Restraining Order On Commercial Spyware Lifted

Back in 2008, the US Federal Trade Commission filed a restraining order against CyberSpy Software, makers of a commercial spyware program that logged keystrokes, took screenshots, monitored IM conversations, and sent all the collected data back to the company's servers. Reader suraj.sun tips news that the order has now been lifted, allowing CyberSpy to sell its software, but with a few restrictions. "According to the US District Court settlement, the company must not provide users with the means to disguise the software as an innocent file or email attachment. Users must also be advised that doing so may violate US state or federal law. Additionally, all recorded information sent over the Internet must be encrypted and older legacy versions of the software must be removed from computers on which it was previously installed. ... RemoteSpy is said to employ rootkit techniques to hide from virus scanners."

Comments

Easy fix...

[gringer]

The final Order bars the defendants from providing purchasers with the means to disguise the product as an innocent file or e-mail attachment.

I'll do it for them:

1. rename 'malicious_software.exe' 'unicorns_with_flowers.jpg.exe'
2. attach to email

Re:So Little

[couchslug]

"Do the authorities care so little for the average citizen?"

Yes. This will last a while, til things get rotten enough, then the purge-and-replace cycle begins again. It was ever thus, and so it shall be.

Use in the workplace

[masmullin]

I am assuming that the order was recinded because workplaces might want this functionality. It sucks for workplaces to do this but it's their right to install this sw on the computers they own

Re:Use in the workplace

[arth1]

I am assuming that the order was recinded because workplaces might want this functionality. It sucks for workplaces to do this but it's their right to install this sw on the computers they own

Is it also their right to install cameras in toilet stalls they own?
How about searching through cars in the parking lot they own?

It's easy to extend your logic to the point where the company owns you, and I don't think we want to approach those times again. (Personally, I'd like to see the point where the workers own the company, not the other way around.)

Re:Use in the workplace

[GillyGuthrie]

The name of the software company ("CyberSpy") sure seems to imply that its marketing strategy is to appeal to the obsessive stalker who needs a convenient way to spy on another person and steal their passwords, read their email, etc. I personally knew a guy that was so obsessed with his ex that he tricked her into d/l a similar spy program with very similar functionality to CyberSpy and all he did was change the filename of the install package to something a little less obvious (unicorns_with_flowers.jpg.exe was a good example).

I agree that the most legitimate use of this software would be for employers to monitor their employees. An employer who owns the computers its employees are using has a right to install spyware without employee's knowledge... duh. They are handing out paychecks and if they don't want their employees farting around on Facebook all afternoon, it's their right to "spy" and verify that rules are not being broken.

Re:Use in the workplace

[drinkypoo]

Is it also their right to install cameras in toilet stalls they own?
How about searching through cars in the parking lot they own?

Are you really this stupid? The company already has a legal right to monitor your work activity, and already doesn't have a legal right to search your car or to watch you poop. Further, there is a clear difference between one and the other. The toilet is provided for your needs. The car is yours. The computer is provided for their needs, i.e. your work output.

It's reasonable not to want to work for someone who monitors your work activity, but not reasonable to compare that to monitoring your toilet activity.

Re:Use in the workplace

[Low Ranked Craig]

That's a bit of a red herring. For example, a company that handles personal customer info has a duty to ensure that that information is handled properly, and closely monitoring employee's handling of that data is completely legitimate as is making sure that the employee isn't spending all day playing Farmville. This is a very poor slippery slope argument - it is NOT easy to extend that logic to to video surveillance of a bathroom stall.

Re:Use in the workplace

[LordAndrewSama]

They have this sort of thing in Taiwan, I was working for a company in South Africa that bought the license to sell it. Here it is: Ip-Guard Basically, the software is scarily powerful in what it records and can do.

In south african law it's legal only if the employee is aware of it, so if it's in the employment contract. I think.

The company I was working for charged too much, didn't make enough sales, went tits-up. Classic case of greed before the fall.

