is increasingly demanding that ISPs, and now entities like Myspace.com, retain information for years about IP address holders specifically so that it (and private litigants) can use the IP information to determine the true identity of users.

Does Microsoft's promise that it does not collect information from which it can learn your identity mean that it doesn't collect the IP information for millions of computers that connect to its servers? I think not. Or that it doesn't retain (at least briefly) that information? Somehow I doubt it.

This problem is not unique to Microsoft. Many companies proudly exclaim on their websites that they "do not collect personal information" or that they only collect that information that people voluntarily provide. They also eschew any attempt to find out who you are - ever, for any reason, really and truly, we mean it.

What this really means is that, if a hacker or attacker were to attempt to access the system, or was truly able to break in, the company's privacy policy pretty much says we won't use the information on our system (your IP address, keystrokes, and so on) to try to identify you. I mean, isn't that what it means when you say you won't collect any information and won't attempt to use it?

In the case of Microsoft, is it really saying that, if the FBI came to them pursuant to a criminal investigation of software piracy, it would not and could not turn over the IP information to help the FBI determine the identity of those committing piracy? Does this mean that Microsoft has never collected it? That if it really wanted to, it could never find out who had unlicensed products? Somehow, I don't think so.

In fact, Microsoft's head is writing checks its body can't cash. On July 2, 2006, Microsoft's PR flack responded to rumours in the blogosphere that, in addition to annoying pop-up ads, Microsoft would soon deactivate any unlicensed copy of Windows. The Redmond giant quickly, but in my opinion unconvincingly, quashed these rumours.

According to a spokeswoman with Waggener Edstrom, from Microsoft's public relations firm: "Microsoft antipiracy technologies cannot and will not turn off your computer."

Hmmm... Microsoft cannot turn off your computer? Well, um... of course it can. When the software phones home to see if it is licensed and it receives a "no" signal, it could simply cease to operate. It is technologically feasible, isn't it? Perhaps she meant that the computer's power will still be on (it won't turn off your computer...), not that it will continue to function.

Moreover, as we have learned from past experience, the fact that Microsoft says now that software will behave in one way doesn't mean that this is the way it will behave in the future. Just download another EULA, or another update.

What all this means is that whenever you collect personal information - whether actively or passively - that could be used to identify people, you need to let them know in clear, unambiguous and easily accessible language. Don't worry, nobody is going to read it anyway. And in the case of Microsoft, does it have any meaningful choices? Sure...that little Antarctic bird...

This article originally appeared in Security Focus.

Copyright © 2006, SecurityFocus

SecurityFocus columnist Mark D Rasch, JD, is a former head of the Justice Department's computer crime unit, and now serves as senior vice president and chief security counsel at Solutionary Inc.

Choosing a cloud hosting partner with confidence

More from The Register

next story
New 'Cosmos' browser surfs the net by TXT alone
No data plan? No WiFi? No worries ... except sluggish download speed
'Windows 9' LEAK: Microsoft's playing catchup with Linux
Multiple desktops and live tiles in restored Start button star in new vids
iOS 8 release: WebGL now runs everywhere. Hurrah for 3D graphics!
HTML 5's pretty neat ... when your browser supports it
Mathematica hits the Web
Wolfram embraces the cloud, promies private cloud cut of its number-cruncher
Google extends app refund window to two hours
You now have 120 minutes to finish that game instead of 15
Intel: Hey, enterprises, drop everything and DO HADOOP
Big Data analytics projected to run on more servers than any other app
Mozilla shutters Labs, tells nobody it's been dead for five months
Staffer's blog reveals all as projects languish on GitHub
SUSE Linux owner Attachmate gobbled by Micro Focus for $2.3bn
Merger will lead to mainframe and COBOL powerhouse
iOS 8 Healthkit gets a bug SO Apple KILLS it. That's real healthcare!
Not fit for purpose on day of launch, says Cupertino
prev story

Whitepapers

Providing a secure and efficient Helpdesk
A single remote control platform for user support is be key to providing an efficient helpdesk. Retain full control over the way in which screen and keystroke data is transmitted.
WIN a very cool portable ZX Spectrum
Win a one-off portable Spectrum built by legendary hardware hacker Ben Heck
Saudi Petroleum chooses Tegile storage solution
A storage solution that addresses company growth and performance for business-critical applications of caseware archive and search along with other key operational systems.
Protecting users from Firesheep and other Sidejacking attacks with SSL
Discussing the vulnerabilities inherent in Wi-Fi networks, and how using TLS/SSL for your entire site will assure security.
Security for virtualized datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.