Silent Software Snoopers

Does it seem like your computer has a mind of its own?

When you go on the Internet, for instance, does it seem like you're always seeing the same pop-up advertisement for a new car? Or perhaps every time you open up a Web browser, it takes you to a strange site that offers free games or a search engine you've never heard of? 

Chances are you're one of the many millions of Net surfers whose computer has been infected with so-called spyware, programs that can monitor your online habits, change your computer's settings, and send personal information back to advertisers. 

Spyware isn't entirely new. Online advertisers and websites have had the means of tracking users' habits since the early days of the Net. But online industry watchers note that the new generation of spyware, sometimes referred to as "adware," is becoming more prevalent among computer users. 

According to a recent research report from GartnerG2, more than 20 million computer users are infected with spyware, or adware, programs designed to deliver even more "targeted" pitches to online surfers. 

Even more disturbing, some security experts say, is that these monitoring programs are being installed as a hidden part of other pieces of software that surfers find as useful online tools. 

Most free file-sharing programs, such as KaZaA, Morpheus, BearShare, and Grokster, contain spyware programs that track users' habits as they swap songs and other digital files. At some less-common Web search sites, users might be offered the chance to install tools, and their hidden tracking programs, that claim to give better and faster results than well-known search engines.

"The fundamental issue is that people just don't know what's happening when they install these programs," says Tom Powledge, director of product management at Symantec, a software security company in Cupertino, California. "The vast majority just don't know what these programs are doing." 

Spyware makers, however, claim that they aren't doing anything nefarious but are merely offering useful pieces of software. And they claim that so-called end user license agreements, or EULAs, those long legal statements that precede the installation of any piece of commercial software, clearly spell out what consumers are getting when they opt to use their software. 

But many users hardly read those documents, says Denise Garcia, the GartnerG2 analyst who conducted the adware research last December. 

"Oftentimes that user agreement is very obscure and difficult to read," Garcia says. And since fewer than 10 percent of computer users skim through, let alone read, such lengthy discourses, "consumers are pretty unaware of what they are agreeing to," Garcia says. 

Even more disturbing, some experts say, is that spyware makers are beginning to take programming clues from virus writers. Once installed on a computer, some tracking programs become buried among code for other programs, such as Web browsers and affect how those programs function on a user's computer. And perhaps even more nefarious, spyware is becoming harder to detect and remove. 

"What we see is that some of the spyware is changing [programming codes] every two weeks," says David Moll, CEO for Webroot, a security software maker in Boulder, Colorado. And by morphing their code, Moll says, spyware makes it hard for anti-spyware software makers to keep up. "We've been researching spyware for almost two years," Moll says. "And the overall population of this stuff is growing at twice the rate of viruses." 

Still, some people aren't quite convinced that spyware is as great a threat to users' security as are traditional viruses. At least, not yet. 

"Adware and spyware are privacy issues," Symantec's Powledge says. But, "I would still classify viruses, worms, and hackers as the greatest threat." 

And according to Gartner's Garcia, many consumers may be willing to sacrifice a bit of their personal information as long as they get something in return. 

"In our research, users are not interested in having their personal information shared with advertisers unless they are offered something for free or get a discount," Garcia says. "Quite honestly, the general consumer is not as concerned with privacy as with getting a good deal."