RealNetworks issues plan to counter security scandal

NEWS Streaming media specialist, RealNetworks, has been forced to overhaul its privacy policy following revelations that the software company can track what individual users are watching. The company, in collaboration with certification authority, Truste, has launched a five-point plan designed to calm users' fears. The measures include an immediate independent audit of its privacy practices and the creation of advisory board to help with ongoing issues. The controversy blew up last week when US security expert, Richard Smith, discovered a Global Unique Identifier (GUID) in RealJukebox, which transmitted data back to the company ('RealNetworks offers patch to combat personal data error', see http://www.silicon.com/a33784 ). RealNetworks disabled the function, but ran into more trouble this week when Smith claimed he had found the same functionality in the company's popular video software, RealPlayer ('Security flaw found in RealPlayer', see http://www.silicon.com/a33861 ). The event has been a high-profile test for Truste, which has awarded RealNetworks its privacy 'seal of approval'. According to Lori Fena, Truste chairman, its seal only covers the collection of data through a Web site, not via software. "However, because consumer trust is more important than legal technicalities for both Truste and RealNetworks, we have worked together to find a series of appropriate solutions," she said. According to Christopher Upton, MD of UK certification authority, Clicksure, a potentially harmful situation has been handled well. "The important point is that there was a mechanism in place to deal with it. If a certification authority hasn't got sanctions, it hasn't got teeth, and you need to ensure the credibility of the brand." Upton added that the industry needs to be proactive rather than reactive to privacy issues. "Ideally you want it to stop happening in the first place, but it can be difficult to prevent," he said. According to a Truste spokesman, the certification authority is now "officially setting the course to expand its program into the software privacy assurance arena".