Slashdot Mirror


Washington State Outlaws Spyware

An anonymous reader submits "Today, the Governor of Washington signs a a bill outlawing spyware (bill history) which imposes penalties of $100,000 per violation. Spyware is broadly defined. It includes everything from changing a browser's bookmarks or homepage settings, "Opening multiple, sequential, stand-alone advertisements in the owner or operator's internet browser", keystroke-logging, taking over control of the computer, modify its security settings, and even "Falsely representing that computer software has been disabled." But here is my favorite: "Prevent, through intentionally deceptive means, an owner or operator's reasonable efforts to block the installation or execution of, or to disable, computer software by causing the software that the owner or operator has properly removed or disabled automatically to reinstall or reactivate on the computer." Microsoft and Ebay both testified in support of the bill. On May 10th, a similar law banning Internet and email phishing was also passed."

72 of 318 comments (clear)

  1. If I'm not mistaken... by NoMoreNicksLeft · · Score: 5, Funny

    Washington state also outlawed killing sasquatch.

    1. Re:If I'm not mistaken... by geekoid · · Score: 4, Funny

      and not a single one has been killed since.

      --
      The Kruger Dunning explains most post on /. http://en.wikipedia.org/wiki/Dunning%E2%80%93Kruger_effect
    2. Re:If I'm not mistaken... by plover · · Score: 5, Funny

      Oh, come on, the governor is going to sign ANYTHING Redmond wants signed. If Bill Gates wants Sasquatch dead, Sasquatch is gonna die. Make no mistake.

      --
      John
    3. Re:If I'm not mistaken... by zoobaby · · Score: 4, Informative

      For those that do not follow Washington politics, the Governor's race was very close. A republican won the first count and the first machine re-count. The margin of victory in each was less than 100 votes. On the hand recount, the democratic person won by 142(?) votes. There are some issues about dead people voting, and people voting twice. While the results have been certified, the republican party has taken the case to court. As of today, there is a democratic governor, but how long she will be in power is unknown.

    4. Re:If I'm not mistaken... by Surt · · Score: 4, Funny

      That's not true, I killed one last week. Just wasn't in washington state, so i'm off the hook as far as the law is concerned. Sure, some people will argue 'it was just a hairy guy backpacking in the redwood forests!', but I had my hunting license.

      --
      "Who is the Journal of Quantum Physics going to believe?" --Stephen Hawking
    5. Re:If I'm not mistaken... by tepp · · Score: 4, Informative

      Actually, the Republican party is mostly claiming that felons were illegally voting. The problem is, many of the people the Republicans are claiming are felons - aren't. Most have juvy crimes, which should have been sealed at 18 which did not affect their voting rights. Others, never had their rights removed at all, or had their voting privilages reinstated.

      Meanwhile, in the Democratic heartland of King County, 50 valid ballots were found to have never been counted, and are still in their envelopes. What a mess. I just hope my vote isn't one of those 50.

      The whole mess has been playing out in the papers for months now, it's getting very old.

      --
      Tepp
    6. Re:If I'm not mistaken... by tepp · · Score: 2, Informative

      Redmond != Bill Gates.

      Nintendo has a HQ in Redmond.

      There's a lot of independant companies here in Redmond that have no association with MS in any way.

      Google has a HQ in Kirkland, but you don't see people saying "whatever Kirkland wants, Kirkland gets...." or maybe that's just because Kirkland is a Grade A dump.

      Depressing place.

      --
      Tepp
    7. Re:If I'm not mistaken... by pizzaman100 · · Score: 4, Informative
      Your facts are basically accurate, but here are the actual numbers: First count - Rossi (R) wins by 261 votes. Second count - Rossi wins by 42 votes. Third count - Gregoire (D) wins by 129 votes.

      Here is a Timeline for the events (with an obvious conservative slant).

    8. Re:If I'm not mistaken... by calyphus · · Score: 5, Insightful
      Oh, come on, the governor is going to sign ANYTHING Redmond wants signed.

      Give her, and the people of Washington State, some credit. WA state was one of the first to enact anti-spam legislation in the late '90s (rendered useless by the Republicans in DC). You may want to just write off everything tech related from WA state as brought to you by Redmond, but I'd credit the greater tech awareness of the area in general. Not every tech-head in Seattle submits to the deathstar (e.g. http://www.omnigroup.com/

      --


      The potato it is uninformed.
    9. Re:If I'm not mistaken... by bladesjester · · Score: 3, Funny

      "Not every tech-head in Seattle submits to the deathstar "

      What does AT&T have to do with this?

      --
      Everything I need to know I learned by killing smart people and eating their brains.
    10. Re:If I'm not mistaken... by Enoch+Zembecowicz · · Score: 2, Informative

      Killing sasquatch is currently illegal in Skamania County, Washington. At this time Bigfoot has no state wide protection. However, if the sasquatch actually exists and someone kills one you can expect a public outcry. /Grew up in Washington

      --
      "Who's going to believe a talking head?" - Herbert West
  2. Not sure how I feel... by bananahead · · Score: 5, Insightful
    OK, this is great. So how does one go about enforcing such a law? I have very mixed feelings about this one.

    I love the idea that we are making something so irritating illegal in the strick legal sense of the word. Make no mistake, I hate Spyware.

    At least I think I hate Spyware. I am not really sure, given the broad definition. Some Spyware is good, based solely on MY definition of 'good' and the mood I am in. So what if I have to give up something 'good' because the purveyors of that 'good' thing felt it might fit into the broad definition of Spyware and thusly discontinued it. I lose.

