Spitzer's Spreading Spyware Net

The New York Attorney General's probe of devious software coders may expand to advertisers and ad networks that work with them

By Spencer Ante

Eliot Spitzer is turning up the heat on spyware. On Apr. 28, the New York State Attorney General, sued spyware operator Intermix Media, alleging that its programs violate New York laws against false advertising and deceptive business practices and trespassing. Now, BusinessWeek has learned, Spitzer is looking at other spyware providers and is likely to broaden his investigation to go after the advertisers and ad networks that work with them, as well.

The probe may lead to a clash with some of the Internet's most powerful players, including Yahoo! (YHOO ) and America Online (TWX ), two companies that run Web advertising networks. While new spyware companies are likely to replace any that are driven out of business, Spitzer may be able to seriously curtail the malicious software coders by going to the source and targeting the ad networks and advertisers that are driving the industry.

In a wide-ranging interview, Kenneth Dreifach, chief of Spitzer's Internet Bureau, told BusinessWeek that his office is "definitely looking across the industry at other spyware distributors." Dreifach said Intermix was targeted because it was the most egregious purveyor of spyware. He declined to name other companies under the microscope, but spyware experts say the top offenders could include Claria, 180solutions, Direct Revenue, and CoolWebSearch. "Intermix is not unusual," says Ben Edelman, a spyware watchdog who has testified in court as an expert.


  Intermix said it "ceased distribution of the applications at issue" in early April, and that it "does not promote or condone spyware." Direct Revenue and 180solutions both say they aren't spyware companies, pointing out that they seek permission from consumers to use their software, and that it's easy to remove. 180solutions President Daniel Todd says the company requires partners to enforce its code of conduct, and that it has reviewed the practices of about 60% of its 7,000 partners and is stepping up its policing efforts. Claria CEO Jeff McFadden says all of its "practices have been designed within the core principles of notice, consent, and consumer control." BusinessWeek could not find a contact for CoolWebSearch.

What's more, ad networks such as Yahoo and the scores of companies that advertise with such networks should realize that they may be on the hook, says Dreifach. According to Jupiter Research, 12% of companies that advertise online use some form of adware marketing. More alarming, spyware accounts for more than $2 billion, or almost 25%, of the online advertising market, according to a report released on May 3 by antispyware outfit Webroot Software. "To the extent that they're driving [spyware] and ratifying it, they may face issues of their own liability," says Dreifach. "Is such a case conceivable? Absolutely."

Spyware or adware programs have become one of the Internet's biggest problems. An estimated 9 out of 10 computers are infected with some form of spyware. Typically, when a user installs a legitimate program, such as a screensaver, they unwittingly install one or more spyware programs as well. Spyware operators either don't alert the user to the new programs or bury their existence within lengthy, legalistic license agreements.


  These programs monitor user activity, sometimes secretly, and often hijack Web browsers to certain Web sites or launch torrents of unwanted pop-up ads. The programs are also often difficult, if not impossible, to uninstall. Congress is considering several antispyware bills. What's more, three states, including California, have already passed such legislation, and 27 more states are considering such laws.

Although it's too early to gauge the ultimate effectiveness of Spitzer's campaign, the Intermix investigation and lawsuit are triggering ripples of fear throughout the world of Internet advertising, and prompting some companies to stop using spyware. Recently, AOL stopped doing business with Intermix, BusinessWeek has learned. "Several months ago, America Online Inc. implemented a policy not to do business with companies running spyware or adware networks that damage our members' online experience," says AOL spokesperson Andrew Weinstein.

Yahoo is scrambling to get ahead of the issue. In its most recent filing with the Securities & Exchange Commission covering the first nine months of fiscal year 2005, Intermix said it received about $5 million, or 10%, of its sales from Yahoo ad subsidiary Overture. Yahoo says it still does business with Intermix. However, the portal is quietly hatching a new ad-partner program designed to clarify its policies, according to sources familiar with the plan. Still, it's unclear as to how that will treat these spyware vendors.


  Don Tellock, a former assistant attorney general who worked in Spitzer's Internet bureau from 2001 until May, 2004, says the lawsuit is designed to strike fear in the industry. Spitzer doesn't have the resources to go after every single spyware supporter, but Tellock says he's likely to shift the investigation to the advertising networks. And though the AG may not sue advertisers, Tellock says Spitzer has leverage over them because his office can sue companies for past illegal behavior.

"Even though you stopped a month ago, he can still get you," says Tellock, now counsel with law firm Arent Fox. "Yahoo and all of the other companies know Spitzer is in the water. They're jumping out."

One company looks like it will escape Spitzer's wrath, however. Google (GOOG ), the world's largest online advertising company, announced a policy of "software principles" in May, 2004, that prohibits many, if not all, of the deceptive and invasive practices of spyware. Google also has a policy that prohibits "pop-up ads of any kind" on its site.


  "Ad networks that have rules like Google have set themselves in a good position," says Ari Schwartz, an associate director of the Washington-based Center for Democracy & Technology, who has assisted Spitzer and other government regulators.

For other, less proactive companies wondering how to deal with the issue, Dreifach has some advice: At a minimum, he recommends that advertisers conduct a study to determine how their ads are being delivered. "If there's a hint that they're being delivered through software that isn't consensual, they should immediately cut off their ties and cease making payments to those deceptive companies," says Dreifach.

More than ever, it seems like lawmakers are starting to tame the Wild West of spyware.

With Catherine Yang in Washington, D.C., and Ben Elgin in San Mateo, Calif.

Ante is Computers editor for BusinessWeek in New York

    Before it's here, it's on the Bloomberg Terminal. LEARN MORE