Written Nov. 2000
Authors: Rom Yatziv and Clark S. Turner, J.D., Ph.D.
Associate Professor of Computer Science
California Polytechnic State University
Reprinted with permission of the authors
Abstract:
Radiate, like many other companies since the creation of
the Internet, is relying on advertising and user information
for its income. In this particular case, however, it is possible
that users' rights are being circumvented, and Radiate may
be poking its nose in private places without proper authorization.
This paper looks at Radiate and its software module, and attempts
to determine whether it is spyware, based on the ACM Software
Engineering Code of Ethics.
For your convenience since this article is quite long we
are also including this article as a downloadable PDF file
Spyware-Radiate.pdf
Introduction
Spyware, according to whatis.com, is "any technology
that aids in gathering information about a person without
their knowledge. On the Internet, spyware is programming that
is put in someone's computer to secretly gather information
about the user and relay it to advertisers or other interested
parties. Data collecting programs that are installed with
the user's knowledge are not spyware, if the user fully understands
what data is being collected and with whom it is being shared."
This subtle distinction between spyware and legitimate data-collection
mechanisms is the issue at hand. I will attempt to determine
the ethics of Radiate's (previously known as Aureate) business
practices, using the Software Engineering Code of Ethics as
my baseline. I will look at whether Radiate's module is, by
definition, spyware, or a legitimate data-collection mechanism.
Take note that this research was completed in November of
2000, and since then Radiate may have taken actions to remedy
the situation in discussion.
Scenario: Part 1: Downloading the Program
We will follow the average user's (let's call him Erik) path
though BinaryBliss.com, Radiate's download site. Although
there may be any number of other points of entry (www.download.com,
personal homepages, etc), this is the most easily regulated
one and thus gives Radiate the benefit of the doubt. Radiate
posts a tiny link to their privacy policy on the second to
last line of their homepage (Figure 1). Although this is common
of most online companies, it is very small, and can be easily
missed.
figure 1
We will assume that Erik neither saw nor clicked this link.
Let's suppose Erik decided to download the program labeled
as the top download (figure 2). We will attempt to download
this program, called “Hey.Beer.Man”; after downloading
a few other programs, I can safely assume that all downloads
that originate in BinaryBliss.com follow this path.
Clicking the “Hey.Beer.Man” link2 loads an intermediate
page where Erik can read a short description of the game,
as well as view a screenshot. Clicking “Download Now!”10
brings us to an important section: the End User License Agreement
(EULA)3.
| Near the top of the page Figure
2 is displayed. This should make some sense to Erik, even
though he is not technically oriented. However, Radiate
is being vague: they will use your connection to "send
and receive data;" what sort of data? |
 |
I was moderately impressed with what I saw here. Near the
top of the page, this is displayed (figure 3). This should
make some sense to Erik, even though he is not technically
oriented. I say moderately, though, because Radiate is being
extremely vague here. They say that they will use your connection
to “send and receive data,” but they don't make
any reference to what sort of data this is. As far as Erik
is concerned, this “data” is the program that he
is about to download. As expected, they provide an “I
agree” link before the actual text of the agreement.
Let's give Radiate the benefit of the doubt, and assume that
Erik actually read through the EULA; following are some excerpts
from the EULA.
"This SOFTWARE PRODUCT is "advertiser
supported software," These advertisements are delivered
via the Internet and will be downloaded from the servers of
Radiate this software will connect to the Internet UBIQUITOUSLY
to download advertisements "
[http://www.binarybliss.com/eula.asp?aid=972].
Here, Erik learns that their software will access the Internet
"ubiquitously" to download the company's lifeblood:
advertisements. Additionally, the EULA provides a link to
Radiate's Privacy Policy.
Here they are defining what the aforementioned “data”
is. Erik learns that their software will access the Internet
“ubiquitously” to download its and the company's
lifeblood: advertisements. Further, he learns that even though
they are using his bought bandwidth to download data, he does
not actually have any right to this data:
“All title and copyrights in and to the SOFTWARE PRODUCT
..., the accompanying printed materials, and any copies
of the SOFTWARE PRODUCT are owned by Radiate or its authorized
agents. As a licensee, you own the media on which the SOFTWARE
PRODUCT is recorded, but Radiate and all Third Party Suppliers
retain title and ownership to the SOFTWARE PRODUCT recorded
on the media and all copyright and other intellectual property
rights therein. This license is not a sale of the software
or any copy. Except as may be required under applicable
law, you agree not to alter, decompile, disassemble, or
reverse engineer the SOFTWARE PRODUCT, in whole or in part,
whether for error correction or otherwise. The SOFTWARE
PRODUCT is protected by copyright laws and international
treaty provisions.”3
To an extent, this makes sense: Erik is getting the software
for no cost to him. There is, of course, no free lunch; he
does not own any of what he just downloaded; he may merely
use it. The idea of separating the hard drive and the information
that is stored in it seems a bit radical to me. Does this
mean that the software can do anything it wishes, for example,
connect once every fifteen minutes to a central database and
report information, since it's not technically yours, and
you cannot legally do anything about it?
