StopBadware Report Release: My SHC Community
From StopBadware.org Project Manager Maxim Weinstein...
We have just released a report identifying as badware the My SHC Community tracking application that we mentioned here a few days ago. The finding of badware was due to inadequate disclosure of extensive tracking and data collection and to the application not identifying itself while running. Sears has informed us that they are not inviting new users to install the software until they make some changes, but if you currently have the app installed, you should read our report thoroughly to understand the privacy implications. It’s worth mentioning that most people who signed up for the My SHC Community website are not affected. This only affects those who received an e-mail or popup asking them to install the application and who chose to do so, which SHC claims is a small subset of the community’s users.There were two things that made our reporting of this application feel different from our usual experience reporting badware:
1. The application is distributed only by invitation to users of a single corporate website, which means that distribution can be more tightly controlled, and changes implemented more quickly, than usual.
2. The vendor, Sears Holdings Corporation, was engaged and open to feedback and recommendations from the beginning and by all appearances is working quickly to incorporate them into the product and website.
Both of these are reflected in the update that was released concurrently with our report:
Sears Holding Corporation (SHC) has informed StopBadware that SHC is significantly improving the My SHC Community application disclosure and privacy policy language and adding a Start menu icon in an effort to comply with our guidelines and address privacy concerns. They expect these changes to be implemented within 48 hours. We have not evaluated these planned changes at this time. SHC has also informed us that they have suspended invitations to new users to install the application until these changes are implemented.
We are very glad to see a company that is responsive to user privacy concerns, and we commend Sears Holdings Corporation (and also comScore, developer of the application via their subsidiary, VoiceFive, Ltd.) for keeping the lines of communication open throughout the process.
---
You can read the report's press release here, find the My SCH Community report in full here, see Max's original post here, and learn more about StopBadware and their badware fighting campaign on their project page.