Slashdot Mirror
Australian Gov't To Consider Spyware Laws
bernie writes "It seems the US is not the only country with spyware legislation in the works. According to this Computerworld article, a bill outlawing the 'harvesting without consent corporate or personal information via a Web site or with software applications for marketing purposes will be classified as 'spyware'' and is set to go before parliament later this year. In addition to making all 'spyware' opt-in the bill will cover 'malware' such as viruses, trojans, and worms. Interestingly, the article cites lack of 'international cooperation' as a barrier to effective enforcement of cyberlaws. Also included is a statement from the EFF that it 'would like to see a more serious effort made to use existing laws against unfair trade practices, misrepresentation, computer fraud and abuse, before new technology-specific laws are passed'."
Unless the Australian government has jurisdiction in foreign countries, this has the same affect as spam laws:
The assholes just relocate to another country.
Life is the leading cause of death in America.
Users will be required to install the Australian government's spyware to make sure other spyware isn't installed.
The more spyware/malware laws we get the better. It's so frustrating trying to use a computer with tons of spyware and spyware trojans. Ugh. And they say the average PC has 28 spyware programs running on it! This needs to stop.
a rt=69274&subj=dlpage&tag=button
It took me about 8 hours to clean out a friends computer the other day. He had about 15 viruses all installing spyware daily.
Here's some suggestions for cleaning your computer:
Grisoft's AVG Anti-Virus Free Edition - this is key. Free auto-updates too
http://www.grisoft.com/us/us_dwnl_free.php
Lavasoft's Ad-Aware - run it every so often, and always be sure to update it manually.
http://www.download.com/3000-2144-10045910.html?p
CWShredder - removes only a few trojans that give you tons of ads, but does a better job of fully removing them than ad-aware.
http://www.spywareinfo.com/~merijn/downloads.html
Spybot-Search & Destroy - Similar to Ad-Aware. You should run both.
http://download.com.com/3000-8022-10122137.html
Interestingly, the article cites lack of 'international cooperation' as a barrier to effective enforcement of cyberlaws.
An idea to get international cooperation would be to make it an act of war to get a mail bomb or any other kind of attack. We (in the US) get a couple of these... go knock on that countries door a few times and we'll get the cooperation from everyone we are hoping for.
Evolution or ID?
If these bills cut the number in half I'd be pleased.
Spyware. It's nasty. But...(and I hate to say it), I make a pretty good amount of money removing it from client PCs. "Internet Optimizer" and "XXXToolBar" are 2 of the more particular nastier ones I come across. It makes it virtually impossible to use IE. When one finds out what these nasties do and how they do it, one gets surprised that they aren't illegal yet. I am all for making this stuff illegal but I sure will miss the extra income.
You'll have that sometimes...
Let's pass a law. That always stops people.
When it says "Click Yes to install if you agree with the EULA." and the user does, what is the problem? People install spyware themselves. It's (at least for the most part) an ID-10T error, not an exploit. Are these governments going to MAKE users read and understand EULAs before installing things? Aren't these people warned in the EULA before they install? Granted, I hate spyware as much as the next, but the worst I've had is DoubleClick cookies that AdAware says is spyware. I just click "No" by default now instead of "Ok" when the "install software" box pops up in IE (at work... never had the problem with Safari at home).
?Not all spyware is bad but most is sinister"
I don't get this, can someone suggest a good spyware?
Or is ntpd also nowadays considered spyware??
screen capture utilities used to capture passwords,..
Damn, now I know why all those passwords in our web site's user db are showing up as long "*"s upon decryption
(Karma be damned; I am no better than an AC anyway)
What is the legal liability within the WWW community of the standard for setting cookies and other session tracking techniques within this law? It's this relationship between web server and web client that leaves the door open for spyware.
The intent of the law will be to establish the intent of the person using the browser rather than the intent of the web site organization who put up the url. But the web operator doesn't force anyone to click their link and the tools are available to prevent most spyware from loading across the link. Will the legal standing become nothing more than the equivalent of individual intent and unstated permissions?
