“Free Services” for Your Computer May Cost More Than You Realize

| Print | E-mail |

April 2005

Have you seen one of these ads or one like it? Looks real doesn’t it? Is your Internet browser trying to protect you? Well, in the lower left corner (that you really can’t see in this picture), in light gray type it says “advertisement.” This “message” didn’t come from your browser or your security software. These types of ads want you to click quickly without considering any consequences. My report this month looks at the potential dangers of clicking on these ads.

Everyone likes to save money. Free services for your computer—from antivirus and anti-spyware programs to Web accelerators—can be very enticing. A barrage of offers hit your screen when you’re online. But some of these “free” services can end up costing your personal information—and opening a back door into your wallet. Beyond your name, personal information can include account and credit card information, online account access information, and even medical information.

Where the dangers are

The dangerous services among these advertisers operate with very loose privacy policies that allow them to collect any information they want and do whatever they want with the information, including sharing or selling it to third parties. In addition, some of the programs provided by these services (or instructions provided by these services that you implement) bypass existing safeguards or defeat security protections that are already in place. Others may state that they monitor all of your Internet activity. Monitoring “all your activity” means that they may be logging every keystroke and collecting your passwords and other private information that you use to access financial accounts or shop online using secure shopping baskets, for example. This can mean that even if you think you are protected by security programs on your computer or on those of the security-protected site you are visiting; your important information is being collected because without realizing it you have given the okay to bypassing or subverting those protections.

For example, installation instructions may tell you that for the program to work properly you must change your security settings in Internet Explorer. You are instructed to change the custom level settings for the Internet and Trusted Sites zones to “Low.” Making these changes, particularly to the Trusted Sites zone, is like leaving the door to your house not just unlocked but standing wide open. For example, all the encryption and security protocols that your financial institutions, including your credit union, have in place to protect you won’t do that when you give these operators permission to override those. And it gets worse. Once you install some of these programs, even uninstalling them doesn’t get rid of them because they have built-in backdoors that stay on your computer even after their program is deleted.

How these services attract your attention.

Causing a sense of urgency is the main tactic used by these services—you have to do something about it now! For example, flashing banners say your computer is infected with a virus or spyware or pop-up and pop-under windows that look like operating system messages urge you to act. The fact that the message is only an advertisement is usually hidden where it’s hard to see, as it is in the ad above.

How can you separate the risky free services from the good?

The most obvious red flag for these services (besides their deceptive banner/pop up techniques) is the very loose privacy policies I mentioned above. Many of these programs and their providers have nostated privacy policy: if you hit one of these, run, don’t walk away from it. Others have something they call a “privacy policy” that is anything but—and often the dangerous parts are buried in lengthy or ambiguous text. Some even start invading your privacy before they let you see their privacy policy.

Here are some quotes from an example of a scary privacy policy:

• ...monitors all of your Internet behavior, including both the normal web browsing you perform, and also the activity you may have through secure sessions, such as when filling a shopping basket or filling out an application form that may contain personal financial and health information...
• ... We monitor the Internet connections of our users so we can not only accurately and anonymously model the browsing habits of Internet users, but also their shopping, registration, and other interactions as well...
• ... In addition to the monitoring of your Internet behavior, we may also combine the information that you provide us with information such as credit or prescription information that we obtain from third parties such as consumer preference reporting companies, credit reporting agencies, and prescription benefits managers....
• ... There are some limited cases in which we share personally identifiable information with third parties. Specifically, we provide personally identifiable information to third parties for the purpose of conducting the secure and confidential matches discussed more fully above....

At least these guys spell out the ways they plan to harvest all your information. Lots of “privacy policies” are much more ambiguous.

Be skeptical and check offers out thoroughly.

People are generally trusting. But when dealing with anything on the Internet, paid or free—especially if your personal information is at risk (or might be at risk)—you should be very skeptical and careful. Before signing up for any service or downloading a program, read the privacy policy carefully. The items to watch for tend to be buried in paragraphs or at the end of long policies. StraightTalk recommends: Don’t use the service or program if there is no privacy policy, if it can’t be found easily, or if it’s hard to understand.

Here’s what you should look for in the privacy policy:

• What personal information will be collected?
• How will the information be collected?
• Why is the information needed?
• How will the information be used?
• How is the information protected?
• Do you have any control over how the information collected about you is used or shared?
• Can you access the information collected about you?
• How are changes to the privacy policy handled?
• Can the privacy policy be changed without your knowledge?

How to Read a Privacy Policy from GetNetWise.org provides more information.

What should you do to protect your computer and personal information safely?

Virus protection for your computer is a must, so don’t go without it. Popular products include Norton AntiVirus, McAfee VirusScan or Trend Micro PC-cillin. If you use one of the major Internet service providers (ISPs) such as AOL, Earthlink, or Road Runner, they provide free virus protection products to their subscribers. No matter what your ISP, you can check out reviews of free and for-fee products on sites such as PC World, PC Magazine, and CNET.com. The downloads sections of these sites also have free or inexpensive reputable products.

Having other security protections in place is also good. The StraightTalk Report Keeping Your Computer Secure and Your Personal Information Safe discusses security in more detail.

What’s the bottom line? I recommend you stick with proven products even if you have to spend a few dollars for them. Better to pay with dollars than with your personal information—and potentially risk identity theft and the integrity of your credit and financial accounts.

Prepared for Corning Credit Union by Remar Sutton & Associates, April 2005. Reviewed March 2007. All rights reserved.