Windows genuine disadvantage

A step too far?

In fact, the class action lawsuit against Microsoft, in addition to alleging violations of the Washington State and California deceptive and unfair trade practices statutes, alleges that the WGA software violates the Washington State anti-spyware law which makes it a crime to:

(1) Induce an owner or operator to install a computer software component onto the computer by intentionally misrepresenting the extent to which installing the software is necessary for security or privacy reasons or in order to open, view, or play a particular type of content; and

(2) Deceptively cause the execution on the computer of a computer software component with the intent of causing the owner or operator to use the component in a manner that violates any other provision of this section.

The lawsuit also alleges a violation of the California anti-spyware statute which also says that you cannot:

(1) Induce an authorised user to install a software component onto the computer by intentionally misrepresenting that installing software is necessary for security or privacy reasons or in order to open, view, or play a particular type of content.

(2) Deceptively causing the copying and execution on the computer of a computer software component with the intent of causing an authorized user to use the component in a way that violates any other provision of this section.

So what about the promise that the information cannot and will not be used to identify individual users? Not so fast. Let's see exactly what information Microsoft is having its OS call home with. Sure, it sends the key, and configuration information. But it sends it over the internet. This adds one more piece of information to the mix - the system's IP address. The government is increasingly demanding that ISPs, and now entities like Myspace.com, retain information for years about IP address holders specifically so that it (and private litigants) can use the IP information to determine the true identity of users.

Does Microsoft's promise that it does not collect information from which it can learn your identity mean that it doesn't collect the IP information for millions of computers that connect to its servers? I think not. Or that it doesn't retain (at least briefly) that information? Somehow I doubt it.

This problem is not unique to Microsoft. Many companies proudly exclaim on their websites that they "do not collect personal information" or that they only collect that information that people voluntarily provide. They also eschew any attempt to find out who you are - ever, for any reason, really and truly, we mean it.

What this really means is that, if a hacker or attacker were to attempt to access the system, or was truly able to break in, the company's privacy policy pretty much says we won't use the information on our system (your IP address, keystrokes, and so on) to try to identify you. I mean, isn't that what it means when you say you won't collect any information and won't attempt to use it?

In the case of Microsoft, is it really saying that, if the FBI came to them pursuant to a criminal investigation of software piracy, it would not and could not turn over the IP information to help the FBI determine the identity of those committing piracy? Does this mean that Microsoft has never collected it? That if it really wanted to, it could never find out who had unlicensed products? Somehow, I don't think so.

In fact, Microsoft's head is writing checks its body can't cash. On July 2, 2006, Microsoft's PR flack responded to rumours in the blogosphere that, in addition to annoying pop-up ads, Microsoft would soon deactivate any unlicensed copy of Windows. The Redmond giant quickly, but in my opinion unconvincingly, quashed these rumours.

According to a spokeswoman with Waggener Edstrom, from Microsoft's public relations firm: "Microsoft antipiracy technologies cannot and will not turn off your computer."

Hmmm... Microsoft cannot turn off your computer? Well, um... of course it can. When the software phones home to see if it is licensed and it receives a "no" signal, it could simply cease to operate. It is technologically feasible, isn't it? Perhaps she meant that the computer's power will still be on (it won't turn off your computer...), not that it will continue to function.

Moreover, as we have learned from past experience, the fact that Microsoft says now that software will behave in one way doesn't mean that this is the way it will behave in the future. Just download another EULA, or another update.

What all this means is that whenever you collect personal information - whether actively or passively - that could be used to identify people, you need to let them know in clear, unambiguous and easily accessible language. Don't worry, nobody is going to read it anyway. And in the case of Microsoft, does it have any meaningful choices? Sure...that little Antarctic bird...

This article originally appeared in Security Focus.

Copyright © 2006, SecurityFocus

SecurityFocus columnist Mark D Rasch, JD, is a former head of the Justice Department's computer crime unit, and now serves as senior vice president and chief security counsel at Solutionary Inc.