Security threats Toolkit

US legislators seek to ban spyware

Tags:
Software,
Install,
Consent,
Us

John Borland CNET News

Published: 04 Mar 2004 09:00 GMT

A trio of Washington lawmakers is seeking to stop the spread of "spyware" and "adware" that hijacks people's computers without their consent.

Late last week Barbara Boxer, Conrad Burns, and Ron Wyden, introduced the "Spyblock" Act, aimed at controlling one of surfers' common complaints. Among other things, the bill would require a computer users' consent before software was installed, and ensure that software programs could be easily removed.

"Computer users should have the same amount of privacy online as they do when they close the blinds in the windows of their house," Burns said in a statement. "But... computers across the country are being hijacked every day as users unknowingly download unwanted and deceitful programs that spy into their online world."

The bill comes as public awareness of the problems and technical headaches caused by surreptitious computer software is growing quickly.

Much of the outcry is coming as people increasingly use software that identifies the hidden software that produces advertisements, pop-up boxes, or changes home pages without permission. The digital pests often find their way onto computers bundled along with popular free programs such as file-swapping tools.

Internet service providers (ISPs) including America Online and EarthLink now distribute spyware-fighting tools, while independent programs such as Ad-Aware and Spybot Search and Destroy have gained large and loyal user bases on their own.

Those tools can lead to some confusion, however. America Online users this week began complaining that the new version of AOL's instant messaging software was installing spyware, or software identified as spyware by other software programs.

AOL said that the controversial software, called WildTangent, was a game component integrated into the new instant-messaging package, and that its functions were covered by the AOL licence agreement.

Other recent instances have been potentially more disturbing. A recent CNET News.com investigation found at least one instance of a company distributing antispyware tools that secretly installed additional software, viewed by many as spyware. That company, called Spyban, has since ceased distributing its product.

The new bill, dubbed the "Software Principles Yielding Better Levels of Consumer Knowledge," is viewed by some on Capitol Hill as a successor to the anti-spam legislation passed last year. But privacy advocates are still studying the language before endorsing it.

The Centre for Democracy and Technology, one prominent group that has recently taken a lead in the fight against spyware, says that it would rather see a larger bill addressing privacy issues more broadly. But a narrower bill may be more likely to pass this year, the group says.

The tricky part with this or any bill will be to create definitions of spyware that don't include innocent companies and which actually are enforceable, CDT Associate Director Ari Schwartz said.

"A lot of the worst cases of spyware are already illegal," Schwartz said. "The key is being able to go after these people. If you expand the definition of what's illegal, and you can't go after what's already illegal, it raises questions."

The bill would require consent for software installations and require strict disclosure if a program collects information about a user and sends it elsewhere over the Net, creates advertising pop-up boxes, uses the computer for any purpose other than the stated purpose of the software, or modifies a computer's settings.