Paying a price to use free software: the dark side of Comodo products

Comodo is a popular name in the software business. Comodo provides multiple free, and excellent, products for home users including, but not limited to, the award winning Comodo Firewall (now bundled with Comodo Internet Security). Comodo has also recently become a big name in multiple front-page controversies including the issuance of its SSL security certificates to known malware distributors/scam websites and a row with Softpedia over the inclusion of a third party toolbar in their software. For those that don’t know I will do a quick recap for you:

• Comodo has been caught selling its popular SSL certificate to malware distributors/scan websites. Now in Comodo’s defense, whenever a malware distributor/scan website which has Comodo’s certificate is brought to their attention, they remove it; furthermore the purpose of the SSL certificate, technically, is not to verify the contents of the website but rather to verify how secure it is to buy from (the irony). However the question of why Comodo is repeatedly selling the certificates to known malware distributors/scam websites (there have been cases where a website with the same exact layout, interface, and “product” except different name has been issued a certificate even though their earlier one was revoked) is still a significant one and still an on going issue.
• Softpedia, once upon a time, labeled Comodo Internet Security as “malware” because CIS included SafeSurf, an optional third party toolbar considered to be malware by Softpedia. Of course Comodo did not like that, so they tried to get Softpedia to remove the label. Softpedia, standing by their high standards, refused. So in the end the result was (is) Comodo Internet Security was (is) removed from Softpedia’s download database.

Whatever side you are on for the above two issues, this post is not to discuss them; that is for another time. I am creating this post to address another (potentially more important) issue with Comodo products.

Today as I was checking my e-mail, I got an e-mail from a dotTechie informing me of the fact Comodo Backup, a free backup solution provided by Comodo, was recently updated to v2 with major changes and I should check it out (yes – I do read the e-mails I am sent even if I forget to reply… surprise, surprise). So, naturally, I was intrigued and went to download Comodo Backup. While installing Comodo Backup I glanced over its EULA (End User License Agreement) and was shocked by what I saw:

I am not legal mind, but to me this says if you install Comodo Backup, Comodo will collect data from your computer such as how you use Comodo Backup. Not only will Comodo collect data, but the data can potentially be personally identifiable: Comodo won’t disclose the data to a third party in a manner which will personally identify you but that means if they are taking a deliberate and conscious action to make sure the data is not personally identifiable when being passed on to a third party, the data is personally identifiable when Comodo themselves have it. Am I understanding it properly or am I being paranoid?

Now it is not just Comodo wanting to collect data from you while you use their software. Many software developers ask you if you want to send anonymous usage statistics to the developer while using their program; however you can always opt out if you do not want to. I looked up, down, left, right, in, and out – no where in Comodo Backup did I see an option to opt out of sending data to Comodo. At best I found an option under settings named “Enable log” which a user can check or uncheck; however there is no clear indication if this “log” refers to the data collection done by Comodo or a different program function. Shame on you Comodo; not only are you collecting questionable data but the user has no clear way to opt out if they find this action less than desirable (bar blocking the program with Firewall of course and/or not installing the program in the first place).

After I got done with Comodo Backup, I was curious to see if other Comodo software do the same thing as Comodo Backup.  I found indeed there are other perpetrators which do the exact same thing…

Comodo System Cleaner

Comodo SecureEmail

…and other Comodo software which do something similar except explicitly state the information collected will be non-personally identifiable:

Comodo EasyVPN

Comodo Internet Security

CIS is the bundle which contains Comodo Firewall, AntiVirus, and AntiMalware solutions.

Since EULAs are long, and Comodo did not exactly help by not properly formatting some of the EULAs for some of their software, I may have missed a software or two which act in the same way as Comodo Backup; so if you find another Comodo product which collects data (personally identifiable or not) without an ethical and clear declaration and a user opt-out, please post below and I will be sure to update this post.

Furthermore, I visited the privacy policy link you see provided in CIS’s EULA. The description on how user personal data is used is vague at best:

So who exactly are Comodo’s affiliates and what are their privacy policies? Farther down the page Comodo does state more explicitly its partners and affiliates have “similar” privacy policies…

…but I am not really impressed in the first place by Comodo so I don’t know what to think.

To make matters even more confusing, it turns out there is another privacy policy currently linked to Comodo’s website (this one was last updated in July as opposed to April for the other one). This one is a little bit more definitive about exactly what Comodo does:

Of course Comodo states the affiliates and/or partners have “similar privacy standards” but I am not particularly impressed by Comodo’s “standards” when it collects data related to its programs without obvious user consent and/or clear opt-out option.

So what do you guys think. Am I being a daft, paranoid idiot or is Comodo pulling a fast one over all of us? Please, dotTechies, lawyers, Comodo reps, and everyone else: post your thoughts below. As it stands, I don’t know about everyone else, but Comodo has lost at least one potential customer: me.

***Update***

Let me make this clear: If potential data collection is not a concern for you, by all means use Comodo products (I have stated time and time again, at face value, Comodo programs are great). However me, and many others, deplore this practice of data collection without clear notification and/or opt-out option and will probably never use Comodo products again.