By Ben Elgin
Long before New York Attorney General Eliot Spitzer picked up Direct Revenue's scent, a few Internet watchdogs spent years tracking the Manhattan-based outfit. Although Direct Revenue's business would soar, the persistence of these amateur sleuths helped raise awareness about some of Direct Revenue's less-visible practices.
Patrick Jordan first encountered Direct Revenue while working as a technical support specialist for tax-services company Jackson Hewitt in Norfolk, Va.. In 2003, one of Jordan's colleagues spotted an unwanted program on his computer and called Jordan over for a look. As he began investigating the software and the company that made it, he was drawn in by the challenge. "They tried to operate in the shadows all the time," says Jordan.
Soon, Jordan was devoting three-quarters of his free time at work to studying Direct Revenue and its programs. He published his findings on a Web site he dubbed "The Transponder Gang."
INSULT TO INJURY.
In early 2004, Jordan shed light on the gory task of removing Direct Revenue's program from a computer. The company had just taken all its programs out of the computer's "Add/Remove" registry—the place where most legitimate software products show up for easy removal by consumers. Instead, it was requiring people with infected PCs to find its removal site, Mypctuneup.com. Once there, users had to submit their e-mail addresses and wait for the antidote. In Jordan's case, it took five days.
Even then, Jordan found that Direct Revenue's code was never entirely deleted from his computer. Adding insult to injury, a test e-mail account he used exclusively for the Mypctuneup.com process started to get spam e-mails. Jordan's conclusion: Direct Revenue must have squeezed every possible dollar out of consumers by selling their e-mail addresses to spammers as they tried to get rid of the company's spyware.
Direct Revenue has since removed the e-mail sign-up requirement for its removal process and now includes its programs in the "Add/Remove" registry for easier removal. In its legal filings trying to fend off the Spitzer suit, Direct Revenue says it has done nothing wrng and describes its past practices as "commonplace" at the time. The company describes its products as "adware." The New York Attorney General, angry consumers, and computer security experts call them "spyware," signifying that the programs typically are downloaded without user consent. Company officials would not discuss Jordan's findings.
Jordan says his biggest blow against Direct Revenue came in March, 2004, when he uncovered a stealth Direct Revenue Web site, Freephone.cc. The outfit had been polishing up the Internet-telephone site with the hopes that it would not be linked to Direct Revenue, according to an internal e-mail uncovered by Spitzer's complaint. The product was marketed as "adware free," although users in some cases received a variant of Direct Revenue's software that showed pop-ups, according to Jordan's research.
After Jordan publicized the connection between Direct Revenue and Freephone, Direct Revenue's then-vice president for distribution, Chris Dowhan, broke the bad news to the company's founders in an April 5, 2004, e-mail, disclosed in the Spitzer complaint. "It seems like our window of opportunity to promote freephone as 'adware free' may have passed us by," he wrote.
Publicly challenging a well-funded company like Direct Revenue has always been a scary proposition. In the summer of 2005, according to court documents filed in the Spitzer case, Direct Revenue's lawyers successfully prodded tech publisher CNET Networks to change the language in one of its stories. On another occasion, the documents show, CEO Joshua Abram threatened Internet watchdog Center for Democracy & Technology (CDT) with legal action for asking questions about Direct Revenue's advertisers. Abram claimed CDT was "intimidating" his company's customers.
Direct Revenue even hired a security firm to investigate the identity and whereabouts of Jordan, the Spitzer's complaint reveals. The preliminary results of the probe were e-mailed to CEO Abram on May 31, 2005. Direct Revenue's outside counsel, Gary Kibel, an attorney at Davis & Gilbert LLP, told Abram investigators had discovered Jordan's name, approximate age, his employer, and home address. "Once we get all the information together, perhaps a letter to his true home address showing that we know more about him will have some results," Kibel said in the e-mail to Abram.
Jordan never received any letter or threats from Direct Revenue. By the time the company had uncovered his identity, he had moved on to a new gig in Florida, as a senior spyware researcher for Sunbelt Software. Even if they had tracked him down, he's not sure they would have been able to deter his digging. "Every time I wrote something about them," he says, "I would supply the evidence."
Elgin is a correspondent with BusinessWeek in San Mateo, Calif.