Security software vendors may soon side with US government authorities and intentionally fail to report "certain spyware" to customers if ordered by a court to remain quiet, according to a survey of leading firms.

In a case decided earlier this month by the 9th US Circuit Court of Appeals, federal agents used spyware with a keystroke logger to record the typing of a suspect who used encryption to scramble his communications.

But would that government spyware used in that investigation actually be detected by security software? Or would security companies intentionally fail to report it?

To answer that question, ZDNet Australia's sister site CNET News.com conducted a survey. We asked three questions of 13 security companies, ranging from tiny ones to corporations like Microsoft and IBM.

When there is no answer listed for a specific question, the company chose not to answer it. In some cases we followed up with additional questions. The survey was conducted over the past week.

AVG/Grisoft
Responses from Fran Bosecker, spokeswoman for Grisoft, which publishes the AVG Anti-Virus, AVG Anti-Spyware, and AVG Anti-Rootkit programs, many of which are free. Grisoft has offices in the United States, Czech Republic, and Cyprus.

Q: Has Grisoft/AVG ever had any discussions with any government agency about not detecting spyware or keystroke loggers installed by a police or intelligence agency?
Bosecker: Not to the best of my knowledge in the US or Europe.

Is it Grisoft/AVG's policy to alert the user to the presence of any spyware or keystroke logger, even if it is installed by a police or intelligence agency?
Bosecker: So far this is the policy, also based on the valid legislature.

Do these policies vary depending on the country (the US vs others, for instance)?
Bosecker: Yes. Current AVG policy is to flag trojans that exhibit these types of actions. With that said, AVG will of course consider all laws, regulations and compliance rules set forth by the nations and/or local governments to the best of our abilities.

We understand that you have to comply with applicable laws and regulations. But do any laws and regulations currently require security companies to ignore spyware/malware/key loggers placed on computers by governmental agencies?
Bosecker: None that we're aware of in the US or Europe, or at least no law enforcement or agency has asked that we ignore any.

Have you ever received such a court order signed by a judge requiring you to cooperate with law enforcement authorities in terms of not detecting government-installed spyware or delivering government spyware to your users?
Bosecker: No

Check Point
Responses from Allison Wagda, director of public relations at Check Point Software, which makes the ZoneAlarm security software, including a Vista version announced last month. Other Check Point products provide disk encryption, firewalls and intrusion detection.

Has Check Point ever had any discussions with any government agency about not detecting spyware or keystroke loggers installed by a police or intelligence agency?
Wagda: No, we've never been approached with such a request.

Is it Check Point's policy to alert the user to the presence of any spyware or keystroke logger, even if it is installed by a police or intelligence agency?
Wagda: Our goal is to detect malicious software. ZoneAlarm does so by detecting certain behaviours (such as keystroke logging) and alerting the user. We do have a policy whereby legal, legitimate software programs from any third-party vendor can be "whitelisted" from detection upon request. We would afford law enforcement the same courtesy.

In a follow-up conversation, we asked Check Point under what circumstances they would afford that "courtesy".
Wagda: We've never been in the situation, but if the request fell outside of our typical parameters for whitelisting (ie having a signed certificate, among other things), then we'd consider on a case-by-case basis.

Have you ever received such a court order signed by a judge requiring you to cooperate with law enforcement authorities in terms of not detecting government-installed spyware or delivering government spyware to your users?
Wagda: Not to our knowledge.

Computer Associates
Response from Jessica Cassidy, a spokeswoman for Computer Associates, which makes software such as PestScan and CA Anti-Virus.

Have you ever had any discussions with any government agency, not counting conversations related to a lawful court order signed by a judge, about not detecting spyware or keystroke loggers installed by a police or intelligence agency?
Cassidy: No.

Is it your policy to alert the user to the presence of any spyware or keystroke logger, even if it is installed by a police or intelligence agency in the absence of a lawful court order signed by a judge?
Cassidy: The simple answer is yes. CA builds detections for all spyware and keystroke loggers that fail to pass our published scorecard criteria. Following is a link to our spyware scorecard.

