Investigator from WinWhatWhere

Webcam spying goes mainstream

Not long ago, software that sneakily turned on Webcams and captured video of someone sitting at a computer would be dismissed as a tool for hackers and voyeurs. This week, a Seattle-based software developer will begin bragging about that feature and many others as it releases a bold update to its computer monitoring software. Emboldened in part by the events of Sept. 11, WinWhatWhere president Richard Eaton no longer feels like he has to apologize for his software; and privacy advocates no longer seem quite as ready to dismiss products like his.

WINWHATWHERE HAS BEEN helping employers, police officers, and even suspicious spouses spy on their suspects’ computer work since 1993. The company’s Investigator product can watch and record every keystroke typed into a computer, and can even secretly e-mail the results across the Internet.

That’s not new; what’s new is the firm’s no-apologies stance to the software’s capabilities, which will become even more intrusive with this week’s release of version 4.0. In fact, WinWhatWhere is bragging about it — in a press pitch, the company’s PR firm boasts of a coming “new set of controversial features.”

 “I was like the conflicted programmer. For years, I used to be apologetic about it,” said WinWhatWhere president Richard Eaton. “But I’ve come around. It does have legitimate uses for investigators. With companies, it is their computer. I don’t think there’s anything inherently sacred about a computer terminal.”

Eaton’s assertions ring very differently in a post-Sept. 11 world — a world where we know terrorists can use remote, anonymous computers to plot heinous acts of murder, and where law enforcement agencies say they need to be on equal footing. The discussion has emboldened Eaton, who has in the past expressed mixed feelings and even regrets about some of the missions his software had been deployed in.

So, while two years ago he nixed the idea of allowing remote control of an unknowing “victim’s” Webcam, he’s now implemented the feature.

 “I fought it two years ago, because I could see no legitimate no usage for it,” he said. “But now I see you use it to confirm who’s typing on the computer while you are capturing keystrokes, so it’s in there.”

Employers have a legitimate right to expect employees to put in a full day’s work for the paycheck. An employee, however, deserves some “down time” without feeling like every trip to the restroom is being digitally chronicled and stored in some electronic file.

Unless the company you work for specifically states otherwise, your boss may listen, watch and read your workplace communication.

In most instances, yes. For example, employers may monitor calls with clients or customers for reasons of quality control. Federal law, which regulates phone calls with persons outside the state, does allow unannounced monitoring for business-related calls. (See Electronic Communications Privacy Act, 18 USC 2510, et. seq.)

An important exception is made for personal calls. Under federal case law, when an employer realizes the call is personal, he or she must immediately stop monitoring the call. However, when employees are told not to make personal calls from specified business phones, the employee then takes the risk that calls on those phones may be monitored.

Yes. Telephone numbers dialed from phone extensions can be recorded by a device called a pen register. It allows the employer to see a list of phone numbers dialed by your extension and the length of each call.

Generally, yes. Since the employer owns the computer network and the terminals, he or she is free to use them to monitor employees.

Employees are given some protection from computer and other forms of electronic monitoring under certain circumstances. Union contracts, for example, may limit the employer's right to monitor. If an employer states in a written document that they do not monitor their employees, they are bound by that agreement, with some limited exceptions.

Most computer monitoring equipment allows employers to monitor without the employees' knowledge. However, some employers do notify employees that monitoring takes place. This information may be communicated in memos, employee handbooks, union contracts, at meetings or on a sticker attached to the computer.

In most cases, no. If an electronic mail (e-mail) system is used at a company, the employer owns it and is allowed to review its contents. Messages sent within the company as well as those that are sent from your terminal to another company or from another company to you can be subject to monitoring by your employer. The same holds true for voice mail systems.

No. Electronic and voice mail systems retain messages in memory even after they have been deleted. Although it appears they are erased, they are often permanently "backed up" on magnetic tape, along with other important data from the computer system.

LAW ENFORCEMENT-FRIENDLY 

The new version of the software, which costs $150, also includes so-called “Scarfo friendly” features which accommodate the sometimes awkward requirements of law enforcement agencies in pursuit of admissible evidence.