    On the other hand, the creepy porn junk and the crud that wants my bank account so they can sell me into slavery in Korea definitely (again, in MY definition of...) fit the model of BAD Spyware and need to have its purveyors captured, subjected to Janet Jackson Videos and sent to prison for a long time. And thus begs the question:

    How does this law get that done? Certainly these guys aren't going to stop their nonsense, they are making money doing it, so we will HAVE to enforce this law to get them to stop, and if they don't stop because there is no good way to enforce this law, then the BAD stuff continues and the GOOD stuff is thwarted.

    I am just not sure about this one.

    I suppose it gives teeth to companies like Microsoft and EBay to go after these guys and have them bundled away. That is good. But Who decides which ones Microsoft and EBay go after? And do I really want to create a system whereby Microsoft and EBay are the US Marshals and are enforcing laws the way they see fit, and going after those criminals that they decide to go after?

    I'm just not sure about this one.

    --
    A most overlooked advantage to owning a computer is if they foul up there's no law against wacking them around a bit.
    1. Re:Not sure how I feel... by AKAImBatman · · Score: 5, Insightful

      OK, this is great. So how does one go about enforcing such a law?

      It won't help from outright viruses, but it could result in massive punitive damages for semi-legitimate corporations. e.g. Gator would be effectively banned from doing business in the state of Washington, under the penalty of heafty fines and/or criminal charges. (Sorry, I didn't read the law in any detail. I didn't catch if it was considered a criminal action or not.)

      As for finding someone to prosecute these companies, that may not be as hard as it seems. Lawyers love to make money by bringing forward any cases they can. In the absense of money, they love high-profile cases that make a name for themselves.

    2. Re:Not sure how I feel... by Antisquark · · Score: 3, Insightful

      It doesn't necessarily STOP the software from running; it forces the software to play nice with the other children and submit to removal if the user wishes.

      If you want various background processes tracking your purchases and webuse to supply you with "tailored results" then you should be welcome to them.

      If you DON'T, however, you should be able to remove the damn things with a minimum of fuss. It's never been good marketing for a company, in my opinion. Would you, in your right mind, buy something from a man who'd replaced the wallpaper in your home with advertisements for his products? I don't think so.

    3. Re:Not sure how I feel... by Rhone · · Score: 2, Insightful

      I, too, wondered if certain types of benign software might be caught in the crossfire with this legislation. After reading through it, I'm not worried about that.

      The bill is littered with words/phrases like "through intentionally deceptive means", "deceptively", "intentionally misrepresenting", "falsely representing", "without the authorization of an owner or an operator", etc.

      In every section of the bill, it's rather clear that the target of the legislation is software that deceives the user and/or does things against the will of the user.

      My biggest concern now isn't that benign software will be punished; rather, I suspect this bill will be useless because spyware companies will just embed "You give us permission to blah blah blah" clauses deep into those EULAs that no one really reads.

    4. Re:Not sure how I feel... by DigitalCrackPipe · · Score: 2, Insightful

      Regarding your definition of "good spyware": what you really mean is that you may be willing to allow information aggregation software to run on your computer in exchange for free services/software.

      OK. That's different from spyware. Information aggregation is still legal. The bill is littered with phrases like through intentionally deceptive means. The deception is a key part of software getting itself classified as spyware. I would posit that spyware is *always* bad (possibly with the exception of by law enforcement).

      A bill like this helps draw the line as to what is acceptable commercial behavior. It makes it more difficult for shady operations to stay above ground, and therefore attract legitimate customers.

    5. Re:Not sure how I feel... by pete6677 · · Score: 2, Insightful

      Putting terms in an agreement is not the same as having them accepted into law, not even close. Many agreements and contracts contain illegal clauses that would never be upheld in court, which is one reason why so many lawsuits are settled out of court. Generally, you cannot use contracts or legal agreements to facilitate illegal activity, so inserting language like this would not make the spyware company suddenly compliant with the law. For example, employers must follow employment law and cannot simply make employees sign an agreement waiving all rights. Some rights can be waived if the law allows for it, but otherwise an agreement cannot contradict the law.

    6. Re:Not sure how I feel... by RealUlli · · Score: 2, Insightful
      My biggest concern now isn't that benign software will be punished; rather, I suspect this bill will be useless because spyware companies will just embed "You give us permission to blah blah blah" clauses deep into those EULAs that no one really reads.

      What happens if the user changes his mind? (In true /. tradition I didn't read the article)

      IMHO, when the user consents through some legalese buried deep within some EULA, the software can install, but I think EULA clauses that go against a law are illegal and not binding. When the user consents, the software can install, but when the user changes his mind, the software should uninstall without putting up a fight, no matter what some EULA says. (I wonder if the lawmakers had something like that in mind? ;-)

      The uninstaller *might* uninstall the goodie that caused us to install the software along with the spyware (there might be a reason...), but not just the goodie, leaving the spyware in place.

      --
      Simple things should be simple, complex things should be possible.
  3. Re:Don't you hear it? by MightyMartian · · Score: 4, Funny

    "Sea," cried Canute, "I command you to come no further! Do not dare touch my feet!"

    --
    The world's burning. Moped Jesus spotted on I50. Details at 11.
  4. Leading the way again... by spyder913 · · Score: 5, Insightful

    We were also one of the first to make spam illegal. I don't really think it has helped all that much...

    1. Re:Leading the way again... by calyphus · · Score: 3, Informative
      All state anti-spam laws were rendered inoperative by completely ineffectual federal legislation.

      WA's anti-spam law was useful for the dedicated individuals that took the time to track spam to it's source and file a civil action with the state against them. If you could track them down and you had otherwise fulfilled your own obligations under the law, it was a simple matter to get a $500 judgement in your favor for each actionable missive. Collecting was another matter.

      The only real chance for success would be if the spammer were also in Washington.

