Cisco appears to have retracted a controversial addition to its privacy policy that allowed the company to track data, including complete Internet histories, for users of its Linksys E2700, E3500 and E4500 routers.
The policy revisions were part of an automatic firmware update that outraged users last week, who tried to log in and found they must instead install the new Cisco Cloud Connect service. The automatic upgrade came without notice and with forced acceptance of a less-private user agreement.
Of particular concern was this item: “When you use the Service, we may keep track of certain information related to your use of the Service, including but not limited to the status and health of your network and networked products; which apps relating to the Service you are using; which features you are using within the Service infrastructure; network traffic (e.g., megabytes per hour); internet history; how frequently you encounter errors on the Service system and other related information (‘Other Information’).”
Joel Hruska at ExtremeTech this week reports the offending paragraph had been removed from the supplemental privacy statement. However, Cisco apparently isn’t backing down from the auto-update setting by default.
According to the site Electronista.com: “Cisco Systems reported that the privacy policy for the Cisco Connect Cloud service was a mistake, and has been removed, but the auto-update provision remains. Should users remain with the new service, provisions exist in the EULA to forcibly disable the routers by disconnection from the Connect Cloud service should they be used for illicit purposes, at the sole discretion of Cisco,”
Such illicitness includes “obscene, pornographic, or offensive purposes.”
The Cisco Home Community forum has instructions on how to downgrade the routers’ firmware and opt-out of future automatic updates. However, the company says the routers’ advanced features will not be available until the upgrade is performed.
