Spyware: What are you signing up for?

NEWS A leading spyware expert has hit out at legitimate organisations who use wordy, confusing and over-long end-user licensing agreements (EULAs) to get users to download adware and spyware.

Increasing competition among adware authors and "ad-herders" is forcing them to look at new and innovative ways to get such applications onto users' machines and for many their activities are blurring the lines between what is and isn't acceptable.

Computer Associates maintains a growing database of thousands of items of spyware and adware and the company claims the two most prolific sources of spyware in this grey area are Claria, which produces Gator and Gain software, and Grokster.

In the all-important eyes of the law these companies are doing nothing wrong, but nor are they doing anything to encourage users to know exactly what they are accepting onto their machines which creates a dangerous opportunity for less-legitimate businesses.

Roger Thompson, director of content research for CA's eTrust Pest Patrol and Anti-Spyware solutions, said: "When users install Grokster they get a dialogue box and will have to page down 131 times to read the EULA."

"Eventually, after scrolling down users get to a passage which reads: 'GP may from time to time, either automatically or through other means, distribute an update to the Licensed Materials and/or may replace Licensed Materials with newer versions thereof and/or otherwise modify or add to the Licensed Materials'."

That line appears almost 4,500 words into the 6,600-plus word terms and conditions which ship with the free software.

And users need to realise what rhetorically applies for lunches also often applies for a piece of software - 'there is no such thing as a free one'. Often they will fund themselves through what they find about their users. The software is offered for free because there is often more value in the data they spy on once installed.

Thompson expressed concern that while Grokster may regard such agreements responsibly this level of ambiguity in the wording means other companies will inevitably use such ploys to legitimise the installation and modification of spyware on a user's machine.

"You're giving the fox the keys to the hen house," said Thompson. "Users shouldn't be allowing any of this stuff onto their systems because they don't know how it is going to be used."

Typically users' first realisation they have been infected by an item of commercial spyware will be the interruption of a web session - by an unusually high volume of pop-up ads, a change to their homepage or the unwitting redirection to other websites.

Many companies distributing these kinds of application are aware of the moves afoot to defeat them. Thompson said many will be deliberately difficult to remove while others expressly state they cannot be removed.

The EULA issued by Gain states: "You agree that you will not use, or encourage others to use, any unauthorised means for the removal of the GAIN AdServer, or any GAIN-Supported Software from a computer."

It also strictly forbids users from using spyware scanning tools such as "a packet sniffer or other device to intercept or access communications between GP and the GAIN AdServer".

"These companies are all after your desktop," warned Thompson.