Canada prohibits installation and/or update software without user consent

[fnixha]

 

 

A new provision in Canada’s Anti-Spam Legislation (CASL) prohibits tech cos from installing software without consent from the device’s owner

 

All those tech companies providing auto update for their software products can take a hike.  At least in Canada.  According to the new rule which kicked in from yesterday introduced by the Canadian Radio-television and Telecommunications Commission, no software can be installed and/or updated without the users explicit consent.

The new rule applies when someone installs or causes the installation of software on another individual’s device in the course of commercial activity. The CASL said that it had noticed websites automatically install software on visitors’ computers without their consent. Often these installs are seen to be malware and adware.

The new ruling includes the installation of software/malware which is bundled with a legitimate applications, or the installation of concealed software from music CDs, the commission said. For example online downloads of software include concealed or cleverly camouflaged toolbar or search software which are often irritating and can classify as adware.

“Usually, CASL requires you to obtain consent from the owner or another authorized user of the computer or device prior to the installation of a computer program. However, in some circumstances, you are considered to already have consent without having to request it”

 

The software excluded from the CASL provisions include cookies, HTML, JavaScript, operating systems, applications that are executable through a piece of software that was already consented to, and updates designed to fix bugs. Telecoms service providers can also install software to protect their infrastructure against security threats, and updates/upgrades for their network. However in this regard, CASL has said that the companies can install these types of programs only if user has given explicit consent to it.

If a user disables JavaScript and/or cookies this should be reckoned as the user doesnt agree with the installation of such software.

CASL said that for updates and upgrades are concerned, software providers need consent from the device’s owner before installing them if the program was self-installed by the user. However, companies can seek consent for all future updates and upgrades when they request the initial consent to install an application.

The new rule for software installation kicks in from 15th January 2015 and updates and upgrades are allowed without seeking consent until January 15, 2018. Until this date, the user’s consent is implied, unless they specifically state that they no longer agree to the installation of future updates.

CASL has made it mandatory for the tech companies to make the consent request to include the reason for seeking consent, the company’s name, contact information, and a general description of the program. Users must also be informed that they can withdraw their consent. The company also should clearly specify if the application is designed to collect personal information, if it interferes with the user’s control of the device, if it changes settings or preferences, if it obstructs, interrupts or interferes with the user’s access to data, if it installs third-party programs, or if it causes the device to send messages to other computers

 

 

original link http://www.techworm.net/2015/01/canada-prohibits-installation-andor-update-software-without-user-consent.html

[Imabigmac]

Only going to affect the honest guys anyway, but still much like the anti spam it could be a nice thing. But then of course how will it be policed?

[Raboo]

Thats cool.

[Sidiox]

Ehm, not good and good at the same time. For instance, does this mean that many computer newbs will have to install their own Windows Updates and these won't just get installed? 

For us powerusers it might be useful, otherwise less so.

 

This argument is invalid ofc if you can just one time give an updater permission and after that it will just do its thing

[dalekphalm]

Ehm, not good and good at the same time. For instance, does this mean that many computer newbs will have to install their own Windows Updates and these won't just get installed? 

For us powerusers it might be useful, otherwise less so.

 

This argument is invalid ofc if you can just one time give an updater permission and after that it will just do its thing

No. It will not affect Windows Update.

 

More like, you bring it into "Best Buy", and they install some sort of "PC Speedup" tool that auto-updates itself, without your permission.

 

For those users who are not very computer savvy, all that a legitimate repair company needs to do is ensure they get written consent for updates and software installs. Most companies make you sign something to that affect anyway already.

[sof006]

Thats not good in my opinion, the whole point for auto updates is to patch vulnerabilities in software etc. 

[Misanthrope]

Good for spyware and malware, yet this just pretty much leaves consumers wide fucking open: let's face it your average joe will never take care to manually download updates for his avast or mcaffe or whatever he is using.

[dalekphalm]

Good for spyware and malware, yet this just pretty much leaves consumers wide fucking open: let's face it your average joe will never take care to manually download updates for his avast or mcaffe or whatever he is using.

It doesn't prohibit auto-updates. Just auto-updates without the users consent. This means, for example, Adobe Flash needs to flash up a screen that says "Hey guy, can I have permission to update so you don't get fucked by security bugs? Yeah? Cool, bruh!"

 

BTW Adobe Flash is apparently a "Dude-Bro".

[Misanthrope]

It doesn't prohibit auto-updates. Just auto-updates without the users consent. This means, for example, Adobe Flash needs to flash up a screen that says "Hey guy, can I have permission to update so you don't get fucked by security bugs? Yeah? Cool, bruh!"

