Introduction

Computer users have recently come to face a barrage of software installed on their PCs even though they don't want it. Some of this software arrives through security holes. Other programs come from misleading popups that look like official messages reporting required browser updates. This article investigates a further source of unwanted software: Add-ons bundled with peer-to-peer filesharing programs.

Specific Findings

I chose to test the five applications listed below based on their high reported total downloads within c|net Download.com's MP3 Search Tools and File Sharing categories. Kazaa is not currently listed at Download.com, but I nonetheless included it due to its reported prevalence.

I installed the specified programs on separate test PCs, each running only Windows XP and the limited additional software necessary to conduct my testing, measurement, and archival. In each installation, I accepted the installer's default settings, including default bundled programs to be installed. After each installation was complete, I restarted the test PC, then loaded my web browser and browsed to www.google.com. Via this procedure, I attempted to activate any delayed-install bundles that waited for restart or web browser use. However, this procedure cannot activate delayed-install bundles, nor bundles with extended delays or other installation conditions.

Reporting in the "bundled software" columns combines my analysis of applicable license agreements and my hands-on testing of the respective programs and their bundled add-ons.

All testing was performed in February - March 2005.

Discussion

Others have previously noted the problem of unwanted software bundled with peer-to-peer programs. A June 2004 FTC press release highlighted the risk that P2P programs bundle "unwanted software ... including spyware." An internal document from Kazaa's chief technology officer revealed Kazaa's awareness of these risks, including many Kazaa employees apparently unwilling to install Kazaa's own software.

My testing uncovered no bundled software installed without at least some disclosure apparent in a careful and complete reading of all applicable installation license agreements. However, it is possible that programs were installed that I failed to detect, especially if bundled program installations were set to be delayed after installation of the requested P2P software.

Although each P2P installer included at least a vague reference to each program to be installed, certain P2P programs' installation procedures nonetheless present cause for concern. For one, substantive disclosures are generally detailed only in license agreements presented in scroll boxes -- often squeezing thousands of words of text into small windows requiring dozens of page-downs to view in full.

In addition, some installers' vague disclosures call into question whether users who press "yes" can reasonably be said to understand what they are (purportedly) accepting. Some installers fail to provide even general information about the programs to be installed. For example, the eDonkey installer offers users New.net without stating the general purpose of New.net software and without disclosing any effects of accepting the installation. Other installers describe selected general effects but fail to prominently mention other effects likely of interest to most users. For example, when Kazaa installs Claria, the Kazaa installer prominently mentions Claria's advertisements but does not prominently mention transmission of user activities to a Claria "decision support" database (reportedly the seventh-largest in the world).

Beyond the frequently-downloaded P2P filesharing programs I tested for this analysis, less well-known P2P programs also bundle unwanted programs. The installation practices of these lesser-known programs may be even more confusing or deceptive to typical consumers. For example, in October 2004 I tested Grokster, finding that Grokster installed certain software even if users pressed Cancel to attempt to deny such installations. (Screenshots and video.) In June 2004 I examined the installer for Kiwi Alpha. In my testing, Kiwi Alpha bundled software from 180solutions, but Kiwi mentioned 180 only at pages 16 through 33 of a 54-page license agreement, without any heading or other text alerting users to the presence of 180 or to the 180 license shown midway through the scroll box. Instead, users would have to scroll to midway through the agreement even to learn of 180's inclusion. (See screenshots.)

One program in my sample is notable not for its inclusion of bundled software but for its omission of such software. Not only did LimeWire not include bundled software, but in my testing it also did not show any advertisements beyond promotions for the paid version of LimeWire.

Appendix: Analysis of Specific Licenses and Installation Procedures
[ eDonkey | iMesh | Kazaa | LimeWire | Morpheus ]

eDonkey

The eDonkey installer shows license agreements in two distinct stages. First, eDonkey shows a five-screen (545-word) set of rules pertaining to use of eDonkey (e.g. policies on copyright violation and child pornography). Second, as highlighted at right, eDonkey shows a 85-screen (7,222-word) document giving the licenses of some of the programs eDonkey offers to install. This second document is difficult for users to meaningfully review and understand, due to at least the following characteristics:

• Window size and shape. eDonkey presents the bundled programs' licenses in a tall narrow window, with as just three words on many lines, and with only four or five words on typical lines. Although the license window includes 24 lines of text, the narrow window nonetheless makes reading the license slower and more difficult than would otherwise be the case. (See Human Factors International research finding that windows four to five inches in width facilitate fastest reading. In contrast, the eDonkey license is approximately 1.5" wide as shown on my test PCs.)
• Merging multiple licenses into a single window. Although the iMesh license window presents three distinct licenses for three distinct programs, the first screen of the license scroll box mentions only the first program. A user must scroll to the precise start of each of the subsequent licenses to learn that the window also includes two other licenses. Because the licenses are lengthy -- 15 on-screen pages for the Webhancer license, 50 for IBIS, and 22 for New.net -- users are likely to face difficulty reaching the specific sections of interest. No special heading (bold type, large font, horizontal line, or other markings) flags the start of a new section of the multi-license window.
• Exceptionally broad substantive provisions. The specific provisions of some of the licenses are unusually broad. For example, the Web Search Toolbar (IBIS) license states that IBIS may "redirect certain URL's [sic] to or through [IBIS']s [s]ervice." Will IBIS cause users to arrive at www.gateway.com when they ask for www.dell.com? The license gives users no way to know. Furthermore, in my testing, IBIS performs some activities not disclosed in its license -- for example, in my testing, attempting to claim affiliate commissions when users type in merchants' domain names. The New.net agreement is similarly vague -- in fact, by my reading, failing to make any specific statements as to what New.net software will do on or to a user's computer, or what conceivable user purpose is served by installing New.net software.
• Failure to disclose functions of software to be installed. eDonkey offers users software from "New.net" without providing a description of what this software does. Note the absence of a description below the New.net icon in the screenshot above. Even if a user locates the New.net license agreement at the bottom of the partner license scroll box, the New.net license offers no description of New.net's purpose or effects. eDonkey also fails to provide a prominent statement of the purpose of Webhancer. (Notice absence of a description adjacent to the Webhancer icon and checkbox in the screenshot above.) However, Webhancer's license agreement does disclose the program's general purpose ("relay... web surfing performance metrics to Webhancer ... to generate performance report for third parties").

See also installer screenshots, license agreement text, and license agreement screenshots.

iMesh

At 5,493 words and 56 on-screen pages, iMesh's license agreement was the second-shortest of those shown by the programs tested here (excluding those programs that showed no license agreement). But the iMesh license is still lengthy -- 19% longer than the US constitution (4,616 words), and 102% longer than the Google Terms of Service and Privacy Policy combined (2,726 words).

What is most notable about iMesh's installation is what it does not say: Although iMesh installs a toolbar into users' browsers, iMesh's installer never mentions the addition of any such software. Indeed, the word "toolbar" does not appear in iMesh's license agreement. In a mis-formatted paragraph at page 27 of the license (see inset at right), the license begins to discuss a "search bar function," which the license subsequently admits "sends a configuration request ... when [a user] start[s his] browser." But nowhere does iMesh define what the "search bar function" entails. Nor does iMesh disclose that this "bar" is in fact a toolbar added to the user's web browser, reducing the amount of Internet Explorer screen space available for other purposes.

The iMesh license discusses its privacy policy and removal procedure. But where surrounding text indicates that URLs should reference an external privacy policy and an external removal instructions document, the iMesh license instead includes only placeholders. See highlighted text at left.

See also installer screenshots, license agreement text, and license agreement screenshots.

Kazaa

The Kazaa installer asks users to accept unusually lengthy license agreements. All told, the Kazaa installation requires accepting 22,606 words of license agreements -- nearly five times the length of the US Constitution. Kazaa includes four separate licenses shown in three separate windows, only one of them affirmatively shown to users without users' specific request, but collectively totaling 182 on-screen pages. Kazaa's licenses further cite seven additional web pages purportedly included by reference.

• Kazaa's main license agreement, some 4,473 words long, is shown only if a user requests it by clicking a link within the installer. (See inset image below, asking users to accept the license without it first being presented on screen.) Even if a user requests this license, it is presented in a window with only ten lines viewable at a time, so viewing the full license requires a total of 46 page-downs (47 on-screen pages).
  
