Some Feds Wanted To Find A Loophole To Avoid Warrants When Using FBI's Homemade Spyware

from the slippery-slope dept

While it's been widely reported for a few years now that the FBI has some spyware, called the "computer and internet protocol address verifier," or CIPAV, for tracking down certain computer users. However, some new Freedom of Information Act-released documents provide some more details, including that other government agencies have requested to use the tool, and that there's been some serious disagreement among the feds about how it can and should be used legally (and if it's always used in legal ways).

[EFF] officials have raised concerns about documents showing that FBI agents at times employed inconsistent methods for gaining authorization to install the tracer. Their email messages talk about using a "trespasser exception" to avoid obtaining a warrant. One message recommends citing the "All Writs Act, 28 U.S.C. § 1651(a)." The group noted that one September 2007 message indicates some agents felt spyware searches do not require any legal process.

"There seems like there was a lot of back-and-forth," Lynch said.

The 2007 email stated, "I still think that use of [redacted] is consensual monitoring without need for process; In my mind, no different than sitting in a chat room and tracking participants; on/off times or for that matter sitting on P2P networks and find out who is offering KP" -- in a likely reference to law enforcement's practice of searching through file-sharing networks for sex offenders exchanging child pornography.

The thing is, it seems like this kind of thing would likely easily get a warrant approval in most cases where it was really necessary. Why is it that our federal government so often seems to hate having to go through such basic oversight efforts? After all, the news just came out that the FISA court approved all 1,506 requests from the government to electronically monitor suspects. It's not as if FISA is a difficult process to go through...

Filed Under: fbi, spyware, warrants

An Olympian Spammer Discovers That Reputation Is A Scarce Good You Don't Want To Destroy

from the it's-your-reputation dept

Given what the Olympics have become lately, I have to admit to not paying attention to any of it so far. I heard the news of the luger's death, and that's been about it. So perhaps more people already knew about this, but apparently one of the mogul skiers has a bit of a reputation as a spam/spyware purveyor. It sounds like the guy is now out of that business, but what's fascinating is how his reputation has been tarnished over all of this, despite winning Olympic medals. The Canadians wouldn't let him on the team this time around years back, due to their dislike of his activities, so he switched his citizenship to Australia, and basically, it sounds like everyone hates him:

After Begg-Smith's second place finish in Vancouver this week, one Australian news organization published an article calling him--in the headline, no less--a "sourpuss." Another, the Sydney Morning Herald, labeled the Olympic athlete as "Mr. Miserable" and speculated that he was "simply flying a flag of convenience" with no real ties to Oz.

Canadians were more direct. Facebook groups such as "Dale Begg-Smith is a sourpuss" and another calling him a "traitor" have popped up. Twitter messages after the mogul race have included "traitor," "fake Canadian and all-around jerk," plus other phrases entirely unsuitable for a family publication.

Obviously, some of that hatred is due to him switching citizenship, but the article explains why his spamming/spyware activities are a large part of it as well (and may have resulted in the citizenship switch). I find this interesting not just because of the Olympic angle, but because of the reputation angle.

Reputation is a rather valuable "scarce good," and destroying your reputation through shady activities can come back to bite you for a long, long time, even if you do plenty of other amazing things. Just ask Metallica.

Filed Under: adware, begg-smith, malware, olympics, spam, spyware

Court Says Anti-Malware Software Maker Immune From Lawsuit From Zango

from the thank-you-section-230 dept

Infamous adware maker Zango may finally be dead, but its lawsuits live on. You may recall a few years back Zango sued security software maker Kaspersky for calling its product "spyware." A court found that Kaspersky has every right to label the software as it feels is appropriate, noting that it's immune from complaints from Zango under section 230 of the CDA.

Zango appealed, claiming that Kaspersky shouldn't be immune because the CDA was only supposed to apply to websites, not software makers. The 9th circuit appeals court clearly disagrees and points out that this is exactly the sort of thing Section 230 should protect. It's always nice to see courts reaffirm the immunity granted by Section 230 -- especially since those protections have been under attack lately. Update: Eric Goldman has more.

