WGA 'spyware' lawsuits against Microsoft probably meritless

WGA 'spyware' lawsuits against Microsoft probably meritless

Summary: On the heels of what I believe can best be described as a faux pas on Microsoft's behalf (and I've already said as much), the Redmond, WA-based company is now the subject of two separate class-action suits due to the behavior of its Windows Genuine Advantage (WGA) software. Classification of WGA as spyware, which is illegal in many states (there is no federal law yet) is central to both cases.

SHARE:
TOPICS: Microsoft
14

On the heels of what I believe can best be described as a faux pas on Microsoft's behalf (and I've already said as much), the Redmond, WA-based company is now the subject of two separate class-action suits due to the behavior of its Windows Genuine Advantage (WGA) software. Classification of WGA as spyware, which is illegal in many states (there is no federal law yet) is central to both cases.  While I wasn't the first to break the news that WGA may include some spyware-like attributes, I was the first to post a detailed screen gallery that replayed the entire WGA user experience from the beginning to the end of its installation. Subsequently, that gallery has been the focus of a lot of analysis on the Web and in the blogosphere because of the questions it raised about Microsoft's practices; Questions that I finally had a chance to ask of Microsoft before these lawsuits were filed and before Microsoft handed more control over WGA to end-users in response to their concerns (and also before fellow ZDNet blogger Ed Bott noted that WGA may amount to a kill switch for allegedly unauthorized installations of Windows; an assertion that Microsoft subsequently denied, but not to Bott who can't seem to get a follow-up interview with Microsoft).

My interview was of Microsoft's Windows Genuine program director David Lazar and it took place approximately three weeks ago by telephone.  At first, I was sitting on it because Lazar was going to get back to me on an outstanding question about one of the End User License Agreements that's relevant to WGA.  Then, my IBM Thinkpad T42's hard drive crashed (just days after it came back from Lenovo for a failed LCD) and I've been playing catch up on the stories I've been working on ever since. My WGA follow-up is one of them. 

Although I am not a lawyer, my sense from that interview is that the lawsuits are without merit.  While the court of public opinion may ultimately be what matters most and while Microsoft clearly could have been much forthcoming about what WGA is and how it works at the times its two primary components get installed (and has acknowledged as much), about the most I think Microsoft is guilty of is sloppiness and really bad form and I've listed the reasons why below.  I also gut-checked my instincts with technology legal expert Jonathan Zittrain whose impeccable credentials can't fit in one sentence.  Based on what I told him about the situation, Zittrain concurs with me and concluded that just about any legal tach against Microsoft -- for example, citing certain existing technology laws -- would probably be  a stretch. Bear in mind that Zittrain has not reviewed the complaints nor has he been following the situation very closely.  I tried my best to bring him up to speed on where things stand today.  Not withstanding some new and relevant factual revelation, here's why the lawsuits are baseless:

