"If the program is enabled, it communicates with our servers to let them know that a particular product has been installed and retrieves JPEG images for that product if any exist," explains Galdin. "This allows us to provide our customers with additional content for the products they have purchased, communicate product fixes, etc. To this end, it connects to the server and sends the product SKU number, last time a connection was made and if any downloads are in progress. Based on that information the server decides whether to send a JPEG image or not."

While this indeed may accurately describe the company's intention in including the DSSAgent, it's pretty easy to see how such technology could cause problems. If it wanted, the company could scan your hard drive for competing products, then flood you with offers to purchase its own similar products, or even just use that info for competitive research. Once this kind of capability is introduced, it could also be misused by a rogue employee to retrieve your financial records or credit-card numbers or to download child pornography onto your computer.

And what about the fact that this technology is included in software for kids?

Earlier this year, the Children's Online Privacy Protection Act went into effect. One of the most significant aspects of this law is that it prohibits companies from collecting information on children under 13 without explicit parental consent. Consent is not just clicking a box -- parents need to send in a letter, a fax or an identifying e-mail message. There's no way to get legal consent through the installation process, and I certainly hadn't signed any permission forms.

Galdin insists that nothing in the Brodcast technology violates COPPA, but after the law went into effect, Mattel stopped shipping old versions of the Brøderbund CD-ROMs and gave the products new installers. "COPPA applies to Web sites directed towards children only and does not extend to this situation," Galdin argues.

"Nevertheless, once COPPA was enacted, we changed our installation software activating both Brodcast and registration so that it first asks the age of a user," she says. "The latest version asks if the user is under 13 years of age and, if so, does not offer to install the Brodcast program and does not ask any of the registration questions requiring personal information." If you are over 13, the program gives you a choice as to whether you want the Brodcast technology installed.

Galdin sent me some new CD-ROMs with the improved installer. I tried them out. But it turns out that even if you tell the installer that you don't want to use Brodcast, the installer puts the program on your computer anyway. "If the user doesn't want it, it is not enabled," Galdin says. But the program is still installed, she says, because it is part of the complete CD-ROM application.

Galdin says that DSSAgent used PGP encryption to protect the information sent from Brøderbund (and then Mattel) to the user. "We don't want anyone else to intercept our communications and send other kinds of information." Nevertheless, she says, Mattel's new products -- those shipped since April -- do not include the Brodcast technology at all.

All's well that ends well, I suppose, but to me, the inclusion of hidden programs with children's CD-ROMs, the installation of these programs even when you specifically choose not to use them, the use of encryption to scramble network communications and the failure to document any of this to the public or to users in any meaningful way represent a bad omen for the future of the consumer software industry.

A growing number of companies clearly think that it's acceptable to build covert monitoring systems into their programs. Proposed legislation specifically allows software vendors to exercise "self-help" in enforcing their copyrights -- actions that could include disabling your computer if they think you have violated the terms of your license agreement. Meanwhile, the ubiquitous Internet connectivity afforded by cable modems and DSL will make it harder and harder for us to know when these sorts of programs are active.

To be sure, the DSSAgent never should have tried to take my computer online when I was flying over the Atlantic. "That sounds like a product malfunction," Galdin said. "The agent normally detects when a user is online only to do its transactions; it is not designed to try to connect independently. We would be happy to look into it."

But were it not for the bug, I would have never discovered that Mattel's DSSAgent was running on my laptop. Were the company so inclined, it could have used this technology to do far more than retrieve a JPEG image from a server.

What concerns me most is that there are simply no rules or regulations inside the United States that set limits on how invasive consumer software can be. Under Canada's newly enacted C-6 privacy legislation, for example, there is a requirement for Canadian firms to inform their customers about what kind of personal information is collected and how it is protected, and to make sure that it is discarded when it is no longer needed. But in the United States, we've already seen several examples of programs -- such as last year's Real Audio Jukebox troubles --- that covertly spy on a person's actions and report them back to a central location.

Surveillance software represents one of the greatest threats to privacy in the coming years. A program that uses undocumented protocols for transmitting information to or from the user, even if it is just to tell a person that a new version of a program is ready for download, is a huge, terrible step in that direction. I'm glad that Mattel says it has decided to remove the DSSAgent technology from its CD-ROM offerings. The fact that the company was only motivated to take this action after a law was passed in Washington demonstrates the importance of legislation as a tool for dealing with privacy issues in the future.

The Free Software Project
Read Andrew Leonard's book-in-progress on Linux and open source -- and post your comments.