By Paul F. Roberts
September 12, 2005
2 comments posted

A dispute has erupted between the Ask Jeeves search engine and anti-spyware software companies that raises questions about the standards used to flag potentially unwanted programs on users computers.

At least two anti-spyware companies—Sunbelt Software Inc. and Facetime Inc. —have been asked by Ask Jeeves Inc. to stop flagging or to change the way they categorize the company's Web browser search bar plug-in programs but have refused to do so, according to interviews with executives at those companies. At issue is Ask Jeeves' method of distributing its software, such as bundling arrangements that result in the programs being installed without users' consent?

Sunbelt Software, which makes the CounterSpy anti-spyware program, flags a number of Ask Jeeves's software products on machines it scans. Products such as My Global Search, My Search Bar, Need2Find Toolbar, My Speedbar and MyWebSearch Toolbar are labeled "potentially unwanted programs," not "spyware" or "adware," and considered a "low risk," said Alex Eckelberry, president of Sunbelt, which is based in Clearwater, Fla.

In recent weeks, executives at Ask Jeeves asked Sunbelt to stop flagging its programs altogether, he said.

"They didn't feel they were adware and felt they shouldn't be listed," Eckelberry said.

The same was true at Facetime Inc., said Wayne Porter, vice president of greynet research at Facetime Communications, Inc. of Foster City, Calif. "They don't think that AskJeeves has a problem," Porter said.

But security researchers at both Facetime and Sunbelt felt otherwise after studying the way in which Ask Jeeves's software makes it onto users' computer desktops.

"We found poorly disclosed bundled installs and poor disclosure," Eckelberry said.

In one example, a special branded version of Ask Jeeves software called the iMesh Bar is bundled with the iMesh peer-to-peer file sharing program. Users who install iMesh must read a 5,500 word end user license agreement (EULA). In that agreement, Ask Jeeves is described as a "Third Party Beneficiary," but the iMesh Bar isn't identified as an Ask Jeeves toolbar and the iMesh Bar is portrayed as an integral part of the iMesh software, according to a soon-to-be-released Sunbelt report.

Both Eckelberry and Porter acknowledge that the browser plug-ins do not display pop-up or banner advertisements, track user behavior or perform other actions that qualify other programs as adware or spyware.

"They're a legitimate search engine that's involved in a distribution channel that doesn't provide proper disclosure (to users)," Eckelberry said.

"Are they making it clear what consumers are getting? No," said Porter.

Other spyware experts have reached the same conclusions and found other faults with Ask Jeeves's distribution practices.

Ben Edelman, a Harvard University Law School student, spyware expert and advertising software industry gadfly, has taken the company to task for what he claims are misleading banner advertisements that target minors and install the company's software without receiving proper consent.

Edelman claims, on his Web site, to have documented instances of Ask Jeeves MyWay and MySearch software being installed using security holes in Web browsers without any disclosure, including video of the surreptitious installation. However, eWEEK was not able to independently verify his claims.

But not all anti-spyware companies agree with the stand that Sunbelt, Facetime and some other companies are taking.

Anti-spyware programs by Microsoft and Lavasoft don't flag Ask Jeeves's search bar plug-ins, Eckelberry noted.

Webroot Software Inc.'s SpySweeper program doesn't flag any of AskJeeves's software either, said Richard Stiennon, vice president of threat research at Webroot.

"We take a tack based on the product. We don't look at the rest of business model," said Stiennon, adding that Ask Jeeves's programs don't qualify as spyware or adware.

"The toolbar doesn't spy on you, so we don't think its spyware," he said.