NYS Senator Suggests Criminalizing Spyware

putch writes "New York State Senator Michael Balboni has introduced legislation to make the dissemination of spyware a criminal act. You can read the full bill text here. Is this a good thing? It defines spyware as software that transmits personal information or computer usage data without obtaining explicit approval from the user. It would seem to me (IANAL) that it would be quite unenforceable, but may send the right message to spyware outfits. Also interesting is that it requires any 'legitimate' spyware to disclose any bandwidth it may consume and requires the disclosure to be in bits per second." The bill is quite short and readable. (This might remind you of the recently introduced anti-spyware bill in the U.S. Senate.)

Comments

Use Utah law as inspiration for a better Fed. law?

[Eric Smith]

We just need the Federal equivalent of Utah's recently enacted spyware law. Although we should try to make sure our congresscritters don't pass a weaker one that overrides better protections at the state level.

LWN ran a story about the Utah anti-spyware law last month. A number of parties objected, but don't appear to have any legitimate grounds for complaint. The law doesn't ban spyware outright, but requires that spyware explain to the user what it will do, and obtain the user's consent before doing it. Only naughty people/companies should have a problem with that.

The LWN story links to an excellent analysis of the law by Benjamin Edelman.

Agreed

[mfh]

> Doesn't sound like it will catch most of what we call Spyware.

I'd have to agree. Spyware is any software that installs, either with or without permission, to monitor the user and relay information to third parties, for the purposes of selling merchandise or services. Spyware runs in the background, and is difficult to uninstall, or breaks other programs when uninstalled.

Trolling for dollars

[Safety Cap]

I run a network ~ [blah blah] ~. Spyware is now our number one threat of individual system stability ~ [blah blah].

Here's a hint: block every one of your gateway's ports, unless specifically requested, documented, and justified for a business function. Same goes for email attachments. Then block (at your proxy) all the known spyware sites (and stuff that contains "ad" in the DNS name).

You might also, I don't know, image the person's drive; when they screw up the machine, restore the image instead of trying to "clean" it. That way you only spend a few minutes dealing with that, and they get the reinforcing pain of losing all their personalized settings. After doing that a few times, they'll figure out that downloading CRAP is bad.