Additionally, the EULA provides a link to Radiate's Privacy
Policy; we shall go back and examine it later.
| In the case that Erik did
not read the EULA, but merely clicked the red link, he
is now allowed to download the host program. |
 |
Soon after he double-clicks the icon to
install the program, he is presented with a box that contains
a document similar to Radiate's EULA; in fact, it is a
superset of that EULA. |
| Aureate's EULA is presented
before that of the host program. |
Effectively, though, none of these warning are of much use.
We assumed that Erik, the average Internet user, would stop
and read any of these user agreements. This is very likely
an incorrect assumption, simply because of the average user's
attention span and interest in legal documents.
Scenario: Part 2: Installing the Program
What happens if, as is usually the case, none of the warnings
are read? Let's assume this is the case, and that Erik indeed
read none of the warnings or user agreements, has downloaded
and installed the program, and is now going to run it. The
program does not create an icon on the desktop, so Erik must
use the Start menu to access the program. If he knows anything
about the state of his computer, he will notice that there
are two new entries to the start menu (Figure 5).
The new links allow Erik to read about what he is getting
into. Here again, he is pointed to Radiate's Privacy Policy.
If he follows the "Advertising" menu, he is given
the opportunity to edit the information he is providing to
Radiate, as well as have the Radiate module removed from his
system. Other than the aforementioned, there is no visible
trace of the module.
This, however, is a best-case scenario. Many host programs,
like the second top download, "DigiCams - The WebCam
Viewer," do not present the EULA upon installation, and
do create a desktop icon. Also, the Radiate Start menu section
is not created. Erik has no way of knowing that the Radiate
module is installed on his computer.
Scenario: Part 3: The Radiate Tools: and Removal
Assuming that the Radiate menu was added to the Start menu,
Erik can now see what information is being saved and sent
to the Radiate servers. You can see the profile in the three
screens below:
As you can see, information ranging from Erik's name,
to his hobbies, to his occupation is being collected. In this
case, there is no information being collected, since nothing
was entered. It is possible, however, that some programs,
before you can use them, require you to give a subset of this
information.
If Erik is at all technologically savvy (although the average
computer user is not, we will assume he is in order to allow
this scenario), he will by now have some idea of what Radiate
does, and may want to remove the module from his machine.
Upon clicking the "Uninstall" link, he is presented
with this a warning prompt. After clicking "Yes"
there, Erik is told that the Radiate module was successfully
uninstalled.
The Questions
Radiate is treading the fine line between spyware and legitimate
data-collection software; has this line been crossed? What
does the Software Engineering Code of Ethics say about this
matter?
Radiate's Case
To argue this side of the dispute, we will examine Radiate's
Privacy Policy:
"Radiate delivers content to computer
software applications that use Radiate's technology. Radiate
will sometimes query you for demographic data All of this
information is aggregated If you have already submitted this
information and would like for us to remove it from our files,
please contact us at the email address privacy@Radiate.com.
We will use reasonable efforts to delete your information
from our existing files."
[http://www.radiate.com/privacy.html].
This is an excellent and fair business strategy. They collect
information about users of their program that they use to
target their ads, and thus increase their revenue. They use
this money to make more programs accessible to people who
would not otherwise be able to use them.
| Radiate makes two good points. First,
they collect non-personally-identifying information in
good faith and use that information only in the aggregate.
Second, they give those who do not want to give their
information the opportunity to opt out. Erik must simply
send his request to privacy@Radiate.com, and he will be
removed in a "reasonable" amount of time. Via
their EULA and Privacy Policy, Radiate complies with canon
1.06 of the Code: |
 |
- 1.06. Be fair and avoid deception in all
statements, particularly public ones, concerning software
or related documents, methods and tools.
If accessing software through Radiate's website, BinaryBliss.com,
the user agreement that is presented before giving the user
access to the software explains clearly what the Radiate module
does.
