A Gator in the Henhouse

Anyone remember Gator? It is/was a nice little piece of "spyware" that covertly installed itself on user's computers during installation of other non-related software such as IE toolbar snap-ins, P2P software and email stationery add ons. Gator is nominally an advertising content delivery system, but in practice tends to do a lot more, including:

GAIN displays advertising. A lot of pop-up advertising if you visit popular web sites or search for advertiser's hot words like "auto loan". Our experience was that its advertising was sometimes poorly targeted and therefore unlikely to be helpful.

GAIN interrupts your work. Usually, your computer does things as a result of your own actions. GAIN actions don't follow that pattern. Their ads are often timed to pop up a few seconds after you've finished clicking on a link or entering data, which can be very distracting.

GAIN can install software without your knowledge. With so many security issues on the Internet, it is important to know when and why software is being installed on your system. Our survey shows that most users do not know how GAIN got onto their system, and Gator can install even more software without further notice.

GAIN collects extensive information. Perhaps Gator doesn't know who you are, but it certainly collects a lot of information when you consider all the things that the company lists in its Terms and Conditions. Take our Gator license quiz and see how well you know it.

GAIN uses up valuable system resources. Gator's simple WeatherScope application takes up about 14 megabytes of memory because of the GAIN software that comes with it. It also uses up 15 percent of system resources on Windows Me. On systems with small amounts of memory this can degrade performance or cause system instability.

from PC Pitstop

The Gator Corporation renamed itself to Claria Corporation in October 2003, probably due to continuing bad press over the Gator name (GAIN is their new acronym for the Gator suite of products). Now for the interesting bit:

Claria(SM) (http://www.claria.com), a pioneer and leader in the behavioral marketing space, today announced that the company's Chief Privacy Officer and Vice President of Regulatory and Legislative Affairs, D. Reed Freeman, Jr., has been appointed to a four-year term on the Department of Homeland Security's (DHS) new Data Privacy and Integrity Advisory Committee (http://www.dhs.gov/privacy).

from Claria Corp. via PR Wire

So the "Chief Privacy Officer" of a company that's so well known for making spyware - spyware so invasive and detrimental as to be one step away from a virus, spyware so poorly viewed in the public eye that they had to change their name to try to disassociate themselves from it - now advises DHS on citizen's privacy?

UPDATE: I dug a little deeper into the DHS site and found the bio for the Chief Privacy Officer for the agency itself: Nuala O'Connor Kelly. Before being slotted to the DHS post, she held the same position at Commerce. Also:

Prior to her beginning her government career, O’Connor Kelly served as Vice President-Data Protection and Chief Privacy Officer for Emerging Technologies for the online media services company, DoubleClick. O’Connor Kelly helped found the company’s first data protection department and was responsible for the creation of privacy and data protection policies and procedures throughout the company and for the company’s clients and partners. O’Connor Kelly also served as the company’s first deputy general counsel for privacy.

For those who aren't familiar with DoubleClick, here's a blurb from HowStuffWorks.com:

There are certain infrastructure providers that can actually create cookies that are visible on multiple sites. DoubleClick is the most famous example of this. Many companies use DoubleClick to serve ad banners on their sites. DoubleClick can place small (1x1 pixels) GIF files on the site that allow DoubleClick to load cookies on your machine. DoubleClick can then track your movements across multiple sites. It can potentially see the search strings that you type into search engines (due more to the way some search engines implement their systems, not because anything sinister is intended). Because it can gather so much information about you from multiple sites, DoubleClick can form very rich profiles. These are still anonymous, but they are rich.

DoubleClick then went one step further. By acquiring a company, DoubleClick threatened to link these rich anonymous profiles back to name and address information -- it threatened to personalize them, and then sell the data. That began to look very much like spying to most people, and that is what caused the uproar.

So we have not only one questionable company represented, but two!