Spyware foes ready to play hardball

Here’s a new way to attack spyware: Embarrass its purveyors.

A free Web site ( www.StopBadware.org) plans to provide a list of programs that contain spyware and other malicious software. It will also identify companies that develop the programs and distribute them on the Internet.

Consumers can then decide if a program is safe to download.

“For too long, these companies have been able to hide in the shadows of the Internet,” says John Palfrey, who heads the Berkman Center of Internet & Society at Harvard Law School and is spearheading the project. “What we’re after is a more accountable Internet.”

The initiative is being run by Harvard and Oxford University’s Oxford Internet Institute and is backed by high-tech heavyweights including Google and Sun Microsystems. Consumer Reports WebWatch is serving as a special adviser.

Spyware invades PCs without users’ knowledge when they download applications such as music file-sharing programs or screen savers or when they visit certain Web sites. Often, spyware tracks Web-surfing habits and bombards victims with related pop-up ads. More nefarious versions monitor keystrokes to steal Social Security numbers or passwords for identity theft.

Also on the hit list of the StopBadware coalition are malicious “adware” programs that serve up onslaughts of pop-up ads or software that contains hidden viruses and worms.

At least 60 percent of home PCs are infected with one or more of these “badware” programs, says Forrester Research analyst Natalie Lambert.

The prevalence of the programs has spawned a booming industry of anti-spyware and anti-virus software. Internet service providers such as America Online and EarthLink include the software free with service. But such programs typically can’t identify all the rogue software on a PC and might not be able to eradicate a deeply embedded program even if they do, says Ferris Research analyst Fred Berlack.

By checking StopBadware.org, its organizers say, consumers can choose, in the first place, not to download a program containing the malicious software. The coalition is encouraging consumers to visit the Web site to log their experiences with harmful programs.

It will then use that information to compile reports on suspect programs, Web sites and companies that foist the software on consumers without getting their consent. The worst offenders will be spotlighted. It will take several months to gather a significant-size database, Palfrey says.