If Erik decides that, given all this information, he does
not want the Radiate module on his machine after all, he is
given the capability to remove it, as you saw in figure 5.
Canon 1.02 of the Code looks positively upon this:
- 1.02. Moderate the interests of the software
engineer, the employer, the client and the users with the
public.
Although Radiate and the host companies may not like it,
the users (the public) are given the opportunity to get rid
of the spyware module.
If Erik does this, none of the host programs installed on
his machine will function, but that is the consequence he
must deal with.
Radiate even takes the time to personally dispel the widespread
talk regarding activities of its module:
“Recently there have been false rumors circulating that
Radiate (formerly Aureate Media) is secretly collecting data
from users of software in the Radiate Network. These rumors
have included accusations such as collecting hard drive information,
tracking where users surf, stealing system registry information,
and 'spying' on user activity. All of these accusations are
false.”5
They are aware of their negative public image, and have begun
taking steps in order to be in the public's favor. Just last
year, none of the aforementioned warnings were presented when
installing host programs.
Backing up Radiate's word are three external, reputable sites,
linked to from the http://www.radiate.com/privacy/falserumors.html,
as well as three internal sources. According to McAfee, “initial
analysis of code by Aureate was taken out of context and should
not have been publicized as the initial study was not complete.
There is no basis to substantiate the claim or accusation
and is therefore false.”6 Similarly, the Vice President
of Technology for Ziff-Davis claims that “After sorting
through all the rhetoric, I see no evidence that Radiate has
ever attempted to match identities with profiles or use what
profile information it has collected for anything other than
matching ads to interests.”7 The provisions we have discussed
are an important step forward, and comply with canon 1.05
of the Code:
- 1.05. Cooperate in efforts to address matters
of grave public concern caused by software, its installation,
maintenance, support or documentation.
When the rumor that the module is secretly reading private
information stored in host computers was spread, Radiate eventually
responded with authorities backing its claim.
As you can see, Radiate is not involved in any bad business
practices. It is, in fact, doing the public a great service
by bringing them software that they would have not otherwise
had free, legal access to. Meanwhile, Radiate is profiting
from these transactions. This relates to canons 1.07 and 3.08
of the Code:
- 1.07. Consider issues of physical disabilities,
allocation of resources, economic disadvantage and other
factors that can diminish access to the benefits of software.
This is exactly why Radiate is in business. They are bringing
software, free of charge, to the entire community.
- 3.08 Ensure that specifications for software
on which they work have been well documented, satisfy the
users' requirements and have the appropriate approvals.
The “users” in this case are not the end users,
but the host companies. The requirements are to be able to
have a revenue source while supplying free software; they
are met.
Radiate has been forthcoming in every way regarding what
its program does, and has given its end users many chances
to opt out of the information collection. It has thus not
performed any unethical actions, and any case claiming that
it has is moot.
The Public's Case
Despite Radiate's efforts to better their image, they are
failing miserably. There are three major problems with their
business practices that they seem to fail to recognize:
First, they are not telling the public everything it wants
to know in a straightforward manner. I had to read two multi-page
legal documents3,4 before I had an idea of what exactly they
are doing. If their target audience is Erik, the average home
computer user who knows how to surf the net, read email, and
not much more, then they need to describe exactly what they
do in terms that Erik can easily, and quickly understand.
Radiate needs to force each and every one of their host companies
to display a short, easy-to-read, and to-the-point paragraph,
detailing exactly what is about to happen. This way, the Radiate
module would no longer be spyware, since Erik is fully aware
of what is happening with his machine. Canons 2.07 and 3.12
address this:
- 2.07. Identify, document, and report significant
issues of social concern, of which they are aware, in software
or related documents, to the employer or the client.
The plain fact that anyone has any reason to call the module
“spyware” is proof enough of social concern that
is not being addressed (reported).
- 3.12. Work to develop software and related
documents that respect the privacy of those who will be
affected by that software.
The end users, e.g. Erik, are victims of a breech of privacy,
as their activities are being monitored. Whether the user
knows what is going on or not, their privacy is still violated.
Even if the module is not spyware, it still breeches canon
1.03 of the Code;
- 1.03. Approve software only if they have
a well-founded belief that it is safe, meets specifications,
passes appropriate tests, and does not diminish quality
of life or privacy or harm the environment. The ultimate
effect of the work should be to the public good.
The Radiate module may be safe and meet its specifications,
but it diminishes its users' privacy. A claim saying that
this is not true based on warnings before installing the software
is moot. Again, whether the user knows what is going on or
not, their privacy is still violated.