      Like all anti-spam legislation it did require some compliance with legal authority on the part of the spammer. as if someone selling fake Chinese Cialis is worried about legal authority.

      --


      The potato it is uninformed.
  5. Realplayer now illegal? hopefully by Toby+The+Economist · · Score: 4, Interesting

    RP is a complete pig to remove.

    Wonder if it's now illegal?

    In fact, I'd like all third-party hidden-startup applications, which generally are unwanted and adopt this method since they know they'd be removed, to be illegal. I get VERY annoyed when other people feel fit to try to force their software into *MY* computer. How would they feel if I came into their front room and took over the remote control?

    --
    Toby

  6. Agreed-hard to enforce by Coopjust · · Score: 3, Interesting

    Hard law to enforce. If it was a national law, then it would have some effect. Hopefully it doesn't become "National weak law" takes over "Strong state law" like can spam

  7. Outlook Express by McGiraf · · Score: 3, Interesting

    Outlook express will re-copy its files next time explorer is started if you delete them.

    at $100,000 per violation that is $100,000 * the number of windows instalations out there, I think microsoft is going broke!

  8. Re:I see why you like that line by tehshen · · Score: 4, Interesting

    That is not a bad point, in general - if I write a program with a security vulnerability, and people use this vulnerability to install spyware on people's computers, do I share the blame with the spyware writers?

    --
    Guy asked me for a quarter for a cup of coffee. So I bit him.
  9. Phishing is already illegal by 77Punker · · Score: 3, Insightful

    Shouldn't phishing just fall under fraud?

  10. People outside the US? by nizo · · Score: 2, Insightful
    which imposes penalties of $100,000 per violation.

    Give half of that to bounty hunters who bring the culprit to justice and we could have a new series of reality shows. Who woulda thunk spyware could be entertaining?

  11. Class Action Lawsuit by benspikey · · Score: 3, Interesting

    Consumers and the state attorney general would be able to seek damages up to $500 per violation, or actual damages if phishers try to get consumers' information. Victimized Internet service providers could get $5,000 or actual damages. Judges could award an ISP three times the amount of fines if they so choose. Alright who wants to sign up with me.. We get 1000 systems download bonzibuddy and weatherbug and make a fortune. or at least have fun trying.. :)

  12. Re:I see why you like that line by masklinn · · Score: 3, Insightful

    As much as you'd share the blame if you were being robbed after leaving an open window.

    In some places, you'll be blamed harsher than the robber himself, in others the window matter won't, actually, matter.

    Oh, and your income matters, too

    --
    "The way we can tell it's C# instead of Haskell is because it's nine lines instead of two." -- wadler
  13. where are the teeth? by spamchang · · Score: 2, Interesting

    or dentures, at least, for this bill?

    i want to see people paying up the wazoo for this: collection agencies pounding down doors, spyware companies going belly up, class action suits, the like. hell, if they put filesharing on the same penalty level as involuntary manslaughter (because you know those two are equally evil in the eyes of MPAA/RIAA/congress), why don't they send spyware companies to bankruptcy? /annoyed

  14. All that needs to be done by doofusclam · · Score: 4, Insightful

    .. is to make companies accountable for the actions of their 'affiliates'. Many a spyware company uses this defence, and end up gaining customers from dodgy affiliates who they don't need to pay as the affiliate has broken the terms and conditions. Genius. Their business model is just like bill posting on roads and streets.

  15. Mod this bill redundant? by mr_Spook · · Score: 4, Interesting

    Okay, it might just be me, and I might just be an idiot here, but isn't spyware illegal already, since it's modifying the contents of my computer without my knowledge or authorization? To me, it seems that spyware makers should be prosecuted just like anyone else who writes malicious code (viruses, trojans, worms, and so on).

    Any technically-literate lawyers have a comment on this?

    1. Re:Mod this bill redundant? by zappepcs · · Score: 2, Interesting

      I think that any bill or law like this has all the teeth that the law against anal intercourse does in Texas. Its only used to prosecute those that the government and/or its most ardent lobbyists want to prosecute, at which point legal action is rammed through (so to speak) in a way that makes it very difficult for anyone to defend themselves should they be the target of this type of law.

      Any law that is practically unenforcable is only ever enacted in order to have it handy like a law against rats being in your garage, so its like a big baseball bat for when you think you see a rat in the corner of the garage.

      To me, this signifies that the lawmakers of Washington state, and their lobbyists are guilty of one of two things:

      Complete ignorance and ineptitude regarding the Internet and how it actually works
      - or -
      Collusion with certain parties in order to help those that they want to help and to hammer those they don't...

      Seeing as Redmond is in Washington state (duh) I can only image that the reason for this is to further the plans of Microsoft.

      just my thoughts...

  16. So now there's a law by RM6f9 · · Score: 2, Insightful

    The next steps will be legal definitions of what constitutes spyware, and refinements of those definitions based on cases brought to trial.

    How will they know who's doing spyware? Offer rewards to reports resulting in convictions.

    Of course, the thing might be struck down as unconstitutional depending on the breadth of definitions it starts with and the zeal of the ever-loathed ACLU in promoting the letter of the First Amendment to the detriment of the spirit of it.

    sigh.

    --
    Take the 90-Day Challenge! http://rwmurker.bodybyvi.com/
  17. That's just a bandaid on the problem. by pg110404 · · Score: 4, Insightful

    Some of the better places to go to get spyware are places in russia or developing countries, etc.

    The advantage and disadvantage of the internet is that you can go access web sites from anywhere.

    By making it tough for any group/organization to spread their malware from washington state, means they'll go elsewhere to host their stuff.

    Suppose all the spyware people jump ship and go elsewhere, somebody WILL find a site that has it and will get the spyware.

