WASHINGTON -- A U.S. House subcommittee has approved a spyware bill that would allow fines up to $3 million for collecting personal information, diverting browsers, and delivering some pop-up advertisements to computer users without their consent.
The Securely Protect Yourself Against Cyber Trespass Act (SPY ACT) which bears little resemblance to the bill originally introduced under that name. It requires vendors of software that collects the personal information of computer users to notify users of its installation, to get the users' consent before installation, and to provide users with easy uninstall options.
SPY ACT was approved by the House Subcommittee on Commerce, Trade, and Consumer Protection this week as an amendment to a spyware bill introduced last year by Representative Mary Bono (R-California). Bono praises the amendment, offered by subcommittee chairman Cliff Stearns (R-Florida), as making "substantial progress in improving" her bill.
Stearns calls his amendment an attempt to outlaw bad actions without outlawing technologies similar to spyware that have legitimate uses, such as parental monitoring software or antivirus software.
An early version of Bono's original bill, called the Safeguard Against Privacy Invasions Act, defined all computer programs that transmit information without action from the user as spyware. But that raised objections from several technology vendors, including antivirus companies. A later draft of Bono's bill, which authorized the Federal Trade Commission to create rules for spyware notice and consent, includes several exceptions. They include exceptions for parental control software, antivirus software, and software that scans for license compliance.
"While we have wrestled with numerous and thoughtful definitions of what spyware is or isn't, the simple fact is that everyone has a right to safeguard their personal property and keep unwanted guests out of their homes and private lives," Stearns says. "To me, it all comes down to good manners--when I invite someone into my home, or in this case my computer, I expect them to behave and leave when asked."
The Stearns amendment allows fines of up to $3 million for actions unauthorized by a computer's owner, including hijacking browsers, changing a browser's default home page, changing the security settings of a computer, logging keystrokes, and delivering advertisements that the computer user cannot close without turning off the computer or closing all sessions of the browser.
The bill requires computer users be notified and be allowed to give consent before software that collects and transmits personal information is installed on their computers. But the notice provision in the bill may not be strong enough, says Ari Schwartz, associate director of the Center for Democracy and Technology.
Although the bill requires the spyware notice be "distinguished" from other notices, the spyware notice could end up buried at the end of a lengthy end user license agreement, Schwartz says. "Then we end up where we are now," he says. "Can we do a notice provision that won't confuse consumers more?"
SPY ACT is now headed to the full House Energy and Commerce Committee. Bono says she expects the bill to pass through the full committee. "We are one step closer to restoring safety, confidence, and control to consumers when using their own computers," she says.
Several states are also considering antispyware legislation, and Utah has already enacted a law to fight spyware.