Imagine if Microsoft pushed an update to your computer that started recording everything you write in Word and shipped it back to Redmond. Or if the phone on your desk was upgraded to send details of your calls not only to the telecommunications provider, but also to the handset maker.
That’s what some users feared was happening to their Internet histories when Cisco Systems pushed out an update for new Linksys Smart Wi-Fi routers this week. The update moved the routers to a new cloud-based management system called Cisco Connect Cloud — and came with an ominous warning in the terms of service that the routers would record users’ Internet histories as part of the arrangement.
When you use the Service, we may keep track of certain information related to your use of the Service, including but not limited to the status and health of your network and networked products; which apps relating to the Service you are using; which features you are using within the Service infrastructure; network traffic (e.g., megabytes per hour); Internet history; how frequently you encounter errors on the Service system and other related information (“Other Information”). We use this Other Information to help us quickly and efficiently respond to inquiries and requests, and to enhance or administer our overall Service for our customers.
Some technologists and privacy advocates were unnerved, complaining Friday on Internet forums such as Slashdot and Reddit that Cisco’s move was a breach of privacy. Some said they would dump Linksys over the issue. Home routers generally don’t do much of anything except act as passive intermediaries, handing off traffic to Internet service providers without keeping a log.
“The language in the terms of service is really worrying,” said Aaron Brauer-Rieke, a fellow at the Center for Democracy & Technology, an online-rights group, in an interview. “That’s an incredible swath of information, when you think about the fact that your router is the first thing your computer talks to before the ISP to go to the Internet. That could be every Internet address you access when you’re online.”
A Cisco executive said the company made a mistake in its terms of service and is changing the language on the website.
In a statement, Brett Wingo, general manager of Cisco’s home networking division, said:
“We are absolutely not tracking Internet history, nor do we intend to. We recognize that some of the words in the statement are unclear. We are taking immediate steps to modify this language to be more specific about our commitment to protect the personal privacy of our customers.”
Wingo said the personal information collected from users is only used for customer support. Users who have gotten the update and want to opt out of the service need to call a Cisco support line — (800) 326-7114 — to revert to the traditional service, the company said in a blog post.
Wingo added that the information won’t be shared with third parties, another section of the terms of service that he said was misleading.
“We may share aggregated and anonymous user experience information with service providers, contractors or other third parties to assist us with improving the Service and user experience, but any shared information will be consistent with Cisco’s overall Privacy Statement and will not identify you personally in any way.”
The experience marks a rocky start for a service that has the potential to make owning and administering a home router easier.
The service works only with the new Smart Wi-Fi routers, which Cisco has sold more than 500,000 of since April, said Dan Albertson, a senior manager for Cisco, in an interview.
Marketing materials tout Cisco Connect Cloud as giving users the ability to adjust their home router settings over an Internet browser or mobile application. Some uses include checking from the road whether your kids have disabled parental-control settings, or adding guest accounts if your guests arrive at home before you do. One day, the service could be used for remotely managing other devices that are getting Internet connections, such as using your phone to tell your “smart” oven to start pre-heating or your network-connected air-conditioning system to turn on.
Given the headaches of dealing with home routers, outsourcing some of the management of these devices makes sense. But the incident makes a broader point about Cisco: As the biggest maker of computer-networking gear, it has unparalleled reach into homes and businesses around the world. And when it comes to data privacy, many users have a fundamentally different understanding of their relationship with Cisco and networking providers than they do with other large technology vendors — such as Google or Facebook — that have made fortunes mining personal data.
“This is very, very different from trusting Amazon with your shopping or Google with your searches,” said Brauer-Rieke of the Center for Democracy & Technology. “This is all of those things rolled into one. Is it ever appropriate for one company to have that kind of vantage point into how you live your life?”
— With assistance from Cliff Edwards in San Francisco.