The debacle surrounding Windows Genuine Advantage just won’t go away. Late last month Microsoft found itself the target of a complaint seeking class action status over WGA’s behavior, and now we have learned that a second related suit has been filed.
Brought by Engineered Process Controls, LLC, Univex, Inc., Edward Mifsud, David DiDomizio, and Martin Sifuentes, the suit charges that WGA is essentially spyware, inasmuch as users are deceived to install it by being led to believe that it is a security update. The suit was filed in the US District Court for the Western District of Washington.
"WGA is ‘spyware’ that transmits data to Microsoft’s central computer ("phones home") every time a PC is booted up and every 24 hour thereafter," the suit alleges. The accusations are in response to the revelation that beta versions of Windows Genuine Advantage did "phone home" once every day, but the company recently confirmed that more recent versions communicate with the company approximately once every 90 days. Microsoft maintains that the daily checks were there because the software was in beta, not because the company intended to test daily checkups.
Daily or not, privacy advocates are outraged. The suit complains that "Microsoft does not advise users of these phone home capabilities. WGA gathers data that can easily identify individual PCs and WGA can be modified remotely to collect additional information at Microsoft initiation." The complaint continues, "software hackers can exploit WGA to not only collect data but also to modify users’ computers." The suit contends that Microsoft and WGA violate Federal and Washington State law and "public policy on privacy, security, consumer deception, notice and consent."
The suit seeks compensatory damages, injunctive relief and a requirement for Microsoft to fully disclose WGA’s "potential security and other risks" to the public. The suit also asks that Microsoft be made to produce a tool that can easily remove WGA from any Windows system. Should the plaintiffs prevail, Microsoft would have to scrap WGA and would be subject to treble damages. Among the damage claims is a request seeking "either actual damages or one hundred thousand dollars per violation, whichever is greater."
For both cases, the debate is expected to center around the definition of spyware. The suit itself uses the recently-formed Anti-Spyware Coalition’s definition of spyware, which focuses on lack of consent and the "collection, use, and distribution of a user’s person or other sensitive information" in constructing a definition of spyware. Microsoft has insisted that WGA is not spyware, and that it does not track user behavior or anything other than the licensed state of a Windows installation.