Slashdot Mirror
NYS Senator Suggests Criminalizing Spyware
putch writes "New York State Senator Michael Balboni has introduced legislation to make the dissemination of spyware a criminal act. You can read the full bill text here. Is this a good thing? It defines spyware as software that transmits personal information or computer usage data without obtaining explicit approval from the user. It would seem to me (IANAL) that it would be quite unenforceable, but may send the right message to spyware outfits. Also interesting is that it requires any 'legitimate' spyware to disclose any bandwidth it may consume and requires the disclosure to be in bits per second." The bill is quite short and readable. (This might remind you of the recently introduced anti-spyware bill in the U.S. Senate.)
I'd be more interested in something that took a dig at the EULAS, in the grand tradition of protecting silly people from themselves. This bill looks like do-nothing election-year fluff. Were I a New Yorker, I'd tell this fellow to go back to the drawing board and try again.
Auto-reply to ACs: "Truly, you have a dizzying intellect."
Because the law will be overly vague, and the next thing you know, you'll be going to jail for writing software which has online updating.
LWN ran a story about the Utah anti-spyware law last month. A number of parties objected, but don't appear to have any legitimate grounds for complaint. The law doesn't ban spyware outright, but requires that spyware explain to the user what it will do, and obtain the user's consent before doing it. Only naughty people/companies should have a problem with that.
The LWN story links to an excellent analysis of the law by Benjamin Edelman.
Seems like the problem here is "explicit approval". I have personally witnessed people who just answer "YES" or "OK" to anything and everything that pops up on their screen - are they not giving explicit approval? They may be signing away their first born in a paragraph you have to scroll down to see, and they would never know.
William Stephens
MCSE,MCDST,Well Respected VBScripting Guru
williams007@yahoo.com,(212)275-4831
This effort from Congress will work very well. After all, they have a good track record. The day Bush signed the "Can Spam Act", the spam shut off; haven't seen any since.
Don't blame Durga. I voted for Centauri.
What if I sneak into a Big Company's computers without their knowledge, using a hacking tool masquerading as a harmless program, or perhaps piggy-backing on a "legitimate" application, and then hide there, secretly reporting traffic and even keystrokes back to a central server? Let alone if I do it sloppily, slowing them down, crashing them, popping up distracting windows all the time?
I think I'd go to prison, don't you?
Why, I think there are some laws against doing that.
Now, switch Big Company with some anonymous little guy. And we debate about whether or not it should even be specifically against the law... Hah.
Want to Know How to Cheat the GPL? Read On!
The test would be to see what sort of thing the user has to click to agree to use the spyware.
If its a 30 page EULA, with a 'next' button, then it is not explicit approval.
If its a large dialog box that says "Do you wish to provide Company X with personal information", and lists what info it will send, then that is explicit.
If someone files a complaint under this law, and the spyware does not comply with the appropriate standards, then the company pays a fine (income for the state!), and possibly jail time.
END COMMUNICATION
... protecting stupid people from themselves.
All of these legal measures, this one and the bill in Utah
that someone else has mentioned are band-aids applied
to the sucking chest wound of the fact that the
average 'Net user wants all the freedom of going to
any site in the world and downloading anything he/she wants
and none of the responsibility of intelligently choosing
said content based on a solid understanding of how information technology actually works.
Call me elitist if you want to, but the scary thing to me about this idea
is that it will give lazy idiots (the people who still call themselves Newbies after using a device for years)
another disincentive to actually gain some knowledge of the tools they use and take for granted every day.
I think that it'd be useful for there to be a legal standard for how a EULA must be presented to a user to be binding.
How about, not binding unless read, agreed to, and signed BEFORE you buy/download the software for a start.
I think shrinkwrap liscenses are a load of bull and they should be just as struck down as they were when they were tried on other products some time ago.
Also the requirement for 'plain language' was a good thing in the proposed bill, however a requirement of prominance and a reasonable effort to make shure it's actually read would be nice as well.