  • Kazaa discloses its planned addition of icons to the computer's desktop (in my testing, two gambling icons) only at page 19 of the Kazaa license agreement. In my testing, Kazaa added two icons for online gambling services to my test PC's desktop. (Screenshot.)
• Kazaa bundles a program called Altnet, showing Altnet's license only if a user specifically clicks to request it. (See inset image above.) Altnet's license is 7,826 words, requiring a total of 71 page-downs.
• The Altnet license references other documents. At page 16, Altnet's license claims that users "hereby accept and agree to" Altnet's privacy policy, subsequently giving the URL of that policy. However, the specified URL is not an "active" hyperlink -- merely clicking the URL does not load it. (Screenshot.) Any users who ultimately manage to obtain the privacy policy find that it entails another 2,044 words of text.
• The Altnet license's formatting omits certain line breaks, merging bulleted lists into extended and confusing blocks of text. See e.g. three screens (1, 2, 3) detailing prohibited user activities. This formatting error is repeated in numerous other screens of the Altnet license (1, 2, 3).
• Beginning at page 32 of the document entitled "Altnet End User Agreement," Altnet presents the license agreement for the My Search program. (Screenshot.) At page 48 (screenshot), this license notes the applicability of a separate My Search Privacy Policy, again referenced via a URL without an active hyperlink. Users who manage to obtain this additional privacy policy receive another 376 words of text.
• If users click a checkbox to accept the Kazaa and Altnet licenses (with or without having actually been shown such licenses), the Kazaa installer next shows users a license from Claria ("GAIN Network"). The Claria license is 5,918 words long and generally fits only nine lines per screen, therefore taking 63 on-screen pages to view in full. Notable characteristics of the Claria license:
• Claria's section headings are collapsed into body text -- lacking bold type or line breaks to help users distinguish section headings from the body text they refer to. 33 of the 63 on-screen pages of Claria's license include this defect. (Screenshots: 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19, 20, 21, 22, 23, 24, 25, 26, 27, 28, 29, 30, 31, 32, 33.) See also yellow highlighting in the screenshot at right, noting two example instances of erroneous line formatting that merges what should be distinct blocks of text. I first reported this error in a November 2004 posting to my site. But the problem remains in Kazaa's current software nearly three months later.
• In eight instances in the document, Claria references a total of five external documents, purportedly each "incorporated herein by reference." In each instance, Claria references these external documents via mere URLs, not active hyperlinks. (See green highlighting in screenshot at right.) In addition, some referenced URLs erroneously include space characters (example), making the URLs inaccurate and invalid even if users attempt to manually copy the addresses to their web browsers. Users who manage to obtain the pages at issue, after correcting the erroneous URLs where necessary, receive documents that are 153, 468, 634, 603, and 111 words in length.
• It is not immediately apparent how Claria decided what material to include in its license agreement and what material to relegate to external documents. Some of the external documents give graphical content (e.g. example advertisements) not readily copied into a textual license agreement. But the document described as "more detailed description of the information collected by GP [Claria] and how it is used" gives ordinary textual information about the specific information Claria collects. This information is likely of substantial interest to many users, and it is information not otherwise discernible even in a full read of the remainder of Claria's license as presented by Kazaa. Because this information includes no graphics, it seems suitable for direct inclusion in the main Claria license as presented by Kazaa, but it is nonetheless included only by reference.
• See also my prior reporting of one-sided provisions in Claria's EULA, including a prohibition against "unauthorized" removal methods and a prohibition against viewing or recording what transmissions Claria sends over users' own Internet connections. Note also absence of the terms "pop-up" and "adware." Finally, while Claria discloses "select[ing ads] based on how you surf the Web" in the first page of its license, only at page 11 does Claria mention that it "know[s]" what web pages users visit.
• Throughout these lengthy licenses, users have limited ability to analyze or preserve the license agreements. Although prior versions of Kazaa included a feature to print the license agreements or to copy the licenses into external text editors for more convenient on-screen reading (e.g. in a larger window), the current version of Kazaa has removed this feature. Right-clicking on license text yields no popup menu (not the usual Windows listing with Select All and Copy options).

See also installer screenshots; license agreements for Kazaa and its bundled software from Altnet and Claria; and license agreement screenshots.

LimeWire

Whereas the Kazaa installer showed so many lengthy licenses, LimeWire is notable for not showing or referencing any license agreement at all. See screenshots below, installing LimeWire without any mention of a license.

