Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Many services such as email and online storage have stated in their Terms of Service that they have the right to view and delete your files at any time. I'm wondering if they same applies to software and especially Operating Systems as well, since the software manufacturer essentially owns the software (we just have a license to use it). Does it mean that they can legally "check on" the program or possibly disable it permeantly without permission. Or does that mean that they can access my files, settings, etc. as well assuming that they built that capability into the program?

I'm saying this since I have read an article before about a Kindle user who had their device remotely disabled by Amazon by violating their license agreement.

share|improve this question
3  
This question appears to be off-topic because it is about the legalities of the matter, which isn't accepted here. –  Terry Chia Sep 13 '13 at 1:11
    
en.wikipedia.org/wiki/NSAKEY –  DKNUCKLES Sep 13 '13 at 2:48
    
@TerryChia "off-topic because it is about the legalities of the matter, which isn't accepted here" Really? Since when? Why do we have a legal tag? –  curiousguy Sep 13 '13 at 7:51
    
2  
Legal advice is tricky. They vary according to jurisdiction. We are also not lawyers. –  Terry Chia Sep 13 '13 at 7:58
add comment

closed as off-topic by Terry Chia, Iszi, Xander, Eric G, TildalWave Sep 13 '13 at 8:41

  • This question does not appear to be about Information security within the scope defined in the help center.
If this question can be reworded to fit the rules in the help center, please edit the question.

2 Answers

Legal

No. Unless you explicitly permitted it.

I suspect if such permission was embedded amongst many other clauses in a EULA, it could possibly be nullified by a court of law if the clause was deemed unconscionable. But if there is no precedent for this, someone would have to risk the time and money for a test case in the applicable jurisdiction. You could ask the Electronic Frontier Foundation if they have explored the topic.

Technical

Unless your computer is always on and acts as a public server, organisations do not access your computer directly - but rather the organisation's software "phones home" like an evil ET.

You can control with an outgoing firewall which applications are allowed to phone home, but certain applications and operating system components tend to malfunction without outgoing internet access. So if for example, you want desirable updates and bug-fixes, you need to accept the risk of the company including undesirable features or behaviour. There is a profound degree of trust required of end-users by software companies.

Precautions against third-party software doing something undesirable are much the same precautions as you would take against a malicious Trojan. Indeed, all third-party software which can self-modify and access the internet can be considered a potential time-delayed Trojan.

Some Precautions (incomplete list):

  • Limit applications to installation, execution and file permissions of a sandbox. Services on a Unix system are often restricted in this fashion (e.g. apached)
  • Separate the operating system, user applications and data into three or more different partitions. If the operating system is stable and doesn't required further legitimate updates, periodically flush the operating system partition with a protected ghost image.
  • Have multiple backups with different retention time-frames, to limit the likelihood of a Trojan contaminating of all of them before igniting its warhead.
  • Have your important data within an encrypted container, mapped to an unusual drive letter.
  • Examine running processes in a proper diagnostic tool (vanilla task managers are inadequate). The tool can show you what background services the application has installed, what ports are being listened on, what files have been opened, etc.
  • Explore what exactly the application installed or updated, if an installation log is available.
  • Prefer open source software.

The take home message is that companies will often do what they can get away with, especially in regards to advertising and your personal information. You have to be proactive with each application and each update; but this level of pro-activity is very tiresome so eventually most people just accept the risk.

If you truly don't trust companies modifying your computer, start getting very familiar with pure GNU-style Linux distros and source code compilation...

As DKNUCKLE's reference to NSAKEY suggests, spy agencies have little or no need to break encryption like a Cold War spy novel. Breaching any of the hundreds of applications you need to use in order to function in the 21st century is quite sufficient.

share|improve this answer
add comment

Could they if they wanted to? yes, probably. They could add in whatever code they want to phone home iwth whatever data they want. Most poeple would consider this a violation of their privacy or their company's privacy.

Do they have the legal right? Ask a lawyer.

share|improve this answer
add comment

Not the answer you're looking for? Browse other questions tagged or ask your own question.