Is anti-spyware always on your side?
Connecting state and local government leaders
Certainly you'd expect that the anti-spyware software you buy will shield your computer from snooping programs planted by the malicious and the opportunistic.
But should the anti-spyware program providers also shield you from the implanted machinations of multinational corporations or even law enforcement agencies? Does the owner of the computer being scanned have sole authority over that machine? Or can the security software company protecting that machine make other alliances?
It's a terribly abstract set of questions, though ones I've never heard good answers for. It came up a few years back when Sony embedded rootkits into some of its music CDs. Sony used this software to try to prevent excessive copying of music, but the software, which Sony purchased from a third-party vendor, actually was built upon a rootkit. When played on a computer's optical drive, the CD would bury the rootkit deeply into the system, making it invisible to home users and exploitable by evil-doers.
Sony eventually recognized its error. But what was unsettling was how sluggishly the normally responsive anti-spyware vendors reacted to the appearance of these rootkits. Even though they came from a respected company, they could have been used to damage a computer just as badly as any other rootkit. Eventually Symantec and others recognized the danger, but not without a little delay and public outcry.
Last summer, when I got a chance to interview Ajei Gopal, the then-chief technology officer for Symantec, I asked him if anti-spyware should always act solely in the interest of the buyers of that software. In other words, if Sony wants to snoop, even for seemingly benign reasons, should Symantec raise a flag for its users? His answer was surprisingly equivocal.
"It's a tough case. It's an issue-by-issue basis," he told me at the time. "What we're concerned with this when we think about it is how do we deal with an evolving threat landscape? Rootkits represent one aspect of the landscape, but there are so many threats you have to worry about. You solve the individual elements but you have to provide a holistic solution."
Not a very clear answer. Holistic for who? But maybe I didn't ask the question precisely enough.
Fast forward one year. CNET reporter Declan McCullagh and Anne Broache recently conducted an interesting survey among 13 anti-spyware vendors. They asked that, if federal investigative authorities installed spyware on the machines of suspected wrong-doers, would the anti-spyware companies silently go along? In other words, if any of those suspects used the company's anti-spyware software, would that software not alert them as to the existence of the law enforcement's spyware?
The answers he found may have been largely good news for the nefarious users of anti-spyware software, and largely bad news for the law enforcement agencies. But like Gopal's explanation a year before, the answers remain curiously ambivalent overall.
Some companies were resolute at not co-opting with outside sources. "Our customers are paying us for a service, to protect them from all forms of malicious code," someone from eEye Digital Security told CNET. Others however appear to be more accommodating to outside interests. A Check Point representative noted that the company kept a whitelist for "legitimate third-party vendors" according to the article.
CNET is looking at this issue from the perspective of civil rights ' whether anti-spyware software vendors would help federal agencies spy on citizens. But that question also has revealing implications about the sovereignty of federal agency computers as well.
To what extent can an agency steeped in sensitive information trust anti-spyware providers not to allow third-parties ' even respected ones ' to introduce vulnerabilities or to collect innocuous operational data? Are these agreements and whitelists made known to the customers? When the stakes get high, can commercial software anti-spyware even be used? The answers have thus far been muddy at best.
NEXT STORY: NASA outsources supercomputer support