Blog Update (February 25, 2010): Who Owns Your PC? New Anti-Piracy Windows 7 Update "Phones Home" to Microsoft Every 90 Days

Greetings. Microsoft officials contacted me yesterday to discuss changes in their Windows Genuine Advantage (WGA) program taking effect today, and to chat about a variety of other issues related to WGA now and in the future. There is a particularly significant change related to the "phone home" Internet activates of WGA that have been so controversial since my initial report on this topic and multiple linked entries dated forward from that posting.

In particular, in response to the original controversy, MS has been widely quoted as saying that they'd reduce the frequency of WGA-initiated Internet connections from daily, to once every two weeks, then eventually to zero.

Officials now tell me that this schedule has been accelerated. A new update of WGA should be appearing in the Windows Update cycle starting this morning (if it's not there now it should be within a few hours). It reportedly will be tagged as an optional "high priority" (not security) update, with a new End User License Agreement (EULA) -- more on this below.

Here are some details on WGA behavior beginning with this new update, as explained to me by MS:

If a system has been previously validated (via a visit to the MS Windows Update or Download Center sites, for example), the new version (and future versions as now planned) of WGA will attempt some network activity to report to MS that the new WGA installation was successful (as per the new EULA). If this connection activity fails, MS says that for most users there will be no further connection attempts by WGA.

If a system has not been previously validated, the new version of WGA will retry as necessary in an attempt to validate, each time the user logs in (for most people, this means each time that they boot their system). Once validation has succeeded, these connection attempts would cease for most users.

There are some Windows license classes that do not have permanent validations, and that need to be revalidated at intervals. For those license classes, WGA would begin initiating connection attempts again when the current license validation period expires. Ordinary consumer licenses of the sort that most people get with their computers have permanent validations and do not fall into this category.

While recurring WGA-initiated connections will no longer be taking place for most users, WGA validation will still occur when users attempt to update at the Windows Update and Download Center sites.

Non-validated systems, or systems that have had their validations revoked, may be subject to restrictions previously noted including inability to download and/or install/execute various non-critical updates -- or some major packages (e.g. Internet Explorer 7, etc.) Officials told me that the most restrictions would be on the use of automatic updates and downloads, with fewer restrictions on actual update installation procedures, and the fewest restrictions of all related to program executions (as noted, execution restrictions would mainly be related to major program releases).

Microsoft considers WGA versions starting from today to no longer be "prerelease" -- but for now they are still optional. A new EULA is provided with a more explicit preamble where the user can decide to accept/reject or read more (a change of this sort was one of my original recommendations regarding the WGA EULA acceptance procedure). MS says that users can choose to reject installation of WGA even if it arrived through Windows Automatic Update.

For persons who wish to remove the prerelease WGA (the one with the boot/daily Internet connection activity for all users) without installing the new WGA, I'm told that a link and Knowledge Base article will be available giving the recommended step-by-step instructions for this process, and that users can call MS support for help with this procedure if necessary (without incurring a support charge).

That's the current situation as I understand it. Since it appears likely that I'll be having additional contacts with MS related to WGA issues, I'll continue to report on this topic as appropriate.

In other essays I'll discuss my specific opinions regarding the implications and other issues relating to these kinds of authentication environments.

--Lauren--

Blog Update (February 25, 2010): Who Owns Your PC? New Anti-Piracy Windows 7 Update "Phones Home" to Microsoft Every 90 Days

Greetings. As I watch (and participate in) the various arguments concerning network neutrality, I do agree with you that the level of emotion that has entered the debate tends to distract us from the underlying technical and non-technical facts.

But this sort of emotion should not be unexpected -- from either side.

The telcos in particular have watched their traditional business models melting away like the Wicked Witch of the West -- drenched in the water of Internet services that bypass conventional communications models. They see their salvation to a large extent in the dream of becoming Yet Another TV Service, and perhaps there will be enough competition in that space to make that work for customers to some degree. The telcos don't like to be reminded that their very existence has been predicated on many decades of monopoly-enabled revenues, but let that pass for the moment.

The other side of the network neutrality debate -- Internet services in particular -- has a different point of view. There are various facets to this relating to telcos vs. cable companies and such, but I believe that a major part can be boiled down to one concept.

They don't trust the phone companies. They've watched as telcos have made infrastructure promises to communities that were never fulfilled, have used anticompetitive means to squeeze customers into packages that limit rather than extend customer flexibility, and in general have not engendered a warm, fuzzy feeling that what the telcos promise today will be worth a wooden nickel down the line -- unless there are laws to force them to comply. To quote the great philosopher Chief Engineer Scott: "Fool me once, shame on you. Fool me twice, shame on me." It's difficult to dispute history on this one.

