data by service providers like Google is at the same time requiring ISPs to increase the
amount of data they are storing and the length of time over which they are storing
it. ISPs are companies just like Google, and requiring that they store the data required by the data retention directive imposes the same sorts of risks of unwarranted
surveillance.
Client Surveillance
In addition to surveillance on the network and on servers, there is a range of different
actors directly watching users’ machines in various ways. The number of different
actors trying to control access to the client has turned the end user’s computers into a
constant battleground of surveillance. Malware creators try to infect machines to steal
valuable personal information. Anti-virus developers watch computers to find these
malware and other sorts of snooping software, including sophisticated family and workplace surveillance systems. Even personal computing equipment—say, a laptop—
can itself be turned into a surveillance system, through the use of keyboard logging
devices that are installed inside the box of the computer, making them virtually impossible for the casual user to detect.
SpectorSoft was selected as PC Magazine’s editor’s choice for ‘‘monitoring’’ software
and is the largest provider of such software for home, small business, and corporate
use. It captures virtually every kind of activity on the client computer and can send all
of the monitored data to a remote computer for viewing. 28 Since becoming the market
leader in 2004, SpectorSoft has stopped advertising to spouses, citing legal ambiguity
and spousal abuse, but it continues to market itself for use monitoring minors and
employees, neither of whom are legally protected from such monitoring in the U.S. 29
SpectorSoft reported in 2007 that its software was installed on over 400,000 desktops,
60 percent of which were home users. 30 All major anti-virus products classify SpectorSoft as spyware and attempt to remove it, but SpectorSoft actively avoids detection by
either the monitored subject or anti-virus or other anti-spyware software. 31
In addition to these monitoring products like SpectorSoft, which take the form of
software, a variety of companies make hardware keyboard logging devices. These devices are generally small plugs that sit between the USB plug of the logged keyboard and
the USB plug of the logged computer but can also be cards that sit inside the computer
case. The devices record every key pressed on the keyboard and can be used to capture
passwords, emails, typed documents, and any such information entered on the keyboard. Relative to software keyloggers, these devices are much easier to install given
physical access and are impossible to detect via anti-virus software. The only way to detect some of these devices is physically to open the computer case. 32
The most intrusive and prevalent example of client-side surveillance software is
the collection of various bots, viruses, worms, trojans, and other malware that infect a
The EU Data Retention Directive in an Era of Internet Surveillance
45
amount of data they are storing and the length of time over which they are storing
it. ISPs are companies just like Google, and requiring that they store the data required by the data retention directive imposes the same sorts of risks of unwarranted
surveillance.
Client Surveillance
In addition to surveillance on the network and on servers, there is a range of different
actors directly watching users’ machines in various ways. The number of different
actors trying to control access to the client has turned the end user’s computers into a
constant battleground of surveillance. Malware creators try to infect machines to steal
valuable personal information. Anti-virus developers watch computers to find these
malware and other sorts of snooping software, including sophisticated family and workplace surveillance systems. Even personal computing equipment—say, a laptop—
can itself be turned into a surveillance system, through the use of keyboard logging
devices that are installed inside the box of the computer, making them virtually impossible for the casual user to detect.
SpectorSoft was selected as PC Magazine’s editor’s choice for ‘‘monitoring’’ software
and is the largest provider of such software for home, small business, and corporate
use. It captures virtually every kind of activity on the client computer and can send all
of the monitored data to a remote computer for viewing. 28 Since becoming the market
leader in 2004, SpectorSoft has stopped advertising to spouses, citing legal ambiguity
and spousal abuse, but it continues to market itself for use monitoring minors and
employees, neither of whom are legally protected from such monitoring in the U.S. 29
SpectorSoft reported in 2007 that its software was installed on over 400,000 desktops,
60 percent of which were home users. 30 All major anti-virus products classify SpectorSoft as spyware and attempt to remove it, but SpectorSoft actively avoids detection by
either the monitored subject or anti-virus or other anti-spyware software. 31
In addition to these monitoring products like SpectorSoft, which take the form of
software, a variety of companies make hardware keyboard logging devices. These devices are generally small plugs that sit between the USB plug of the logged keyboard and
the USB plug of the logged computer but can also be cards that sit inside the computer
case. The devices record every key pressed on the keyboard and can be used to capture
passwords, emails, typed documents, and any such information entered on the keyboard. Relative to software keyloggers, these devices are much easier to install given
physical access and are impossible to detect via anti-virus software. The only way to detect some of these devices is physically to open the computer case. 32
The most intrusive and prevalent example of client-side surveillance software is
the collection of various bots, viruses, worms, trojans, and other malware that infect a
The EU Data Retention Directive in an Era of Internet Surveillance
45