Catfight in the spyware corral

A group devoted to setting anti-spyware standards and helping consumers distinguish between safe and harmful software is on the rocks, with three founding members resigning in protest over policies they say are too lax.

It's a "catfight in the spyware corral," as one security expert called it.

Webroot Software, Aluria Software and Computer Associates International's PestPatrol successively announced their departures in recent days from the Consortium of Anti-Spyware Technology vendors (Coast).

The walkout came just weeks after the group welcomed adware-maker 180Solutions as a member. That decision capped growing frustration over the group's direction, according to representatives from Aluria and Webroot, making it impossible for them to remain.

"It became clear that the anti-spyware members would be outnumbered by the companies that had nothing to do with anti-spyware."

--Richard Stiennon, vice president, Webroot

"Coast had done an about-face, starting to allow and entertain requests for so-called adware companies to join," said Richard Stiennon, vice president of threat research at Webroot, which makes the popular spyware removal tool Spy Sweeper.

The infighting highlights sharp disagreements within the software industry over "adware" and "spyware," a difficult-to-define class of applications that trigger advertising on PC screens and collect data, such as Web surfing histories, to personalize marketing messages. Practices run the gamut, from displaying small banner ads inside applications to infiltrating operating systems and taking over key computing functions without notice or permission.

While clear examples of legitimate and illegitimate behavior are easy to find, drawing a bright line between them has proven to be extremely difficult.

According to Stiennon, Webroot co-founded Coast in 2003 to help establish industry-binding guidelines defining spyware and a code of ethics surrounding the distribution of desktop software. Instead of sticking to the mission, he said, the group sought to reform bad actors by helping them change and become certified.

"It became clear that the anti-spyware members would be outnumbered by the companies that had nothing to do with anti-spyware," Stiennon added.

Webroot's departure Friday caused a domino effect among its partners. Aluria resigned, and then Computer Associates said Monday that it, too, would leave.

The remaining members of Coast include advertising software makers New.net, Weatherbug and 180Solutions.

Todd Sawick, a representative for 180Solutions, said that the company is disappointed with Coast's troubles. But he reiterated that the company's software was certified "spyware free" by the group.

"We are moving forward on an individual basis with all the former Coast scanning application members. We're proud of our accomplishments with Coast and will continue to serve as a leader in legitimate keyword search advertising," he said.

180Solutions, which makes downloadable software that tracks

computer users' behavior and delivers ads to the desktop, long had a black mark on its back among its spyware-removal tools, and the group disagreed about its membership to Coast.

Among other practices, 180Solutions uses vulnerabilities in ActiveX to automatically install its software on people's PCs without their express permission, according to security experts, a method that rival WhenU recently said it would no longer use. In recent months, Google also said it cut off 180Solutions from its AdSense advertising network after finding that the company was not in compliance with the service's terms and conditions.

"There's a strong incentive for adware publishers to want to be involved in an organization like Coast because it separates them from all the bad spyware companies out there."

--Rick Carlson, president, Aluria Software

Coast recently worked with 180Solutions to review its software and recommend changes, which 180Solutions instituted in a new version of its software. The company was given 90 days to replace all of its outstanding software with the new version. Meanwhile, 180Solutions announced its membership with Coast.

"There's a strong incentive for adware publishers to want to be involved in an organization like Coast because it separates them from all the bad spyware companies out there," said Rick Carlson, president of Aluria Software, which just released the 4.0 version of its spyware removal tool. "But we can't give these guys membership and not push a standard."

Webroot's Stiennon went further to say that the certification process was a conflict of interest.

"Webroot's goal is...diametrically opposed to companies that want to install software on your computer that uses your computer's resources and sometimes have sloppy or damaging practices all in the purpose of serving up ads, which they get paid for and you don't," Stiennon said.