eWEEK content and product recommendations are editorially independent. We may make money when you click on links to our partners. Learn More.
Editors Note: Weve updated this story based on new information from Intuit clarifying their privacy policy, along with their comments and our observations regarding use of forms mode in a “non-activated” copy of TurboTax.
Many taxpayers throughout the United States have been upset to discover that Intuit has added digital rights management (DRM) — AKA copy protection — to TurboTax, its bestselling income tax preparation software. So we put the software to the test – in our labs — to determine exactly what was going on. In this article, well give you the skinny — the good and the bad — on what weve found out about this thorny issue.
Why Consumers are Worried
Many readers in ExtremeTechs forums have indicated that they resist purchasing any copy-protected software — including Microsofts Windows XP and recent versions of Microsoft Office — on principle. Theyre not thieves, but theyre simply not comfortable with the prospect of asking “Mother, may I?” to run software for which theyve already plunked down their hard-earned cash.
Other posters have expressed worries that the software which enforces the copy protection will interfere with the correct operation of their machines, consume excessive resources, refuse to work if they change computers or replace components, or spy on them as they work. One user claimed — though we were not able to reproduce the problem in our tests — that TurboTaxs copy protection interfered with his ability to burn CD-Rs.
When confronted with DRM, many users have, historically, voted with their feet. Several ExtremeTech readers who run alternative operating systems, such as Linux and BSD, have said that the “product activation” in Windows XP and Microsoft Office caused them to make the jump from Windows. Others have told us that theyve only tolerated Microsofts scheme because of the companys entrenched monopoly or because the vendors from whom they bought their computers offered no other options.
DRM is an even greater concern for users of tax software. They worry — justifiably as we found out — that they might be cut off from their tax data if they change computers or hard disks, perhaps at a crucial time such as just before a deadline or during an audit. And they want ironclad assurances that theyll be able to access their data at any time in the future — for example, decades from now when computing capital gains on a home or other asset thats about to be sold. Will the software work if the company that sold it goes under, is acquired, or discontinues the product? Users want to be sure.
Adequate notice
?”> In Intuits case, many of our readers also felt that the copy protection had been foisted on them without adequate notice. The package of our store-bought copy of TurboTax Premier Home and Business contained no warnings about the presence of DRM, other than one sentence, in tiny print, on the spine.
This is, in our opinion, inadequate notice of a “feature” that is of such great concern to consumers and is so likely to affect their decision to purchase a product. We noticed a warning at the bottom of the “System Requirements page” (that few people likely read) for the various Turbo Tax versions on Intuits Website stating “The TurboTax program may be installed on a single computer and must be activated by Internet or telephone prior to use.” While this is OK, information should also be present in the main FAQ and Product Info sections, given the fact this is a radical change from prior years.
What the DRM Restricts
Intuits DRM isnt a homegrown product; instead, the company licenses a copy protection scheme called SafeCast (formerly known as “C-Dilla”) from Macrovision. (Macrovision, sometimes called “Macrovillain” by video buffs, is also responsible for the anti-copying technology used in DVD players and on many VHS tapes.) According to Intuits FAQ — which ironically cannot be viewed unless ones browser allows the installation of several tracking cookies — its possible to use the product, in a limited way, without activating it. “If you install TurboTax on another computer without activating it,” says Intuit, “you can view or make changes to your tax return — but you will not be able to print from within the program, electronically file, or save your tax file as a .pdf file from that computer. However, you can transfer the .tax file to an activated computer for printing and/or electronic filing.”
As well explain later, our tests showed that these statements are almost — but not quite — true. You (or your computer, acting automatically) do have to contact Intuit before the software can be used, even in the mode in which printing and filing are disabled. We also encountered some other situations in which the DRM did not work as claimed — though, in several of them, it malfunctioned in such a way that we were afforded more, rather than less, access to the software than Intuit intended.
Our Test Results
Faced with confusing and sometimes contradictory statements from Intuit and Macrovision, we decided to run our own tests to see what the software actually did. We started with a copy of TurboTax Premier Home & Business, bought for $67.77 at a Sams Club warehouse between Christmas and New Years Day, 2002.
CD Itself Not Copy-Protected
Macrovisions Michael Glass recently told ExtremeTech that “Burning the protected CD doesnt work because the software sends certain commands which can only be interpreted by master CD burners at mass duplication factories.” This statement appeared to us to be highly questionable, to say the least: How could software that we hadnt yet installed send “commands” to our machine? And why would commands to factory equipment be included on a finished disk? So, the first thing we did — before installing TurboTax — was test to see whether the CD could be copied.