    It's like passing a law that makes it illegal to skid out of control and hitting a particular tree in the hopes of eliminating accidents.

  18. AOL's AIM by yrogerg · · Score: 4, Interesting

    Have you ever tried installing AIM from AOL? It install links everywhere regardless of if you tell it 'no' in the setup process. Maybe they'll finally change this.

    1. Re:AOL's AIM by mindstrm · · Score: 2, Insightful

      From what I've seen, mac users have higher standards. Unlike the bulk of windows users, mac users tend to know with confidence how their computers are supposed to behave.. and anything that messes with that doesn't have much chance of gaining a foothold in the market.

  19. Re:Realplayer now illegal? hopefully by Chris+Burke · · Score: 4, Insightful

    How would they feel if I came into their front room and took over the remote control?

    The same way a Mafia racketeer would feel if you threatened to burn their house down if they didn't pay for your "fire insurance".

    They aren't children; they know people hate what they do. As long as the annoying thing is happening to you for the profit of them, then they don't care, whether "they" are the Mafia or Gator or whoever.

    --

    The enemies of Democracy are
  20. maybe the religous fundies should promote this law by hurfy · · Score: 3, Insightful

    ""Opening multiple, sequential, stand-alone advertisements in the owner or operator's internet browser"

    hehe no free porn for Washington :)

    We know what at least one state congresscritter is up to...

    Sounds all warm and fuzzy but actually doing anything is doubtful...at least til califonia catches up.

    I believe you cant make automated telesales calls here but several computers havent read THAT law either :(

  21. Alexa by HermanAB · · Score: 4, Insightful

    So, will MS finally stop shipping Alexa with IE?

    --
    Oh well, what the hell...
  22. Re:Remember when SPAM was outlawed? by Rick+the+Red · · Score: 3, Informative

    Remember, the CAN-SPAM act revoked all the state's anti-spam laws, including Washington's. I'm a Washington resident and my inbox has more spam than ever since CAN-SPAM passed. "CAN-SPAM" indeed, now they sure can, and with the government's blessing!

    --
    If all this should have a reason, we would be the last to know.
  23. Huge Loophole, Crappy Bill by Erris · · Score: 3, Informative
    Of course M$ loves this one. Check out this wopping loophole:

    These prohibitions do not apply to any monitoring of a subscriber's internet service by a telecommunications carrier, cable operator, computer hardware or software provider, or provider of information service for network or computer security purposes.

    So, when M$ looks at and deletes your files for supposed copyright violations, that's a "security" issue and they are OK. It does not matter that they have all of the other definitions of spyware and are much more invasive, they are a "software provider" doing it for "security".

    The definition is so broad that it's hard to imagine who is not a "software provider" doing something for "security". Oh wait, now I know, anyone Microsoft does not like is not a "software provider".

    A real spyware law would spank M$, HP and many other "software providers" for all the things this bill legitimately complains about and then allows.

    --
    DMCA, Hollings, Palladium. What might have sounded like paranoia is now common sense.
  24. Too bad it'll never bite the **AA by SocialEngineer · · Score: 3, Interesting

    Considering their actions (through contraction of Overpeer) to smuggle spyware in through windows media files..

    --
    "Better to be vulgar than non-existent" -Bev Henson
  25. Re:Realplayer now illegal? hopefully by plover · · Score: 5, Interesting
    Try removing HP printer "drivers" some time, or "desktop helpers" that come with video cards, sound cards, TV tuner cards, MP3 players, Bluetooth dongles, printers, scanners, faxes, cameras or any other peripheral your PC may have seen on a TV commercial.

    As far as I'm concerned, start arresting them all. I don't want their sh!tware on my box. I want their stuff to sit there nice and quiet up until the moment I want it to do something, and then I want it to do nothing extra. I don't want a pop-up "toolbox" to fix my printer; I don't want a noisy "Lookie what I printed for you, John, aren't you proud of my wonderous inkjets?!" dialog box. And when it's done I want it to get the hell out of my way. Completely. Don't ask me to update, don't leave a tool tray icon behind, don't leave a task running in task manager.

    If all this requires sending a few developers to Federal Pound Me In The Ass Prison, all I can say is "don't drop the soap, guys."

    --
    John
  26. more jobs lost by kingjosh · · Score: 2, Funny

    So now they'll have to outsource spyware writers to third world countries? AND move the company's there?

  27. Re:I see why you like that line by MBCook · · Score: 4, Insightful
    Good question, I think so.

    But... MS is one of the largest employers in the state. Their employees are highly paid. Those employees spend money, buy expensive houses, etc. Microsoft builds buildings, buys land, and supports the arts and such. And lets not forget all the computers and software that they donate/discout for the state and it's schools.

    Washington state will not piss off Microsoft. It is a fact. When those state AGs sued because they didn't like the settlement the DOJ did with Microsoft, was the Washington State AG among them? Why do you think that was?

    MS is behind this law because if it works, it removes some (much?) of their responsibility (and also codifies in law that spyware is the programmer's fault, and doesn't specify it to be MS's fault). If the law said that, do you think it would have gotten a vote, let alone pass?

    Things like this happen. At least it is a win for the consumer if it works, even if MS still isn't held accountable. All us geeks can do is answer questions from friends truthfully. "What's with/causes/why is there so much spyware?"... "Microsoft." Grass roots will work, we just need it to be organized. But then again we need to do that with lots of things (accepting buggy software, the release-then-patch mantra, overpriced software, etc.)

    --
    Comment forecast: Bits of genius surrounded by a sea of mediocrity.
  28. Real Player by m00nun1t · · Score: 4, Interesting

    Like many others, I consider Real Player to essentially be spyware.

    I think (correct me if I'm wrong) that Real are based in Washington State. So what's the impact here, for both current and future versions of Real Player? Would make an interesting test case.

