Big Brother Was Listening

By JOSHUA QUITTNER

"Say it ain't so, Rob!" I whine into the telephone at Rob Glaser, founder and CEO of Real Networks. I am very agitated, O.K.? I admit it. Last week The New York Times broke a story reporting that RealJukebox, one of the most popular pieces of music-playing software on the Net, is a secret spy!

It turns out that the program--used by more than 13 million people around the world, including me--has been tracking our music-listening habits, recording the titles of the CDs we play and beaming the information back to headquarters. Whenever we go online, a sneaky little subroutine has been quietly shuttling that data over to Real's servers and dumping them into their files. Since I had to register my name to get the jukebox software, who I am and what music I like have been surreptitiously databased by Glaser's company. Without my or anybody else's consent. How rude!

Mind you, it's not the invasion of privacy that bothers me. My privacy is invaded in so many ways by so many different entities each day that I'm getting used to living in a glass house. When I step into a bank or an elevator and see a video camera overhead, I know I'm being recorded; the camera is usually right out there for me and everyone else to see. When I use my credit card to buy a meal, I know that American Express is recording that I've chalked up yet another overpriced expense-account lunch. And I know that AmEx knows.

But in the case of Real, I didn't know--and that's where Glaser's company stepped over the line. It was especially shocking to me since a) I've been recommending Jukebox to lots of people and b) I've always considered Glaser to be an extraordinarily ethical guy.

"We screwed up," says Glaser. The problem started when people in Real's marketing department decided they needed a better sense of who was using the service and what they were using it for. This is what every website wants to know. If it serves up 300,000 pages of information a day, does that mean 300,000 different people came to visit, or 50,000 who each visited six times? Glaser's techies tagged each user with a special ID number, or cookie, that identified them. Most big sites do the same thing, from Microsoft's to Time Warner's. But Real crossed the line when it correlated that ID number with each user's e-mail address and matched it to the user's offline listening habits. Even this might have been O.K. if it had disclosed the practice and given users the option to block it, as America Online does (see AOL's explicit privacy guidelines at keyword privacy).

Last week Real released a patch on its website to prevent users' personal IDs from being transmitted; you can download it from www.real.com or wait for the next version of RealJukebox. Meanwhile, the company is undergoing an internal privacy-policy review, and an outside auditor will be brought in for a final seal of good privacy housekeeping. But right now, there's a log file somewhere in Seattle that has my name in it, as well as the Allan Sherman CDs that I've been playing, and that ticks me off. If a good company like Glaser's can go astray, who knows what the bad guys are up to?

Crave more tech news? Subscribe to TIME DIGITAL magazine at timedigital.com Questions for Josh? E-mail him: [email protected]