China Tech News has another little gem:

Believing that Microsoft’s Windows Genuine Advantage violates privacy and personal information security, a Peking University student surnamed Lu has filed a lawsuit against Microsoft (MSFT) and Microsoft China.

Lu says that Microsoft’s Windows Genuine Advantage program, which exists in users’ computers permanently and collects users’ personal information before sending it to Microsoft, is a big threat to computer information security and users’ privacy.

Lu asks the court to order Microsoft to cancel a protocol the company signed with him on the installation of the program, delete all his personal information, provide him an uninstall tool and apologize to him in the national newspapers. In addition, Lu asks Microsoft to provide technology services in a reasonable manner and pay him RMB1350 in compensation.

Microsoft was first sued over the Windows Genuine Advantage (WGA) program in Seattle in the summer of last year. According to CNet’s news.com Microsoft:

…violated state consumer protection and anti-spyware laws by installing the WGA software on systems without properly telling people it was doing it. It is also asking the court for class-action status.

This was quickly copied in Seattle. From ZDNet:

In this most recent lawsuit, the parties allege Microsoft violated the Computer Fraud and Abuse Act, the Consumer Protection Act, the Computer Spyware Act, and also engaged in intentional misrepresentation of the software program.

Microsoft presented WGA as a security update, rather than as a licensing tool. By collecting and sending to Microsoft a slew of basic computer and operating system information without explicitly informing the user, they contend it is spyware.

Despite some assiduous googling, I was unable to find out the current status of the lawsuits. As far as I can tell, they’re still winding their way through their respective federal courts.

Which brings us to Mr. Lu’s case. I’m not sure how Chinese courts assess the merit of a lawsuit, but Mr. Lu seems to have missed the mark. The article has him suing Microsoft over WGA, claiming it “exists in users’ computers permanently and collects users’ personal information before sending it to Microsoft, is a big threat to computer information security and users’ privacy.”

While WGA does exist permanently (at least in Vista), it doesn’t collect personal information. From Microsoft’s WGA FAQ:

Q:What information is collected from my computer?
A:The genuine validation process will collect information about your system to determine if your Microsoft software is genuine. The validation tools do not collect your name, address, e-mail address, or any other information that Microsoft will use to identify you or contact you. The tools collect such information as:

* Computer make and model
* Version information for the operating system and software using Genuine Advantage
* Region and language setting
* A unique number assigned to your computer by the tools (Globally Unique Identifier or GUID)
* Product ID and product key
* BIOS name, revision number, and revision date
* Volume serial number
* Office product key (if validating Office)

In addition to the configuration information above, status information such as the following is also transferred:

* Whether the installation was successful
* The result of the validation check

As standard procedure, your Internet Protocol (IP) address is temporarily logged when your computer connects to a genuine validation website or server. These logs are routinely deleted.

While this is a significant amount of information, it isn’t anything specific to the individual. This is where I fear Mr. Lu may not get his RMB1,350. The suits in the United States targeted Microsoft via specific laws meant to protect individuals from spyware, not based on a generalized complaint about information gathering and vague fears of its consequences.

Mr. Lu may have been better off by just waiting for several months. According to China Daily a personal privacy law will be introduced in China next year. I won’t speculate on whether or not it would be applicable in this case, but consumer-focused companies operating in China had better start working on their data retention and privacy policies.

Better luck next year, Mr. Lu.

Share This