  • Although the screen gallery I posted suggests that Microsoft may have surreptitiously installed a software component (WGA Validation) onto our computers that  phones home to Microsoft's servers with information about our systems, as it turns out, it looks like we already agreed to let that happen by virtue of the End User License Agreement that we accepted during a prior installation of Microsoft's Windows Update software. Microsoft has also been offering additional disclosure on its Web sites for people seeking more details.  Zittrain concurred, citing the fact that there may be more than 20 other software products on our computers that engage in the similar behaviors.  In other words, it's standard industry practice.  Without having the list of data Microsoft collects in front of him, Zittrain said the question then is whether or not the information being sent back to Microsoft constitutes a violation of privacy. Looking at the list of data that Microsoft's collects (according to Pamela Jones research on Groklaw), you could make arguments that swing in either direction.  For example, Web sites routinely collect the IP address of the computers that visit them.  So, what's the big deal? Well, recording  that information on a daily basis (and mapping it to one computer as Microsoft could have easily done when WGA was first reporting back to Microsoft on a daily basis, a practice it has since discontinued), could result in a map of the movements of that computer. That said, no personal identifiers appear to have been passed and the list of fields is probably a superset if not a direct match to the ones Microsoft has been using to map software licenses to physical computers as a part of its Windows Product Activation program (WPA, Microsoft's other anti-piracy technology).  WPA uses unique information about a computer to create a fingerprint to which software licenses can be assigned.  If the fingerprint changes (which has happened to me when moving a virtual machine-based installation of Windows XP from one computer to another), WPA wakes up and asks for revalidation.  The bottom line? WGA is an integral part of the latest version of Microsoft's online update service and if what Microsoft says is true about its disclosure that it would be collecting information from our computers when we first installed Windows Update (I don't have a copy of the EULA that accompanied the original Windows Update installation), the spyware accusation won't hold up.
  • While it is a fact that the End User License Agreement that originally came as a part of of the installation of the second  WGA software component (WGA Notifications) had the wrong text in it (the result of which may have been a non-binding agreement between you and Microsoft), this was simply sloppiness and lack of attention to detail on Microsoft's behalf.  Unless someone can find an internal email that suggests that (a) Microsoft realized it forgot to get users to agree to some legalese during the installation of the first component (WGA Validation) and (2)  then tried to recover from that mistake by sneaking the necessary langugage into the second EULA (thereby attempting to retroactively cover itself), there's little or no benefit to Microsoft if its customers agree to something that has the wrong language in it.  It was clear from my phone interview with Lazar that Microsoft didn't understand my original complaint about the mismatch between what was installed second (WGA Notifications) and the EULA users were asked to accept.  At the moment that I reviewed the details of the mismatch with him on the phone -- where the EULA refers to WGA Validation (even in its title) when it should refer to WGA Notifications -- there was a palpable change in the tone of the conversation which began with Lazar saying "Now, I'm freaking out" and that he'd have to get back to me. Clearly, he recognized that something was amiss and although he never got back to me (even after I reminded Microsoft's PR agency that I was waiting for the results of whatever internal inquiry it was that Lazar was conducting), Microsoft has since changed the EULA that's delivered with WGA Notifications to one that's more in alignment with the software component being downloaded.  Clearly, the company recognized its mistake and took action.  And just to be clear, there is no doubt in my mind that this was a mistake.  Lazar genuinely sounded stunned on the phone as I pointed out the mismatch to him.  Regarding a wrongly worded EULA, Zittrain agrees that there's not much to get excited about in terms of what would hold up in court.  Said Zittrain, the suit might have merit "if something rises to level where it has some impact on the community-at-large or on technology as a whole rather than just a s chance to say Gotcha! and get a reward for having said it. One would want to look at the larger issues at stake."
  • Beyond the potential spyware accusations, there was also the issue of Microsoft automatically installing what, by its own admission, is pre-release software onto our systems.  To some extent, this is tangentially connected to an issue raised in the second lawsuit that legitimately licensed installations of Windows are being denied access to the updates they deserve because they've been falsely identified as pirated copies.  Ed Bott turned an official Microsoft statistic against the company when he pointed out that as many as 20 percent of WGA installations are failing, but not because the version of Windows in question is pirated.  Amidst concerns, Microsoft has issues a knowledge base article with instructions on how to disable or completely uninstall WGA Notifications (but not WGA Validation -- the component that "phones home").  While false positives can cause a lot of grief, making them grounds for a lawsuit is a  completely different ball game. Back in the 90's, when I was director of PC Week's testing labs (now eWeek Labs), Larry Seltzer taught me that all software is beta software, regardless of whether the vendor says its  beta, pre-release, or shipping.  To this day, his words echo in my head because it's so true.  While vendors may have some secret internal threshold that all software must cross before it can be considered "shipping software" (or RTM -- "released to manufacturing"), the truth of the matter is that all software is buggy and prone to malfunction.  This is especially so of one-size fits all software that must work in a nearly infinite number of end-user configurations any one of which could foil that software's normal operation. Personal firewalls and anti-spyware products are notorious for stopping what would otherwise be legitimate behavior, many times without the end-user's understanding of what's going on.  But the point is, all software will malfunction whether the vendor says it's shipping or not and WGA is no different.  Although he wasn't directly addressing this point, Zittrain pointed out that harm and remedy matters.  Were legitmately licensed end-users harmed (for example, have people lost functionality as a result of WGA) and is Microsoft unwilling to remedy the problem? "As long as they have a way to deal with the false postives, it's hard to complain" said Zittrain.  Microsoft has been mum, so it's hard to know what the company's prescriptions for false positives are.  But here again, I'm going with bad form and sloppiness; stuff that's hard to sue for.  I know Microsoft well enough to know that it would be more than willing to remedy a situation where a legitimate licensee was falsely identified as "a pirate" and being denied certain updates.  With WPA, Microsoft provided a plainly visible toll-free phone number in case there was a problem.  Microsoft may not have done that here (the bad form) but I'm not sure that we can draw a line from here to a lawsuit until Microsoft is clearly denying updates to people who deserve with no recourse.  Software fails. 

