Slashdot Mirror
Anti-Spyware Bill up for Vote in Congress
paul_friedman writes "According to Reuters - The U.S. House of Representatives will vote as soon as next week on a measure to crack down on deceptive "spyware" that hides in users' computers and secretly monitors their activities."
I think the most important part of this is that it also requires the software to be easily uninstallable. Something that isn't true today. This is the main point that I believe needs to be inforced, as its hard to exactly give a definition of spyware. But any software that installs permanently onto your computer (java apps and such don't nessearly apply) needs to have a simple uninstall.
Actually I take that back, that is the senate bill. Which is much more comprehinsive. It appears that the house bill is very simple and just disallows installing without notice.
In the hands of the typical "click every 'OK' on every popup that appears", it will delete just about everything in their registry.
Let them use spybot or ad-aware, at least there if they click and delete everything it finds it won't leave them with an unbootable machine.
This in and of itself will not be the end of spyware. However, I believe that this is a starting point from which we can eventually build a system of enforcement which will hunt for spyware and prosecute people who develop and/or utilize it.
d evioussoftware.mspx
Still, good Internet practices are a good starting point for the rest of us can implement now. This entails doing some research in addition to some common sense. Tools such as Spybot S&D and Ad-Aware are excellent in addition to being freely available and for real. There are a slew of other software claiming to be able to remove spyware when in fact they are spyware themselves! (anyone ever see the web banner ads, "Your computer may be infected with spyware..."?) Believe it or not, Microsoft actually has some good starting information for users of the Windows OS who are interested in what spyware is and how they may take some steps to protect themselves. http://www.microsoft.com/athome/security/spyware/
I recommend that users research as much as they can about what spyware is, the damage that it can do your your computer,your network, and your personal information. From there, one can learn some simple steps to avoid it. My personal recommendation is that if you are looking software, consider open source solutions. SourceForge is a great resource http://sourceforge.net/ Being that the code is openly available, open source is naturally not a desirable form of software for those who wish to do you harm. This does not mean that it is completely impervious to malicious coders, but at least you know that others will be able to see the code and blow the whistle upon the detection of any such inclusion.
Get some.
The only law which will truly cut down on spyware would be one which bans Internet Explorer.
A lot of spyware isn't 'piggybacked', it's installed through IE browser exploits. A number of people run into the exploits when they mistype a URL or search for porn.
Attempting to pass legislation against companies which will just relocate to other countries is pointless.
I researched spyware this past summer with a professor of mine at law school. The main flaw with all the proposed spyware legislation (there are around 10 pieces of it at the state and federal levels) is that it focuses on regulating "spyware" itself, rather than dealing directly with what bothers us about spyware. This is especially problematic because spyware is defined to cover a hopelessly broad array of software. As a result, two different legal issues have been handcuffed together. These two issues are information privacy and trespass.
Information privacy covers all the collection and use/abuse of personally identifiable information. This concern is not unique to spyware. It also exists in the use of bank records, medical information, etc. The EU has done a better job than us of consolidating information privacy concerns into a coherent body of law. In the US we have a legal patchwork that covers each use of personal information separately.
Trespass covers the installation, disclosure of functionality, and uninstallation of programs. There is a strong analogy here to real property, where you have some control over who comes onto your property, what they do there, and your right to expel them. One area that is in flux (and it is not unique to computer software) is that burying something in legalese in a license agreement may no longer be viewed as giving someone notice. This view is already being taken by some courts with regard to boilerplate contracts for products like cellphones.
In the end, this legislation is flawed because the legislators failed to identify the distinct issues of information privacy and trespass and address them separately. Identifying and separating issues is rule #1 when it comes to the understanding the law. I would imagine this mistake was made because this law involves technology, which probably makes legislators think they need to write completely new law. Sometimes this is the case, but often it is better to extend the laws we have developed over hundreds of years.