Adobe even logs what you read in Digital Editions' instruction manual.
Adobe’s Digital Editions e-book and PDF reader—an application used by thousands of libraries to give patrons access to electronic lending libraries—actively logs and reports every document readers add to their local “library” along with what users do with those files. Even worse, the logs are transmitted over the Internet in the clear, allowing anyone who can monitor network traffic (such as the National Security Agency, Internet service providers and cable companies, or others sharing a public Wi-Fi network) to follow along over readers’ shoulders.
Ars has independently verified the logging of e-reader activity with the use of a packet capture tool. The exposure of data was first discovered by Nate Hoffelder of The Digital Reader, who reported the issue to Adobe but received no reply.
Digital Editions (DE) has been used by many public libraries as a recommended application for patrons wanting to borrow electronic books (particularly with the Overdrive e-book lending system), because it can enforce digital rights management rules on how long a book may be read for. But DE also reports back data on e-books that have been purchased or self-published. Those logs are transmitted over an unencrypted HTTP connection back to a server at Adobe—a server with the Domain Name Service hostname “adelogs.adobe.com”—as an unencrypted file (the data format of which appears to be JSON).
The behavior is part of Adobe's way of managing access to e-books borrowed from a library or "lent" by other users through online bookstores supporting the EPUB book format, such as Barnes & Noble. If you've "activated" Digital Editions with an Adobe ID, it uses that information to determine whether a book has been "locked" on another device using the same ID to read it or if the loan has expired. If the reader isn't activated, it uses an anonymous unique ID code generated for each DE installation.
Update, 4:45 PM: The unencrypted transmission of reader data, along with an apparent lack of coverage of the collection of that data in Adobe'e terms of service, may be in violation of a recently passed New Jersey Law, the Reader Privacy Act. And the collection has also raised concern among librarians. The American Library Association's Code of Ethics states, "We protect each library user's right to privacy and confidentiality with respect to information sought or received, and resources consulted, borrowed, acquired or transmitted."
In a phone interview with Ars Technica, Deorah Caldwell-Stone, the deputy director of the American Library Association's Office for Intellectual Freedom, said that the ALA was still investigating the issue. "We are looking at this, and very concerned about this," she said, and If the data were to pertain to any library transactions, "we would want this information encrypted and private."
Reply With Quote
Connect With Us