This is not entirely hypothetical - Apple's iTunes installer actually did contain a script which accidentally formatted some users' hard disks (well, rm -rf'd the partition actually - but same effect). Of course, the key word there was accidental. I would hope that an app that tricked the user into formatting their hard disk would be treated the same as a virus that just went ahead and formatted it anyway, no questions asked.

Seeing as most people do not actually read clickthru licenses, and their legal validity is very dubious anyway, I'd say there is a strong commonsense argument that this is equivalent to selling a piece of software with a secret backdoor, and then logging in via the backdoor and logging all keystrokes. The latter would surely be actionable under "hacking" law, because you don't have the permission to log on to that system. The only difference here is (a) the clickthru and (b) the fact that it's automated - no actual person is hacking into your box, or even running a script to hack into your box, it's just some code spying on you. But the fact remains that chances are you haven't given them your informed consent to log all keystrokes (all except the "private" ones that they've managed to think of - yeah, really reassuring, that is!)

Though law != common sense, as we all know.

In the UK the main law covering hacking is the Computer Misuse Act. It's very broad. If I go up to a computer and I've haven't been given explicit permission to access it, and I press a key, I can theoretically be sent to jail. (God knows how this applies, or not, to portscanning etc., but anyway.) If I access a computer without permission to commit a crime, that's a crime in itself (therefore three crimes in total - one for the original crime, one for illegal access, and one for illegal access with intent to commit a crime). Etc. etc.

I would like to know (any lawyers here?) how bad this has to get before we can get the creators personally sent to jail under laws like the Computer Misuse Act. (Of course, the courts are probably going to treat some smarmy CEO much lighter than a poor kid who only wanted to experiment, but what can you do?) There's some spyware that already installs itself even if you say "no" (I think it was bundled with Audiogalaxy - bastards!), and some that doesn't allow you to reject it without uninstalling the app (Cydoor, part of Kazaa).

Isn't there something we can do, apart from boycotting? If they instead installed a backdoor [and who's to say some of them haven't??] and logged in to read our private conversations whenever they felt like it, there'd be an outcry. But because it's automated it seems less dangerous. If they have the ability to read private things sent over SSL by using keylogging, it doesn't really matter whether they telnet in to a backdoor to read it, or read it on their boxen. It's still outrageous.

Like the original article, I suggest contacting:

• Your friends - especially anyone who uses AudioGalaxy
• Slashdot
• Your elected representative(s)
• Any popular weblog, like Plastic.com or Metafilter - try and get something on the front page
• Your local friendly tech journalist - especially ones who work for major newspapers.
• Or just the major media generally. To those in the UK - I have a list of UK media contacts - I don't know how good or secret they are, but I'll email them to anyone who can convince me they can spell and are not going to make us look like zealots/fools/nutters
• Or even your lawyer, if you think there might be grounds for suing

IMPORTANT CORRECTION: One of the updates makes clear that this (apparently) has nothing to do with OnFlow. VX2 and AudioGalaxy are the guilty parties here.

You can also join a discussion on the site of the person who first broke the news (can't think of a better word - "the newsbreaker" maybe??):

However, the FTC press releases about the case (summarised and linked here) show that O'Bannon was the only defendant who was not found guilty of credit card fraud.

I dug a little deeper: I quote from one of the court orders, written by the judge (page 62):

O'Bannon argues that there is an absence of evidence to support the FTC's case. O'Bannon contends that the FTC's evidence shows he only temporarily acted as an officer for MJD, Discreet Bill and TAL, he had no actual authority over these companies, he resigned shortly after each corporation was formed, he did not know the other defendants and did not receive any compensation from the companies. O'Bannon motion at 2. Notably, O'Bannon does not mention the Charter Pacific merchant account agreement that indicates O'Bannon signed a legal contract on behalf of TAL in or about December 1998.

First, contrary to O'Bannon's assertion, the evidence shows that he was not always a "temporary" officer for the companies. In fact, the corporate documents indicate that he was an officer and director of Discreet Bill, at least on paper, for 13 months. [emphasis is in the original court order] [...] During the interim, O'Bannon, on behalf of Discreet Bill, signed the four fictitious business certificates. Second, it appears that O'Bannon signed the Charter Pacific merchant account agreement on behalf of TAL and he may have done so in or about Dec 1998, after he puportedly resigned from the company. The merchant account agreement enabled TAL to continue the fraudulent scheme, albeit only for about a month before the Receiver took over the company.

Nevertheless, the Court finds that O'Bannon is entitled is entitled to judgement in his favour. The FTC's case against O'Bannon is based solely on O'Bannon's role as an officer of the defendant companies. Therefore, to hold O'Bannon liable for injunctive relief, the FTC must establish that O'Bannon either participated directly in the wrongful practices at issue or had the authority to control the corporation.

Again, this all assumes we are talking about the same O'Bannon here.

But who knows? Maybe VX2 is already planning to commit a crime with the information they have surreptiously gathered (that's supposing their information gathering methods aren't already criminal). There may be an opportunity here to haul them (further) into the limelight before they do some serious damage.

Many of the companies involved are linked either by being spun off by the same shady venture capital company or by actually sharing the same offices.