Fear and a lack of trust are tandem ingredients that have driven the network neutrality debate into the current impasse. Perhaps if we can at least accept this fact, we can start to move beyond this seemingly solid brick wall of accusations and counter-accusations. Maybe.

--Lauren--

Greetings. The Microsoft program director for Windows Genunine Advantage (WGA) -- whom I spoke to originally -- has responded to my questions regarding impacts of WGA validation checks on innocent users that I noted in a recent blog entry.

To summarize his response (in my words):

- MS is aware that repair depots and stores have had a habit of re-installing Windows (e.g., from cloned systems) in ways that could result in WGA validation failures.

- MS realizes that being told that a system is failing WGA checks for no obvious reason can be extremely frustrating to an innocent victim.

- He says that MS has been warning distributers, resellers, etc. about this issue for years, and urges them to use appropriate software tools when fixing/configuring customer machines to avoid creating invalid OS copies that will fail WGA validation -- but MS knows that this is still definitely a problem.

- He urges customers who have been "victimized" by such actions that cause WGA failures to go back to the dealer (or whomever) to request a proper installation, using the original activation keys whenever possible.

In the event that the dealer, etc. won't help or can't help, he suggests:

1) Turning off WGA notification warnings via the system tray applet -- so at least that won't keep bugging them...

then:

2) Phone MS support via whatever numbers are provided for the user's area. He says that the support people (he notes that phone banks have been beefed up to handle more calls) have a variety of tools that can be used to swap and/or override keys to get around a variety of related WGA issues.

- - -

So it appears that Microsoft does have mechanisms in place to deal with at least some of these issues in typical contexts, assuming that folks caught up in these situations aren't too flustered, and that they are able to realize what is actually going on and what corrective steps are available.

Of course, none of this addresses the basic questions in general relating to users vs. vendor control and licensing rights monitoring, ownership vs. effectively the "rental" of software, and a range of other questions, including one of the perhaps most fundamental of all: Aren't these kinds of situations starting to get far too complicated and unnecessarily complex for consumer products, on which people now depend for so many aspects of their lives?

--Lauren--

Blog Update (June 27, 2006): Details From Microsoft Regarding Significant WGA Changes

Greetings. In the wake of the controversy triggered by my earlier discussions regarding Microsoft's "Windows Genuine Advantage" (WGA) behavior, (June 5, June 6), I've received a lot of e-mail from folks who assert that they are being unfairly tagged by Microsoft WGA as having illicit systems, with continuing warning messages and attendant future restrictions on their ability to obtain non-critical updates.

As I've noted previously, I have no sympathy for genuine pirates. However, there is a common thread running through many of the reports I'm seeing, suggesting that innocent users may easily end up with "pirate" versions of XP without their knowledge, and with no entirely clear and practical path to rectifying the situation.

The scenario is obvious once you think about it. People start off with the legit copies of the Microsoft OS that come pre-installed on their computers (relatively few people ever install their own OS, or would care to risk the process in any case -- most use what comes on their machines). The OS copy is legal, authenticated, and paid for as part of the system.

Now the trouble starts. They have a disk crash or other serious system problem. They take their computer back to the store's repair depot, or to a third party computer repair entity. The computer is fixed and seems to be fine again. Then suddenly, they start receiving WGA piracy warnings.

Why? It appears that it is exceedingly common for repair operations to reinstall based on "cloned" or otherwise duplicated copies of the Microsoft OS, rather than try to restore or reauthenticate based on the original users' OS serial numbers or authentication codes. Original restore disks and key information cards/labels are frequently missing, making it difficult to duplicate the original authentication environment.

Service depots tend to frequently have a working configuration that they can easily clone to repaired systems, and since the user originally paid for one copy of the OS (with their computer, now wiped out as part of the repair process), and ends up with a single copy afterwards, it's not like there's now an additional copy in use.

Once their systems have been flagged by WGA, users may have a serious dilemma, even if MS is willing to provide clean versions of the OS to persons who can demonstrate that they are unwilling "piracy" victims. Most of these users don't have original "pirated" disks to send over to MS. In fact, such users are likely not to understand what is going on at all in this respect, since -- as far as they knew -- their systems had simply been fixed and then were working fine -- until WGA kicked in, that is.

If MS could provide such users with a simple way to update their authentication keys that might be one solution, but an alternative such as having to completely reinstall a fresh copy of the OS would be completely beyond the pale for most users.

I have not yet received a response from officials at Microsoft to e-mail I sent several days ago, asking specifically how they intended to deal with these kinds of WGA situations.

As Microsoft ramps up WGA enforcement, we are likely to see scenarios such as these -- involving innocent users -- appearing in potentially very large numbers.

