Should Your Antivirus Software Be Spying On You?

from the there-is-no-privacy dept

Back in August, Wladimir Palant, the creator behind Adblock Plus, wrote a blog post detailing how Avast Online Security and Avast Secure Browser were collecting and selling the browsing data of the Czech company’s 400 million users. In response, both Opera and Mozilla pulled Avast extensions from their respective add on markets, forcing Avast CEO Ondrej Vlcek to go on a PR tour last month to downplay the issue.

Vicek’s going to have another busy week. A joint investigation by both Motherboard and PC Magazine (you should read both) obtained documents highlighting how the company collects the browsing data of its 450 million active antivirus customers, then, with the help of a third party outfit named Jumpshot, sells access to that data to a laundry list of companies:

“The data obtained by Motherboard and PCMag includes Google searches, lookups of locations and GPS coordinates on Google Maps, people visiting companies’ LinkedIn pages, particular YouTube videos, and people visiting porn websites.”

Throughout the scandal, Avast, like so many other companies trafficking in your daily habits, insisted that this collection wasn’t that big a deal because this collected data was “anonymized.” But there’s an endless list of studies showcasing how anonymized data isn’t really anonymous, and user data of this type can easily be identifiable with just a small number of additional data points. “Anonymization” is treated as some silver bullet magical get out of jail free card in countless privacy policy conversations, and it really shouldn’t be.

PC Mag, for example. highlights how it would take Amazon seconds to identify you from the data they buy from Avast based on the timing of purchases at Amazon. For example a single chunk of anonymized data like this on your clicking habits:

“Device ID: abc123x Date: 2019/12/01 Hour Minute Second: 12:03:05 Domain: Amazon.com Product: Apple iPad Pro 10.5 – 2017 Model – 256GB, Rose Gold Behavior: Add to Cart”

…can pretty easily be used to identify you and build a not-so anonymous profile:

“At first glance, the click looks harmless. You can’t pin it to an exact user. That is, unless you’re Amazon.com, which could easily figure out which Amazon user bought an iPad Pro at 12:03:05 on Dec. 1, 2019. Suddenly, device ID: 123abcx is a known user. And whatever else Jumpshot has on 123abcx’s activity?from other e-commerce purchases to Google searches?is no longer anonymous.”

Given we long ago prioritized profits over user security, this certainly isn’t new behavior. The telecom sector has been engaged in the same behavior for years, often either outright lying or denying that detailed data collection was happening. It was also reflected by the wireless industry’s cellular location data scandals, which highlighted how your wireless carrier collects your every waking movement and then sells access to that data to pretty much any nitwit with a nickel. Nobody cared how that data could or would be abused, ensuring that it repeatedly was — by everyone from stalkers to law enforcement.

While telecom, app makers, and a laundry list of other companies have been doing this sort of thing for years, you’d think we’d hold security software to a higher standard. Apparently not.

Update: After this article was written, Avast’s CEO came out with a statement stating that the company would be shutting down its data collection and sale efforts, and terminating its relationship with Jumpstart. Again, something that would have never happened if a journalist hadn’t discovered it:

“As CEO of Avast, I feel personally responsible and I would like to apologize to all concerned. Protecting people is Avast?s top priority and must be embedded in everything we do in our business and in our products. Anything to the contrary is unacceptable. For these reasons, I ? together with our board of directors ? have decided to terminate the Jumpshot data collection and wind down Jumpshot?s operations, with immediate effect.

That’s of course the right way to respond to such a scandal. That said, since there’s no real privacy rules for the internet era and no real penalties for companies that routinely lie about this sort of thing, there’s really not much (aside from journalists and bad PR) stopping Avast from reconstituting this program in a more modest form at a later date under a different name. And for every CEO like Palant, there’s probably 10 executives who couldn’t give any less of a shit about user privacy, and see it as their god-given right to hoover up your data and sell it to every nitwit with a nickel.

Filed Under: , , , , ,
Companies: avast

Rate this comment as insightful
Rate this comment as funny
You have rated this comment as insightful
You have rated this comment as funny
Flag this comment as abusive/trolling/spam
You have flagged this comment
The first word has already been claimed
The last word has already been claimed
Insightful Lightbulb icon Funny Laughing icon Abusive/trolling/spam Flag icon Insightful badge Lightbulb icon Funny badge Laughing icon Comments icon

Comments on “Should Your Antivirus Software Be Spying On You?”

Subscribe: RSS Leave a comment
18 Comments
Anonymous Coward says:

That said, since there’s no real privacy rules for the internet era and no real penalties for companies that routinely lie about this sort of thing, there’s really not much (sort of journalists and bad PR) stopping Avast from reconstituting this program in a more modest form at a later date under a different name.

Uh, what about the GDPR? We’re not talking about a Silicon Valley company here; Avast is headquarted in Prague, which is in the EU.

This comment has been flagged by the community. Click here to show it.

This comment has been deemed insightful by the community.
Anonymous Coward says:

Re: Should my search engine be spying on me?

It’s hard to give Avast crap for something Amazon, Google, and Apple do.

No it’s not. If there’s one thing Internet users are good at, it’s giving other people crap. It’s even been known to happen in relation to the exact companies you listed.

This comment has been flagged by the community. Click here to show it.

This comment has been flagged by the community. Click here to show it.

This comment has been flagged by the community. Click here to show it.

Add Your Comment

Your email address will not be published.

Have a Techdirt Account? Sign in now. Want one? Register here

Comment Options:

Make this the or (get credits or sign in to see balance) what's this?

What's this?

Techdirt community members with Techdirt Credits can spotlight a comment as either the "First Word" or "Last Word" on a particular comment thread. Credits can be purchased at the Techdirt Insider Shop »

Follow Techdirt

Techdirt Daily Newsletter

Techdirt Deals
Techdirt Insider Discord
The latest chatter on the Techdirt Insider Discord channel...
Loading...