Surfing in disguise

Services keep your boss and the sites you visit from tracking you

10/24/2002

By DOUG BEDELL / The Dallas Morning News

Surfing in disguise

It's getting harder to remain nobody on the Internet.

Out there on the Web, increasingly sophisticated tools are being used by sites and marketers to track visitor movements. Back at the office, about a third of online workers – more than 27 million – have their Internet or e-mail use under continuous surveillance, the Privacy Foundation estimates.

"People don't understand," says Bill Unrue, chief executive officer of Anonymizer.com. "The Internet is the most surveillance-friendly environment there is."

But companies selling privacy software subscriptions have had a hard time scaring up customers. In the last year, several large players have folded shop or turned to strictly business clientele.

It seems people will buy Telezappers and pay to get off telemarketer lists, but they ignore online equivalents – programs that cloak their online identities and encrypt communications.

The attitude is reflected in the independent research of the Pew Internet and American Life Project. Americans want the presumption of privacy online, but "a great many Internet users do not know the basics of how their online activities are observed, and they do not use available tools to protect themselves."

Pew researchers point out that most people never have a harmful experience online. But computer invasions are often more subtle than ringing phones but far more intrusive, computer experts say.

How anonymous surfing tools work
    1) After paying for a subscription and downloading a small plug-in, an icon appears in your browser menu. The icon allows you to activate or deactivate your secure browsing sessions and adjust your levels of protection.

    2) When typing specific Web site addresses in your regular browser, all of your connection requests to Web sites are encrypted and redirected to proxy servers maintained by the anonymity service.

    3) The requests are then sent to the Web site, protecting your computer's IP address. For the return trip to your computer, codes that pose privacy and security threats are removed.

    A boss or network administrator monitoring your activities should be unable to decipher the destinations from typical log files used to scan for visits to forbidden or sensitive sites, such as job search boards.

With Javascript tricks, Web sites can grab your e-mail address, then start a spam onslaught. With invisible "Web bug" graphic files, a user who is simply viewing a page can trigger tracking by ad companies. That user's Internet address is, quite invisibly, being added to all sorts of databases.

And in the workplace, job hunters may find employers are documenting visits to destinations such as Monster.com. Or they may be inspecting any communication with domains of competitors.

There are free services, such as The-cloak.com, still available on the Net, but most are now fee-based.

Fee-based and free applications work essentially the same way. Commands and communication from your computer terminal are routed through proxy servers. Your identifying Internet address is altered. The Web page is channeled back to you for viewing, but with a fake identity sent to the Web server.

Within that process, other privacy-related walls can be added. The best services are sold by a dwindling set of companies such as Mr. Unrue's Anonymizer.com and the recently revived Freedom.net from Zero-Knowledge Systems.

The $29-a-year privacy service, called Anonymizer Private Surfing 2, lets you surf without giving away personal information to nosy Web sites. Users interested in even higher security can pay $99 annually to route all of their Internet communications through Anonymizer.

By creating a private network between a customer's PC and its servers, Anonymizer offers complete encrypted delivery of all e-mail and instant messages.

Zero-Knowledge jumped back into business in March after shutting down late last year. Its Freedom WebSecure service is priced at $59.95 for a one-year subscription for consumers, but the company has shifted its attention to bigger deals. For example, it announced this year that computer maker Hewlett-Packard would include its products in Pavilion PCs sold in North America.

What information can be taken from your computer without permission?
    Web sites can determine your IP address, a unique location number identifying your computer on the Internet.

     Advertisers can deduce your geographical location.

     Third-party marketers can use spyware to track your online activities, surfing habits and personal interests.

     Malicious hackers can infect your computer with programs that reveal online banking and credit card information.

     Spammers can get the name of your Internet service provider for targeted e-mail campaigns.

In the old days, users of both these services had to log into Web sites to activate the service. Now, both Zero-Knowledge and Anonymizer can be triggered from the tool bar.

Within this mechanism, another layer of security can be added at the customer's end. Both the services can be customized to block ads, stop or monitor the placement of cookies on your hard drive, and remove malicious privacy and security threats from Java, JavaScript, VBScript and ActiveX codes.

Neither software package is probably foolproof. Web tracking, filtering and surveillance mechanisms grow more elaborate daily. Recently, several programmers have reported security dangers in Anonymizer and Safeweb.

Anonymizer's technicians repaired 10 reported software flaws within two days, the programmers say. Meanwhile, 8e6 Technologies of Orange, Calif., claimed its filtering software – used by libraries, schools and corporations – can thwart use of Private Surfing 2.0.

Safeweb's structure was examined and criticized for security flaws in an exhaustive study by Andrew Schulman of the Privacy Foundation and Boston University computer scientist David Martin. The company, the researchers say, did not immediately respond to their discoveries.

Other companies have been driven from the arena or drastically changed their business models. Most notably, they include Safeweb.com, which attempted an advertising-supported model. After winning a PC World award as "Best of the Web" and an investment from the CIA's venture capital firm, In-Q-Tel, the company has abandoned its consumer products and switched to strictly corporate sales.

High-profile ventures such as Enonymous and Privada simply died.

Anonymizer says it has a subscriber base of 500,000, and its leaders expect sales to climb as Internet users – both corporate and consumer – grow more educated on privacy issues.

Already, some companies are using the service to hide inquiries that can return valuable pricing information or other business intelligence. Others have been able to identify site visits from competitors' computers and later e-mail back – under cloak – job offers to their employees. Smart companies use all sorts of Internet tricks, Mr. Unrue says.

And why not? Mr. Unrue likens Web browsing these days to leaving the window shades open at night.

"People can see everything you're doing," he says. "That's exactly the way it is online. Everything's being tracked today."