Security threats Toolkit

AIM add-on prompts spyware concerns

Tags:
Aim,
AOL,
Spyware

Jim Hu CNET News

Published: 03 Mar 2004 18:05 GMT

America Online began offering games along with the latest version of its instant messenger, and now some customers are worried that the company is playing with them, too.

People who use AOL Instant Messenger (AIM) have started complaining on AOL message boards and publications such as BroadbandReports.com after software bundled with AIM 5.5 began showing up in "spyware" scans. The popular chat application includes games from WildTangent, which has a tool that reports back to the company every time someone uses its products.

WildTangent chief executive Alex St. John denied that his company is doing anything improper. "It's not doing anything sneaky; it doesn't pop up anything," he said. "It tells us how popular a piece of content we release on the Internet is."

Benign or not, the software and the controversy it has sparked highlight growing sensitivity among consumers over unexpected surprises accompanying free software downloads over the Net -- and the potential backlash facing companies that seek to quietly gather data on their customers.

Web surfers have zeroed in on concerns about spyware and its "adware" cousin, which is software that can lead to unwanted advertising pop-ups, changes in computer settings and other unexpected tweaks. Spyware has become an issue of concern among consumers, companies, privacy experts and even members of Congress.

All of those parties are concerned about the security threat to consumers and businesses over software that can steal sensitive information without their knowledge. An anti-spyware bill has been introduced by Representative Mary Bono, a California Republican, to outlaw these programs, and a consortium has been formed to study and define it.

The issue has raised also significant questions about disclosure, with advertising and tracking features sometimes buried in lengthy licensing agreements, if they're mentioned at all. Some AIM 5.5 customers say they were surprised to discover that some of their activities are being tracked, and they criticised AOL for failing to better flag their practices.

"I realise most/all of the software we are talking about is free, but dammit, tell us up front what the software is going to do and let us decide before we install if we wish to comply," wrote one irate poster on an AIM message board.

AIM 5.5's licensing agreement includes broad language that covers third-party software. It states that all third-party programs are considered part of AIM and that by agreeing to install AIM, people agree to install everything that comes with it.

"This is a key component of the AIM experience," AOL spokesman Andrew Weinstein said. "It's software integrated into AIM to provide gaming functionality to AIM users, and that functionality has proven extremely popular."

The flip side
Not all monitoring software is considered insidious. Products ranging from automatic update clients to "adware" programs often found with digital media players commonly appear on anti-spyware scans. These programs are generally accepted by many Web users as necessary byproducts for using popular Web software.

For example, an anti-spyware scans can often reveal common applications, such as components in Microsoft's Windows XP operating system, Apple Computer's iTunes, RealNetworks's RealPlayer and elements of AOL's proprietary online service. And although some people reject any information-gathering programs on their computers, others are more accepting of monitoring programs if they receive popular services in exchange.

The WildTangent software does not collect personal information that can be linked to individuals, according to WildTangent's Web site. The program tracks how often and how long people play their games, and it offers updates to its software.

Anti-spyware vendors defended their decision to include the WildTangent software in their scan reports, saying that any software behavior that launches without adequate warning on a PC should be considered suspect.

"If they're not telling you what they're doing, then that's not right," said Roger Thompson, vice president of product development at computer security company Pest Patrol.

WildTangent's St. John added that he understands the alarm surrounding the spread of spyware and adware on the Internet.

"It's hard to blame user paranoia," St. John said. "But if you're a legitimate company trying to be a good citizen, it's damaging to us as well."

For AOL's part, filtering out monitoring software has become one feature it hopes will help sell subscriptions to its online service. The company in January said it will begin bundling anti-spyware software with future versions of its AOL 9.0 Optimized service. The program will scan a subscriber's computer at regular intervals while letting people delete files they deem potentially harmful.

"Not only is AOL adamantly opposed to all types of spyware and adware, we are actively working to help our users protect themselves from such programs," AOL's Weinstein said.

Currently, AOL offers anti-spyware software as a separate download.

CNET News.com's John Borland contributed to this report.