Slashdot Mirror
Iowa Senate Proposes Making Spyware A Crime
Cooked Chicken writes "Iowa State Senator Keith Kreiman (D) is proposing Senate File 2200, an act making the distribution of Spyware without notice an aggravated misdemeanor, punishable by confinement for no more than two years and a fine of at least $500 but not more than $5,000. The proposed bill also provides victims and county attorneys with the ability to file a civil cause of action for relief from conduct constituting the crime of unauthorized collection and disclosure of personal information by computer."
moving his money to Brazil as we speak . . . he is so sued.
It's illegal to personally use someone's machine without their consent. It doesn't take a huge jump of logic to see that launching a program to use their machine without their consent should be illegal as well.
"Eve of Destruction", it's not just for old hippies anymore...
In my humble opinion, those penalties are only remotely strict enough if they are assessed per instance installed. Otherwise, even the maximum fine of $5000 is a drop in the bucket for most adware/spyware perpetrators.
RHCE; are you certified? Karma: ambiguous.
This is a step in the right direction. We need this type of legislation ASAP. However, I should point out:
The problem is that much spyware explicitly tells the user what it is going to do: in the EULA. But how many users read the EULAs? How many people understand them? As a computer repairman for lots of moms, granny's, and kids, I can tell you that these people won't read the licenses even if I explain to them the importance.
Some interesting stuff
We privacy freaks now understand that "anonymous" usage information tied to "unidentifyable" facts like my sex, birthdate, and zip-code are sufficient to identify me when partnered with other databases.
While they're at it, they could make identity theft a capital crime, raise speed limits on rural roads, and skip raising the sales tax.
A fine is a tax you pay for doing wrong and a tax is a fine you pay for doing all right.
To paraphrase, the bill defines spyware as programs that send "Identifying personal information" without user knowledge or consent. It has a list of obvious exceptions, what's left is spyware.
...
a. "Identifying personal information" means
the following:
(1) Name.
(2) Address, including the street name or name of city or town.
(5) Social security number.
(8) Any other information identifying an individual.
(I cut some stuff out, but you get the idea.)
Do we hate spyware because it sends out this kind of information, or do we hate it because it runs in the background, shows pop-ups, and makes the computer unstable?
I don't have a problem with the bill, but I don't think it target's the underlying problem of nearly self-installing crap-ware.
btw, my computer's always 100% spyware free, it's my parents' computer that's beyond redemption.
Sangloth
I'd appreciate any comment with a logical basis...it doesn't even have to agree with me.
If you have too many laws for the Internet, you'll stiffle its development and waste a needless amount of society's resources.
People will be more apprehensive about developing new ideas for fear of lawsuits and others will spend enormous amounts on litigation.
And even if that's not true.
How could you write such a law. Spyware? What's that? If Microsoft polls your computer for update requirements, would that not constitute a violation of such a law? If so Microsoft will amend its license agreement to compel a user to allow such Spyware. People who write programs will draft similar licenses, then they'll be lawyers, and endless amounts of everybody's time and energy.
I would much prefer a technical solution at the user end, it's cheaper and more elegant.
The problem is that in the EULA of the program it usually says something about you permiting the company to run the spyware. We don't need laws about this, just more competent computer users.
Unless its really aggressive in making this "notice" very clear, and not just hidden in a lisence agreement. Things will stay just like they are, since I believe its already required by law that you are told what you are installing although its fine if its hidden in 10 pages of law-speak. Sounds to me like a senator that wants to make a name for himself by trying to combat somthing people are concerned about, but not actually making any difference at all, similar to the CANSPAM laws.
Unlike spam, spyware controll can be completely handled by the user. So if you really want a spyware-free computer, you need to take care of it yourself, not ask the government to do it for you.
It's nice that some state governments are willing to look after their constituents. It's just too bad that the US federal government (and most other governments worldwide) are unwilling to take such measures.
The history classes I've taken seem to suggest a time when western governments actually worked for their citizens, rather than against them. It would sure be nice to see a return to such days. (smarminess intended)
One important thing to remember in this discussion is that many companies spend far more time keeping their networks spyware-free than they do worrying about viruses/worms. I know mine does.
I don't really view spyware/adware/etc as anything other than a virus/worm with an EULA. If mydoom had an EULA attached to it which specifically states how it will work, and what it will do (in perfect legalese) -- should this be legal to write and spread in the wild? I say hell no. Anyway, since EULA's are not signed (in any way), and don't even have to be read -- they're not really an "agreement". They're more of a proclimation. Not only are their names misleading, but certain fundamental rights cannot be taken away by an EULA (and these are). Why not call one of those rights "control over your computer and personal information"? Maybe even redefine how EULAs are written. If you're giving up control over certain functions and information, maybe it should be in BIG BOLD LETTERS in plain English at the top of the agreement (rather than somewhere in the middle, small print, and in legalese so ambigous, most lawyers would read it and say "WTF?").
It's about time that someone did something (not that this is the best thing to do). I'm all about freedom -- let people do what they want as long as nobody gets hurt. However, when software depends on mass trickery in order to propigate, then there is a problem. When it comes to spyware/adware, it's important to let people know what they're getting into -- this is where we should start.
-Turkey
Having in mind the widespread use of technology in Iowa, it is quite understandable how this progressive state came with such a groundbreaking idea...
a. Determine whether or not the user is a licensed or authorized user of the software.
b. Provide technical support for the use of such software or computer service upon request of the user.
c. For any legitimate law enforcement purpose as authorized by applicable federal, state, or local law.
d. To enable an employer to monitor employee computer usage while such employee is within the scope of any employment as authorized by applicable federal, state, or local law.
By the way, this also appears to illegalize cookies.
4. As used in this section, the following definitions shall apply:
a. "Identifying personal information" means information that personally identifies a user of computer software or interactive computer service, including but not limited to any of the following:
[items skipped]
(8) Any other information identifying an individual.
DNA is a Turing machine. You, however, being dynamic and emergent, are not.