Slashdot Mirror
Australia Says No To Spyware
PrivateDonut writes "Australian parliament introduced a bill on Thursday that would 'make it illegal for anyone to install a program without informed approval and attract a fine of $10,000.' Is this doomed to fail as many other anti-spam/spyware bills have failed? Or has Australia finally hit the mark?"
I think, this proposal is a bit of a lame duck - much like other laws.
If I am under the danger having to face $10.000 for installing spyware on a PC in my own country - then I'll do it in another country. Do you really think there will be extradition for installing Spyware?
As long as I am willing NOT to visit the country where I hijacked some PCs, where's the problem? I can still do an awful lot of damage anyway...
I think, such laws will only become effective, once we will have international agreement on such laws to make them easily punishable across country borders. Internet criminals have the big advantage that they can BE in a non-extradition country even at the time they commit the crime in an entirely different country.
Is it correct that spyware works for its master? So at some stage it must try to communicate with its master to relay any information back right?
I believe if a lab (open, sponsored or even MS) can do the traceback and tie every spyware to its owner, then it'll be easier for those who want to take action to do whatever the law allows.
For example, if credit card numbers or PayPal logins are purposely fed to the spyware, and whoever uses that information will be linked directly to the spyware.
Rock that crushes, Paper & Scissors that don't matter.
Seems like most spyware has the same level of "informed approval" that store-bought commercial software does: An EULA that nobody reads.
It's a feel-good law.
The problem is that most spyware IS INSTALLED BY THE USER. Users are idiot!
A lot of spyware (via the licence agreement) *do inform the user that they are about to be installed. Even those that install themselves via an ActiveX control do so... So this new law will help very little in this war against spyware.
On that note, look how much good the anti-virus laws have done in cutting them down (nothing). We need to find technical solutions to technical problems, not social solutions to technical problems.
Although I applaude the efforts of the ozzie goverment, I can't help but wonder how many hours it will take a lawyer to find the first loophole. Thus placing the advantage back in the malware authors hands.
I think the idea of a worldwide anti-spyware alliance is more than a little silly. In fact, I shy away from any push for international policy beyond the protection of basic human rights.
The solution to spyware problems is either technological(although I have no idea how, using an non-Widnows OS isn't really "the answer") or social(teach people how to 1. Avoid spyware and 2. Avoid giving any kind of financial incentive to any company associated with spyware).
Not all spyware is installed directly by the users, but I've seen it happen in many cases, and sometimes even PAY for it (eAnthology stuff and the like).
I've seen people who had a completely crashed PC every week, were told that spyware (lots of-) was the cause, were explained everything, but didn't mind if their daughter was going to reinstall spyware-infested kazaa on it again, and kept using IE anyways.
A lot of people don't care, and some even pay for the previlege of having more spyware on their PCs. Users ARE idiots! It's insightful - not funny!
As long as people won't read disclaimers, they'll end up installing lots of spyware "legally". w00t for 250 pages disclaimers!
"...(teach people how to 1. Avoid spyware and 2. Avoid giving any kind of financial incentive to any company associated with spyware)"
...and so on. A strategy that involves educating everyone is doomed because not everyone is willing to be educated (sad but true).
That's on the list, right after we teach people the following:
1) MS Word is a word processor, not an operating system;
2) Nobody in Nigeria really wants to give them $millions;
3) Their bank hasn't really lost their details, and they don't need to go to a website to re-enter them;
4) Passwords shouldn't be something as blindingly obvious as the name of their cat/favourite band/significant other;
Blank until
Spyware, like viruses, are not solved by simply moving to a different platform. Once enough people migrate then malware writers will start to include that platform.
Will other platforms have a better security model then Windows? Sure.
Will other platforms still have security vulnerabilities? Yes.
Will malware writers do everything they can think of to get a user to install their software (so-called "social engineering")? You bet.
The user is the weak link in the chain, and I think user education is the only real way to solve that problem in the long run. IE/ActiveX have really brought the problem to the public consciousness and made it easier for malware to get installed & propagate much faster than ever before. But fixing Windows (or moving away from it) won't eliminate malware.