These Eyes Are Trackin’

Today in Tedium: There’s this tool I’ve used for a number of years that I’ve found incredibly useful and important. It’s a password manager called 1Password, and it helps me save logins so I don’t have to remember them. It’s far from a new application, but at its foundation is a basic layer of trust. You use 1Password, or LastPass, or whatever other tools of this nature, because you trust them. What if I told you that one of the most infamous examples of adware and spyware, one that snuck onto tens of millions of computers, started out as the 1999 version of 1Password, but almost immediately was bastardized by the desire to bake in a business model. That tool, once a scourge of Windows users everywhere, is called Gator eWallet—and it set the stage for a climate where our data is constantly being grabbed around the internet with little in the way of end-user control around the issue. Today’s Tedium looks straight into the eyes of the spyware gator that hates that I just called it spyware. — Ernie @ Tedium

The Gator eWallet website, circa early 2000s. (via Internet Archive)

The roots of the Gator eWallet represent the roots of modern spyware … no matter what Gator’s opinion was of that term

In 2005, Wired gave a company called Claria the attention it was looking for: A long feature about how it had managed to vanquish its reputation as a provider of spyware and become accepted as a successful part of the internet, a company on the rise. And the then-CEO felt confident that it was a company on the right track.

“I don’t feel like there’s a need to wipe the slate clean,” the company’s then-CEO Scott VenDeVelde told the magazine. “Our technologies are dead center of where the market is going.”

He was arguably right, but it was not enough to prevent the market from absolutely disrupting the crap out of it. See, just as modern consumers have easily been able to see through the Facebook name change to Meta, so too did they see through the name change from Gator to Claria … and not long after that, another name change from Claria to Jellycloud. It may have gotten its redemption story in 2005, but by 2008, the company, having changed its name numerous times in unsuccessful attempts to shake off its reputation, was dead.

It sued a lot of people and companies in an attempt to salvage that reputation, but in the end, it wasn’t enough. The anti-consumer sentiment was just too obvious.

But let’s go back to the moment, in 1999, when Gator first emerged onto the scene. Arguably, the market was ripe for an application like it, because security was little understood during this era of digital culture when many people had been using computers for five years or less. As a case-in-point, games like Elf Bowling—which, while legitimate and not malicious, was transferred online as an executable file through the very risky medium of email—reflected how regular people just didn’t think about security or privacy when using the internet. At all.

And this was around the time that Napster was going viral, so people were literally just downloading random files from random sites on the internet without much care as to what those files included. Napster was largely just music, but it set a tone of what was allowed in regards to these apps, which meant that it was an anything-goes world of downloadable software for quite some time online.

An example of the kind of security warning Gator/GAIN often left on installers. (via Ben Edelman)

A major vessel for how we got software, besides the aforementioned file-sharing tools, were download sites that proliferated like weeds on the early internet. The sites best remembered today are probably Tucows and Download.com; there were dozens of others, of varying quality. As much as we complain about App Stores, this model was worse because this software inevitably came with some hangers-on in the install process.

One of the first apps to do this was Comet Cursor, a customization app that became very popular during the Internet Explorer era as it allowed for custom cursors, often tied to popular brands and franchises. But when word came out that the company was tracking individual users and installing itself without users’ consent, the application’s reputation declined to the point that its developers at one point got into a public fight with Lavasoft, a company that produced anti-spyware tools, in a desperate bid to save its parent company. It didn’t work.

In many ways, tools like Comet Cursor, BonziBuddy, and Gator eWallet fostered what could arguably be called an evolution of the model of shareware and freeware. Rather than paying if you liked the app, these apps subsidized the software by offering themselves as options within the installer. The goal was to make the application sound like enough of a good idea that you installed it, but then, once it had its grips in your system, to make it difficult to remove.

Combine the predatory business model with the rise of file-sharing tools like KaZaA and LimeWire, and you had a recipe for digital disaster.

Gator/Claria filed for a number of patents throughout its history, including this one, which might just be relevant to the creators of 1Password and LastPass. (Google Patents)

Was there another path forward for Gator eWallet as a business model?

It should be noted, given its current reputation, that had Gator actually used a legitimate model that respected consumers’ privacy rather than one that was literally inspired by the coupon printer at grocery store checkout lanes (as the Wired piece notes), it likely might have had a completely different reputation. (The later success of 1Password, first released in 2006, underlines this point.)

There were clear signs that the application could have been accepted on its own as a useful tool. One of the first mentions of the software in the media, a review published in The South Florida Sun-Sentinel, seemed ready to highly recommend it! Here’s what they wrote of this Trojan horse of a password manager:

Gator.com has introduced its free Gator program, which memorizes all your passwords, credit-card numbers and other pertinent information and uses the data to automatically fill out those final order form pages. When you come to an order page, Gator will automatically pop up and ask if you want it to fill in the blanks. With one click, the order form will be completed.

This is very different from the Auto-Fill ability of the more recent browsers that attempt a best-guess at filling in a form. Gator.com maintains a huge database of purchase forms and accurately fills in the proper information. And since we usually have more than one credit card, phone number, address and so forth, Gator will present the last data used at that site. If you want to change it, you can select any of your alternatives.

