ComScore Accused Of Covert Data Snooping

Internet audience tracking and analytics firm comScore is being accused of surreptitiously collecting Social Security numbers, credit card information and passwords from consumers.

The company is also accused of using its data collection software to tamper with user systems and stealing information from saved documents, according to a proposed class-action lawsuit filed in the United States District Court, Northern District of Illinois. Filed on the behalf of two people, one from Illinois and one from California, the lawsuit claimed comScore allegedly violated the Stored Communications Act, the Electronic Communications Privacy Act, the Computer Fraud and Abuse Act, and Illinois Consumer Fraud and Deceptive Practices Act.

In Through The Backdoor

The privacy violations include comScore allegedly changing security settings on the user’s firewall and opening backdoors, redirecting user traffic online, and injecting data collection code into browsers and instant messaging applications without user permission, according to court documents.

The plaintiff claimed the software could monitor keystrokes and every action taken online as well as scanning all saved documents, emails and PDF files on the user’s computer in order to transmit the data gleaned from the files. The software may even scan visible files belonging to other users on the same network.

“The scope and breadth of data that comScore collects from unsuspecting consumers is terrifying,” the lawsuit said.

An online audience measurement and customer tracking company, comScore bundles its tool with free products such as screensavers and music-sharing software or with chances to enter sweepstakes and other incentives. Once the tracking software has been installed, comScore collects information from the participants and distributes it to its client roster of approximately 1,800 customers including e-commerce sites, retailers, advertising agencies and publishers. The comScore statistics are frequently used by news outlets to discuss online behaviour and Website analytics.

One of comScore’s Websites warns users that the software monitors all Internet activity, including filling a shopping basket, completing an application form or checking online accounts. The fact that it is monitoring keystrokes and all online activity means it would be easy for someone at comScore, or someone who hacked comScore’s data, to grab sensitive consumer information.

The software is distributed under various names such as RelevantKnowledge, OpinionSpy, PremierOpinion, OpinionSquare, PermissionResearch and MarketScore, according to the lawsuit. It is often embedded in free screensavers, games and other applications without proper notice, so users are not even aware they are sending data to comScore, according to the lawsuit.

Difficult To Remove

The software is difficult to uninstall and, even after the user manages to remove it, an untrusted “root certificate” is left behind that potentially exposes the user to online security threats, the plaintiffs said. The application can also be updated and controlled remotely without user intervention, the plaintiffs said.

ComScore “constantly collects, monitors and analyses every online move, no matter how private, of over two million persons”, the suit said.

ComScore spokesman Andrew Lipsman called the lawsuit meritless. “We have reviewed the lawsuit and find it to be without merit and full of factual inaccuracies,” he said. “ComScore intends to aggressively defend itself against these claims.”

Privacy advocates have grown more concerned about data collection, and there’s a lot of interest among Congressional lawmakers to give Internet users more control over what kind of data is being collected and how to opt-out of tracking.

On its Website, comScore claimed to try to filter out confidential and personally identifiable information from the data or purge it from the database if such data was “inadvertently” stored. The company claimed to “make commercially viable efforts” to clean the data.