The Spy Who Loved You

Whoever Said You Can't Get Something for Nothing Hasn't Downloaded Any "Free" Software Online Lately

Angela Gunn Consumer Reports WebWatch Web Ethics Columnist

Despite current economic conditions and the end of the dot-com boom, there's still a lot of free stuff available online — news, music, software, advice, and information are all there for the clicking. Play your cards wrong, though, and you can also get viruses, spam, and other unwanted gifts. And then there's spyware, which straddles both categories: It's something you don't want (software that gathers and redistributes information about you and your online habits) that arrives in conjunction with something you do want (music, software, etc.). Consumers object, ConsumerWebWatch reporters scrutinize — but what are the ethics of exchanging personal information online for, well, something else you hadn't bargained for?

We'll focus for the purposes of this discussion on exchanges that are freely made, which leaves out any of the really sneaky stuff: Programs that don't tell you that they're installing themselves on your computer. You don't need an ethicist to tell you that it's wrong to put something on someone's computer without asking, for heaven's sake.

We're going to assume not only that the spyware sender is forthright, telling the consumer that such software is about to be installed and giving them the option to opt out, but also that the recipient is sensible about reading any warnings presented by spyware on the brink of installing. In other words, don't just click on things in a rush to install something you've downloaded or to view a Web site you want to see; if a company is responsible enough to erect warning signs, you must be responsible enough not to zoom past them.

Now that we've got that cleared up, we can figure out who's actually involved in this exchange, look into what's really being offered, and decide what the ethics are in this situation. Speaking broadly, there are three players here: The entity that created the software or Web page that has been requested, the entity that makes and administers the "spyware" that's attached to the software or Web site, and the individual consumer.

In a spyware situation, the consumer wants to deal with the software or Web site creator, only to be introduced to a spyware-making third party to the potential deal: "I will give you access to the thing I've created," the software or Web-site creators says, "but first I'd like you to give some information to this guy over here, who will then help me to defray the costs of providing this software or Web site to you." For those of you who like charts, this is the breakdown of this three-handed transaction:

For a transaction to be ethical, it must involve a fair exchange of value for whatever's received. In this transaction, the spyware folk and the software folk are likely to have signed a contract with each other that lays out exactly how much money will change hands. The spyware company will have based their financial offer on the amount of information they believe they'll receive from consumers of the software, an amount they'll have calculated as part of their own business research; the software or Web-site provider will also have a good idea of the benefit they expect to derive from this association. And if for some reason either party is unhappy with the deal they've worked out, the deal can be renegotiated or voided; odds are good that the contract lawyer at Spyware Inc. knows the phone number for the contract lawyer at Shareware Doodz Ltd. and vice versa. There's nothing essentially unethical about this transaction.

Good for them, but what about the consumer? Unfortunately, software contracts and licensing agreements are invariably a take-it-or leave-it proposition for the end user; if you don't like the terms offered, don't use the software or visit the Web site. (That is, of course, assuming you can even understand the terms offered. Not many consumers are comfortable deciphering legalese, and few of us keep a lawyer around the house for such occasions.)

These one-sided contracts are a fact of computer-using life, and every so often a dispute over their legality or enforcement makes its way through the courts. It's ethically interesting terrain, but let's bypass it in favor of our earlier question: Is the consumer's exchange of information for software (or site access) ethically compromised?

The good news is that this transaction has the potential to be ethical: If the consumer is allowed to decide what information is given, and if she is fully informed as to what will be done with that information, and if she is hereafter a party to any renegotiation or restructuring of the agreement — yes, then, this is an ethical transaction. Yay team.

But return to Earth, please: That's not how the system works. Companies are in no hurry to attract your attention to changes in those contracts, and most behave as if it's the responsibility of the consumer to keep an eye on the agreement in case changes are made. (It's a curious stance considering that they've only got the one contract to worry about while the average user has encountered dozens if not hundreds of them, but there you have it.) Changes are made with scant notice, and those changes are apt to affect how your information is used. Since companies aren't likely to rewrite such contracts in such a way as to get less use from your info, the value of what you gave them has now changed — and the transaction becomes uneven.

One of the ways in which a spyware company might garner more value for the information you've given them is to treat it as an asset that can be exchanged with other companies, firms you never agreed to give your info to at all. (Some companies have declared consumers' information as assets in bankruptcy proceedings — your personal data on a dot-com liquidation sale!)

This potential outcome — introducing a fourth, fifth, sixth player into the original contract, without the consumer's permission and quite possibly without her knowledge, increasing the value of her information in direct proportion to the decrease in her control over it — is where your humble ethicist steps back and says, as before, you don't need an ethicist to tell you this is wrong.

***

Gunn is the co-founder of, and former Internet ethics columnist for, Yahoo! Internet Life and is currently the technology editor for Time Out New York weekly magazine. She has written hundreds of articles for PC Magazine, MSNBC.com, The Industry Standard, Business 2.0, CNN.com, Seattle Weekly, LA Weekly, and other publications.