Filed Under: section 230, spyware
Companies: kaspersky, zango

Sears Settles With FTC For Putting Spyware On Customers' Computers

from the customers-aren't-lawyers dept

You may recall a couple years back, a controversy over the fact that Sears appeared to be installing spyware on the computers of online customers who had agreed to join a "community." Sears insisted this wasn't true, and that it really was software to help create a community of shoppers -- but the evidence suggested otherwise. The FTC eventually got involved, and now Sears has settled the charges that it was unfairly spying on users without clearly indicating this to users. Sears insisted that because the fine print of the terms of service for joining the community said that it would track your online browsing, it was in the clear, but the FTC noted, accurately, that most users would not have gotten that impression from signing up. As Thomas O'Toole notes about this ruling:

I'm pretty sure that attorneys would understand the breadth of the consent covered by the phrase "online browsing." It means everything. The position taken by the FTC signals the agency's belief that consumers should not be treated like lawyers when it comes to privacy-related disclosures. The FTC also appeared to be concerned about the fact that the disclosure was buried in a lengthy privacy statement, which was displayed to the consumer rather late in the consent-collecting process.

This is a good thing. Customers shouldn't need to be lawyers to understand what it is they're agreeing to, and it's nice to see the FTC recognize that fact.

Filed Under: community, lawyers, spyware, terms of service
Companies: sears

Surreptitious Adware Company Zango Finally Shuts Down

from the about-time dept

Remember back in the days of surreptitiously installed adware/spyware? For the most part, those days are gone, driven out by better security, FTC crackdowns and more sophisticated users. However, one of the big companies in the space, Zango, hung around for years, and finally shut down.

The company, which was originally known as 180Solutions, raised millions from VCs who didn't seem to recognize just how hated the company was, and just how many of its installs weren't by choice, but through annoyance. Then, for years, the company kept trying and failing to shake the "spyware" label, always blaming "bad actors" in its distribution network, but doing little to actually stop any of those bad actors. At times, it even rewarded them or made ridiculous claims about how its software couldn't be used for sneaky installs any more, despite plenty of evidence to the contrary. Incredibly, the company merged with another infamous adware firm and renamed the new company after the firm's most hated app Zango. And then, of course, came the lawsuits and a settlement with the FTC, which the company didn't appear to live up to. Most recently, the company was supposed to have "reinvented itself" in the "casual gaming" market.

Of all things, I'd actually run into some folks from the company at a conference last year, where they were pitching their "innovative advertising solutions," but would clam up or use misdirection any time you asked them for specifics about who would see the ads and how the software had gotten on their computers in the first place. In the meantime, one of the company's founders has written up something of a post mortem, where he suggests that only 4% of their installs early on were "completely silent," but doesn't note how many weren't necessarily "silent," but were done through trickery or a lack of full info. He also blames others in the space for being worse, and getting a bad rap because of their actions. Eventually, he also admits that the company also never provided much value in exchange for the advertisements, and at least is willing to admit that the company's management "was brain-dead" and should have recognized this early on. It's a fairly open and honest piece on what happened, though I think he doesn't give nearly enough blame to the company itself. It was quite evident how problematic the company's actions were from a very early stage, and the fact that it continued right up until recently suggests this wasn't just a case of a few small mistakes, but a systematic culture at or around the company that encouraged those types of actions.

Filed Under: adware, spyware, zango
Companies: 180solutions, zango

Porn Shakedown Company Takes Its Business Model And Moves On

from the good-riddance dept

Last year, a company called Platte Media came to light in the UK, after it started running a slightly bizarre spyware extortion scheme. The company would suck users in with a site promising licensed blockbuster movies, then take users through a registration process that involved installing some adware on their PCs. It didn't actually have the movies, just some trailers, and drove users to pornographic content. If users didn't cancel the "trial" they'd unwittingly agreed to in the process, they'd start getting popups on their screen, demanding payment of subscription fees. But the company has now shut up shop in the UK, though it's not clear if it's because the company wasn't properly paying taxes or because of scrutiny from the country's Office of Fair Trading. The company says it's pulled out for business reasons, but nobody will likely care too much, as long as it just goes away.

Filed Under: scams, spyware

Bogus Spyware Scan Companies Held In Contempt Of Court

from the like-they-care dept

Earlier this month, we noted that the FTC had cracked down, yet again, on a company for putting up a bogus spyware scanner. The company would get people to their site where it would supposedly "scan" their hard drive for spyware. Of course, the scan was entirely bogus, and the scan would always tell you that your computer was rife with spyware. Then the site would tell you to buy its anti-spyware product for about $40. Of course, that anti-spyware product did absolutely nothing. The FTC ordered the company to shut down, but apparently the company is ignoring the order. It's now reached a point where a court has found the company in contempt and ordered it to pay $8,000/day until it complies. The execs in the company have had their assets frozen and the judge is now threatening to have them arrested. Sure, scamming may be easy money, but you would think these guys would at least shut down this operation and move on to some other bogus scam, rather than outright ignoring the court and the FTC.

