Beware of Free Gifts
by Don Rittner

Recently Radio Shack and a company called Digital:Convergence Corporation has been making waves in the Net community.

Digital:Convergence Corporation is a privately held Internet technology company headquartered in Dallas but has offices in New York and London.

Privacy groups are alarmed and advertisers are delighted at a little free product they are offering through your local Radio Shack. It's called the :CueCat!

Basically, it's a cheap bar code reader that you can plug into your computer and/or TV, and by swiping this scanner across a page of text, or pick up a digital signal through a TV or radio, it will take you automatically to the Web page of the sponsor.

The company's proprietary technology can link media or products instantly with a single swipe delivering specific information on a product.

There seems to a hitch to this free lunch. First you need to register with the company at their Web site before it works, using their proprietary software. It asks you for your name, email address, zip code, gender, and age range. Are you ahead of me yet? Yup, with that little bit of info, they can easily look up your address and get other "confidential" info on you.

This of course is the data that any potential advertiser wants to have. Marketing is the key to success. The only problem, as privacy advocates point out, is with that info it also keeps track of where you go on the Net and the kinds of products you are interested in. The company forgot to tell folks that.

This is simply the biggest invasion of personal privacy or the best marketing gimmick ever conceived.

The Linux community decided to reverse engineer the product to make their own drivers and found that the scanner appears to send unique identifiers back to Digital Convergence. So, while the scanner is "free", when you use it, they are collecting data on your reading habits without your knowledge.

To make things worse, there is virtually no encryption of the data and one of the Linux hackers managed to uncover the entire registration database. So much for privacy, huh!

After the Linux community revealed this little problem, Digital Convergence sent a vague cease and desist letter to sites claiming that the :CueCat is intellectual property and that the hardware is only on loan and can be recalled at any time. However, it's pretty much case law that anything received unrequested in the mail is yours.

The :CueCat reads UPCs and the company's own bar codes printed in advertisements and articles in Wired Magazine (which quickly adopted it) and other magazines. The :CRQ software that comes with the bar code reader also analyzes audio from radio and TV broadcasts, picking up special tones embedded in the broadcasts. These tones identify the broadcast just like a bar code identifies printed material. You simply connect a cable from your TV or stereo to your computer.

When you scan a UPC, the software takes you to the web site of the company that produces the product. Or, it picks up a code in an audio broadcast, it will take you to an appropriate Web site. Of course you can do this yourself by remembering the URL and typing it in, but hey that's not as cool!

So each time you use the scanner it communicates with Digital:Convergence Corporation and tells them who you are and what you are interested it. It will tell them what TV and radio broadcasts you listen to, and what advertisements and articles you are interested in. Now the company can track the users in print and broadcasting the same way companies can track Web users on the Net. Can you imagine how many companies are chomping at the bit to get this info about you?

Right now the :CueCat only works on a PC, unless you Mac lovers use Virtual PC. The company is working on a Mac version, provided they still have a business after all this privacy issue stuff gets public.

In September, the Web site of Digital Convergence was hacked and the "confidential" database was compromised. The company admitted that "email addresses and names have been downloaded by unauthorized third parties."

Leave it to the programming community to come up with a little reinventiveness. The :CueCat is a harmless scanner and free. So, several programmers have written scripts or software to use the scanner for reading the barcodes of your CD collection into a nice little database, for example. UPC, ISBN, and Codabar all read in pretty reliably.

So get your :CueCat while they last. And remember Don's Online Observation #20: Never post any information on the Net that you don't want your mother or the FBI to know about.