  29. Re:The Search For Credible Evidence Continues. by c0d3h4x0r · · Score: 2, Interesting

    I imagine this won't put to rest the rumors of spyware in their recent players

    That's because you're misunderstanding the "rumors" (which are not rumors, but facts, by the way). The problem is that Real's software (maybe not the very latest version, I haven't tried it, but for relatively recent versions this is certainly true) IS spyware in and of itself, because it (1) deceives users into installing stuff or signing up for stuff they didn't want or expect to be signed up for, (2) deeply integrates itself into the system in a variety of unwanted ways, and (3) makes itself almost impossible to cleanly and completely uninstall.

    --
    Moderator hint: a comment is neither "Flamebait" nor "Troll" if it is true.
  30. Re:Realplayer now illegal? hopefully by crabpeople · · Score: 2, Insightful
    "I don't want a pop-up "toolbox" to fix my printer; I don't want a noisy "Lookie what I printed for you, John, aren't you proud of my wonderous inkjets?!" dialog box."


    well you could not install those "features". Most driver cd/downloads have their drivers tucked in a directory some where. Especially true with driver updates you download from the manufacture's website. So yeah, you installed all that crap, you live with it. When i install an epson or an HP i just point add printer wizard at the driver dir. I have found very few peripherals to not have some kind of "manual install".

    I would also add that the more expensive the hardware, the more likely it wont have badly coded drivers/software. This is why its better to buy quality peripherals rather than cheap "no name chinese company" stuff.

    --
    I'll just use my special getting high powers one more time...
  31. Re:Realplayer now illegal? hopefully by Rorschach1 · · Score: 4, Funny
    ...or any other peripheral your PC may have seen on a TV commercial

    This is exactly why I don't let my PC watch TV.

  32. Silently installing DRM enforcing programs? by emarkp · · Score: 3, Interesting
    Hmm.. Recently I played Splinter Cell: Chaos Theory, which installed StarForce without my knowledge or consent--and which doesn't uninstall ever unless I download the uninstall tool.

    Would this violate this law? I think it should. I wish I'd known about the StarForce installation--I wouldn't have bought the game.

  33. Copy Protected CD's by complete+loony · · Score: 4, Interesting

    And the driver that copy protected CD's install without your permission to prevent the tracks from being ripped? I had to clean up one of these last week while I was ripping music for my father in law's new iPOD....

    --
    09F91102 no, 455FE104 nope, F190A1E8 uh-uh, 7A5F8A09 that's not it, C87294CE no. Ah! 452F6E403CDF10714E41DFAA257D313F.
  34. Goodbye Copy Protected CDs by shogun · · Score: 4, Insightful

    Won't this ban some of those 'copy-protected' CDs that automaticaly install some kind of driver through auto-run?

  35. Great and everything... by Zach978 · · Score: 2, Interesting

    I like it, but I don't like legislators getting used to writing bills dealing with the Internet...

    They get their foot in the door and we might be in trouble...

    --

    "I told you a million times not to exaggerate!"
  36. Exercise in futility by Argon+Sloth · · Score: 2, Insightful

    Well it probably seemed like a good idea at the time. But I have the feeling this will be difficult to enforce, with the exception of cases involving untrusting spouses. It's like outlawing rain. Or declaring war on Algebra. It looks good on paper, but seems entirely unfeasible.

    --
    Laziness is a virtue, anyone who bothers to tell you otherwise, is clearly lacking it.
  37. Re:$100,000 is a bit excessive by humankind · · Score: 2, Insightful

    It's not excessive in my opinion. Small fines are what nullified the effectiveness of many previous anti-spam, anti-virus laws.

    There has to be a substantive risk on the part of the perpetrator to dissuade him from producing the spyware, and there also needs to be suitable incentive to pursue legal action. Small fines aren't worth anything because you can't find a lawyer who would take the case.

  38. Enforcement? by Chris+Burke · · Score: 2, Interesting

    Off topic, but tangentially related: Austin, TX recently passed a city-wide smoking ban. On the news a couple nights later, the anchorwoman said: "With Austin's voter-approved smoking ban coming into effect soon, people are asking how it will be enforced."

    Oh, I'm so glad they thought to ask about that tiny, niggling issue of enforcement after voting for it.

    And you're right, enforcement is going to be a big issue here. How many spywhores are operating in Washington? How many are operating in the U.S.? When enforcement gets difficult, then enforcement gets selective. The question always is: who is going to do the selecting? That becomes the deciding factor in what the impact of the law will actually be. If it is Microsoft, woe be unto us.

    --

    The enemies of Democracy are
  39. Mod Parent Up by Rocketship+Underpant · · Score: 3, Interesting

    The parent makes a very good point. A lot of sleazy Digital Restrictions Management software uses spyware and malware tactics to control your computer. After all, it can't work without restricting your use of your own system to some degree.

    Can Washingtonians now sue record labels that use malware to prevent CD copying? That would be a terrific step towards ending such nonsense.

