July 5, 2012 at 3:43 PM ET
Update: Cisco has put up a second blog post addressing a number of the issues brought up here and indicating some changes in policy.
A number of Cisco customers woke up this week to find that their routers, normally straightforward devices that perform the grunt work of Internet communications, had signed themselves up for a service that not only moved critical functions to a new cloud service, but included a terms of service that forbade porn and suggested Cisco would be recording your browsing habits. The company has since written a none-too-convincing blog post in an attempt to reassure customers and provided instructions on how to roll back the update.
The "Linksys Smart Wi-Fi Routers" (models EA2700, EA3500 and EA4500) were introduced in April as simple but powerful home routers with features like parental controls, media streaming, and so on. The various cloud features were potentially useful, and until the update rolled out, totally optional. The new firmware enabled them by default, opting owners of the routers into a new and troubling user agreement.
Restrictive and arbitrary terms of service are nothing new, but in this case they were totally unexpected and especially disconcerting. Here were the main three problems with the terms and privacy statement:
- The terms forbid using the service "for obscene, pornographic, or offensive purposes" — though these are not defined, and it isn't clear how you would use router configuration software for obscene purposes.
- In the original privacy statement, which ExtremeTech found still intact on Google's servers, Cisco says that they "may keep track of certain information related to your use of the Service, including but not limited to the status and health of your network and networked products; which apps relating to the Service you are using; which features you are using within the Service infrastructure; network traffic (e.g., megabytes per hour); Internet history..." Naturally, people are confused as to why the people who made the router should be recording the Internet history of the people using it.
- Lastly, although Cisco says that the update was only applied to people who had opted in by allowing automatic updates, the privacy policy still reads: "in order to provide an optimal experience on your home network, some updates may still be automatically applied, regardless of the auto-update setting." So if you've opted out, they can still opt you back in.
Cisco has said that they do not "actively track, collect or store personal info or usage data for any other purposes, nor is it transmitted to third parties." But the assurance seems at odds with the stated limitations and information they intend to record. It's unlikely that Cisco, a highly successful company with a reputation to maintain, would find much money or benefit in scraping some data from its consumer-level customers. But that's not really what people are angry about.
This unasked-for update is still a worrying indicator of the future of consumers' ability to control their own devices. If the company that made the device can update it any time they want, along with their privacy statement and miles-long terms of service, what assurance does an average consumer have that their privacy and preferences are being respected?
Instructions on how to roll back to the "Classic" router software can be found here.
Devin Coldewey is acontributing writer for msnbc.com. His personal website iscoldewey.cc.