Secret Software Could Take Control of University Computers
By SCOTT CARLSON
A company has disclosed that the popular file-sharing program KaZaA, which has been downloaded by innumerable students to swap video clips and
MP3 files, has software attached to it that could allow the company to use student computers and university bandwidth for commercial ventures, such as serving Internet advertisements or selling computer storage space.
Brilliant Digital Entertainment, the owner of the stealth software, called Altnet SecureInstall, detailed its plans for the software on Monday in a filing with the Securities and Exchange Commission. The company says in the filing that it will get permission from individual KaZaA users before activating the software. KaZaA itself is owned by another company.
Kevin Bermeister, chief executive officer of Brilliant Digital, said in an interview that permission will be obtained through a pop-up window with buttons allowing the user to accept or decline. Users who accept will get credit for non-cash items like gift certificates or access to video content; Mr. Bermeister says those details haven't been worked out yet.
Brilliant Digital will sell access to its computing network to companies for several different purposes: to run online advertising, to store data, or to run a distributed-processing service, which uses many computers in a network to solve large computational problems. SETI@home, which uses idle computers to analyze radio-telescope data to search for extraterrestrial life, is a particularly well-known example of distributed computing.
The securities filing says SecureInstall will start working sometime within the next few months. It also says that the program will first seek out "selected users with higher-than-average processing power, significant free space on their hard drives, and broadband connectivity to the Internet" to become main components of its network.
"Universities are probably the best-connected places around," says Gerry Sneeringer, the network engineer at the University of Maryland at College Park. "I get the feeling that, like it or not, we will be an early guinea pig for what's coming."
The news hasn't been well received by network administrators at colleges and universities. The existence of SecureInstall was first reported by CNET.com, and word quickly spread onto university-oriented e-mail discussion lists, where administrators have been pondering what to do about this file-sharing software and its secret alter ego.
Some have already decided. Barbara Inzina, the network manager at the Marine Biological Laboratory, in Woods Hole, Mass., held a meeting about the stealth software Wednesday afternoon and decided to use network equipment to block access to KaZaA. "Our end users do not have the legal right to sign away institution resources," she says. "Our Internet connection is huge, so we are likely to be one of the top candidates for having this service offered to people."
"We're taking it very seriously," she says. "Our bandwidth costs us a lot of money. We use it for scientific and educational purposes, not for serving ads."
Many universities are in a wait-and-worry mode. Mr. Sneeringer, at the University of Maryland, says that the commercial nature of the software would be a great excuse to ban it, because university policy forbids commercial ventures. But "the fact is, KaZaA is everywhere," he says. "We're not going to stop it, and there are ways around any block we could put in. It's a real quandary." He is consulting the university's lawyers for help. "We're going to do a lot of talking, and I don't know where we're going to go with it."
Christopher E. Cramer, the technology-security officer at Duke University, has also consulted the university's lawyers. "It's definitely something that we have our eyes on and concerns us, not only for the potential for abuse of Duke's network," he says. "I also have concerns about the abuse of our user's computers and their privacy."
Background article from The Chronicle: