They're B-a-a-a-ck! Spyware Bills Resurface

Like the phoenix rising from the ashes, two anti-spyware bills have reappeared on Capitol Hill. In the Senate, Senators Conrad Burns (R-Montana) and Ron Wyden (D-Oregon) resurrected the Spy Block Act on March 21, 2005. The House has been deliberating on its own anti-spyware legislation since January. Both bills call for bans and fines on a number of practices that result in unwanted software being placed surreptitiously on people's computers.

Burns and Wyden said their bill is based on the principle that computer users should have knowledge and control over the software installed on their machines. "When I purchase a computer and install it in my home, I expect to be the only one who has access to it," Burns said in a statement. "This legislation gives control back to those who should have it. It protects computer users from those potentially devastating spies and the programs they want to install." Burns and Wyden are also the authors of the CAN-SPAM Act, which regulates unsolicited commercial e-mails.

The bill bans the secret installation of software and misleading inducements to install software. It also targets software that, once installed, prevents efforts to uninstall or disable it. The bill also proscribes the collection and transmission of information about the user without the user's consent and the installation of software that causes ads to appear (adware) without identifying itself as the source of the ads. And it includes criminal penalties for "particularly egregious and intentional acts," as well as protection for providers of anti-spyware technology from being sued for blocking or removing software programs from a user's computer.

The Federal Trade Commission would be charged with enforcing the legislation, with violations treated as unfair or deceptive trade practices. In addition, state attorneys general would be authorized to bring actions. The bill would preempt state spyware statutes, except to the extent such statutes prohibit deception.

Late last month, the House Energy and Commerce Committee unanimously approved its fast-track anti-spyware legislation, sending the bill out for a full House vote. H.R. 29, the Securely Protect Yourself Against Cyber Trespass Act (SPY ACT), prohibits unfair or deceptive practices related to spyware, and requires an opt-in notice and consent regime for legal software that collects personally identifiable information from consumers. The spyware practices targeted by the House include phishing, keystroke logging, homepage hijacking and ads that can't be closed except by shutting down a computer. Violators could face civil penalties of up to $3 million.

Significance: Spyware, which was the subject of three bills last year, none of which made it into law, continues to be a popular target for federal lawmakers. As reported in the November 15, 2004, issue of AdvertisingLaw@manatt, the FTC has told Congress at least twice that anti-spyware legislation is at best redundant of existing fraud laws and at worst will cause enormous problems if poorly drafted; however, such protests appear to be falling on deaf ears.