Nicodemo Scarfo was arrested for loan sharking in 2000 after FBI agents installed key-logging software on his machine. In order to not run afoul of wire-tapping laws, the software was programmed to shut down if Scarfo connected to the Internet — since the FBI had not obtained a court order which allowed monitoring of telephone communications.

WinWhatWhere can also shut itself off if an Internet connection is detected; or it can turn on only when a certain key phrase is typed in, thereby activating the narrow terms of a search warrant.

WinWhatWhere’s relationship with the FBI earned the software company great notoriety two years ago when it was used by agents who had lured two infamous Russian hackers to the United States. But in fact the software is really a small player in the market, according to Andrew Schulman, chief researcher of the Privacy Foundation. In a study released last year, Schulman discovered that one in four U.S. workers are monitored in some way, but generally companies use software that is much less intrusive than WinWhatWhere. Only about 15,000 corporate desktops have WinWhatWhere watching employees, Schulman says. The company says it’s sold 200,000 licenses for the product.
      
MONITORING MORE PALATABLE

Still, the software is important because it pushes the envelope on monitoring technology and is a lightning rod for debate on the emotional topic. And right now, Schulman said, monitoring software — like all security measures — seem more palatable then they once did.

 “And I’m not quite sure why,” he said. “Before Sept. 11 there were all sorts of laudable law enforcement goals, too.”

And yet, Schulman concedes, U.S. law enforcement’s ability to quickly collect images of terrorists as they made withdrawals from ATM machines or walked through airport security have amounted to an impressive demonstration of the value of monitoring technologies.

 “The big story about workplace surveillance is that more and more of what we do gets recorded somewhere, and that has both negative and positive aspects to it,” he said. “After Sept. 11, we’ve all seen pictures of Mohammed Atta at an ATM, about to get on an airplane. And when those pictures were taken, no one knew Atta or any other terrorists. The fact that everyone using an ATM has their picture recorded and can be found later in an investigation, that’s where WinWhatWhere fits in.”
      
WORKS IN INTERNET CAFES

Eaton argues that law enforcement agents frustrated by criminals using technology to gain the upper hand deserve help, and his software provides it. For example, public Internet cafes provide near-perfect anonymity for criminals looking to evade avoid law enforcement and cover their tracks. But armed with his software, corporate investigators recently napped a criminal making e-mail threats against a U.S. corporation from just such a cafe in India — because the cafe agreed to install the software on every computer to watch for the suspicious writer.

Without the software, catching the criminal would have been nearly impossible, Eaton said.

But privacy expert Richard Smith, who now operates ComputerBytesMan.com, is worried use of the software in a public place like a cafe probably sacrificed the rights of many to hunt the trail of one.

“Sounds like there were plenty of innocent people who got listened in on,” Smith said.

That’s why WinWhatWhere can turn itself on or off, and even uninstall itself, counters Eaton.

STILL UNSAVORY USES

But even as he claims the product will only improve and conform to limited uses allowed within the rules of evidence, he admits the product still has unsavory applications — like spouses spying on each other. Only 60 percent of WinWhatWhere customers are corporations or law enforcement, and Eaton estimates about half the remainder are home users.

“I don’t like it. I have no use for that purpose,” he says, a bit sheepishly. “When I hear from these people, I tell them your money is better spent on counseling. If you are sneaking into your wife’s laptop, shame on you.

“But,” he sheepishly concedes, “We do cash their checks.”

Even in this unsavory arena, Schulman concedes there seems to be a growing voice that is willing to re-balance the scales of privacy and safety. With the admiring tone of one describing a respected, worthy opponent, Schulman echoed the position maintained by David Brin in the book “The Transparent Society” during a recent interview with MSNBC.com.

“We may be headed for a golden age of accountability,” Schulman said. “It’s possible the erosion of privacy is a good thing ... Maybe ‘A man’s home is his castle,’ just gives men the right to beat their wives.

“Well, Richard Eaton is bringing us there. Whether, ‘there’ is a good place or not is just not clear to me.”