Have you ever received such a court order signed by a judge requiring you to cooperate with law enforcement authorities in terms of not detecting government-installed spyware or delivering government spyware to your users?
Cassidy: (Editor's note: No answer to the last question by Monday evening in the US, although we didn't give CA that much time to respond to it.)

eEye
Response from Marc Maiffret, eEye Digital Security's co-founder and chief technology officer (who also has a regular podcast talking about security). eEye products include a network security scanner and a network traffic analyser.

Has eEye ever had any discussions with any government agency about not detecting spyware or keystroke loggers installed by a police or intelligence agency?
Maiffret: eEye has never had any discussions with any government agencies about not detecting any sort of malware, including spyware, keystroke loggers, etc.

Is it eEye's policy to alert the user to the presence of any spyware or keystroke logger, even if it is installed by a police or intelligence agency?
Maiffret: Our customers are paying us for a service, to protect them from all forms of malicious code. It is not up to us to do law enforcement's job for them so we do not, and will not, make any exceptions for law enforcement malware or other tools.

As soon as a company, like we have seen with McAfee, starts making exceptions to their protection products, they can no longer guarantee a sound and safe product for their customers. We will not play that game.

Have you ever received such a court order signed by a judge requiring you to cooperate with law enforcement authorities in terms of not detecting government-installed spyware or delivering government spyware to your users?
Maiffret: No

IBM
Response from Angela Frechette, spokeswoman for IBM Internet Security Systems. IBM sells a wide array of consumer and enterprise security products, including mail filters and the Proventia desktop security software that has antispyware features.

Have you ever had any discussions with any government agency, not counting conversations related to a lawful court order signed by a judge, about not detecting spyware or keystroke loggers installed by a police or intelligence agency?
Frechette: No, IBM Internet Security Systems has not had discussions of this kind.

Is it your policy to alert the user to the presence of any spyware or keystroke logger, even if it is installed by a police or intelligence agency in the absence of a lawful court order signed by a judge?
Frechette: Yes, it is IBM Internet Security Systems' policy to alert customers of any malicious programs/activities on their machines.

Have you ever received such a court order signed by a judge requiring you to cooperate with law enforcement authorities in terms of not detecting government-installed spyware or delivering government spyware to your users?
Frechette: IBM Internet Security Systems has never received such a court order.

Kaspersky Lab
Response from Randy Drawas, vice president of marketing at Kaspersky Lab, with offices in Massachusetts and Moscow. Last year, CNET Reviews awarded Kaspersky Anti-Virus 6 an Editor's Choice award.

Have you ever had any discussions with any government agency, not counting conversations related to a lawful court order signed by a judge, about not detecting spyware or keystroke loggers installed by a police or intelligence agency?
Drawas: No.

Is it your policy to alert the user to the presence of any spyware or keystroke logger, even if it is installed by a police or intelligence agency in the absence of a lawful court order signed by a judge?
Drawas: Yes. While part of our product's technology relies on static signatures to detect known malware, signature detection is only one of several detection methodologies in Kaspersky products. Our products, as with many other commercial anti-malware software, implement proactive detection methodologies -- statistical analysis, heuristics, emulation, and so on. These methodologies, unlike signature detection, do not "know" what they are detecting; they only know they've detected a form of malware. This is basically to say that detection of malware written specifically for purposes of law-enforcement is something that we cannot control. If our product detects a piece of malware, it detects it.

Have you ever received such a court order signed by a judge requiring you to cooperate with law enforcement authorities in terms of not detecting government-installed spyware or delivering government spyware to your users?
Drawas: The answer is no, not to date.

McAfee
Response from Siobhan MacDermott, vice president for worldwide corporate and executive communications for McAfee, which makes antivirus and antispyware software (here's our review of McAfee VirusScan Plus 2007). VirusScan Plus includes spyware protection and a personal firewall.

Have you ever had any discussions with any government agency, not counting conversations related to a lawful court order signed by a judge, about not detecting spyware or keystroke loggers installed by a police or intelligence agency?
MacDermott: It is McAfee policy to not comment on our conversations with law enforcement.