It'll be an interesting legal question as to where various digital rights boundaries start and stop.
Mod me troll, if you must, I can't help it.
The same approach might be less effective against corporations, but I'd still love to see an attempt.
The problem that I can see is that type 1, even though it sucks and no sane person wants it on their computer if it were presented honestly, is probably already compliant with these laws because somewhere in the EULA it explains what it is doing. Never mind that even moderately intelligent people just click "OK" as soon as any dialog box pops up on their computer (my fiance still hits "OK" whenever she goes to an encrypted page since she doesn't take the time to read the box and click "don't show this dialog again").
The problem with the second type is that they don't give a damn now and they're not going to give a damn. I can't belive that using exploits to install software is not already illegal somewhere, and many of these type of companies are already out of jurisdiction...
To tell the truth, I can't think of a good way that we will get around this. We have to remove the motive - perhaps prosecuting the people that advertise this way?
+++ ATH0 +++
I know: not a new idea, or particularly interesting. However, I do find it funny to see people applauding legistative solutions to problems on the internet, which is usually praised for being an anarchic forum.
would like to see a more serious effort made to use existing laws against unfair trade practices, misrepresentation, computer fraud and abuse, before new technology-specific laws are passed
Here, here -- why aren't fraud and other bad-trade laws used more often? Is it a lack of resources? A cultural zeitgeist that embraces legal-gymnastics and rationalizations as legal compliance for prima faciae unethical conduct? Part of the current administration's pro-corporate/pro-business mindset?
It just seems that as long as you're not outright *stealing*, you can get away with pretty much anything, and it's not fraud. Has this always been the case?
If it has an EULA and people have to "accept" the program before it runs, should it be placed in the same category as other spyware? If you say "no - it's still spyware all the same - people just click through the EULA without reading it", then what would you say about Windows XP, where you have an EULA and data gets transferred to and from Microsoft regularly (especially if you use Windows Media Player 9)?? Is that the same thing?
Users need to take some responsibility for clicking through EULAs. There are many laws against reckless driving but I still have to CHOOSE to drive down a one-way street in the wrong direction. Who's at fault here? The law for not being strong enough or me for being an idiot? Users who choose to install software without thought are in the same boat. There are limits to the effectiveness of any law.
If spyware makers create a valid EULA and requires a valid install procedure (one which doesn't hide additional installs, for example), I would say, grudgingly, that there's a place for these programs in the world.
Futilty detector is sounding... So it would be only illegal to collect this information for *marketing* purposes?!!!
That's a law that'll be useful.
I am staunchly opposed to spyware. I was disappointed with the article however. The article seemed to place dropping a cookie on the same level as using a Trojan to install a program that pop ups ads left and right.
From the article:
Come on! The easiest way to do session management is to drop a cookie. The article in question suddenly classifies the majority of interactive web sites (forums, online stores) as spyware because they drop cookies for session management. To have an online store, you have to be able to track the user as they place things in their shopping cart, then procede to checkout. To keep a shopping cart between sessions or to keep user information available for the next forum discussion...you drop cookies that extend beyond the session.
Yes, there are privacy concerns with third party cookies from large entities like doubleclick and valueclick. These companies already have privacy statements, and have big legal departments and contribute to PACs to assure whatever they do is legal.
Laws that get passed from ill informed groups like the one quoted in the article simply create hassles for legitimate firms trying to do legitimate business. It will not affect the large ad firms like doubleclick and valueclick. Nor will they have any affect on the people willing to work on the fringes of society.
I am all for efforts to define and regulate adware. Such companies actually have code downloaded installed and running on people's computers. Unfortunately, I doubt legislatures will have the tech savvy to make such definitions. Especially in a world where privacy rights advocates are as befuddled by session management with cookies as they are with a trojan that includes code that tries punching holes through firewalls.
I suspect the Spammers / Crackers are DESPARATE enough now to see about compromising antivirus and firewall programs at the source via a crooked/disgruntled person at the company with access to the software and/or the source code to it (even 'better').
You have been warned....