Intellectual Property Law

Sears and K-Mart Purposely Exposing Web Customers to Spyware

By IBLS Editor

A Harvard professor has published a claim that Net marketing software employed by Sears and corporate sibling K-Mart has been linked to privacy concerns, and worse, they are not divulging this information as they are obliged to do by law.  Business School Assistant Professor Ben Edelman, who wrote the report, says, "The software is not something you'd want on your computer or the computer of anyone you care about," said Edelman in an interview. "It tracks every site you go to, every search you make, every product you buy, and every product you look at but don't buy. It's just spooky."

Edelman is an expert in Web security and anti-spyware and says that the Sears Holdings' My SHC Community program is not compliant with the U.S. Federal Trade Commission (FTC) standards since it does nothing to alert customers to the danger, nor does it explain the basics of the software the company would like its users to download. This news reveals a disturbing disinterest in the online safety of the very people making Sears and K-Mart's existence possible, as defects in the My SHC Community program first surfaced in late December, when IT senior engineer Benjamin Googins of Computer Associates wrote about the issue.

The My SHC Community was unveiled in March, and was supposedly designed to improve communication between customers and the corporation. Rob Harles, vice president of MY SHC Community, said "It's still kind of in its early days. It's mainly used right now for research, but what we want to do is open it up so it's creating dialogue with our customers." The lead corporation is Sears Holdings, which owns Sears Roebuck and Kmart department stores, and is America's the third-largest retailer.

Customers are encouraged to join by a bonus $10 and the opportunity to win a sweepstakes, but what the customers could lose is potentially much more expensive. Some new members are asked to install software, which turns out to be extremely invasive, as it monitors all of the user's Web traffic, and even keeps track of secure Net visits to addresses like bank sites, and also inspects e-mail headers.  All the information is then sent to ComScore.

Googins calls the software "a significant threat to privacy," but Harles disputes this claim, pointing out members can choose to join without the tracking software, and that only 10% have accepted the full software tracking program. Edelman scoffs at Sear's refusal to accept responsibility for such rank breaches of privacy, saying "The comments from ... Rob Harles are remarkable...Exactly contrary to actual facts as best I can tell."

The FTC has recently clarified in several settlements the rule of disclosure, especially for the level of information and consent required before installing tracking software on user computers. The FTC demands vendors obtain "express consent", meaning a "clear and prominent disclosure of the material terms of such software ... including the nature and purpose of the program and the effects it will have ... prior to the display of, and separate from, any final End User License Agreement." What really distinguishes a "clear and prominent" installation agreement is one that by its very nature is "unavoidable" in terms of notice and acceptance.

Edelman says that while Sears does generally disclose the installing tracking software, it simply does not educate the users on the severity of the search, nor to the rights these users are voluntarily giving up. Edelman claims, "The FTC requires that software makers and distributors provide clear, prominent, unavoidable notice of the key terms. SHC's installation of ComScore did nothing of the kind."

Edelman also points out that Colcom itself has been at the center of many disputes, asking -- "Why so many problems for ComScore? The basic challenge is that users don't want ComScore software. ComScore offers users nothing sufficiently valuable to compensate them for the serious privacy invasion ComScore's software entails. There's no good reason why users should share information about their browsing, purchasing, and other online activities. So time and time again, ComScore and its partners resort to trickery (or worse) to get their software onto users' PCs."

Full post as published by IBLS Internet Law Blog on January 06, 2008 (boomark / email).