Is it your policy to alert the user to the presence of any spyware or keystroke logger, even if it is installed by a police or intelligence agency in the absence of a lawful court order signed by a judge?
MacDermott: Yes. McAfee alerts the user to the presence of any spyware or keystroke logger it detects, regardless of who installed it.

Have you ever received such a court order signed by a judge requiring you to cooperate with law enforcement authorities in terms of not detecting government-installed spyware or delivering government spyware to your users?
MacDermott: Sorry, but I will have to refer to my previous response for this one. "It is McAfee policy to not comment on our conversations with law enforcement."

Microsoft
Response from a representative of Microsoft at the company's outside public relations firm, who asked to be identified as a company spokesperson. Microsoft makes Windows Defender, which offers free spyware protection. It also makes operating system patches available through its Windows Update site for Internet Explorer users.

Has Microsoft ever had any discussions with any government agency about not detecting spyware or keystroke loggers installed by a police or intelligence agency?

Is it Microsoft's policy to alert the user to the presence of any spyware or keystroke logger, even if it is installed by a police or intelligence agency?
Spokesperson: Microsoft's antispyware tools and products are designed to alert customers to any spyware that these tools detect. The company only modifies these tools to improve their ability to detect spyware.

Is Microsoft able to answer more directly whether its spyware/key logger detection tools are ever turned off per the government/law enforcement's request, or whether it has ever had discussions with government agencies about not detecting spyware/key loggers they install?
Spokesperson: Microsoft does not turn off Windows Defender's ability to detect any spyware or other potentially unwanted software, including keyloggers, at the request of government entities.

We were hoping to push our luck and see if you would give a yes-or-no answer to these two narrower questions:

Has Microsoft ever had any discussions with any government agency, not counting conversations related to a lawful court order signed by a judge, about not detecting spyware or keystroke loggers installed by a police or intelligence agency?

Is it Microsoft's policy to alert the user to the presence of any spyware or keystroke logger, even if it is installed by a police or intelligence agency in the absence of a lawful court order signed by a judge?
Spokesperson: We heard back from the appropriate parties at Microsoft and got some additional clarification. They let us know that it is Microsoft's policy to provide visibility and notification to an individual about what is running on their computer including any spyware or keystroke logger -- how it got there is not a factor.

Have you ever received such a court order signed by a judge requiring you to cooperate with law enforcement authorities in terms of not detecting government-installed spyware or delivering government spyware to your users?
Spokesperson: Microsoft frequently has confidential conversations with both customers and government agencies and does not comment on those conversations. This should not be construed to imply these conversations have occurred, but instead taken as an indication that Microsoft does not comment on conversations, on any topic, that we have had with our customers or government agencies in confidence -- to do so would violate the trust and confidence customers and governments agencies around the world place in us.

Sana Security
Response from California-based Sana Security Chief Technology Officer Vlad Gorelik. Sana's products include Primary Response SafeConnect, Primary Response MemoryShield Server, and a utility that aims to improve Wi-Fi security.

Has Sana ever had any discussions with any government agency about not detecting spyware or keystroke loggers installed by a police or intelligence agency?
Gorelik: No. Our product detects potentially malicious software based on its behaviours. We are not looking at whether the purpose of the software is legitimate or not but rather whether it is potentially compromising the usage of the computer or users data. We adhere to industry standard definitions on legitimate information access such as the "Anti-Spyware Coalition" which define expected policy on software and information access on the computer.

Is it Sana's policy to alert the user to the presence of any spyware or keystroke logger, even if it is installed by a police or intelligence agency?
Gorelik: Absolutely! For the reason stated above.

Have you ever received such a court order signed by a judge requiring you to cooperate with law enforcement authorities in terms of not detecting government-installed spyware or delivering government spyware to your users?
Gorelik: The short answer is "No." Actually, I don't think there is a longer answer.

