What's the Best Way to Stop Spyware?

WASHINGTON -- Technology leaders and government officials remain locked in battle over how to fight spyware, but at least they agree the war is on, if not who should lead the charge.

Both groups agree consumers need better protection from spyware peddlers. Industry officials say that protection should come from within the technology sector, while some government officials assert that legislation designed to punish the perpetrators is the best solution. They stated their cases at a forum sponsored by the Federal Trade Commission here this week.

Cause for Concern?

We need a clear definition of spyware and technological development to create anti-spyware solutions, tech industry insiders say. But they say the answer isn't laws, like the SPYBLOCK (Software Principles Yielding Better Levels of Consumer Knowledge) Act recently proposed by Senators Barbara Boxer (D-California), Ron Wyden (D-Oregon), and Conrad Burns (R-Montana).

"All kinds of negative things could happen with legislation. The more that I look at the text of bills the more nervous I've become. Even if I drafted a bill tomorrow, the really bad people aren't going to be affected, partly because they're not located here [in the United States]," says Andrew McLaughlin, senior policy council for Google.

Technology solutions that protect the consumer are the only effective answer to this evolving problem, McLaughlin says.

"We didn't look to laws to stop viruses, we looked to technology like Norton Antivirus that stops viruses," he says. "Senator Burns' bill defines spyware as anything that sends a packet to a computer; this means that every application on a computer will cause a 'notice and consent' message to come up on the computer. We need to address this problem first and foremost with technology. The bills proliferating within states are making people's lives harder, not easier."

J. Trevor Hughes, executive director of Network Advertising Initiative, says he worries about laws passing that won't accomplish their goals.

"Hasty legislative policies, seen with online privacy legislation, are the worst first response," Hughes says. "We've seen this with conversations about cookies and spam. Best practices is what worked."

Overzealous legislation does not benefit the consumer, agrees Jules Polonetsky, an America Online vice president. "We'll learn what the consumer thinks based on how they respond; it's not tied to any legal definition," Polonetsky says. "People need to give the consumer notice and control."

Defining the Problem

Lack of a standard definition of spyware is a key challenge, several participants say.

"We need to know what to wrap our hands around. It's early and premature to sit down and write best practices without really knowing what we're talking about," Hughes says.

While industry officials agree defining spyware, malware, and adware is needed before regulatory steps can effectively control the problem, government officials argue that constituents can't wait any longer for a solution.

"I've heard . . . a lot of 'legislation is just the wrong answer,' but we can't sit around and just think about it," says Jennifer Baird, legislative council for Representative Mary Bono (R-California). "That's not how it works in Congress. My boss has a responsibility to her constituents."

Stephen Urquhart, a Republican state representative from Utah, says he supports Bono's proposal to tighten restrictions on downloads and cites Utah's spyware law as a step in the right direction. Utah is the first state to declare spyware a crime, and levies fines of up to $10,000 per incident.

"Unless there's regulation, the butcher, the baker, and the candlestick maker will stick to brick and mortar and the consumer will shy away from these technologies," he says. "Adware companies say [the state has] cost them tens of thousands of downloads. Well, great! Another adware company, about to go public, said they'd avoid Utah. Well, that makes a lot of consumers happy."

Legal Aid Ideas

Existing federal laws already enable the Justice Department to go after criminals effectively, says Mark Eckenwiler, deputy chief of the department's computer crime and intellectual property division.

"There are different kinds of behavior that fall under the spyware umbrella," he says. He notes that current law covers such infractions as impairing the integrity of someone's machine. Keyloggers could fall under the wiretapping statute as use of an intercepting device, he says.

"We have a number of arrows to use in the prosecution of such crimes," Eckenwiler says.

Mary Engle, a former Federal Trade Commission associate director, agrees that current laws are effective.

"Under consumer injury, it doesn't matter what it's called. If it causes a PC to crash or slows down the computer, we can find it actionable assuming we were able to identify the perpetrator, which, if located overseas, can be another difficulty," she says.

Bono aide Baird maintains the representative's bill is necessary because it will make it harder for spyware promoters to deceive consumers.

Under current law, companies must ask permission before downloading information onto your PC. As long as the company asks permission in some way, they're protected. But some companies are navigating around this restriction with deceptive techniques, critics charge. For example, some will post a window that offers the option to "cancel," but if you click anywhere on the screen--including the "cancel" button--it automatically launches a download.

"A lot of times when people download spyware, we wouldn't have the tools to prosecute because they are given notice. Yet few consumers are looking at [the permission notices]," Baird says. "My boss's bill would require a notice regime to ask if they want to continue. There would be a downloading window making it clearer for the consumer."