Re:Use in the workplace

[fuzzyfuzzyfungus]

As does its feature set. In your standard corporate/institutional environment, you don't need stealthy install techniques, since IT already has mechanisms in place for rolling out whatever software is needed; and you don't need any sophisticated AV-dodging techniques, since AV is typically centrally managed, and IT can whitelist whatever they want.

At best, this stuff is being used in interpersonally-touchy-but-legal ways(ugly roommate situations, spying on the kiddies, spousal paranoia, etc.), and I'm guessing that the sliminess of the customer base just increases from there.

duh

[KwKSilver]

Do the authorities care so little for the average citizen? If they despise us so much, why don't they just allow phishing scams? Embezzlement? Ponzi scams?

The authorities "care" for the average citizen is roughly 0.000. Who says the don't allow scams, embezzlement and Ponzi schemes. Isn't all that what blew up the economy a couple of years ago?

Or on your own systems

[Sycraft-fu]

Not saying I'd trust software like this, but I could see the potential in wanting to be able to monitor your own computers. Maybe you live with roommates and you don't trust them to leave your shit alone, etc.

There are legit uses for having clandestine reporting software on a PC. Same deal as lock picks, firearms, and many other things with legal and illegal uses.

Sounds like the problem with these guys is they were attempting to primarily market it for illegal use. That is what gets you in trouble. If something has legal and illegal uses, but you market it for legal uses and attempt to sell it only to legal users, then you are fine. If you market it for illegal purposes, then you get in trouble.

That is why smoke shops are so big on what you say you are going to use their glassware for. It is perfectly legal to buy it for smoking tobacco. Bongs and such derive from Hookahs which were invented for the purpose of smoking tobacco. However, if you imply that you intend to use their products for smoking marijuana or other controlled substances, they'll refuse to sell to you. In this way they can make sure to stay clear legally. Though their products have illegal uses, they only market them for legal ones, and take care to attempt to not sell them for illegal purposes.

Re:So Little

[arth1]

Clearly, this is done "for the sake of" protecting children, "for the sake of" protecting us against terrorism, and "for the sake of" protecting our companies from industrial espionage.

When someone wearing a suit says "for the sake of", he or she means "in the name of".
Remember that the next time you vote.

Visible spyware?

[assemblerex]

How do you market an oxymoron?

Re:So Little

[Low Ranked Craig]

Well, yes, they do, but this is not an example of that. If I own a small company I can install whatever I want on my systems to monitor what my employees are doing for various reasons. I know of one specific case where a property management company does this to ensure that a disgruntled employee doesn't improperly handle a tenant's personal information - it is there for CYA reasons. I would also imagine that some parents would want to monitor their kids. I can see a lot of legitimate uses for this, and the ruling specifies that you cannot disguise the package as something else. I don't see or have a problem with this. Having said that, people will undoubtedly abuse the software, but that is true of most anything.

I don't think this is a good example of the authorities eroding the rights of the people - there are plenty of examples of that to be had.

Re:So Little

[digitalhermit]

This will last a while, til things get rotten enough, then the purge-and-replace cycle begins again.

If only it were so simple. It's relatively easy to pass a law. It's a lot more difficult to repeal them.

Re:So Little

[DaMattster]

"Do the authorities care so little for the average citizen?"

Yes. This will last a while, til things get rotten enough, then the purge-and-replace cycle begins again. It was ever thus, and so it shall be.

Of course, don't you know government and industry are mostly in sleeping together? Why do you think BP got away with murder up until the point thhings quite literally exploded.

I turned down the "opportunity" ...

[Brett Johnson]

Back in 2002 or 2003 I was offered a job with these guys [or possibly a similar firm] to port the software to Mac OS X. Once I was informed that the product I would be working on was to be used to spy on a company's employees, I chose to decline. When I started in my career almost 30 years ago, I vowed to myself that I would pursue it with the utmost integrity. This was way over *my* line.