--Lauren--

Blog Update (June 15, 2006): Microsoft Responds Regarding Innocent Users and Windows Genuine Advantage

Greetings. Given all of the other news last week, some interesting and potentially important statements by Google co-founder Sergey Brin went largely unnoticed, and I believe that they are worth highlighting here briefly.

While he was in Washington D.C. promoting the Google view on network neutrality issues (which I support), Sergey made some comments about the continuing controversy regarding the censored version of Google for China. Word is that the vast majority of Chinese users still (attempt) to use the uncensored version of Google, to the extent that this is not blocked by Chinese authorities (as of late, this blocking has apparently become largely ubiquitous).

As we know, Google's censored version has been highly controversial since it was announced earlier this year, and collected considerable criticism at various levels, including from me, as in:

Google's Search Query Log Battle vs. China Censoring -- Perceptions Matter!

Remarks that Sergey made in D.C. suggest that a reevaluation of Google's participation in the censored version of Google for China may be in the offing. Sergey reiterated a stance that we know from the project's launch:

"We felt that perhaps we could compromise our principles but provide ultimately more information for the Chinese and be a more effective service and perhaps make more of a difference."

However, he added the following key statement:

"Perhaps now the principled approach makes more sense ... It's perfectly reasonable to do something different, to say, 'Look, we're going to stand by the principle against censorship and we won't actually operate there.' That's an alternate path. It's not where we chose to go right now, but I can sort of see how people came to different conclusions about doing the right thing."

While this is obviously not a promise of changes, and in fact we're told that Google is trying to improve the censored service before deciding about such a potential change of course, I am very pleased to see Sergey bringing these controversial aspects of the issue directly and personally into the public view, something that most persons at Sergey's level in many other firms would be loathe to do. Sergey is to be congratulated for these comments.

These are complex issues, with vast numbers of users and very large amounts of money at stake. Google has stockholders who understandably want the best possible value for their money.

Yet Google has positioned itself in a very unique way. Sergey noted that Google's rivals accommodated the same Chinese demands ("a set of rules that we weren't comfortable with") without the same sort of international criticism. But people simply expect Google to lead in the ethical corporate arena, and any perceived shortcomings (whether real or not) will be magnified in the public reaction.

Sergey also noted how limited the safeguards are on the personal information in electronic systems:

"I think it's interesting that the expectations of people with respect to what happens to their data seems to be different than what is actually happening."

I agree, and I again hope that Google will push to lead in this area, as I suggested in:

An Open Letter to Google: Concepts for a Google Privacy Initiative

Putting on my "Jiminy Cricket" hat for a second though, a common thread that runs through so many of these issues is as old as mankind: "Let your conscience be your guide."

I assert that with ethical questions -- even when large corporations and billions of dollars are at stake -- in the long run, following what your heart tells you is right will rarely lead you astray. In many cases, the goodwill engendered will actually result in new economic benefits, perhaps in ways that weren't originally imagined.

I plead guilty to sounding a bit simplistic when it comes to ethics. But while ethical questions may be complex, the answers often are not, at least if we're being completely honest about ourselves and our priorities. This may be the single concept of the most importance that I've learned in my life -- for what it's worth.

And that's why I was pleased to see a bit of public soul-searching on these issues by Sergey. It's potentially a good sign for Google, and for the rest of us as well.

--Lauren--

Luke: "You lied to me. You said that Darth Vader killed my father."
Obi-Wan: "When Anakin Skywalker turned to the Dark Side of the Force, the good man that was your father ceased to exist. So, what I told you was the truth -- from a certain point of view."
    -- Star Wars: Return of the Jedi - 1983

Pat (to Mystic Seer): "You're just a stupid piece of junk, aren't you?"
Don (reading response): "It all depends upon your point of view."
    -- Twilight Zone ("Nick of Time") - 1960

Greetings. In yesterday's blog posting, I asked the implicit question: "Is Microsoft's update of their 'Genuine Advantage' OS validity verification tool behaving as spyware?"

Within hours of that text becoming widely public, I received e-mail and a call from the director and the senior program manager for Microsoft "Genuine Windows" (their anti-piracy division). We three had a lengthy and friendly chat, and I believe that I can now answer this question. However, as you have probably already guessed, the answer is, "It depends upon your point of view."

And perhaps of more importance, it's not clear that the spyware question alone is really the key issue in this case, since this is all part of a larger MS anti-piracy effort with broader implications for all concerned. In the long run, the real issues are clarity and control, as we shall see.

Microsoft has major piracy problems, on a massive scale -- this we all know. They have been ramping up their infrastructure to prohibit "non-validated" copies of Windows XP from installing non-critical software updates. What many people don't realize is that MS does not consider validation to be a necessarily permanent state. Even after a copy of XP has been validated, MS may choose to "revoke" that validation (via communications with their Windows Update site) at a later date if activation codes are found to be pirated in the future.