Ultimately, at the end of the day, the mistakes made by Microsoft throughout this process (and there were many) are ones that the company will have to answer to in the court of public opinion more than any other court.  Provided that it's working within the boundaries of the laws and anti-trust remedies that govern its operation, Microsoft is entitled to protect its intellectual property with the sorts of techniques employed by its WGA technology. 

In the bigger picture though, it has to decide if the way in which it goes about rolling out such services -- services that Microsoft knows all-too-well that its customers will be sensitive to -- will yield the sort of ROI the company is looking for. Does the potential revenue from a pirate crackdown outweigh the potential loss of legitimate customers who frown upon such practices?  By overcommunicating at every opportunity to do so when dealing with software that phones home or that could limit the functionality of your computer -- and by overcommunicating, I mean lots of in your face repitition, links to everything relevant, and display of contact information in the event something goes awry -- Microsoft (and any other software company for that matter) runs far less of a risk of really upsetting its customers to the point that they start seeking other solutions.  It's something Microsoft needs to think about given that more and more of those solutions are turning up every day.

Disclosure: In the spirit of media transparency, I want to disclose that in addition to my day job at ZDNet, I'm also a co-organizer of Mashup Camp and Mashup University. Microsoft, which is mentioned in this story, is a sponsor of both upcoming events. For more information on my involvement with these events, see the special disclosure page that I've prepared and published here on ZDNet. 

Topic: Microsoft

Kick off your day with ZDNet's daily email newsletter. It's the freshest tech news and opinion, served hot. Get it.

Talkback

14 comments
Log in or register to join the discussion
  • I am going to repost this

    I fill that another post I made is applicable here. Why should we expect all software to be BETA? Why can't we expect better?

    The orignal is here
    http://www.zdnet.com/5208-11535-0.html?forumID=1&threadID=22809&messageID=431869&start=-1


    <--- Original Post Below --->
    Am I the only person that expects better?
    I agree that this isn't a suprise. Microsoft is world known for their shipping delays.

    I don't mind the delays.
    That is if the software actually works and works exactly as it should.

    However, I get the feeling that most people including yourself think it is ok to have a random crash or two with their software. What harm does it do?

    Then I remember the story about the Thailand's finance minister getting trapped in his car because the computer crashed. Running Windows I might add. Nothing in the car worked at all.
    http://www.thaivisa.com/index.php?514&backPID=10&tt_news=325

    The financed minister was quoted saying "We couldn't breath because there was no air".
    Remember this was a bullet proof almost air tight limo.

    They finally got him out of the car by breaking in the glass using a sledge hammer.

    If noone had noticed that he was stuck and had been left there for a few hours in the heat of the day this man could have died including others who were in the car with him.

    The only way for Microsoft to grow is to branch their software into as many things as possible. There is little growth for them in a pure PC market.

    They must do a better job with near zero crashes of their software if they want to integrate their software in to more things than just PCs. Think cars or other must work devices.

    I understand programming is difficult. I have had some small programming projects myself. I just feel that not keeping the quality of the software high is going to backfire on us in ways we can't even imagine. Causing us or our loved ones great harm.

    Let Microsoft delay their software that is ok. Let's not allow them to continue with poor coding.
    dragosani
    • Define Beta...

      after you're done, name a software product that doesn't qualify. Beta is in the eyes of the beholder. All software is buggy. Even some chips have been buggy.

      David
      dberlind
      • That is my point

        [b]Why does all software have to be buggy?[/b]

        It is like software in a car. All modern cars have computers with software. The code has to be well written. If it isn't it could literally get someone killed.

        [b]Why do we put up with buggy software?[/b]

        We are settling for less. Software is going to be regulating our lives in the future. If, we don't start demanding bug free software people are going to get hurt or killed. I know people have gotten killed by software flaws in the past.

        [b]Why are software companies excempt?[/b]

        When a design flaw in any other industry gets people hurt or killed the company is held accountable. Why do we excempt software? Because of the EULA?