Sure enough — and as we expected — Roxios disk copying software was able to make a perfect copy of the TurboTax CD without so much as a hiccup.
Update: We have received the following information from Michael Glass at Macrovision that clarifies this matter:
“Glass says that TurboTax does NOT use SafeDisc, MacroVisions CD-ROM copy protection product. It only uses SafeCast, their licensing product. The comment regarding “the software sends certain commands…” refers to a SafeDisc software toolkit used by a software publisher to prepare a golden master CD for duplication, and its not related to software running on a users PC.“
Elaborate Testbed
We next set up an elaborate test bed, consisting of two heavily instrumented Windows XP computers. We loaded the machines with PartitionMagic 7.0 (to monitor the disk partition table), Neil Rubenkings InCtrl5 (which monitors changes made to your system during installation), Norton SystemWorks (to allow low-level inspection of the hard disk), and Roxio CD duplicating software (to test whether the DRM would keep us from copying CDs).
A packet sniffer monitored all network traffic to and from the machine under test (the sniffer system and systems-under-test were plugged into a network hub device, not a switch, so we could monitor traffic). We commanded InCtrl5 to take an initial inventory of the systems registry entries and file system, then began the installation. We started with the systems network cable unplugged, so that we could watch what happened if the user was not connected to the Internet during installation.
The installation program asked us to agree to a license containing roughly 4 pages of complex fine print that few users are likely to read. We did read it, of course, and discovered among the terms a statement that if the product had not been “activated,” we could prepare a return but not use the systems “form mode” to inspect the tax forms that were being created. This concerned us, because even if you prepare a tax return that will ultimately have to be printed or filed from an activated copy of TurboTax, you should still be able to see how the forms are filled out.
Note: Intuit claims to have addressed this issue with a mid-January update that now lets you use “form mode” even if the product has not been activated. But as youll soon see in Part 2 of this review, our testing revealed that the license was in error: forms mode may in fact be used when the product is installed on a second machine. After we reported this to Intuit, the company updated the license agreement and FAQ which are posted on its Web site. However, Intuit cant change the license you see when you install the product, since the text thats displayed is read from the CD-ROM.
The program also displayed a dialog box indicating that the program contained DRM. This dialog box is the first warning that most users will get that the program is copy-protected.
We entered the product key and watched the product install itself. Unfortunately, Intuit apparently could not resist placing advertising both inside the installation program and elsewhere. We had to dismiss an offer to purchase Quicken, and remove a bunch of annoying advertising icons that were strewn across our pristine desktop.
Activation
Next, after apparently being installed, without giving us a chance to say “yea” or “nay,” the product attempted to reach out across the Net and contact Intuits Internet servers. Of course, since wed removed the Ethernet cable from the back of the machine, it wasnt successful; instead, it displayed a dialog box insisting that we activate the product either by telephone or over the Net before use. At this point, we quit the installation program and tried to run the product without “phoning home” to Intuit. Alas, we were surprised to discover that we could not do so; each time we started the program, it would let us go no farther.
In short, contrary to Intuits claims, you must activate TurboTax even to use it its “crippled” or “trial” mode. And since activation requires either a phone call or Internet connection, Intuit can conceivably determine your telephone number (via ANI) or your IP address when you activate. This isnt detailed personal information, of course, but it may still be enough to track you if the company thinks youre a pirate. It also gives Intuit information about the number and whereabouts of computers on which its software is installed.
Note: Intuit claims that it neither obtains nor saves your IP address or telephone number during the installation process, and that its privacy policy specifically forbids this type of activity.
But the more serious problem lies with requiring Intuit to either answer the phone or have a server available to respond to the installation programs requests. Should Intuit go out of business or be acquired — or if its communications lines were to go down — there would be no way to install and then use the software youve bought. In any mode at all.
After assuring ourselves that there was no way to continue otherwise, we finally relented and allowed the software to contact Intuit via the Internet. We didnt see sufficient Internet activity to suggest that any private information extracted from the computer was sent during the process.
We then prepared and printed a simple tax return (one W-2, no deductions) without incident, and conducted a post mortem examination to see how the DRM had affected the machine. Well report on the results in our next installment, due later this week.