CRTC investigating Norton for pushing crypto-mining software onto Canadians' computers

“We reiterate that we dispute any allegation that our practices violated” federal anti-spam laws, an official at Gen said.

OTTAWA – The CRTC is investigating leading cybersecurity software company NortonLifeLock over whether it broke anti-spam laws when it installed a cryptocurrency-mining software onto Canadians’ computers without their “express consent” in 2021.

In August last year, the CRTC launched an investigation into the American software giant, now called Gen Digital, which owns the “Norton 360” cybersecurity program suite.

At issue are allegations that NortonLifeLock (NLL) “had installed, or caused to be installed, Norton Crypto on the computer systems of some of its Norton 360 customers without consent,” according to a compliance agreement between the regulator and the company signed last month and obtained by National Post.

Norton Crypto was a controversial program launched by NortonLifeLock in July 2021 that turned users’ computers into “low-volume” cryptocurrency mining machines when the device was idling. Cryptocurrency like bitcoin can be “mined” by computers performing complex, time-consuming calculations that can unlock small amounts of currency. Norton Crypto users kept the income, minus a 15-per cent commission to Norton.

But users and privacy watchers quickly became concerned when they noted that the software was automatically downloaded as part of the Norton 360 cybersecurity software installation package.

In August, the CRTC launched an investigation into the company because it was concerned that the company was installing the crypto program without users’ informed consent, thus breaking the spyware sections of Canada’s anti-spam legislation.

The legislation “prohibits the installation of a computer program (software) to another person’s computing device (e.g., laptop, smartphone, desktop, gaming console or other connected device) in the course of commercial activity without the express consent of the device owner or an authorized user,” according to the CRTC’s website .

In the weeks following the launch of the investigation, and with NLL already under fire in the U.S. because of Norton Crypto, the company told the CRTC it wanted an “early resolution of the investigation.”

The company admitted that Norton Crypto was “downloaded as part of the Norton 360 installation package, and installed at the same time as Norton 360,” according to the agreement.

But in both the agreement and a statement provided Monday, the company — now named Gen — denied it had broken any laws and argued that clients always had to “opt-in” to use the crypto service.

“Gen takes compliance with all laws and regulations extremely seriously and voluntarily extended its full cooperation to the CRTC. We reiterate that we dispute any allegation that our practices violated” federal anti-spam laws, Jenna Torluemke, senior public relations manager at Gen, said in an email.

But privacy lawyer David Fraser says the CRTC would not have pursued that investigation and compliance agreement if it didn’t believe NLL broke the law.

“It’s pretty clear that the CRTC was of the view that this was in violation of our anti-spam law, and in particular, the spyware installation of software provisions in the anti-spam law,” said Fraser, a lawyer at McInnes Cooper.

In the agreement with the software company, the CRTC’s chief compliance and enforcement officer, Steven Harroun, noted the issue at the heart of his investigation was if “NLL installed or caused to be installed, in the course of a commercial activity, a computer program in the form of Norton Crypto on the computer systems of Canadian consumers without their consent” between July and December 2021.

It was only in January 2022 that the company changed its installation process for Norton 360 so that it sought express user consent for the installation of the cryptocurrency-mining computer program.

In the agreement, the CRTC’s chief enforcement officer noted the company was trying to “address the issue posed by the lack of express consent for the installation of Norton Crypto… likely in response to concerns raised by the public.” He also stated the change came before the regulator launched its investigation.

The company officially killed Norton Crypto in September and it is no longed installed alongside Norton 360.

But as part of its agreement with the CRTC, the company pledged to take “all reasonable steps” to guarantee all the software it sells and installs complies with Canada’s anti-spam laws. It also promised to designate a senior corporate office that would update the company’s compliance program to ensure it reflects Canadian law.

The company also pledged not to install any programs on clients’ computers without namely first obtaining express consent and that will cause the device to “operate in a manner contrary to the reasonable expectations of the owners.”

Fraser said this is the first time he has seen a well-known brand company get dinged by the spyware sections of federal anti-spam legislation.

“I’m aware of these sections having been used in the past, but principally to go after the real bad actors, like botnets and things that take over your computer and turn it into a spam machine in the background,” he said.

“So this might be a little bit more eye-opening because this is characterized as spyware, and a lot of companies say, ‘hey I don’t do spyware’. But it’s a lot broader that that.”