    --
    He who lights his taper at mine, receives light without darkening me.
  40. Section 5 pretty much invalidates the whole bill by billstewart · · Score: 2, Interesting
    • 1 - Definitions
    • 2 - Intentionally deceptive evil things banned,
    • 3 - Illegal to transmit software that takes control of computer or changes security-critical settings,
    • 4 - Illegal to deceptively induce owner/operator to install software for security/privacy/viewing, or to execute software that installs software.
    • 5 - Covers the ass of ISPs, carriers, hardware and software vendors, service providers, etc. installing, monitoring, managing, or upgrading things or detecting illegal use of networks, services, or software.
    • 6 - Penalties
    • 7,8,9,10 - Legal technicalities and boilerplate.
    Section 5 is directly intended to protect people like anti-virus companies updating their products, Microsoft doing operating system updates, Digital-Rights-Management software companies running licensing spyware, ISPs doing security stuff, etc. Real Networks appears to be pretty thoroughly protected here. But just about anybody selling software is protected, even if it's ueber-blatant spyware, as long as they don't falsely claim that they're the *only* way to view some kind of material when they're not. And the bill makes the classic passive-voice mistake of referring to "authorized" updates and "authorized" remote system management without saying *who's* authorizing it to do *what* to whom. So my software company, Evil-Ware Incorporated, authorizes anybody to install our product on their computers and use it to update their browsers, and we'll be monitoring your machine to make sure you're not using it in ways that violate the 347 pages of fine-print licensing terms that you agreed to when you clicked the "Yes!" button, including Page 157 where you agree that you've read the whole thing and understand it.

    It's probably impossible to write a good anti-spyware bill. Not only are legislators and their staffs not skilled enough to recognize the subtleties, but they're under pressure from major manufacturers not to interfere with various software or content licensing products, which are essentially legitimate spyware. Furthermore, it's extremely difficult to draw subtle legal distinctions between edge cases (with a $100K penalty for the loser) when the legislators aren't smart enough to apply the equivalent of the "I know it when I see it" obscenity test. Think about the differences between an email message or web page containing

    • a 1x1 transparent GIF HTML tag (obviously a web bug) sent by someone evil,
    • same web bug sent by the listbot for a mailing list you intentionally subscribe to,
    • an HTML IMG URL that also displays an ad for the usual canned-spiced-meat products,
    • an HTML IMG URL that displays the logo of some advertiser or author but isn't tracked and doesn't have the recipient's address or other identifier,
    • the same IMG with a URL that does have a query identifying the addressee,
    • the same IMG with a URL that is tracked but doesn't identify the addressee,
    • the same IMG with a URL that doesn't directly identify the addressess but could be indirectly used to do so if somebody queried the web server logs and correlated them with other databases,
    • any of the above, where the image says "Click Here for More Info"
    • any of the above, where the image says "Click Here To Be Removed",
    • animated singing-dancing humorous video image from some streaming-video provider that tracks recipients by IP/cookies/etc. that you requested
    • same video that your Mom forwarded because she thought it was funny when one of her AOL buddies sent it to her,
    • same video, sent by spammer who gets paid by the number of people who watch it
    • etc. etc. etc. - You can think of dozens more subtly different cases, but you're reading Slashdot, so you're almost certainly more technical than 99% of your legislators and 95% of their staff people.
    --

    Bill Stewart
    New Fast-Compression-only CPR http://preview.tinyurl.com/dy575ks
  41. How about an industry-wide prosecution orgy? by quag7 · · Score: 2, Interesting

    Like many here, I think this law will do a whole lot of nothing.

    But as for the comments about Windows and its security holes, and how we should blame Microsoft, I don't agree with this either.

    I don't think criminals who break into your house shouldn't be blamed because lockmakers, doormakers, or windowmakers (no relation) should have made their wares of sturdier materials.

    People use Windows out of momentum and because they feel they have no choice. Microsoft would clean up its act if consumers forced them to by using other products. A variety of circumstances have largely prevented this from happening.

    Mac users have felt that their experience has been better for many years, and have often wondered why anyone would choose a PC over a Mac - especially now with OS X which, they say, rocks harder than a llama with a chaingun and free calzones.

    I have seen people complain about the smallest changes on their systems, including point upgrades to browsers or MSOE upgrades.

    People aren't down with change, especially on things they think of as complicated devices. Those of us who read Slashdot are, I am sure, far more flexible and adventurous in this regard, but I don't think we in anyway represent consumers as a whole.

    Microsoft could probably commit genocide, and people would still use Windows. They could declare themselves as a nuclear power in Redmond, and people still would use their products. Not because they are the best (a minority use them for this reason, but not, I think, most people), but because it is what they are used to, and have become used to and really don't want to learn something new, along with its attendant frustrations, hassles, and time commitment.

    People use Windows because they would rather eat glass than have to re-learn a new interface or OS, because, for many, computers are a sad fact of life, as opposed to a fulfilling hobby or something they would choose to spend time using.

    That being said, spyware authors are degenerates, and deserve, basically, what they get.

    But here's an idea.

    Corporations do not ordinarily prosecute virus writers, phishers, spyware authors, and people who crack their systems for a variety of reasons. One is the cost, and two is the embarassment of being compromised.

    What if all of the major corporations and banks secretly decided to do a collectively lodge a wave of lawsuits all over the world. Coordinate with governments abroad and just do a year of scorched earth prosecutions of these folks, and promise to follow up with regular "waves" of prosecution, but not say when. In the intervening time, companies would be free to prosecute or not prosecute (or sue) who they like, but they would agree at regular intervals to time their lawsuits to make a massive public statement that they and their customers are sick of putting up with this crap.

    This would probably go further as a deterrent since clearly laws and civil suits as they are undertaken now, have not had much effect.

    Countries can bring economic pressure to bear on other countries which, mainly through lack of resources I imagine, do not prioritize investigating and prosecuting computer crimes.

    Imagine if you rattled the cages of these degenerates in a way that produced not only actual prosecutions, but revenue to follow up with more waves at unannounced rituals? That might have a deterrent effect.

    Of course, the question of whether you like the idea of governments exercising their power this way, is certainly valid.

    I do not like government. I wish we did not need it at all. I am not so convinced however that since we have it, that the government should do nothing whatsoever when it comes to these kinds of crimes. These crimes have considerable consequences for many, not the least of which is the erosion of confidence in the internet in general as a valid medium of economic, intellectual, and cultural exchange.

