Anonymizer privacy claim: A case of 'buyer beware'?

[InfoSec News <isn () c4i org>]

http://www.computerworld.com/securitytopics/security/privacy/story/0,10801,74397,00.html

By PATRICK THIBODEAU 
SEPTEMBER 19, 2002

WASHINGTON -- IT managers who want to control workplace Internet use
have a new adversary: a San Diego-based company that makes it possible
for people to surf anonymously.

Anonymizer Inc. last month released a new version of its product,
Private Surfing 2.0, and coupled it with a bold marketing claim: "Surf
at work without being monitored."

Yes, dear IT manager, your employees are being encouraged to pay
$29.95 annually to circumvent your systems. But the message to
surf-happy employees ought to be "buyer beware."

No sooner had Anonymizer begun its marketing campaign than Orange,
Calif.-based 8e6 Technologies Inc. (a takeoff of the slang expression
86ed), announced a simple library update to thwart Anonymizer. Another
security and filtering company, St. Bernard Software Inc. in San
Diego, said it didn't even have to make changes to preempt
Anonymizer's claim.

IT managers such as Harold Moscho, director of technology management
at MultiCare Health System in Tacoma, Wash., where he has 6,000 users,
are nonetheless concerned by the development.

"I hope that it is not something that is very widespread," said
Moscho, who is using 8e6's filtering technology. He says he fears that
Anonymizer may be appealing to people "who have a great deal of desire
for vengeful or mischievous" behavior.

Users of Anonymizer surf the Internet through the company's network.  
End users log on via their Web browser and get IP addresses and domain
names that can't be traced back to them.

The filtering services are thwarting employees by blocking access to
Anonymizer.com. And if the connection is encrypted, 8e6 will time out,
or cut off an encrypted link, said Mark Parker, a senior engineer at
8e6.

When questioned about its claims, an Anonymizer official downplayed
its workplace surfing marketing claims.

"We're not really pushing the surfing at work," said Lance Cottrell,
the company's president and founder, who acknowledged that employers
can use a range of techniques, such as monitors to record keystrokes,
to otherwise track employee Internet use.

Moreover, Anonymizer says it isn't planning to use the same aggressive
techniques it uses in China to get around government-sponsored
filtering, such as a continuously changing array of IP addresses and
domain names.

Anonymizer is working both sides of the fence. At the same time it
appeals to employees, the privately held company is also appealing to
employers. Cottrell cited a growing number of corporate and law
enforcement organizations that need to surf anonymously, such as the
FBI, companies engaged in competitive intelligence, law firms and law
enforcers. Another key market: home users who want to avoid being
tracked by network advertisers and others.

Patrick O'Donnell, senior systems specialist at Paulo Products Co., a
St. Louis-based metal finishing company, installed St. Bernard's
filtering software after a temporary employee downloaded a virus.

With monitoring tools, O'Donnell says that he doesn't believe that
employees can easily escape detection. But he also wonders why anyone
would risk violating company policy on Internet use.

"If someone wants to risk being unemployed at this time of year. . . ," 
he said.



-
ISN is currently hosted by Attrition.org

To unsubscribe email majordomo () attrition org with 'unsubscribe isn'
in the BODY of the mail.