Why is the new version of the validity tool trying to communicate with MS at every boot? The MS officials tell me that at this time the connections are to provide an emergency "escape" mechanism to allow MS to disable the validation tool if it were to malfunction.

While most users will routinely accept the tool update from Windows Update, MS considers it to be (for now) an optional upgrade as part of a pilot program, as described in accompanying license information that (as we know) most users will never read. (I should note that while these materials do discuss Internet connections, they do not appear to notify users that the updated tool will make multiple connections to MS at various intervals, even on systems that are already validated.)

I was told that no information is sent from the PC to MS during these connections in their current modality, though MS does receive IP address and date/timestamp data relating to systems' booting and continued operations, which MS would not necessarily otherwise be receiving.

Apparently these transactions will also occur once a day if systems are kept booted, though MS intends to ramp that frequency back (initially I believe to once every two weeks) with an update in the near future. Further down the line, the connections would be used differently, to provide checks against the current validation revocation list at intervals (e.g., every 90 days) via MS, even if the user never accessed the Windows Update site directly.

Can you safely block the tool from communicating with MS using ZoneAlarm or another third-party firewall? The answer appears to be yes. I'm told that if the tool can't communicate with MS, validation checks will be made the next time the system communicates directly with the Windows Update site, in the same manner as has been done up to now since validation began.

We can argue about whether or not the tool's behavior is really spyware -- there are various definitions for spyware, and the question of whether or not you feel that the notice provided at upgrade installation time was sufficient is also directly relevant. I believe that the MS officials I spoke to agree with my assertion that additional clarity and a more "in your face" aspect to these notifications in such cases would be highly desirable.

But this is where an even more important question comes into play. Microsoft (and other software vendors) are moving inexorably toward a more "distributed" computing model where users are really "renting" software services, rather than buying commodity software products. The "rental" model implies long-term vender control over the use and applications of such software, with associated communications between user PCs and vender servers for ongoing authentication and other purposes.

The entire concept of authentication revocation will be utterly foreign to many users, who are used to assuming that once they've bought something that they believe to be legitimate -- and that in fact has initially been verified as legitimate -- it's then theirs forever and can't be disabled or restricted later.

And as we've now seen yet again, the communications issues associated with the rental/service model introduce a range of both real and perceived privacy factors and concerns that we've hardly yet begun to explore in depth as technologists or as a society.

One thing is certain regardless of your point of view -- the sorts of issues that relate to this particular case are but harbingers of what's to come, in terms of capabilities, controversies, risks, and more. The old models are dying, and if we don't get ahead of the curve by understanding and properly framing the new models, we are likely to be very sorry after the fact.

--Lauren--

Blog Update (June 13, 2006): How Innocents Can Be Penalized by Windows Genuine Advantage

Greetings. There have been some murmurs about this in other forums, but since I've now independently verified I figured I'd better report here.

A recent Microsoft update to Windows XP, which modifies the tool that verifies the "validity" of XP installations to insure that they are not illicit, may itself be considered to be spyware under commonly accepted definitions.

The new version of the "Microsoft Genuine Advantage" tool reportedly will repeatedly nag users of systems it declares to be invalid, and will then apparently deny such users various "non-critical" updates. Apparently various parties have already found ways to bypass this tool, though the effects of this on later updating capabilities remain to be seen.

However, I've noted a much more serious issue on local XP systems, all of which are legit and pass the MS validity tests with flying colors. It appears that even on such systems, the MS tool will now attempt to contact Microsoft over the Internet every time that you boot. At least, I'm seeing these contacts on every boot after the tool update so far, and I've allowed them to proceed to completion each time. Perhaps it stops after some number of boots, but there's no indication of such a limit so far. The connections occur even if you do not have Windows "automatic update" enabled.

I do not know what data is being sent to MS or is being received during these connections. I cannot locate any information in the MS descriptions to indicate that the tool would notify MS each time I booted a valid system. I fail to see where Microsoft has a "need to know" for this data after a system's validity has already been established, and there may clearly be organizations with security concerns regarding the communication of boot-time information.

I'll leave it to the spyware experts to make a formal determination as to whether this behavior actually qualifies the tool as spyware.

For now, you can block the tool's connection attempts via firewalls such as ZoneAlarm, though the long-term ramifications of doing this are unclear. I do not know if it's possible to block this behavior using the internal XP firewall system.

This situation is potentially a very disturbing development.

--Lauren--

Blog Update (June 6, 2006): Please see this entry for a discussion of Microsoft's response regarding this issue.