    Try as I might, I cannot think of a reason why vandals

  42. bill may be unconstitutional by arbitraryaardvark · · Score: 2, Interesting

    Since the software has no way of knowing what state it's being installed in, this is like if your town council tried to regulate, or ban, the internet.
    Earlier this week the Supreme Court held that regulations interfering with out of state wine sales violated the constitution's dormant commerce clause. There have been half a dozen cases, e.g. ALA v Pataki, that say states can't regulate online smut, on commerce grounds.
    A person charged under this bill could sue the county/city where he was charged, for violating his civil rights to commerce.
    So the bill may just be a bluff.
    Has anybody who is literate as to both spyware and legislation evaluated this to see if it hits the target? Does it ban spyware, and just spyware, or are there legitimate apps that would into trouble with this?

    1. Re:bill may be unconstitutional by digitalunity · · Score: 2, Informative

      Since the software has no way of knowing what state it's being installed in, this is like if your town council tried to regulate, or ban, the internet.

      Not true. It is possible for software to determine it's own locality if it is connected to the internet, which is how most spyware gets installed in the first place. Although it is not 100% accurate, it is close enough that they could say they made every effort.

      A person charged under this bill could sue the county/city where he was charged, for violating his civil rights to commerce. So the bill may just be a bluff.

      I don't know where you got that but that is just plain wrong. The bill does not contain any language excluding or preferring any State's software over another. This bill does not care where the software came from, but it does apply to computers in this state. In general, you cannot sue one locality for the laws in another locality, you must sue the locality you are claiming has done you harm. It is called 'jurisdiction'. For them to even come close, they would have to sue the state of Washington itself and claim the burden this places on their business is greater than the burden it places on a company in this state. BTW, that is highly unlikely to happen.

      And, to your last question: Yes, there is some broad language in it that might cause problems for shady companies selling legitimate software with adverse/unintended side effects. I think overall, this new law really comes closer to anything I expected to come out my home state.

      --
      You can't legislate goodness. Let each to his own destiny, by will of his freely made choices.
  43. valuable legal principle - accountability by heretic108 · · Score: 4, Insightful
    From this Bill it seems that an important legal principle is being established - when code written by Alice runs on Bob's computer, then Alice has the same accountability for her (code's) actions that she would have if she were physically allowed into Bob's home or office.

    If Alice was an interior decorator who, on gaining access to a client's home, did stuff like:
    • Changed all the speed-dial numbers on the telephone
    • Installed listening/recording devices in all the rooms
    • Modified the TV/video so it overlays ads of her choice over the top of programs (in addition to the regular ads screened by the station)
    • Duplicated door keys and alarm codes and sold these to others
    • etc
    then Alice would be doing hard time at Club Fed or Her Majesty's.

    So why should it be any different with software?

    When someone runs your software on their computer, they have admitted you into their sovereign private space, and you have a responsibility to behave in a manner respecting this. Well done, Washington. I note also that the Australian Democrats party has introduced similar legislation, which God-willing will also pass.
    --
    -- In the beginning was the WORD, and the WORD was UNSIGNED, and the main(){} was without form and void...
  44. Phishing as Fraud vs. Attempted Fraud by billstewart · · Score: 2, Interesting
    When the phisher sends you email saying "Get a Great Credit Card / Mortgate Today - Send me all your information!" it's not fraud unless you actually give them your info and they use it to rip off you (or some bank, etc.) It is spam, and you'd like it to go away. And it's easier to prove that somebody broke a phishing law than to get your money back.

    "This is EBay/PayPal/SomeRealBank/eGold/etc. - Give me all your info", that's lightweight no-money-stolen fraud, unless you give them your info and they use it, in which case it's bigger fraud. The smaller fraud isn't typically worth the effort of the police to track down. EBay/SomeRealBank/EGold could go after them for trademark infringement or something, but you've probably noticed that eBay/PayPal and most banks haven't even bothered to use SPF on their domain names to make it easy for your mail server to discard mail, so that tells you how much *they* care. (SPF's not perfect, but it's a start.) If they steal small amounts of money from you, depending on your state's thresholds, it's still petty enough that the police are not likely to bother with it, and they'll probably find that it's interstate commerce, so it's the Feds' problem to deal with it, and it's almost certainly too small for them to bother with either.

    Adding Phishing as a separate crime raises the potential penalties enough that the state police might find it worthwhile to go after a phisher just for sending out the email, if there's a $100K fine or a $100/message fine times a million messages or whatever. In reality, of course, it's almost certainly an interstate crime or an international crime, but at least Washington State gets to spank Washington-based phishers even if they can't extradict someone from Florida or Russia, and they're more likely to be able to extradict them if there's a felony with a $100m potential fine than if there's a misdemeanor with 30 days in jail.

    And like it or not, police do prioritize crime-fighting effort based on dead bodies and violence, big amounts of money, political-correctness crimes like drugs, or things that bring revenue to their departments (like traffic tickets). That's not all bad - unless the legislature tells them something is a real priority by attaching lots of money to it, they're going to ignore that spam you're receiving and spend their time worrying about any recent murders and rapes, responding to complaints about street-fights and maybe domestic violence, give out $200 tickets to people with burned-out taillights, and *maybe* deal with stolen cars and laptops, though the probability of success of those two is low enough it doesn't get much effort unless they're busting a suspected fence anyway. If you lost $1000 to a phisher, and you're a grandmother, they'll feel sorry for you, and if you're a yuppie they'll laugh at you after you leave the room. If you're a *bank*, and 500 of your customers have lost $1000, then that's enough that they'll be interested, and anti-phishing laws make it easier to get evidence to catch the successful phishers and stomp on some of the riff-raff along the way.

