washingtonpost.com  > Technology > Tech Policy > Cybercrime

Anti-Spyware Legislation Could Pass This Year

By David McGuire
washingtonpost.com Staff Writer
Wednesday, September 22, 2004; 4:52 PM

Measures to curb the use of "spyware" -- the computer programs that surreptitiously track people's online movements -- are steamrolling their way through Congress and a combined proposal could reach the President's desk before lawmakers break for the November election.

"People regardless of political affiliation are outraged about spyware. No one thinks spyware should be acceptable," House Energy and Commerce Committee Chairman Joe Barton (R-Texas) said in a conference call today. "We're beginning to get strong support from out in the industry. I think that'll help us get close to 435 votes when this comes up on the floor."

_____Related Coverage_____
Senate Panel Weighs In On Wireless Directory (The Washington Post, Sep 23, 2004)
Senate Panel Votes to Transfer TV Airwaves to Safety Groups (The Washington Post, Sep 23, 2004)
House Wants to Move Cybersecurity Offices (Associated Press, Sep 23, 2004)
_____Cyber-Crime Headlines_____
Court Rejects Child Porn Internet Law (The Washington Post, Sep 11, 2004)
House Panel Moves to Criminalize Spyware, Net Piracy (washingtonpost.com, Sep 8, 2004)
Suspected File-Sharing 'Hubs' Raided (The Washington Post, Aug 26, 2004)
More Cyber-Crime Headlines

Spyware is a catchall term to describe computer programs that are designed to stealthily install themselves on people's computers -- often when the users attempt to download seemingly legitimate programs. The most benign spyware programs -- also called "adware" -- simply serve up a barrage of pop-up messages, while the most intrusive can track online movements, steal passwords and hijack sensitive data.

Although some of the most intrusive uses of spyware are already illegal, many of the programs aren't covered under current law, a disparity that prompted the current clamor on Capitol Hill. After spyware began making headlines last year, lawmakers introduced no fewer than four bills to tackle the problem.

Both Barton's committee and the House Judiciary Committee have passed anti-spyware bills. Although the Commerce and Judiciary committees often clash over legislation, Barton said he'll ask House leaders to merge the two bills into one package and send it to the floor next week. Meanwhile the Senate Commerce Committee today approved its own anti-spyware measure, clearing the way for a vote on the Senate floor.

Rather than outlawing certain kinds of software -- something the high-tech industry vehemently opposes -- the spyware measures instead target the activities commonly associated with spyware, specifically the practice of installing a program on a person's computer without that person's knowledge and consent.

When the House commerce panel first began considering its bill, high-tech companies and organizations like Microsoft and the Business Software Alliance said they were concerned that the measures could unintentionally outlaw legitimate software designed to automatically patch software or update anti-virus tools.

Barton said committee staffers met repeatedly with representatives of the software industry to resolve their concerns about the bill.

Microsoft spokeswoman Ginny Terzano today sounded a more optimistic note: "We want to get good spyware legislation passed, because it is in the best interest of consumers, we’re encouraged by the progress of legislation thus far, and are hopeful Congress will move forward before recess."

The commerce bill creates civil penalties ranging from $11,000 to $3 million per violation for offenses like improperly collecting personal data, manipulating users' Internet browsers to divert them away from the Web sites they intend to visit or modifying their Internet settings.

Dropping a piece of adware on a single user's computer without their consent could be an $11,000 offense. Miscreants who deposited programs capable of recording everything a user types on multiple computers could be hit with the $3 million penalty.

Under the Judiciary Committee measure people who install programs on users' computers without their consent could be jailed up to five years.

The Senate measure, sponsored by Sen. Conrad Burns (R-Mont.) differs somewhat from the House commerce measure, but targets similar activities. Under an amendment approved today it also includes a criminal component.

Barton said he was optimistic that the differences between the House and Senate versions could be hammered out in the conference process used to reconcile differing versions of laws passed by the two bodies.

Ari Schwartz, an associate director at the Washington-based Center for Democracy and Technology said the spyware measures are useful, but tackle only one symptom of the overarching electronic privacy problem.

"These bills will help under certain circumstances that we see today, however we're not going to get at the deeper problems of spyware until we have a privacy bill," Schwartz said. "These bills aim at software that's downloaded onto somebody's computer, but if you talk about what third parties do with that information, it is not addressed." CDT is one of a handful of groups that has long called for Congress to enact a law that protects consumers' privacy rights online.

Although lawmakers have made some efforts to draft an electronic privacy bill, those efforts have trailed off in the past two years.

© 2004 TechNews.com