Sears Privacy: Spyware is Watching You

Hoffman Estates, ILTalk about Big Brother watching you. Spyware is something you expect to get from an unsavory web site or an infected email—not from a major retailer. However, that appears to be the case with Sears and Roebuck through their My SHC Community, on-line service.

At issue is the inclusion of a tracking device linked to a well-known tracking company ComScore, which monitors Internet traffic and mines for data. While a welcoming email was reported to have contained a reference for the tracking opportunity, the on-line registration does not.

My SHC Community is an on-line shopping service billed as the Sears Holdings Community, "a place where your opinion matters."

Apparently so, in more ways than one. Tracking software installed by ComScore is not, according to critics, fully communicated to the user at the time of installation. According to a senior researcher in the anti-spyware unit at Computer Associates, the My SHC Community spyware issue first came to light at the end of December. While Sears, Roebuck and Co defends its practice, those in the know in the computer industry disagree with the company, stating that disclosure provided by the company is limited and, according to veteran antispyware researcher Benjamin Edelman, "the limited SHC disclosure provided by email lacks the required specificity as to the nature, purpose and effects of the ComScore software."

And make no mistake—in the view of software professionals, this tracking software IS spyware.

The non-profit StopBadware.org, which is run by the Harvard Law School at Oxford University, agrees with Consumer Reports WebWatch in citing the SHC "because of inadequate disclosure of extensive tracking and data collection, and because the application does not identify itself while running."

ComScore maintains that its data collection methods do not qualify as spyware, but many computer professionals disagree. It is interesting to note that a senior VP of SHC was at one time a senior VP of ComScore.

According to a recent post at c|net NEWS.com, Edelman cites that "the initial SHC email refers to the ComScore software as 'VoiceFive.' The license agreement refers to the ComScore software as 'our application' and 'this application.' The ActiveX prompt gives no product name, and it reports company name 'TMRG, Inc.' These conflicting names prevent users from figuring out what software they are asked to accept."

Serars, Roebuck & Co have reportedly made changes to their SHC web site since the controversy first erupted, beefing up its privacy policy and adding a prominent link to it

In a further post from c|net NEWS.com, StopBadware.org said: "Sears Holding Corporation (SHC) has informed StopBadware that SHC is significantly improving the My SHC Community application disclosure and privacy policy language and adding a Start menu icon in an effort to comply with our guidelines and address privacy concerns."

StopBadware.org added that SHC had informed them, in the second week of January, that they had suspended invitations to new users to install the application until the changes had been implemented.

Even so, StopBadware.org had yet to change their negative designation with regard to SHC.

Sears, Roebuck and Co. faces a possible class action lawsuit over its alleged data tracking activity.