08/15/2001 - Updated 11:46 AM ET

Groups expand XP privacy complaint

WASHINGTON (Reuters) — Consumer advocates said they will expand their privacy complaint against Microsoft's new Windows XP operating system and Internet identity service.

A group of 13 consumer and privacy groups said that on Wednesday it will submit a new, beefed-up version of the complaint that it filed with the U.S. Federal Trade Commission last month.

The groups want the FTC to investigate whether Microsoft's collection of personal information amounts to an "unfair and deceptive trade practice" under federal law.

In their new complaint, the groups will try to cast more doubt on whether Microsoft can guarantee the security of customers' personal information, said Jason Catlett, president of a privacy group called Junkbusters.

Catlett said critics also will contend that Microsoft's Passport identity service for children violates a 2000 law that protects the privacy of children online.

Microsoft spokeswoman Tonya Klause had not seen the new complaint. But she said Microsoft "stands behind its full commitment to privacy and security, and continues to believe their claims are misinformed and unfounded."

Klause said that all Passport approved Internet sites require parental consent before children are allowed to disclose information to those sites.

In their original complaint, the same groups asked the FTC to open an investigation into Windows XP and Passport, claiming they coerce users into revealing sensitive personal information with little control over how it will be used.

The groups, led by the Electronic Privacy Information Center, contend Microsoft intends to track and monitor millions of Internet users by requiring them to reveal a broad range of personal information.

Microsoft plans to include the Passport service in its new Windows XP operating system due out this fall, and has already registered 165 million users, many of them users of its free e-mail service, Hotmail.

Microsoft says Passport will give Web surfers more convenience and control over what information they reveal about themselves, but EPIC and others charge that it would allow the world's largest software maker to amass a giant database of millions of Internet users who have little control over how information about them is distributed.

The complaint asks the FTC to require Microsoft to loosen the Windows XP registration process so users may more easily opt out of the Passport system, and allow Passport users to surf the Web anonymously.

Microsoft has disputed the claims, saying that Windows XP users can easily opt not to use Passport. In addition, Passport users can prevent junk e-mail by clicking a box in the sign-up process, they note.

While Passport may be required for certain features like instant messaging and free e-mail, Internet users will not be required to sign up.

Microsoft says it will require Web sites that participate in its upcoming Hailstorm data-sharing platform to meet certain privacy standards.

In their amended filing planned for Wednesday, Catlett said privacy advocates will cite recent problems with the so-called Code Red worm, which Catlett said exposed more security holes in Microsoft servers.

"There's abundant evidence that Microsoft's claims of security are, on their face, deceptive," he said.

Microsoft spokeswoman Klause responded that no software is 100% secure, but she said Microsoft is improving security and has dealt with any security problems quickly and publicly.

Microsoft announced last week that it would require merchants using Passport to employ P3P technology, which allows consumers to more easily determine the privacy practices of a Web site.

Catlett said he was not impressed.

"We charge Microsoft with specific unfair, deceptive and illegal behavior in collecting information, and their response is to make merchants use this pseudo-privacy technology. It's just insultingly nonresponsive."

Catlett said the FTC acknowledged that it received the complaint but it would not be able to talk about any investigation it chose to undertake.

"It's clearly not sitting in an 'in' tray somewhere," he said.

-- Anonymous, August 15, 2001