Intellectual Property Law

Net eavesdropping firm NebuAd and its partner ISPs violated hacking and wiretapping laws when they tested advertising technology that spied on ISP customers web searches and surfing, according to a lawsuit filed in federal court Monday.

The lawsuit seeks damages on behalf of thousands of subscribers to the five ISPs that are known to have worked with NebuAd. If successful, the suit could be the final blow to the company, which abandoned its eavesdropping plans this summer after powerful lawmakers began asking if the companies and ISPs violated federal privacy law by monitoring customers to deliver targeted ads.

NebuAd paid ISPs to let it install internet monitoring machines inside their network. Those boxes eavesdropped on users' online habits -- and altered the traffic going to users in order to track them better. That data was then used to profile users in order to deliver targeted ads on other websites.

For instance, if NebuAd noted that someone had repeatedly searched for information about smart phones, it would serve a targeted ad for iPhones the next time you went to a webpage NebuAd sold advertising on. Having that breadth of info on a user, which would be far deeper than any other only ad firm, the compnay would be able to charge advertisers a steep premium.

The suit alleges the ISPs and NebuAd both violated anti-wiretapping statutes by capturing users' online communications without giving adequate notice or getting consent.

NebuAd declined to comment on the suit saying only "We are reviewing the complaint, which we intend to defend against vigorously." The company's CEO left in September and the company is now marketing more mainstream ad technology.

In the past, NebuAd has said it immediately throws away URLS such as "http://sports.espn.go.com/nhl/clubhouse?team=det" after noting that the person might like hockey and the Red Wings in particular. It also argued that users could opt-out of getting the targeted ads,  though they could not get out of being monitored.

But that doesn't matter, according to the suit.

"Like a vacuum cleaner, everything passing through the pipe of the consumer's internet connection was sucked up, copied, and forwarded to [NebuAd's] California processing center," the suit reads. "Any alleged anonymizatin of subscriber's identity and data ? if in fact any such occurred, occurred after the phase of initial interception which provides the basis of this class action lawsuit."

That logic -- that the interception of an Americans' communication stream is illegal even if later thrown out --is no stranger to the U.S. District Court in San Francisco, where the suit was filed.

That's the same argument being made by the Electronic Frontier Foundation in its suit against AT&T for allegedly building an NSA internet spying room inside a switching facility in San Francisco. That suit and dozens like it targeting other ISPs and phone companies are being handled in the same court house in San Francisco.

They argue that wiretapping law is broken the moment AT&T diverts a copy of internet traffic into the room, even if the equipment in the NSA only examines certain portions of the traffic.

(One dissimilarity exists, however. The feds are unlikely to step in to save NebuAd and its partners as they are with AT&T, Sprint and Verizon.)

Neither WideOpenWest nor Embarq, the two largest ISPs being sued, responded to requests for comment.

But WideOpenWest told Congress this August that it let NebuAd monitor its 330,000 broadband customers for four months, starting in March, 2008.

Knology told Congress in August it had used NebuAd in Georgia, Florida, Tennessee and Alabama, but stopped in July after Congress started asking questions.

The other named ISP defendants are Bresnan Communications, Cable One, CenturyTel, all of which admitted testing NebuAd's technology.

The suit seeks damages as well as an injunction against any similar behavior in the future.

Photo: Herby Hönigsperger / Flickr