Watchdog group backs off Microsoft

TRUSTe of Palo Alto, Calif., instead chided Microsoft (Nasdaq:MSFT) over its use of an identifying number that could be used to trace the authors of some electronic documents even when they want to remain anonymous.

The group said Microsoft's uses of the number "compromise consumer trust and privacy." But TRUSTe said it will take no further action as an online guardian because the dispute involved Microsoft's commercial software, not the company's Internet site.

An awkward situation
Critics pressing for new federal privacy laws said TRUSTe's awkward role of being asked to investigate one of its biggest donors illustrates the risks of letting the industry regulate its own behavior.

The White House has consistently urged the Internet industry to find ways to police itself or face possible new privacy legislation from Congress.

"This really undercuts the whole administration's claim that self-regulation works," said David Banisar, a staff lawyer at the Electronic Privacy Information Center in Washington. "This was the big one. This was Microsoft, the major computer company in the United States. And they just missed it."

TRUSTe receives $100,000 annually each from Microsoft and nine other sponsors. It agrees to regulate Internet privacy policies for about 500 companies in exchange for a fee and a seal of approval for their Web sites to reassure online customers.

But TRUSTe said a bug in Microsoft's Windows 98 software that permitted the company to harvest identifying numbers did not violate privacy promises it made with TRUSTe over its Internet site.

"When consumers go to a company and see a statement of a privacy policy, they expect that will deal with their data for that company regardless of whether it's on the Web," complained Deirdre Mulligan of the Center for Democracy and Technology, an Internet civil liberties group. "Is there a self-regulatory remedy that gets to problems not at the Web site?"

MS promises to make amends
TRUSTe could have denied Microsoft use of its seal of approval.

"We followed our methodology when we deal with any consumer dispute," said Susan Scott, the group's executive director. "We did not treat Microsoft any differently than any of our other licensees we have received complaints on."

Jason Catlett, who filed the complaint, said he never seriously expected TRUSTe to investigate Microsoft.

"Believing in self-regulatory seal programs is like dealing with a shady insurance company," said Catlett, who runs Junkbusters Corp., a privacy group. "The policy looks impressively long, but when something goes wrong, they point to a piece of fine-print legalese and you're left with zip."

Microsoft confirmed earlier this month that its latest version of Windows generates a unique serial number for each computer. That number partly is planted within some documents created with its popular collection of Office 97 business programs, which include Word and Excel.

Those numbers are part of a 32-digit identifier created by Windows 98 whenever customers register their software with Microsoft.

Separately, the company acknowledged it may have been collecting those serial numbers from customers -- along with names and addresses -- even when customers explicitly had indicated they did not want the numbers disclosed.

Microsoft denied it ever used the serial number together with its customer lists to track documents. But privacy groups complained that it made it technically possible for the company to trace documents to a specific computer even when an author wished to remain anonymous.

The company has promised to purge any identifying numbers it may have collected inadvertently, and it is offering two free software programs on its Internet site to strip out the numbers.

© 1999 Associated Press. All rights reserved. This material may not be published, broadcast, rewritten or redistributed.