from the January/February issue of Mother Jones

   Lock Your Windows

   Microsoft says it's spying on you with only the purest of intentions.
   At least for now...

   by Richard Blow

   To understand how Microsoft can learn all about you, visit one of the
   company's new city-guide Web sites, known as Sidewalk. There are now
   10 of them, including Boston, New York, San Francisco, and Sydney
   (Australia), with more on the way, and they're chock-full of
   information about restaurants, movies, and other ways to spend your
   leisure time. If you have a fondness for topless bars, those are
   listed; if you're curious about gay bars, you can find those as well.
   You can even customize a site to update with new activities that fit
   your interests. It is undeniably convenient.

   But at the very bottom of Sidewalk New York's opening page, there is a
   small, almost unnoticeable blurb that reads "Terms of Use." It begins
   rather murkily:

     This Web site is offered to the user conditioned on the user's
     acceptance without modification of the terms, conditions, and
     notices contained herein. By accessing and using this Web site, the
     user is deemed to have agreed to all such terms, conditions, and
     notices.

   That's a little weird: After all, the instant you land on the site,
   you've accessed and used it, thereby agreeing to Microsoft's terms
   before you even know what they are. Then, if you scroll farther down,
   you come to a line simply titled "Use of Information." It reads:

     By being a user of this Web site, the user agrees that Microsoft
     may share with other parties both aggregate information, individual
     information, and locator information gathered by Microsoft in the
     course of the user's continuing individual use of this Web site.

   That seems inoffensive enough, until you come to the part about
   "locator information." Locator information, according to Microsoft,
   "consists of a user's name, e-mail address, physical address, and/or
   other data about the user that enables the recipient to personally
   identify the user."

   If this line doesn't stop you in your cybertracks, well, then
   Microsoft loves you for it. After all the hard-to-find legalese,
   Microsoft's intentions become bluntly clear: You are giving Microsoft
   permission to collect specific, highly personal information on who you
   are and what you do-collected as you surf. Microsoft learns your taste
   in film, culture, politics, sex. And then it can do whatever it wants
   with that information.

   Microsoft can preserve such data indefinitely, for its own use, until
   you die. And it's a safe bet that, sooner or later, Microsoft will
   sell it to other businesses because such information is a valuable
   commodity. Microsoft could sell it to a direct-marketing company; it
   could sell it to your health insurer or your employer; it could,
   theoretically, give it to the FBI, which is conducting a background
   check on you. Or Microsoft could simply use the data for its own
   commercial purposes, collecting as much information about you as, say,
   the government does-but with far less oversight.

   You don't have to be a privacy rights fanatic to find such information
   collection alarming. "Microsoft has the ability to automate data
   collection in a way that no one else does," says Paul Saffo, a
   director at the Institute for the Future in Menlo Park, California.
   Lauren Weinstein, the moderator of the Web site Privacy Forum, adds,
   "Consumers feel that Microsoft takes a parental attitude: 'Trust us,
   we know what's best, we'll take good care of you.'"

   Saffo and Weinstein say that what Microsoft can do isn't qualitatively
   different from what, for example, banks and credit card companies try
   to do. But "because Microsoft has such a wide reach," Weinstein
   explains, "the amount of potential power and the amount of potential
   problems are multiplied." Admits Megan Bowman, Microsoft's government
   affairs manager: "We're hard to compare to some of the other actors
   just because of the breadth of our business."

   The inevitable domination of its Internet Explorer browser means that
   Microsoft has another way of gathering information about you: The
   browser can keep track of your stopping points along the Web-your
   "clickstream"-and that information could be transferred to Microsoft
   when you visit one of its Web sites. Given the lack of government
   Internet oversight, it's completely legal. In a new ad campaign,
   Microsoft describes I.E. 4 as a "faster, more personalized Web
   browser" and promotes "content that can only be viewed with Internet
   Explorer 4." It's a seamless horizontal ladder: You use Windows to
   open Explorer to access, say, Carpoint, Microsoft's online car-buying
   service, and details of the sites you've visited previously can be
   sent to Microsoft-like a pipeline from your brain to Redmond.

   This, of course, can all sound a little paranoid. But Microsoft has
   given experts who follow privacy issues ample reason to worry in the
   past.

   Most notorious is the Windows 95 "Registration Wizard." Back when
   Microsoft was releasing early versions of the operating system, it
   introduced a rather remarkable feature: To register your software, the
   system calls up Microsoft via modem. During the process, Windows asks
   whether it can send Microsoft information about your computer. If you
   agree, Windows, exploring your computer, will tell the company what
   other products you use.

   But savvy users pointed out that Windows doesn't just send back
   information about Microsoft programs on your hard drive; it will also
   send back data about competitors' programs. After furious protests by
   developers, Microsoft defended the program, saying it was for the
   consumer's benefit: If you have a compatibility problem, Microsoft
   will know what software you have and can help you diagnose the
   problem.

   The company has still another means of accessing information from your
   computer: Internet Explorer contains a "File Upload" feature, which
   allows users to send information to Web sites. But the feature also
   reportedly can allow Web servers to upload files from your hard drive
   without your knowledge. (To be fair, Netscape used it first, in
   Navigator.)

   And then there are "cookies," small text files that a Web site can
   write onto your hard drive. The cookie can retain information about
   whatever you do on that Web site, such as using your credit card to
   buy a magazine subscription. The next time you visit that site, the
   cookie enables the Web site's owner to determine who you are and
   sometimes even what other sites you've been visiting. (Due to
   complaints-and probably to fend off government regulation-Netscape and
   Microsoft built tools into their browsers that let you block cookies.)

   The likelihood of Microsoft becoming a major information clearinghouse
   grows with the number of services it provides. In addition to
   Sidewalk, Microsoft also operates Slate, an online magazine; Expedia,
   an Internet travel business; Investor, a financial services site; and
   Carpoint.

   "The only sensitivity they have about privacy is that it could present
   obstacles to some business venture," says James Love, director of
   Ralph Nader's Consumer Project on Technology.

   Says Microsoft's Bowman: "A lot of the promise of the Internet is in
   personalization. When people understand what value they get for
   providing information, and that that information is protected, they
   will feel quite comfortable providing it."

   So how does Bowman, who says Microsoft does not now sell user
   information, explain Sidewalk's Terms of Use, which can also be found
   on Microsoft's other online services? "The language is just designed
   to be fairly open to anticipate a number of ways in which we might
   provide you with more information and benefits," she says.

   Consider, for example, the different ways Slate learns about its
   readers. The magazine recently posted and e-mailed to registered Slate
   readers an extremely detailed survey.

   An accompanying note from Rogers Weed, Slate's publisher, downplays
   any privacy concerns: "Contrary to what some people believe, we in
   cyberspace do not secretly scan your hard drive while you surf Slate."
   And many of the questions seem fairly standard (What is your total
   household income? Do you read your newspaper's editorial page?). But
   the information also helps Microsoft understand the potential for new
   online markets, possibly to develop future Web sites, and allows the
   company to integrate itself into your life, so that you find it as
   hard to live without Microsoft as, say, to extricate Explorer from
   Windows.

   For Microsoft, there is a massive amount of valuable information out
   there, and little standing in its way. As Love puts it, "From a
   privacy point of view, Microsoft is a very big deal-and a lot of
   what's a big deal hasn't even happened yet." [INLINE]

   Richard Blow is a Mother Jones contributing writer and a senior editor
   at George magazine.


     The MoJo Wire and Mother Jones are projects of the Foundation for
    National Progress, a nonprofit 501(c)3 organization, founded in 1975
    to educate and empower people to work toward progressive change. All
                              Rights Reserved.