Online spy plan raises fears over privacy

A trial of the program uncovered more than 1100 attempts to download Chicken Little

Powerful, intrusive new technology is about to be used to spy on New Zealanders online.

The software, developed to hunt movie pirates, can track internet searches in what an international privacy watchdog says is an alarming intrusion. It can trace Google searches and other download attempts back to the computer they came from.

New Zealand anti-piracy investigators used the program in a recent trial, discovering 1153 attempts to illegally download hit children's movie Chicken Little.

Now the Weekend Herald can reveal that the Motion Picture Association, a consortium of major movie studios, is about to use the anti-piracy program fulltime.

The way it could allow private companies to intrude on personal computer use and gather evidence for legal action has raised concerns with internet companies, the Privacy Commissioner and the police.

The New Zealand Federation against Copyright Theft, the MPA's representative here, will use the software to identify pirates by their IP address - a computer's unique identity. It could track the IP address to the internet company which holds the user's details. The internet company could then agree - or be compelled - to give those details to NZfact.

Federation executive director Tony Eaton said action against pirates could begin with a "cease and desist" letter.

In more serious cases, Mr Eaton said, the police could be informed, a search warrant executed, the computer seized and the user prosecuted under the Copyright Act. It is believed that nobody has yet been prosecuted here for downloading movies or music off the internet, although it has happened overseas.

"If the anti-piracy message isn't getting through, then this is one of the tools we will use," Mr Eaton said.

He described the pirate-hunting software as "basically a search engine that searches the search engines", not spyware or a virus.

Mr Eaton has appointed a internet investigator whose first job will be to try to get the co-operation of internet companies in giving the details behind the IP addresses. However, ihug and Orcon have said they would not give up the information without a court warrant.

Privacy Commissioner Marie Shroff said computer users could ask her to investigate. "It is understandable that people can feel strongly about companies covertly accessing information from their personal computers," she said. "It is an intrusion into personal space."

Ms Shroff said it was unclear if the software breached existing law because an IP address identified a computer - which could obviously be shared or used by just one person.

Maarten Kleintjes, head of the police electronic crime lab, said he "wanted to have a talk" with NZfact to make sure it was not breaching the "demarcation line" between where the internet ended and the personal computer began.

"Even we can't do that," he said. "It would be like us searching every house in a street, without telling anybody and without search warrants."

The Electronic Freedom Frontier (EFF), a United States-based internet civil liberties watchdog, said claims the pirate-hunting software could trace internet searches were new.

"You may occasionally search Google for information about downloading a movie, but you are going to make a hundred unrelated searches, [maybe] about a medical condition, your sexual orientation and political beliefs," said EFF senior lawyer Fred von Lohmann.

"No one should be fooled by their argument that just because they are trying to stop piracy they should be allowed to do whatever they want."

The police and Internal Affairs said their operations to identify IP addresses being used for crimes such as child pornography were targeted rather than "fishing expeditions". Both said they would usually use a search warrant to obtain information from the internet companies.

Scott Bartlett, general manager of Orcon Internet and a director of the Internet Service Providers Association of New Zealand, assured his customers that it would defer only to the justice system.

Mark Rushworth, chief executive of ihug, said: "We won't be passing on any information to a private consortium."

It is understood the software was developed under the command of Chad Tilbury, the MPA's director of worldwide internet enforcement.