        Software design is going to have to get better for it to keep branching out. To much is at stack for it to continue to be buggy.
        dragosani
        • Your totally disconnected from reality

          I wonder if you know? Lets start.
          1. The software in my car is broken into tiny components, each doing one thing, only one thing, and therefore can do it really well. When was the last time you used the software in your car type a letter, record a TV show, play music, and surf the web (all at the same time no less)? How about running new software and hardware that isn't even in existence when it was written? When you start making home computers do less, then we might talk; until then, the comparison is just ridiculous.

          2. We are settling for less because it costs less. Near perfect software take lots of time and dollars. We the people are simply not going to pay fo it.

          3. When my Mac at work wretches saving a Photoshop file to the network and I loose a few hours of work or my home XP box crashes and doesn't record the history channel, no one dies. No one is hurt. We as users are annoyed, but read #2 above to understand why we just deal with it.
          mdemuth
        • Buggy software means even you can use it

          As mdemuth says we accept failure cause it's not life threatening if we loose a bit of work or have to replay a couple of levels on a game.

          Safety critical systems would normally have triple redundancy built invto try and prevent failure. 3 different bits of software written by different programmers all doing the same thing. Even then it can still go wrong.

          This would put computing capability back beyond the reach of all but the filthy rich.
          Fujikid2
    • Since when has any version of Windows ever been ready to ship?

      Every version of Windows has been a work-in progress.

      Would you pay retail price for a pair of pant's that needed patching at point of sale and then routinely thereafter?...And then when the store announced they would no long patch those pants, would you buy another more expensive pair from them also full of holes?

      We the public are the cause of Microsoft's success selling faulty products...We allowed it too long for them to listen now when we scream.

      Vista will never see the store shelf if MS waits until it is truely ready to ship.
      Yodaddy
  • Antipiracy measures at the cost of privacy & freedoms = disaster

    Software and content companies need to think carefully if they want to wage war against their customers? privacy and freedoms, in an effort to control piracy. If they do that, they are bound to lose. DRM was rejected in ebooks. There are now indications that it is being rejected in music downloads. (See [url=http://www.ehomeupgrade.com/entry/1792/why_are_online]here[/url] and [url=http://www.cdfreaks.com/news/13590]here[/url].) If these guys try to push these technologies into CDs and HD technologies, these technologies will tank. I personally will not touch these technologies with a ten foot pole if they become poisoned by DRM or similar technologies. Also I?m not sure how MS is going to deal with people having multiple PCs of different form factors, not wanting to buy several copies of a piece of software such as Office, when they use their PCs one at a time. I understand these guys wanting to protect their businesses, but attempting to do so at the cost of their customers? privacy and legitimate freedoms is a recipe for disaster.
    P. Douglas
  • They guess what is real

    I went to there forum about WGA and saw good or bad, won't do a good job detecting software.

    We download there MGA tool and KeyUpdater tool only to find that it works right for some people, and bad for others. Microsoft thinks as if its impossible to go wrong.

    I have 2 Notebook Computers, I run both tools and it failed with the software that came with the Computer, just for a test, yet we know its real software, because of several things:

    1. Came with the Computer.
    2. Passed Activation - lucky.
    3. Used several months or longer, still knows its real
    4. Checked the disc for clues, Microsoft says it will have, if real.

    Strange things happened, after we run these tools.
    I had to use System Restore to go back before I installed those tools, because it made my software terminated, it expected me to activate, then failed if I tried.

    Trashed my Retail Version of Windows XP Pro from the replacement of a Optical drive, won't activate,
    the only way I can get it to work is if I used Anti-WPA, downloaded from the internet, which I don't plan to use, it was just a test, its not proved safe, someone could be spying or using a keylogger with this free gift or very small fee for Anti-WPA. I don't plan to buy retail again soon.

    I think Microsoft is strange about the Retail version, it comes with a key like many other software, won't work out with the key, if you test part or replace parts it fails activation, yet you can buy a Computer and use the software that came with it, and replace parts or test parts and still activate the software.

    Its great if they want to protect there software, there not doing a good job of it, Because honest people that buy retail version of there software, can suddenly have there software terminated, yet fake software can be activated anytime they want because they know how.

