Fake Elf News

Today in Tedium: I know this sounds pretty crazy and dangerous, but there was once a time when we sent one another executable files via email. It was kinda like playing Russian Roulette with our operating systems, but we still did it. (No executables in this message. Promise.) And one of these executable files that was distributed over this medium that’s infamously prone to security problems is basically a goofy holiday-themed game. You’ve probably played it a few times if you’re of a certain age. It’s called Elf Bowling, and it was nothing more than a brilliant bit of viral marketing for a web design company. But weirdly enough, its story feels like it has a lot of parallels today—the accusations against it feel like a prime example of fake news. Tonight’s Tedium discusses the email era’s greatest holiday-themed hoax. — Ernie @ Tedium

Editor's note: Miss the gift guide earlier this week? There's still time to check it out!

(via MobyGames)

The lighthearted roots of Elf Bowling, a game that took over the internet around Christmas 1999

The story of Elf Bowling is a strange one—in no small part because it reflects how a tale with an element of truth can flow wildly out of whack into the realm of fiction.

But it did so before social media could really sink its teeth in. In fact, it gained momentum via the original social media tool—email. And honestly, minus the whole people-think-it’s-a-virus thing, this phenomenon probably would have been forgotten about by many.

The concept, when it started drawing attention in December of 1999, was simple and enjoyable—a fun, offbeat take on traditional bowling full of in-jokes, goofy elves, and lighthearted animation—it was clearly an early example of a casual game, and years before the App Store, it stood out because of its distribution model.

It wasn’t even shareware—it was essentially content marketing, an interactive ad designed to promote the creative services of its designer, NVision Design. And on that front, it was a major success. A 1999 article on the Scripps newswire noted that the application was being downloaded at a rate of 900 times per second upon its release in November of that year. The article noted that the company received numerous leads off the release of the game, which won fans for both its animation and sound effects. Per Direct Marketing News, the company earned client interest from companies like AT&T and Texas Instruments.

“Millions and millions of people see our work every day,” noted Matt Johnson, then NVision’s director of multimedia. “The 40 people we have here in a little shop in Dallas now have worldwide recognition.”

But not all that recognition was good.

(via MobyGames)

No, Elf Bowling didn’t have any viruses in it, and its “spyware” was essentially the game pinging a random server somewhere

So, if it was just an innocuous, funny game, why did Elf Bowling gain a reputation as a piece of malware?

In a lot of ways, the issue cropped up because its insane popularity was being driven by bad behaviors among the millions of people who had only started using the internet a few years prior.

This was before more traditional social media vectors like Facebook and Twitter, and while Flash and Java existed at the time and conceivably would have been a good way to distribute a game like this on the web, Elf Bowling was instead distributed as a Windows executable.

It wasn’t a huge executable, really—at just a megabyte, it was small enough that a few years earlier it might’ve gotten a boost from distribution via floppy. In its own way, it was a slightly more modern twist on what people did with Commander Keen, Jazz Jackrabbit, and Doom just a few years prior.

But the game came to life as millions of people were using email for the first time. While just a few years earlier, chain letters and scams may have gained steam through email or similar tools like Usenet, executables were a new phenomenon for most. And there were already signs that sending executables through email was risky behavior.

Just six months earlier, millions of computers were seriously affected when a Microsoft Word “macro virus” called Melissa tore through the internet. In the ensuing years, email would be the key vector for some extremely damaging viruses, like ILOVEYOU, Sircam, and a virus named for tennis star Anna Kournikova. Their methods were different; their vector, across the board, was the same.

Security experts, understandably had concerns. A 1999 piece written by David Wilson of the Philadelphia Inquirer lays out the concerns like this: This random game which was just emailed you without your consent just so happens to use your internet connection. And it doesn’t tell you off the bat. Ergo: Downloading executables and immediately running them is a bad idea.

Wilson interviewed experts, from places like the Electronic Privacy Information Center and Carnegie Mellon University to bolster his case against downloading random apps from any-which-where.

“Experts say the game is a good example of why Internet users should avoid opening unsolicited programs received via email,” Wilson wrote. “It illustrates how computer users often lack privacy protection.”

This is a valid concern, and NVision Design agreed that its game should have had a privacy policy to protect users.

However, the piece somewhat overplayed what the internet connection actually allowed. Per another piece nearby in Allentown, Pennsylvania’s Morning Call that same week, the app simply contacted a server owned by a company to track where the game was being played, and whether the user clicked the link to the company’s website when they were done. The company also used the internet connection to allow users to share high scores, and discussed the potential of distributing updates via an internet connection.

“We were a small company without a budget to get our name out to corporations,” CEO Michael Bielinski said to Direct Marketing News. “We were trying to think of different ways other than putting up banner ads.”

On a base level, yes, the game tracked where a user was coming from, as a primitive form of analytics. But it’s a real stretch to call what they did “spyware.” If you’ve used a website on the internet in the past ten minutes, that page has likely done far worse. Google Analytics does far worse things than this by accident. It was nowhere near as bad as much of the crapware being made at the time, either.

The company denied it was doing anything nefarious other than releasing an offbeat elf bowling game into the wild. It wasn’t like they were the ones who started the email chains—they were distributing the games on their website, a safe and reputable source, after all.

“Absolutely no information is sent back to the company from the user's computer,” NVision’s Bielinski emphasized to the Inquirer.

Somewhere along the line, though, the legitimate privacy concerns highlighted by the media got turned into something approaching a full-blown hoax. Email, the same medium that made Elf Bowling a hit, gave it an unfounded reputation as a piece of malware. The company spent weeks fighting back from the claims, which were further ratcheted up by the Inquirer story, which the company reportedly called “irresponsible and inaccurate”—considering it turned the story from a fake virus story into a spyware story, they probably have a case.

“Absolutely no information is collected from your computer and transmitted over the Internet by Elf Bowling or other games. At the beginning of each game, Elf Bowling tests to see if the computer has a live Internet connection since registering scores online is one of the functions of the games,” the company wrote, according to a Geocities page from the era that collected the company’s correspondence from the time. “To determine if there is a live Internet connection, it sends an HTTP request command to nstorm.com, requesting nstorm.com to send it a blank HTML page. If it receives the blank HTML page, it sets a variable for Internet connectivity to TRUE.”

Symantec, to this day, has a page up on its website emphasizing that NVision’s game were never, at any point, laden with viruses. Sophos says the same thing, though it adds it might have been infected with one later.

To this day, if you look around hard enough on respected sites like TechTarget, Elf Bowling will get accused of being one of the first pieces of spyware. Based on my research, this widely repeated claim appears to be based on a brief mention in a Wikipedia article on spyware that dates to 2005 but was removed in 2006 because there was no source to support the claim that Elf Bowling spied on its users.

It was nothing more than a promotional game that just happened to become insanely popular. It was not spying on you.