Second, they claim to provide an uninstall option for their
module (figures 5 and 7). As far as Erik is concerned, there
is not a trace of the module left on his machine after the
uninstallation process is completed. This, however, is not
the case. I used Gibson Research Corporation's8 OptOut program
to verify that Radiate had indeed done what it claimed to
do. To my dismay, but not necessarily surprise, the screens
in figure 9 appeared. The log generated gave some more information.
OptOut Activity Log & Report:
~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~
OptOut Registry Analysis on: 11 / 05 / 2000 at 15:58
• Searching System Registry
• Searching all seven system root registry branches
for the "SOFTWARE\Aureate" key
• Not found under HKEY_CLASSES_ROOT
• Not found under HKEY_CURRENT_USER
• Not found under HKEY_LOCAL_MACHINE
• Not found under HKEY_USERS
• Not found under HKEY_PERFORMANCE_DATA
• Not found under HKEY_CURRENT_CONFIG
• Not found under HKEY_DYN_DATA
• Aureate keys were not found in the registry
• Searching the Windows registry "SharedDLLs"
key for known Aureate DLLs
• Reference found to Aureate DLL: anadsc.ocx
• Reference found to Aureate DLL: advertx.ocx
• 2 Aureate DLLs are referenced in the registry!
• Searching the Windows registry for Netscape
and IE web browser Aureate Process Parasites.
• Process Parasite references were not found
2 Adbot/Spyware entries were found in the registry!
OptOut Deep Drive Scan on: 11 / 05 / 2000 at 16:09
• Scanning Drive C: for known problem files
• Found Aureate file: anadsc.ocx. Last accessed:
11 / 05 / 2000 -- earlier today!
• File path: C:\WINDOWS\SYSTEM\anadsc.ocx
• Found Aureate file: advertx.ocx. Last accessed:
11 / 05 / 2000 -- earlier today!
• File path: C:\WINDOWS\SYSTEM\advertx.ocx
• Found Aureate file: adimage.dll. Last accessed:
11 / 05 / 2000 -- earlier today!
• File path: C:\WINDOWS\SYSTEM\adimage.dll
• Found Aureate file: ipcclient.dll. Last accessed:
11 / 05 / 2000 -- earlier today!
• File path: C:\WINDOWS\SYSTEM\ipcclient.dll
• Found Aureate file: msipcsv.exe. Last accessed:
11 / 05 / 2000 -- earlier today!
• File path: C:\WINDOWS\SYSTEM\msipcsv.exe
• Found Aureate file: tfde.dll. Last accessed:
11 / 05 / 2000 -- earlier today!
• File path: C:\WINDOWS\SYSTEM\tfde.dll
• Found Aureate file: htmdeng.exe. Last accessed:
11 / 05 / 2000 -- earlier today!
• File path: C:\WINDOWS\SYSTEM\htmdeng.exe
• Found Aureate file: advert.dll. Last accessed:
11 / 05 / 2000 -- earlier today!
• File path: C:\WINDOWS\SYSTEM\advert.dll
• Found Aureate file: amcis.dll. Last accessed:
11 / 05 / 2000 -- earlier today!
• File path: C:\WINDOWS\SYSTEM\amcis.dll
• Found Aureate file: amcis2.dll. Last accessed:
11 / 05 / 2000 -- earlier today!
• File path: C:\WINDOWS\SYSTEM\amcis2.dll
10 known problem files were found on Drive C: !
• Scanning Drive D: for known problem files
This system's Drive D: is completely clean
OptOut Deep Scan Finished: 11 / 05 / 2000 at 16:09
You can see that, contrary to what Erik thinks, the Radiate
module still contaminates his machine. It appears that Radiate
simply removed the registry keys that identify it. Not only
did it not remove the files performing the data transfers,
but there is now no way to tell via the registry that it still
exists!
Since the Radiate controversy began, Radiate released another
piece of software that supposedly removes everything related
to Radiate from the host machine. Radiate describes it as
follows:
“In some cases, uninstalling software that uses our
technology may fail to properly uninstall our ad-serving component.