Update: Now it comes out that these sites are using URL redirectors via Microsoft and the IRS to make people think they're legit.

Filed Under: contempt of court, spyware

FTC Shuts Down More Bogus Spyware Scan Companies

from the here-we-go-again dept

A few years back the FTC shut down some scam fake anti-spyware companies that would advertise "free scans" of your computer and would then (of course) tell you you had spyware. The scam, of course, was that for a fee of only $30 or $40, you could buy their "software" that would supposedly rid your computer of spyware. Of course, your computer probably didn't already have spyware, and the software you bought certainly wouldn't do anything towards ridding your computer of any actual spyware. It looks like some new scammers have picked up where the old ones left off, because the FTC is announcing, yet again, that it's been able to shut down some bogus anti-spyware operations. Apparently, this operation was slightly more scammy, because advertising networks have stopped accepting ads for such bogus anti-spyware. So, instead, they pretended to place ads for legitimate companies, but then used some code to swap out the "good" ad with the bogus anti-spyware ad.

Filed Under: ftc, scams, scans, spyware

Is The Original Spyware Company Finally Dead?

from the a-milestone dept

For nearly a decade, we've followed the changing business of what was originally called Gator. When it first launched, back in 1999, the company was offering an e-wallet product, and even though there were many such things on the market, Gator insisted that it was first. When it turned out that there wasn't much of a market for an e-wallet product, the company quickly morphed its business into popping up ads over existing ads -- which resulted in a whole bunch of lawsuits. It didn't take long before Gator realized that people didn't really want its software popping up ads, so it began tricking users into downloading. As many folks recall, Gator was one of the first real "spyware" companies -- tricking users into downloading a product that watched what they surfed and popped up ads.

As the whole spyware (the companies in the space preferred the adware label) got a bad name, Gator first threatened to sue anyone who called its product spyware, and then eventually decided to shed the baggage of the Gator name and renamed itself Claria. -- insisting that it was now a legitimate advertising firm. Except, the charges of spyware kept flying in Claria's direction. The company tried and failed to go public, and then, once again, insisted that it was getting out of the adware business and moving into "behavioral advertising" -- which, most people realized was just another term for what it had been doing in the past.

Plenty of folks were shocked when rumors started spreading that Microsoft wanted to buy Claria, though, the public backlash to the "leaked" rumor was so harsh that Microsoft very quickly backed away from those plans. So, without being able to IPO or sell itself -- and with a still awful reputation as a spyware provider, the company tried to change once again.

The company insisted (yet again) it was getting out of that old sketchy business, and tried to launch a "portal" that would provide relevant content based on how you surfed. In other words: it was still in the spyware business, just positioning it under a better name. The company did try and fail to sell off its traditional adware business.

After that, honestly, we hadn't heard much of a peep out of the company. Despite launching its portal to great fanfare (we were inundated with PR spam from the company about this great "portal" idea), it didn't seem to get any traction. We apparently missed the news that recently the company (through a somewhat complex transaction) changed its name, yet again, to JellyCloud. Basically, the same exec team started a new company just a few months ago, raising another $11.5 million, and then took over Claria, though carefully hid all connections to its past, claiming to be just another online advertising company.

However, Valleywag is now reporting that the company shut down this weekend (despite having just raised all that money, and not counting all the money it raised in the past). If so, it's a rather quiet end for the company that really did become synonymous with the "spyware" term, and helped create that whole space.

Filed Under: adware, out of business, spyware
Companies: claria, gator, jellycloud

UK Police Stop Phorm Investigation, As They Don't See Any Criminal Behavior

from the civil,-however.., dept

While American competitor NebuAd may be on the verge of shutting down, it appears that Phorm, the controversial clickstream tracking, behavioral ad company that focused mainly on the UK market, may be dodging a series of bullets. First, the government said that clickstream tracking could be legal if the situation was clearly explained to customers and there was an obvious mechanism for opting out. Now, UK police are dropping their own investigation of earlier trials with BT, which many believed were illegal because they were done with no notice to consumers at all, and no way to opt-out. That would seem to go against the government's earlier statements, but the police are saying that there's no evidence that this is a criminal matter -- which would leave this open to civil lawsuits from individuals who were impacted by the trials.

Filed Under: clickstream tracking, isps, legality, spyware, uk
Companies: phorm