But Gator insisted on going another way, and ensuring that it was never not clear that the users were the product, rather than the other way around.

This was an application that was literally designed to suck up all your personal data, and reuse it to target pop-up advertising to you, and newspapers were out here talking about how useful it was! Clearly, someone in market research should have suggested there was another path forward for this tool they created.

But even early in its life, questions emerged about what Gator and other apps of its ilk represented. Jeffrey Rosen, a law professor who has frequently contributed to The New York Times Magazine and The Atlantic wrote an essay for the Times, titled “The Eroded Self,” that nailed the tension between advertising and privacy that complicates the public discourse in the internet era, explaining it though the lens of the still-fresh tale of Monica Lewinsky. Gator.com, of course, gets a mention:

The e-commerce lobby prefers a more modest Senate proposal that would require Web sites to display a clearly marked box allowing users to “opt out” of data collection and resale. But it’s not clear that “opt out” proposals would provide meaningful protection for privacy. Many users, when confronted with boilerplate privacy policies, tend to click past them as quickly as teenage boys click past the age certification screens on X-rated Web sites.

Moreover, many people seem happy to waive their privacy rights in exchange for free stuff. There is now a cottage industry of companies with names like Free PC, Dash.com and Gator.com that offer their users product discounts, giveaways or even cash in exchange for permission to track, record and profile every move they make, and to bombard them with targeted ads on the basis of their proclivities.

This is about as rational as allowing a camera into your bedroom in exchange for a free toaster. But as Monica Lewinsky discovered, it’s easy to forget why privacy is important until information you care about is taken out of context, and by that point, it’s usually too late.

Gator wasn’t first to this market, as Rosen implies; companies like Juno and NetZero did this a few years earlier, expanding the user base of the early internet at the cost of siphoning users’ data. But Gator represented a new front from a software perspective: It was an application that many people did not actually install themselves, that was basically included as part of a shareware package.

This image from a patent filing, created by the same person as the original app, is titled, and I quote, “Method and apparatus for defeating a mechanism that blocks windows.” Yes, Gator patented a pop-up blocker blocker. (Google Patents)

Despite the application’s controversial nature, it was not actually a pariah in Silicon Valley culture. Much the opposite, in fact: The company, in its various forms, raised tens of millions of dollars in funding. Of course it did! It offered something that advertisers didn’t have up to that point—a way to directly compete with a competitor by putting a pop-up ad in the user’s face.

That the model was highly funded and successful as long as it was really highlights just how little the company thought of the consumer.

Don’t be fooled by the fun Gator logo. The gator was more like this gator. (Joshua J. Cotten/Unsplash)

One thing Gator didn’t like people doing: Calling its application “spyware”

Despite the reputation this application carried, it was not a pariah of the technology industry to the point where it couldn’t get funding. In fact, it showed up in the press frequently, announcing new funding rounds, and generally avoiding losing a step given its controversial brand name.

And perhaps for that reason the company took pains to ensure that it was not called spyware, despite the fact that the average person considered the application an annoyance, no matter what it was called.

And it was a company not afraid of picking a fight, using legal action to discourage others from calling the application spyware. Perhaps the most notable of these conflicts involved a website called PC Pitstop, which had a page on its website telling people how to remove the spyware while deeply criticizing the company. Claria sued, and PC Pitstop eventually settled. The suit eventually forced PC Pitstop’s hand, but despite not being a gator, the hand bit back: The company essentially rewrote the page (still online today thanks to its successor company, PC Matic) to the letter of the law, while maintaining the same criticisms as before.

“The most expedient thing we could do after settling the Gator suit, rather than changing our site point by point in real time, was to regroup and put together something that still conformed to our agreement with Gator but allowed us to say the things we needed to say,” said Dave Methvin, PC Pitstop’s chief technology officer, in 2003 comments to ZDNet. “For example, we still detect Gator and recommend that people remove it. I certainly don’t believe it’s libelous.”

One could argue, that all Claria did with all this litigation was make “adware” another way of saying “spyware,” with little effect on how people perceived the application’s reputation.

And besides, there were lots of other ways for Claria to ruin its reputation beyond lawsuits it brought against other companies. For example, lawsuits brought against it by numerous newspaper chains and Fortune 500 companies. The companies (among them The New York Times, The Washington Post, UPS, Hertz, and Wells Fargo) were upset because the pop-up and pop-under ads were doing what they were designed to do, recommending competitors while end users were on their sites.

They sued on a trademark infringement cause, and the lawsuits were powerful enough that Claria generally settled.

“Claria will continue to protect (its) business model,” company spokesperson Scott Eagle said at the time of a joint settlement with Wells Fargo and Quicken Loans.

The company ultimately did not; as Jellycloud, it essentially admitted that its pop-up ads didn’t work and came up with a personalized homepage product instead. That product didn’t work, either, and by October of 2008, the company, which specialized in spyware despite its protestations otherwise, was gone.

If only it had stuck with selling password vaults instead of behavioral marketing.