Boycott widened over new Intel chip ID plan
(IDG) -- Intel's plan to ship its Pentium III chips with a processor serial number in the "off" position hasn't satisfied privacy
Intel announced last week that it would include a processor serial number (PSN) in every one of its new Pentium III chips for online merchants to use in identifying and authorizing users for secure Internet commerce.
After privacy rights advocates complained that the PSN would allow sites to monitor and profile users without their consent, Intel announced that it would ship the chips with the PSN switched off. The company also said it would offer software that would allow users to switch the PSN on and off, and alert them if the PSN's mode was to be changed.
That move temporarily appeased an Arizona state lawmaker who previously planned to introduce a bill banning the manufacture or sale of Pentium IIIs. But privacy rights groups are still outraged after meeting with Intel.
"This serial number is designed to facilitate tracking," said Dave Banisar, policy director for the Electronic Privacy Information Center (EPIC). "Given Intel's marketplace share of 85 percent of the microprocessors," it is likely that online merchants will try to monitor and profile the great number of users with PSNs in their machines who surf the Internet, he added.
EPIC, Junkbusters, and Privacy International -- the three groups who are leading the boycott -- are also considering sending a letter of complaint to the Federal Trade Commission (FTC) over the issue, according to Banisar. More groups are expected to join the trio in leading the movement, he added.
Banisar and others pointed out several flaws in the latest Intel plan. For one, it is not within Intel's control to set the PSNs in the off default. The PC manufacturers who assemble the machines ultimately decide whether to ship the systems with the PSN de-activated.
"You're relying on PC manufacturers, who in some cases want to identify users and were behind some of the initial demands for [PSNs]," Banisar said.
With desktops managed by OEMs, "all the defaults are set to extract the maximum amount of information from the user," said Jason Catlett, president of Junkbusters. "It's another way to get information to trade and sell."
An Intel spokesman said PC manufacturers will have to answer to end-users, ultimately.
"The naysayers are going to look for holes wherever they can find them," said Intel spokesman Seth Walker.
Secondly, critics say, the software utility that users need to activate or de-activate the PSN is vulnerable to hacking -- something even Intel acknowledges. Software can be used to obtain the PSN and, if the application is Internet-enabled, can transmit it anywhere without the user knowing it, Junkbusters said in a statement on its Web site at www.bigbrotherinside.com.
In addition, hackers could write programs that transmit a fake ID number, or which hide the alert that the software utility is supposed to show to notify the user that the PSN is about to be turned on, said Bruce Schneier, president of security firm Counterpane Systems and author of "Applied Cryptography."
"The basic problem is there's no secure way of querying the [ID] number, so you have no verification the number is accurate," Schneier said.
Intel's Walker acknowledged the security vulnerability with the software utility, but said users should go to Web sites they trust. In addition, users will have to reboot their computers before the PSN mode can be changed, reducing the chance that the PSN could be turned on without their knowledge, he said. Web sites that want to use the PSN will also warn users that they are entering an area where their processor serial number could be identified, he added.
"There is the ability for a malicious piece of software to try and disable that [alert], but users will have to go to sites that they trust and be careful about this feature," Walker said.
A third flaw with the PSN plan, according to critics, is that online merchants and other service sites, who want to know as much about customers as they can, are likely to require users to enable the PSN as a condition for access, according to Catlett at Junkbusters. In fact, Intel has said more than 30 companies are planning to take advantage of PSNs.
Intel spokesman Howard High agreed that some Web sites and chat rooms are likely to restrict access to only those users who volunteer their PSNs. But most businesses aren't likely to turn their backs on users, he said.
High and Intel colleague Walker pointed out that companies will find the PSN helpful in keeping track of their computers, and some users may find it helpful to be tracked for marketing and transactional reasons.
"For consumers, the potential of the Internet promises new ways to shop online," Walker said. "But greater levels of security are required. ... The processor serial number adds a level of security that doesn't exist today."
However, Counterpane's Schneier points out that the same flaws that make the PSN less than secure for end-users worried about protecting their privacy also undermine the security level of the feature for I-commerce.
One critic who was appeased by Intel's new plan to ship the PSNs in the off position was Steve May, a Republican member of the Arizona House of Representatives. He said that he won't submit a bill banning the production or sale of Pentium IIIs, which are manufactured in his state, because Intel is taking steps to address the security and privacy concerns. May is working on legislation, to be submitted by Feb. 8, that would address the misapplication of the technology in general going forward, he added.
"Even if Intel fixes the current problem with the Pentium III, we now know that this technology exists and it could be a problem from AMD [Advanced Micro Devices] next year," May said. However, Intel chip rival AMD has reportedly said it will not put serial numbers in its chips.
Meanwhile, Intel said the software utility will either be pre-installed on machines or available separately from retailers, as well as downloadable from its Web site by the time computers containing the Pentium III are available to customers, according to company spokesman High. The chips will be shipped to PC manufacturers before April, he said.
In response to speculation that Intel wants to be able to use the PSNs for its own purposes, Intel spokesman Walker said the company will not use the PSNs to track chips, to recover stolen chips, or to check that manufacturers don't run the chips faster than the speed for which they are rated.
"We're not going to keep any list of [ID] numbers," Walker said.
Elinor Mills is San Francisco bureau chief for the IDG News Service.
Back to the top
© 2000 Cable News Network. All Rights Reserved.
Terms under which this service is provided to you.
Read our privacy guidelines.