In April I mentioned WhenU’s suit against the state of Utah, challenging Utah’s recent Spyware Control Act. Oral argument took place yesterday and today as to WhenU’s motion for preliminary injunction.
Consistent with case filings, WhenU claimed that the company cannot reliably determine which users are in Utah and which are elsewhere. However, documents presented in the hearing showed that WhenU offers its advertisers the service of showing their ads only in particular locations, including in particular states.
Counsel for the state of Utah also asked WhenU’s CEO about WhenU’s display of advertising for online gambling and for online liquor sales. My testing demonstrated that WhenU shows such ads in Utah, but longstanding Utah law is thought to prohibit these ads. So WhenU will have to develop — arguably, already should have developed! — systems to avoid showing these ads in Utah. WhenU has criticized the Spyware Control Act, claiming that compliance would be difficult and costly. But WhenU must satisfy Utah’s gambling and liquor laws independent of the Spyware Control Act. So much for the purportedly high burden of Utah’s spyware regulation.
In my own oral testimony, I explained the methods of installation and operation of spyware. In one notable section, I showed videos of WhenU software installed via drive-by downloads with defective license agreements, such that even when a user requested to view WhenU’s license agreement, the license was not available.
Details in WhenU.com, Inc., v. The State of Utah – Case Documents. The hearing will conclude on June 22, 2004, and the Court’s decision is expected thereafter.
Today I presented Empirical Research on Search Engine Omissions at Computers, Freedom, and Privacy (CFP) in Berkeley, CA. My presentation focused on two prior empirical projects in which I documented sites missing from Google search results: Localized Google Search Result Exclusions (documenting 100+ controversial sites missing from google.de, .fr, and .ch) and Empirical Analysis of Google SafeSearch (documenting thousands of unobjectionable and non-sexually-explicit sites missing from google.com when users enable Google’s SafeSearch feature to attempt to omit sexually-explicit content).
On Monday I was in DC for the FTC‘s Spyware Workshop. I thought the final panel, Governmental Responses to Spyware, did a fine job of explaining the legislative options on the table, and of noting the pressure to address the problem of spyware for the large and growing number of affected users. But I was dismayed that the first panel (Defining Spyware) classified as fine and unobjectionable certain programs that, in my experience, users rarely want, yet often find installed on their computers. Key among these undesired programs are software from Claria (formerly Gator) and WhenU. The technical experts on the second and third panels agreed that these programs pose major problems and costs for users and tech support staff. Yet the first panel seemed to think them perfectly honorable.
Also puzzling was a new position paper from the Consumer Software Working Group recently convened by CDT. Examples of Unfair, Deceptive or Devious Practices Involving Software (PDF) purports to offer a listing of bad behaviors that software ought not perform. It certainly lists plenty of behaviors that so outrageous as to be beyond dispute. But what it misses — indeed, ignores — are the harder cases, i.e. the programs that make spyware a more complicated issue, and the programs that affect the most users. For example, the Examples document condemns software installed without any notice to the user. It is silent about — and thereby is taken to endorse — the far more typical practice of showing a user a license agreement and/or disclosure that describes the software in euphemisms, but admittedly does provide at least some notice of the software’s purpose.
What to make of the document’s failure to consider the methods actually used by the controversial software with highest installation rates? Perhaps one explanation is that Claria and WhenU helped draft the report! (See the signators listed on page five.) That said, the document doesn’t purport to be comprehensive. Perhaps a future version will address the problems of drive-bys and euphemistic, lengthy, or poorly-presented licenses.
For more on the workshop, and another critical reaction, see other attendees’ notes on dslreports.com forums (especially a recent post by Eric Howes). See also impressive studies from PC Pitstop showing that more than 75% of Gator users don’t even know they have Gator (PDF) (not to mention consenting to Gator’s license agreements) and more than 85% for WhenU (PDF).
See also a transcript of the workshop (PDF).