    --

    Bill Stewart
    New Fast-Compression-only CPR http://preview.tinyurl.com/dy575ks
  45. Re:How will they enforce these laws? by i.r.id10t · · Score: 2, Insightful

    Gee, sorta a lot like the gun control laws that were being passed daily from the mid 80s on...

    --
    Don't blame me, I voted for Kodos
  46. That does it. by Zillatron · · Score: 2, Funny
    I will now change my registration information information for the things that won't operate without registration to:
    • DOB: 1901-01-01
    • Gender: F
    • Income: Under $X,XXX
    • Children: 0.3
    • e-mail: not@today.con
    • Address: 123 Main, Anywheresville, WA 99999

    I'm just not worth your time to try marketing to me. Even on legit registration they get my area code followed by 555-1212. I'm listed. Look me up.

  47. fragile wording = fragile protection by NetSettler · · Score: 2, Informative

    The summary of this bill here at Slashdot seems to suggest it outlaws keystroke logging, but in fact it's a bit more specific and talks about transmitting, etc. Still, one thing that disturbs me is fragile wording like:

    (a) Through the use of a keystroke-logging function that records all keystrokes made by an owner or operator and transfers that information from the computer to another person;

    It looks to me like if you just skip recording characters every now and then, you're safe on that point. Or if you transferred the data first to another computer and then maybe a person or program or corporation or someone's dog picked up the data instead of having it transferred to them.

    It probably needs at least some wording like "substantially all" instead of "all", and "entity" instead of "person".

    I doubt this is the only problem with the legislation, it was just the first thing I saw when I spot-checked that one sentence.

    --

    Kent M Pitman
    Philosopher, Technologist, Writer

  48. Re:Realplayer now illegal? hopefully by plover · · Score: 2, Interesting
    -5, wrong. But thank you for playing Slashdot.

    HP has been the poster child for how to install crap the wrong way in Windows.

    Set the wayback machine for the late 1990s. I bought a fast, expensive HP inkjet. When I got my brand new printer home and tried to "install" it, the "installer" wanted me to run their stuff. Having had prior experience with HP crapware, I said "no thanks, I'll install it myself." So I clicked up the add hardware lizard, and said "I'll for search myself, and I have a disk, thank you." When I selected the correct HP driver, only a dialog box appeared, informing me "ERROR: You must run SETUP.EXE from this disk in order to install the printer driver."

    Yes, I'm sure I could have un-cabbed whatever real driver files there were, made dozens of appropriately arcane registry entries by hand, and had a mostly unstable printer driver at the end of a very long day. Instead, I opted to run their SETUP.EXE.

    I failed to recognize my real mistake was in not bringing the piece of sh!t printer back to the store on the spot.

    So, I lived with the pop-up printer boxes that interfered with Print Managers inherent ability to deal with an out-of-paper situation all by itself. I learned to cancel the toolbox, load the paper, don't cancel the print job, and basically twirl myself around. (That's what it's all about.)

    Well, fast forward to two years ago. Stupid me, I plunked down more money for a portable HP photo printer. Ye gods, I'm still plucking crap out of the registry today for that stupid decision. So, I vowed to never purchase HP again.

    Having had generally good experiences with IBM printers at work, about a year ago I switched to a Lexmark all-in-one.

    Yes, the quicker of you have already begun typing "you dumb *&^%$" into the reply box.

    This pop-up nuisance makes my HP experience seem almost divine. By default it's got to use a digitized voice to talk to me about every print job (better have the speakers turned down for those 2:00 AM print tasks.) It clutters up the toolbars, and the task manager. Right now, I can count at least four running tasks that exist so I can do what, ask it for a piece of black and white paper? What heinous fiend sold Lexmark (and by extension me) this crapware? And what prison can I not visit him in?

    --
    John
  49. This is absolutely mindless by TractorBarry · · Score: 2, Insightful

    This is moronic !

    So we have a flawed operating system that doesn't give the user (when in Administrator mode) the required tools to remove software from their o/s. It also makes it trivially easy for malicious third parties to install software on the o/s.

    And the answer is to pass legislation to try to prevent said operating system being exploited ?

    This is completely Mindless. It's like letting a colony of wasps build a nest in your bedroom then treating each individual sting without ever looking at the nest.

    Mindless I say... What they should have done is pass a law telling MS to fix their fucking rotten o/s. That MIGHT have done some good.

    --
    Sky subscribers are morons. They pay to be advertised at !
  50. No relief for oe, ie and wmp? by sl4shd0rk · · Score: 2, Interesting

    "Computer software" means a sequence of instructions written in any programming language that is executed on a computer. "Computer software" does not include computer software that is a web page, or are data components of web pages that are not executable independently of the web page.

    ----

    Seems to me they are classing the "spyware" or "Computer Software" independantly of anything you can catch online - with outlook, ie or media player. wtf?

    --
    Join the Slashcott! Feb 10 thru Feb 17!
  51. Re:I see why you like that line by CaptRC · · Score: 2, Interesting

    I don't agree that you should be held accountable for writting poor code, riddled with vulnerabilities. If your app works, then so beit. Accountability falls square on the person with "malicous intent" and nobody else. I have been stricken and subsequently resolved a Browser Hijack recently. And yes, I've switched to FF over IE-6 as a result. But I would not consider Willie G's people at fault for wasting two hours of my life... For that I blame who ever it is that wrote the hijack and to a much lesser extent myself for leaving the doors un-locked. just my 2-cents. Thanks, RG

  52. Re:Realplayer now illegal? hopefully by fbjon · · Score: 2

    Fantastic, just what I need. Blackviper.com is well and alive in the Webarchive.

    --
    True confidence comes not from realising you are as good as your peers, but that your peers are as bad as you are.