Sophos
Response from Ron O'Brien, senior security analyst at Sophos, which says its enterprise and small business products do a superior job of protecting against viruses, spyware, adware, hackers, spam and malicious Web sites.

Has Sophos ever had any discussions with any government agency about not detecting spyware or keystroke loggers installed by a police or intelligence agency?
O'Brien: No.

Is it Sophos policy to alert the user to the presence of any spyware or keystroke logger, even if it is installed by a police or intelligence agency?
O'Brien: Yes. See this Sophos statement that was made in 2001. Sophos has not been asked to turn off detection of any spyware, viruses, worms or Trojan horses by any intelligence agency around the world and continues to believe that detection of all such malware is important to our users.

(Editor's note: During a follow-up conversation, Sophos added that it would still stand by that statement today if approached by law enforcement or intelligence agencies and asked to change its policies.)

Have you ever received such a court order signed by a judge requiring you to cooperate with law enforcement authorities in terms of not detecting government-installed spyware or delivering government spyware to your users?
O'Brien: No, we have not received an order from a judge instructing us not to disclose the presence of a keylogger.

Symantec
Response from Cris Paden, manager of corporate public relations at Symantec, one of the world's largest computer security companies. Symantec sells a range of products including the Norton series for home use, and a long list of options for business customers.

Have you ever had any discussions with any government agency, not counting conversations related to a lawful court order signed by a judge, about not detecting spyware or keystroke loggers installed by a police or intelligence agency?
Paden: No, we have not had any discussions along those lines with any law enforcement agencies.

Is it your policy to alert the user to the presence of any spyware or keystroke logger, even if it is installed by a police or intelligence agency in the absence of a lawful court order signed by a judge?
Paden: Yes, barring a court order to cooperate with law enforcement authorities, Symantec would definitely alert our customers to the presence of any malicious code or programs that we detect on their systems. Symantec makes no differentiation from where an attack originates. If they are a customer of ours, we will alert them to all threats, regardless of where they come from.

Have you ever received such a court order signed by a judge requiring you to cooperate with law enforcement authorities in terms of not detecting government-installed spyware or delivering government spyware to your users?
Paden: Absolutely not. We have never received such an order or even a request.

Trend Micro
Response from Mike Haro, a representative of Trend Micro, which has its headquarters in Tokyo and an office in Cupertino, California. Trend Micro's products for home use include Trend Micro Internet Security 2007, which offers antivirus and antispyware protection.

Have you ever had any discussions with any government agency, not counting conversations related to a lawful court order signed by a judge, about not detecting spyware or keystroke loggers installed by a police or intelligence agency?

Is it your policy to alert the user to the presence of any spyware or keystroke logger, even if it is installed by a police or intelligence agency in the absence of a lawful court order signed by a judge?
Haro: We still prefer not to comment on our communication and policies for communicating with government agencies and government customers.

However, we can comment on your specific question: "Is it your policy to alert the user to the presence of any spyware or keystroke logger, even if it is installed by a police or intelligence agency in the absence of a lawful court order signed by a judge?"

Our answer is "yes".

Have you ever received such a court order signed by a judge requiring you to cooperate with law enforcement authorities in terms of not detecting government-installed spyware or delivering government spyware to your users?
Haro: (Editor's note: No answer as of Monday evening in the US.)

Websense
Response from Dan Hubbard, Websense's vice president of security research. Websense started out as an Internet porn-filtering company and still sells Websense Enterprise, which the company calls the "world's leading Web filtering solution". It also sells spyware detection software.

Has Websense ever had any discussions with any government agency about not detecting spyware or keystroke loggers installed by a police or intelligence agency?

Is it Websnese policy to alert the user to the presence of any spyware or keystroke logger, even if it is installed by a police or intelligence agency?
Hubbard: Our customers decide whether to block or allow such code. Websense detects malware irrespective of its source. Websense detects malware based on the behaviour and perceived intent of the code.

Have you ever received such a court order signed by a judge requiring you to cooperate with law enforcement authorities in terms of not detecting government-installed spyware or delivering government spyware to your users?
Hubbard: We have never received such a court order.