    .
    adventure
  • They guess what is real

    I went to there forum about WGA and saw good or bad, won't do a good job detecting software.

    We download there MGA tool and KeyUpdater tool only to find that it works right for some people, and bad for others. Microsoft thinks as if its impossible to go wrong.

    I have 2 Notebook Computers, I run both tools and it failed with the software that came with the Computer, just for a test, yet we know its real software, because of several things:

    1. Came with the Computer.
    2. Passed Activation - lucky.
    3. Used several months or longer, still knows its real
    4. Checked the disc for clues Microsoft says it will have, if real.

    Strange things happened, after we run these tools.
    I had to use System Restore to go back before I installed those tools, because it made my software terminated, it expected me to activate, then failed if I tried.

    Trashed my Retail Version of Windows XP Pro from the replacement of a Optical drive, won't activate,
    the only way I can get it to work is if I used Anti-WPA, downloaded from the internet, which I don't plan to use, it was just a test, its not proved safe, someone could be spying or using a keylogger with this free gift or very small fee for Anti-WPA. I don't plan to buy retail again soon.

    I think Microsoft is strange about the Retail version, it comes with a key like many other software, won't work out with the key, if you test part or replace parts it fails activation, yet you can buy a Computer and use the software that came with it, and replace parts or test parts and still activate the software.

    Its great if they want to protect there software, there not doing a good job of it, Because honest people that buy retail version of there software, can suddenly have there software terminated, yet fake software can be activated anytime they want because they know how.

    .
    adventure
  • They guess what is real

    I went to there forum about WGA and saw good or bad, won't do a good job detecting software.

    We download there MGA tool and KeyUpdater tool only to find that it works right for some people, and bad for others. Microsoft thinks as if its impossible to go wrong.

    I have 2 Notebook Computers, I run both tools and it failed with the software that came with the Computer, just for a test, yet we know its real software, because of several things:

    1. Came with the Computer.
    2. Passed Activation - lucky.
    3. Used several months or longer, still knows its real
    4. Checked the disc for clues Microsoft says it will have, if real.

    Strange things happened, after we run these tools.
    I had to use System Restore to go back before I installed those tools, because it made my software terminated, it expected me to activate, then failed if I tried.

    Can't activate my Retail Version of Windows XP Pro after replacement of a Optical drive, won't activate,the only way I can get it to work is if I used Anti-WPA, downloaded from the internet, which I don't plan to use, it was just a test, its not proved safe, someone could be spying or using a keylogger with this free gift or very small fee for Anti-WPA. I don't plan to buy retail again soon.

    I think Microsoft is strange about the Retail version, it comes with a key like many other software, won't work out with the key, if you test part or replace parts it fails activation, yet you can buy a Computer and use the software that came with it, and replace parts or test parts and still activate the software.

    Its great if they want to protect there software, there not doing a good job of it, Because honest people that buy retail version of there software, can suddenly have there software terminated, yet fake software can be activated anytime they want because they know how.

    .
    adventure
  • They guess what is real

    I went to there forum about WGA and saw good or bad, won't do a good job detecting software.

    We download there MGA tool and KeyUpdater tool only to find that it works right for some people, and bad for others. Microsoft thinks as if its impossible to go wrong.

    I have 2 Notebook Computers, I run both tools and it failed with the software that came with the Computer, just for a test, yet we know its real software, because of several things:

    1. Came with the Computer.
    2. Passed Activation - lucky.
    3. Used several months or longer, still knows its real
    4. Checked the disc for clues Microsoft says it will have, if real.

    Strange things happened, after we run these tools.
    I had to use System Restore to go back before I installed those tools, because it made my software terminated, it expected me to activate, then failed if I tried.

    Can't activate my Retail Version of Windows XP Pro after replacement of a Optical drive, won't activate,the only way I can get it to work is if I used Anti-WPA, downloaded from the internet, which I don't plan to use, it was just a test, its not proved safe, someone could be spying or using a keylogger with this free gift or very small fee for Anti-WPA. I don't plan to buy retail again soon.

    I think Microsoft is strange about the Retail version, it comes with a key like many other software, won't work out with the key, if you test parts or replace parts it fails activation, yet you can buy a Computer and use the software that came with it, and replace parts or test parts and still activate the software.

    They told me call someone on a phone, I tried to activate, she asked questions, it did strange things, I told her and ignored me, we continued and reached the end and said click this, I told her something went wrong, she hung-up on me.