 

BTW Adobe Flash is apparently a "Dude-Bro".

 

Cool bro.

[WanderingFool]

It doesn't prohibit auto-updates. Just auto-updates without the users consent. This means, for example, Adobe Flash needs to flash up a screen that says "Hey guy, can I have permission to update so you don't get fucked by security bugs? Yeah? Cool, bruh!"

 

BTW Adobe Flash is apparently a "Dude-Bro".

 

Actually by the sounds of it *could be wrong* it might be even better than this.  From my understanding of this, is when you install a program you have to get consent but any updates to it are automatically assumed to have consent *under the concept that the auto-update doesn't install additional software, just pure updating*  Again I could be wrong, but I this is what I feel was intended from reading this.

[dalekphalm]

Actually by the sounds of it *could be wrong* it might be even better than this.  From my understanding of this, is when you install a program you have to get consent but any updates to it are automatically assumed to have consent *under the concept that the auto-update doesn't install additional software, just pure updating*  Again I could be wrong, but I this is what I feel was intended from reading this.

Could be. It would be interesting to see a digital privacy expert weigh in on this, like Michael Geist.

[GoodBytes]

For clarification:

 -> All it means is that software can't magically be installed on your computer without your agreement. So that means that if I call say software XYZ, it can't install on the back without me knowing, BonziBuddy

And the software company can't pass it as "update".

 

 -> Another scenario is that a person can't install software without your knowledge, say BestBuy installing extra software as dalekphalm explained.

 

 -> Windows built-in software, Windows updates, normal software updates, all can be distributed as normal, as now. As they are not installing extra software.

 

This law will NOT affect the junk pre-installed on a computer. This "junk" is advertisement to reduce the system price to be competitive as you, the consumer, seek for the lowest price possible, especially that most aren't no willing to pay the for not having these ad software. This is also why the OS disk and driver dis aren't included. Even though they cost nothing, they don't need to manage it, and that drops the cost more.

 

So that is the reason why we have junk on computers you buy in stores, so now why it won't be affected?

 

Well, when you'll first start the system, you are greeted with Windows license agreement (which is fine), but also another one, which you MUST agree, which will install the drivers, and also the junk software series. And that is your consent to install them. This is something that BestBuy can also go arround by making you sign an agreement which states you give them right to install what they please.

 

So in other words, this law does nothing.

[amdart11]

Yay! Canada took a half-step forward and finally did something sorta kinda okay in terms of technology! 

[Technous285]

It doesn't prohibit auto-updates. Just auto-updates without the users consent. This means, for example, Adobe Flash needs to flash up a screen that says "Hey guy, can I have permission to update so you don't get fucked by security bugs? Yeah? Cool, bruh!"

 

BTW Adobe Flash is apparently a "Dude-Bro".

That's why I neuter the service that allows that shit to run when the hell it wants, then slit open the throat of the AdobeARM.exe file so it doesn't try running on its own.

If I want to update Flash or Reader - I'LL DO IT IN MY OWN SWEET TIME YOU COCKS!

Oh, sure "But by doing that, you'll leave yourself open to backdoors and trojans that can use the older versions!"; I manually check for a new version of that shit about every 6 weeks already, I don't need something running in the background silently suddenly popping up and murdering my gaming session at 2am just because "Updates!". -.-

[Yog]

 

 

The software excluded from the CASL provisions include...applications that are executable through a piece of software that was already consented to

 

They're going to have to define consent because the way that's written it could pretty much include everything, especially if you're clicking the "accept" on the TOS during the installation process of a random piece of software that includes a ton of bloatware.

[Albatross]

This is good if it doesn't include Windows updates etc etc, which by the sound of it, doesn't include.

 

But was this even a large issue in Canada? Isn't there something else they could  be spending their time on making legal or illegal etc?

[13CA350]

They'll just make an option to give "auto updates" permission to do so

[GoodBytes]

This is good if it doesn't include Windows updates etc etc, which by the sound of it, doesn't include.

 

But was this even a large issue in Canada? Isn't there something else they could  be spending their time on making legal or illegal etc?

Not really a problem, that I am aware about.

It's a bit silly regulations as, first of all the company needs to have offices in Canada to apply, and software that does this are generally crapware.

 

Also, it can be passed over via license agreement of the software, which no one reads in any case.

[sgloux3470]

Ehm, not good and good at the same time. For instance, does this mean that many computer newbs will have to install their own Windows Updates and these won't just get installed? 

For us powerusers it might be useful, otherwise less so.

 

This argument is invalid ofc if you can just one time give an updater permission and after that it will just do its thing

 

You could still have automatic updating, the user would just have to confirm that they want it.

 

Which is mostly already the case anyway.