Spyware bill should focus on behavior, not technology, experts say
Connecting state and local government leaders
Effective anti-spyware legislation must focus on unfair and deceptive behavior and not on specific technology, according to security experts who spoke as a Senate committee considered anti-spyware legislation.
Effective anti-spyware legislation must focus on unfair and deceptive behavior and not on specific technology and tricks, according to a panel of experts who spoke on Wednesday as a Senate committee considered an anti-spyware bill.
Narrowly defining spyware or illegal activities would be self-defeating, allowing online criminals to avoid liability by adopting new technologies and techniques, said Benjamin Edelman, assistant professor of business administration and spyware researcher at Harvard University.
'At our peril do we make a list of practices that ought to be prohibited,' Edelman added.
The broad language of unfair and deceptive practices in the Federal Trade Commission Act that FTC now uses to prosecute spyware cases already is adequate, he said. 'Avoid attempting to define spyware, because we have enough of that in the FTC Act. That is an approach that has served us well for decades and will serve us well going forward.'
Edelman and representatives from FTC, the software security and direct marketing industries, and consumer advocacy groups testified Wednesday before the Senate Commerce, Science and Transportation Committee. Sen. Mark Pryor (D-Ark.) presided, calling spyware 'a pervasive problem that demands swift action by Congress to protect consumers from very serous privacy and security risks.'
Pryor convened the hearing in an attempt to move his Counter Spy Act (S.1625), out of the committee, where it has been stalled for nearly a year.
The bill would give FTC specific authority to prosecute the unauthorized installation of software on consumers' computers and require disclosure to users of the features of any software being installed that could pose a threat to privacy. The bill would pre-empt state law in most cases.
It is generally agreed that spyware is undesirable software surreptitiously installed on a computer to monitor a user's online activities or gather information from the computer. But coming up with a comprehensive, workable definition is difficult. Many products intended to combat spyware can fall under the spyware definition because they monitor activity on a host computer. Some rogue anti-spyware products actually install spyware on computers, and some marketers object that their legitimate adware is unfairly targeted by legitimate anti-spyware products.
Pryor said he wanted to amend and move his bill out of the committee and was seeking industry and other advice to improve it. He clearly was struggling to find a definition of spyware that would distinguish between good and bad, allowable and unacceptable, without leaving loopholes and would not be left behind by changes in technology.
Eileen Harrington, FTC's deputy director of consumer protection, said the bill would be 'a welcome addition to remedies open to us,' providing needed civil penalties that go beyond the forfeiture of ill-gotten profits that can be easily hidden. But the standards of unfair and deceptive practices already used in the FTC Act are good ones, she said, and the commission has brought 11 actions against spyware distributors.
She called the FTC Act, written in the early 20th century, a 'resilient statute. It has stood up very well.'
FTC has been successful in court acting on three principles concerning spyware, according to Harrington:
- It must be the consumer's choice whether to install software.
- Disclosure of what software does must be clear and not buried in a licensing agreement.
- Consumers should be able to uninstall or disable unwanted software easily.
Some suggestions for improving the Counter Spy Act were offered, often focusing on raising the level of accountability for companies that put software on computers.
Arthur Butler, an attorney at the consumer group Americans for Fair Electronic Commerce Transactions, warned that an exception in the bill that allows third-party monitoring of computers to detect and remove undesirable software is over-broad. It would provide too much cover for vendors to unilaterally act against other vendors or the computer user, he said.
Jerry Cerasale, senior vice president of governmental affairs at the Direct Marketing Association, favors self-regulation for the marketing industry, some parts of which use adware installed on computers to deliver advertisements. He wanted more accountability for anti-spyware vendors, some of whom remove his members' software.
Marc Rotenberg, executive director of the Electronic Privacy Information Center, called the bill a step in the right direction but also warned against overly broad exclusions and immunities and pre-emption of state law.
NEXT STORY: Microsoft: 10 patches for Windows