Since LimeWire contains no apparent bundled software, its on-disk presence might be expected to be smaller than its 61 folders and 864 files (the second-largest and largest additions among the programs I tested, as measured along those metrics; though simultaneously the second-smallest in both registry keys and values). My examination of the specific files and folders created by LimeWire reveals the reason for the many additions: More than half the folders created by LimeWire and more than 65% of files were associated with the Java runtime that LimeWire requires. Users who do not otherwise seek to run Java software may see these files as a burden. However, those who already have Java a runtime may not require any of these files or folders, making LimeWire's on-disk burden for such users among the smallest of tested programs.

My hands-on testing of LimeWire's application yielded only ads promoting the paid version of LimeWire, but no advertising for third-party products.

See also full-size installation screenshots.

Morpheus

Morpheus neither shows nor references any license for its own software. However, Morpheus shows a Direct Revenue license agreement and installs Direct Revenue software. At 4,492 words and 44 on-screen pages, Morpheus's DR license is the shortest of the license agreements analyzed in this article. But reading the license could be burdensome nonetheless. According to research conducted by Human Factors International, the average adult's reading speed is 250 to 300 words per minute, such that this license would still require 15 to 18 minutes to read in full.

Installation screenshots:

The Direct Revenue license contains a number of notable provisions:

• The license purports to give Direct Revenue the right to automatically update itself "in order to ... stop hacks or attacks ... by other contextual advertising software applications." But in my prior testing, I have observed DR performing precisely this kind of "attack" in removing software from other companies. See my analysis of Direct Revenue deleting Avenue Media software from users' disks. Consistent with such deletions, the license further provides that DR "may, without any further prior notice ..., remove, disable or render inoperative other adware programs resident on your computer."
• DR's license discloses collection of "certain ... non-personally identifiable information," and the license lists some examples of such information ("your Internet protocol (IP) address, your domain, your operating system, your browser version"). But DR's license fails to mention that DR software also transmits an inventory of numerous registry entries (their presence or absence, and their values if present), including information about other "adware" programs as well as certain security programs.
• Both as disclosed in DR's license and as observed in my hands-on testing, DR features an unusual and deficient uninstallation procedure.
• Rather than an ordinary entry in Control Panel's Add/Remove listing, DR's uninstall procedure requires downloading a removal program from a DR web site, running that program, and typing a special code into a dialog box.
• DR's license purports to give DR the right to "automatically repair or reinstall the Software if any third party application attempts to delete, disable or modify the Software" -- seemingly referring to any removal procedure other than DR's official removal procedure. If a user turns to a program like Ad-Aware to remove DR, thereby avoiding DR's convoluted uninstall procedure, this text claims that DR may reinstall itself.
• The URL given in DR's license agreement, purportedly the address of the DR uninstaller, is in fact a broken link. DR's link omits the "www" host name necessary, as to the specific domain at issue, in order to retrieve the DR uninstaller. Screenshots of EULA snippet, resulting web page access attempt.
• DR states that it "does not screen the websites accessed through the software" and claims that it therefore "assumes no responsibility for the content of any website" it shows. This disclaimer correctly anticipates controversy as to DR's choices of advertisers and targeting: For example, in my hands-on testing, DR shows ads for gambling and credit card sites when users visit certain web sites primarily visited by children. I intend to publish a future article specifically documenting these and other controversial ads shown by DR software.

See also full-size installation screenshots for Morpheus, as well as license agreement text and screenshots for Direct Revenue (as installed by Morpheus).

In addition to Direct Revenue, Morpheus's FAQ also discloses bundling of IBIS. A Slyck article dated February 10, 2005 discusses Morpheus's inclusion of IBIS, and a Google search yields hundreds of similar reports. However, in my testing, Morpheus's installer neither disclosed installation of IBIS nor actually installed IBIS. If Morpheus in fact installs IBIS, e.g. with some delay after installation, Morpheus's installation procedure offers no applicable disclosure and obtains no such consent.

In certain testing of February 2005, Morpheus showed no license agreement at all, and did not install Direct Revenue or other software.

Disclosures

This article builds on paid consulting I conducted for LimeWire. I thank LimeWire for their willingness to let me share my findings with the public.

My interest in spyware originally arose in part from a prior consulting engagement in which I served as an expert to parties adverse to Gator in litigation. See Washingtonpost.Newsweek Interactive Company, LLC, et al. v. the Gator Corporation. More recently, I have served as an expert or consultant to other parties adverse to spyware companies.

Thanks to Mike Kneller for CSS tips.

Last Updated: March 7, 2005 - Sign up for notification of major updates and related work.