House Approves Spyware Penalties

By David McGuire Staff Writer
Tuesday, May 24, 2005; 12:32 AM

The House of Representatives on Monday night approved two measures designed to punish Internet scammers who install "spyware" on people's computers without their knowledge.

After abandoning efforts to merge the two measures into a single bill, the House voted 395-1 to pass legislation that would send some spyware distributors to jail for up to five years, and 393-4 in favor of another bill that would impose heavy fines on people and companies that install spyware on people's computers without their permission.

The House passed two nearly identical bills last October, but concerns in the Senate -- including how best to punish spyware purveyors while protecting legitimate businesses -- prevented legislation from reaching the president's desk. Anti-spyware initiatives have drawn broad support from industry and public-interest groups, but lingering concerns among high-tech companies over some of the measures' finer points have slowed the process.

Spyware is a loose term that describes computer programs designed to install themselves with little or no notice, and sometimes without any interaction on the part of the user. Once installed the more benign spyware variants generate flurries of pop-up advertisements, while the more malign types track online movements, steal passwords and hijack other sensitive data.

Malign or not, the unifying attribute of the programs is that they gobble up valuable computer processing power. Unchecked, the programs can render word processing, Web browsing and other important computer functions virtually unusable.

Public aggravation has prompted high-tech lobbyists to get behind the anti-spyware measures.

"We've worked closely with both committees in the House to get legislation moving forward. Spyware is a growing problem for our industry," said Robert Cresanti, vice president for public policy at the Business Software Alliance. "We routinely get telephone calls from consumers who've bought very high-end PCs saying, 'What's the problem here? I'm not getting the performance I paid for.' Invariably we're finding that consumer dissatisfaction is related directly to spyware."

Experts say the spyware problem has grown to rival that of "spam" e-mail. Last October, America Online Inc. and the National Cyber Security Alliance -- a group of more than 50 technology companies -- examined the computers of 329 randomly selected Internet users and found that 85 percent contained some form of spyware. The average "infected" computer had more than 90 spyware and adware programs. The research firm IDC estimated last year that spending on anti-spyware software will increase from $12 million a year in 2003 to $305 million a year in 2008.

The two House measures take different approaches to tackling the problem. The Spy Act from Rep. Mary Bono (R-Calif.) requires businesses to obtain permission before placing computer programs on people's computers -- a so-called "opt-in" provision that still makes some high-tech industry advocates nervous. Technology companies generally prefer "opt-out" language that allows consumers to request that programs not be uploaded to their computers, but doesn't force companies to ask permission every time.

Bono's bill also outlaws some of the nastier practices associated with spyware, including many of the ploys used to dupe people into installing the programs. Violators could be fined up to $3 million per violation.

Rep. Bob Goodlatte's (R-Va.) Internet Spyware Prevention Act has raised fewer hackles in industry circles. It avoids the "opt-in," "opt-out" debate and focuses on some of spyware distributors' more overtly criminal activities. Goodlatte's bill would impose jail terms of up to five years on those who use software to illegally gain access to a computer.

Under pressure from House leadership, representatives of the House Energy and Commerce Committee -- which approved Bono's bill -- and the House Judiciary Committee -- which approved Goodlatte's bill -- met last week to see if they could merge the two measures into one, but those talks faltered as neither side was willing to give ground on the "opt-in" issue, Bono said.

"I believe it's one of the most important parts of the bill," she said. "I think we own our computer and we ought to have a say about who installs what on your computer. It would be like if I owned a car and... parked at a certain mall, they have a right to put a tracking device on my car."

The Information Technology Association of America has opposed anti-spyware legislation in the past, but the group's president, Harris Miller, said it is probably necessary to establish a national standard now that several states have begun pushing their own anti-spyware measures.

"What we don't want is a balkanization where you have fifty different states with fifty different ideas of what spyware is," Miller said. He took issue with the opt-in language in Bono's bill and says his group is more supportive of Goodlatte's approach.

The BSA's Cresanti said he would have preferred that the House pass a single measure, but hopes the two bills will spur activity in the Senate. Despite some lingering concerns, Cresanti said his group is "satisfied" with the measures that passed the House.

Sen. Conrad Burns (R-Mont.), who has proposed his own anti-spyware measure, applauded the House. "Action creates awareness, and I am pleased to see the movement on this issue in the House today, which will continue to bring attention to this matter," Burns said in a written statement. I have been working to combat spyware for some time now, and I look forward to continued work with my Senate and House colleagues to make sure we can pass spyware legislation and get it to the president for his signature."

Bono said she's hopeful that the measure will pass, but notes that the Senate is preoccupied at the moment. "With all that's going on in the Senate you really have to cross all the fingers that you can and hope that this bill gets through."

© 2005 The Washington Post Company