    Its great if they want to protect there software, there not doing a good job of it, Because honest people that buy retail version of there software, can suddenly have there software terminated, yet fake software can be activated anytime they want because they know how.

    .
    adventure
  • WGA - Microsoft Genuine ?

    So if WGA is trying to load onto my computer tonight..why do I get a text box popping up and telling me that it is not "signed by Microsoft' and may not be 'GENUINE'. Personally, I clicked NO. This isn't the first time; I'm sure it won't be the last. Probably has something to do with the lawyers...can't leave Microsoft open to litigation...just in case..this WGA does more than it's supposed to do. IF WGA does ONLY what it's supposed to do, I don't have a problem with it...I think 90% of the users would either. Sign it; install it; use it only for what you say. Trust is a two-way street. Microsoft....it's only one-way, and why is it always the direction that they are traveling. Obviously, we need to get there first and establish the direction.
    sammy64
  • Hey Berlind!

    Why don't you just lay down, roll over on your back for a belly rub from M$?

    BTW if you don't agree with the EULA then you don't get to use the software. OK I can live with that IF I HAD A REALISTIC CHOICE! In practically every area of software enterprise, Microsoft has done their best to wipe out the competition. The only company that seems to have been big enough not to become assimulated is Intuit. AutoDesk seems to have come to some sort of understanding with M$, they didn't get eaten up but Visio did! If the DOJ had some brass ones and actually took MS to court and forced them to divest some of their software holdings then I would have more choices now. Microsoft has more of a monopoly in software now than AT&T had in the phone business when they were broken up.!

    Geez. What a whitewash. If ANY other business but MS or any other software company tried to do what they do with their EULAs, they would be out of business, period.

    Would you buy a car, a set of golf clubs, a toaster, a washing machine, whatever, that promised that if it didn't work the way you would expect it to work, then tough, just eat the dollars you spent for the item?

    Would you buy a plane ticket if they didn't reasonably promise to deliver you to the destination you paid for?

    That is exactly what Microsoft says with their OS EULA. Read the damn thing, they don't promise squat. When was the last time Microsoft offered a cash-back guarantee that their software would work and perform as well, forget better, as anybody else's? Proctor & Gamble seems to be able to offer a cashback guarantee. Some car manufacturers offer cashback if you're not satisfied in 30 days.

    Berlind, Microsoft is in the CONSUMER BUSINESS, yet they still think they are the gods of the software business running around in white lab coats just like IBM did.

    So who gives a crap about whether or not the lawsuits are credible? The actions Microsoft is perpetuating with its WGA and WPA and whatnot are driving legitimate users to seek some relief from slowing hardware and unreliable operating system software.

    For me I've bought my last copy of MS anything. WGA trashed Windows Update on my home computer again today. I told it I didn't want to update Windows Genuine dis-Advantage today and BTW don't remind me about it again and now I can't do a manual update of ANYTHING. Yes my copy of Windows XP Pro is legit and all of my MS software on this box is also legit. Even though I have the CDROM, the CDROM key and the sticker for this copy of XP and all of that, it still doesn't work right.

    My machine has been running slower with each "security update". Now its running about like the P3 700 I have at work. System here is a P4/2.4 GHz with 1GB ram and I swear its getter slower practically by day.
    Xwindowsjunkie
  • I'm all for catching the pirates, but....

    I sincerely hope that Microsoft totally wipes out the pirates...I fully support them in that effort...I never flinched when I paid $200 for XP Home...I was actually proud to own a legal copy when many of my friends were using hacked versions.

    BUT!,....Microsoft really, really pizzed me off when they insulted me and tricked me into downloading WGA...I admit I did not READ the EULA or even bother to scan it....I TRUSTED Microsoft to provide me a more secure platform and allowed them to auto-update my machine....Instead, they then falsely invalidated my XP and caused me hours of grief....Then they refused to admit their errors.

    I am not complaining that they are trying to stop pirates, I am unhappy because they betrayed my trust in them and then treated me like a priate....Now I feel like I must read especially their EULA's with a magnifying glass.

    Have you ever shopped in a store where the sales people followed you around and made you feel they were closely watching you to prevent you from shoplifting?...What a sucky feeling that is!
    Yodaddy