In this case, you can use our DLL Remover to remove any remaining
files from your computer. Click here to download the DLL Remover
utility.”5
According to this statement, there should now be absolutely
no trace of any Radiate software on Erik's computer. I ran
Radiate's DLL Remover, and then GRC's OptOut once more. The
following is an excerpt from the generated log:
OptOut Activity Log & Report:
~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~
OptOut Registry Analysis on: 11 / 05 / 2000 at 16:32
The system registry is completely clean
OptOut Deep Drive Scan on: 11 / 05 / 2000 at 16:33
• Scanning Drive C: for known problem files
• Found Aureate file: advert.dll. Last accessed:
11 / 05 / 2000 -- earlier today!
• File path: C:\WINDOWS\SYSTEM\advert.dll
• Found Aureate file: amcis.dll. Last accessed:
11 / 05 / 2000 -- earlier today!
• File path: C:\WINDOWS\SYSTEM\amcis.dll
2 known problem files were found on Drive C: !
OptOut Deep Scan Finished: 11 / 05 / 2000 at 16:33
This scenario is covered by canon 3.10 of the code:
- 3.10. Ensure adequate testing, debugging,
and review of software and related documents on which they
work.
As you saw with both of Radiate's attempts at uninstalling
their own software, at least this portion of the project has
not been fully tested.
Even their own special purpose utility was unable to remove
all traces of their module from the machine. And they are
surprised that the public does not like them!
Finally, I tested their public relations response. I sent
an email to them, asking in a friendly tone to know exactly
what their program is doing in the background, and what they
have done in the past year to better their public reputation.
The email was sent to:
Headquarters: info@radiate.com; East Coast Sales, David Kates,
kates@radiate.com; West Coast Sales, Scott Verel, verel@radiate.com;
general sales information, sales@radiate.com; Director of
Corporate Communications, Peter Fuller fuller@radiate.com;
Director of Marketing, David Reichwein, reichwein@radiate.com;
Director of Sales, Randy Lewis, lewis@radiate.com9. Almost
three weeks after having sent the email, I have received neither
a reply, nor a confirmation of having sent the email in the
first place. In this case, the previously mentioned canon
1.05 is being breeched: they did not respond to the public
when asked simple questions relating to the ethics of their
module.
The Software Engineering Code of Ethics
The clear applications of the Code have been presented as
they have come up. There is, however, a canon whose application
to Radiate is ambiguous:
- 3.13. Be careful to use only accurate data
derived by ethical and lawful means, and use it only in
ways properly authorized.
One could argue that the module was installed without the
users' notice, and thus the data collection is unethical.
In some cases, this may indeed be the case. However, if, as
with “Hey.Beer.Man,” notice was given prior to installation,
then lack of ethics or illegality cannot be argued. Regarding
authorization, the same scenario applies; depending on the
way the software was obtained, the user could or could not
know (have read and agreed to the EULA) what was going on.
Conclusion
When I began researching for this paper, I was looking for
information that would incriminate Radiate's business practices;
I found this information in vast quantities. Ironically, though,
I also found much information that advocates Radiate's business
plan. I think that, if they cleaned up their business practices,
quality assurance, and really controlled the sources of their
host programs, the public would not have a leg to stand on.
The public's argument stems from the fact that in many cases,
Radiate's module is installed with user authorization. If
Radiate made absolutely sure that every program that was distributed
as shareware under their name would adhere to strict standards
of providing the user clear, easy-to-read information about
what the Radiate module does, Radiate would be home free.
Their business plan, in my opinion and according to the Code,
is ethical; it is their lack of control over their market
that provides the controversy.
Sources Cited
1 http://www.binarybliss.com/
2 http://www.binarybliss.com/TopTenDownloads.asp
3 http://www.binarybliss.com/eula.asp?aid=972
4 http://www.radiate.com/privacy.html
5 http://www.radiate.com/privacy/falserumors.html
6 http://vil.nai.com/villib/dispVirus.asp?virus_k=98516
7 http://www.zdnet.com/eweek/stories/general/0,11011,2478459,00.html
8 http://www.grc.com
9 http://www.radiate.com/about/contact.html
10 http://www.binarybliss.com/product.asp?aid=972
Figure 1: http://www.binarybliss.com/
Figure 2: http://www.binarybliss.com/TopTenDownloads.asp
Figure 3: http://www.binarybliss.com/eula.asp?aid=972
Figure 4: License Agreement within installation process of
“Hey.Beer.Man”
Figure 5: Start menu post “Hey.Beer.Man” installation
Figure 6: Screens brought up by “Edit Your Profile”
link from “Advertising” submenu of “Radiate”
menu
Figure 7: Radiate uninstall confirmation screen
Figure 8: http://www.radiate.com/consumers/free/form.html
Figure 9: Gibson Research Corporation's OptOut