Plus some of the vagueness needs to be taken care of. As it currently stands some spyware could get through and some non-spyware could be 'caught'. I believe someone else mention the update feature on software, though I'd rather not have more than a notice be automatic, or at least require auto-updating to be turned on. McAfee's updater is broken, it tries silently EVERY 5 MINUTES. And if you've configured windows to automatically connect it'll quite happily do so and if your paying by the minute..........
Mycroft
https://signup.leagueoflegends.com/?ref=4c3ed6600b6ea
The problem is not in the way a EULA is displayed.
It is that people don't want to read them. I've seen some where the reader has to scroll all the way down through the license before it is even possible to click the 'I Accept' checkbox. This is a step in the right direction, but the fact is, it isn't enough to help most users. They will figure out what they have to do do get past the license agreement, and most will never even consider reading it.
"as if nothing were solid...and that would be the end of the world, not fire and brimstone, but goo."--Rand
> Doesn't sound like it will catch most of what we call Spyware.
I'd have to agree. Spyware is any software that installs, either with or without permission, to monitor the user and relay information to third parties, for the purposes of selling merchandise or services. Spyware runs in the background, and is difficult to uninstall, or breaks other programs when uninstalled.
The dangers of knowledge trigger emotional distress in human beings.
You might also, I don't know, image the person's drive; when they screw up the machine, restore the image instead of trying to "clean" it. That way you only spend a few minutes dealing with that, and they get the reinforcing pain of losing all their personalized settings. After doing that a few times, they'll figure out that downloading CRAP is bad.
Yeah, right.
I think the biggest problem with EULA's is that they can be agreed to without being fully displayed to or read by the end user.
Maybe the biggest problem with EULAS is the fact that they exist at all.
The only thing an application should have is a copyright notice.
EULAs are only used to try and take away a user's rights (illegaly) that go beyond copyright.
Do you know of any store that will take back a piece of opened software and give a refund that you disagree with the EULA ??
EULAs are immoral in the extreme. This has to be the first issue that a computer rights group should take up.
And the statement printed on software boxes (like microsoft's) that state "You must agree to the end user license to the software" or other such statement is so much poo smelling malarky that it's not funny.
Take the cheese to sickbay, the doctor should see it as soon as possible - B'Elanna Torres, "Learning Curve"
Some things that probably meet the such a broad definition of spyware -
Windows XP
Windows Media Player
Internet Explorer
All of these programs transmit personal information without your consent (sometimes this depends on your patch level and the virus du jour as well). That being said, as soon as you turned the computer on, or opened the shrink wrap you accepted the EULA. Thus you explicitly accept that your personal information will be transmitted. The same types of wording are in the EULA's often accompany spyware that people install. In the end - it's probably a mute point. Personally I think it would be more important to look at EULA as a whole and how they are used to take away the rights of consumers, as well a shield companies that knowingly sell out defective software.
cluge
AngryPeopleRule
"Science is about ego as much as it is about discovery and truth " - I said it, so sue me.
You can't really stop spyware with illegalizing it. It comes as a addition to a programm your average Windows-users want to install. So it's their fault if they also install features that they do not want. And what's the difinition of 'spyware' anyway? Is the Windows media player spyware because it transmits your UID to Microsoft? Is Windows XP spyware with all this activation stuff? First, there has to be a clear definition of this term and it's uses. Then there might be some kind of strict and standardized guarantee or approval that the original distributor of a proprietary software product doesn't use additional features of tracking users and uses. Then a company can be held reliable if they infringe with the rules of an standardized "spyware-free"-label.
But alas, no law can stop users who have the habit of double-clicking everything clickable, be in their Outlook in-box, their desktop or on some local network share.
There's only one way to stop it: education for users that happen to have a computer just by incident but don't understand a thing about it and are happy without having to read manuals or EULAs
In Europe there was a huge problem with camouflaged dialers that establish a connection to some over-priced service-providers charging as much as $35 per call. Only after the media got interested in people who got an devastating phone bill, politicians got aware of this problem and illegalized certain numbers that dialers use. Lots of loopholes are still open, but just the media coverage and the discussion about illegalizing a certain telephony service sensitized the average Windows-user that dialers is something they don't want and double-clicking unknown objects can indeed have a real-life effect.