Spyware Creates Legislative Nightmare

After taking on spam, state and federal lawmakers are tackling the next technology-related pestilence: spyware. The software is downloaded onto unsuspecting users’ computers, in some case, triggering a barrage of ads.

Last week, two California anti-spyware bills won committee approval, and similar legislation is on the table in Iowa and Virginia. Meanwhile, Utah recently became the first state to pass such a law, which is due to take effect this month.

At the federal level, House Energy and Commerce Committee chairman Joe Barton, R-Texas, promised swift action at an anti-spyware hearing on April 29. Most of the legislation under consideration would require notice and consent before software could be added to computers.

As its name suggests, spyware in its extreme form can track and gather users’ whereabouts and keystrokes while online. But the word has been applied to everything from advertising applications to Web cookies.

“Spyware is a broad term,” conceded Ari Schwartz, an associate director at the Center for Democracy and Technology in Washington, D.C. “We tend to think of it as something that users don’t want, or is doing something that users don’t want it to do, or they can’t get rid of.”

The definitions for spyware vary as greatly as the suggested solutions. The Federal Trade Commission, for instance, recommends handling the problem “case by case” with existing anti-fraud laws. “I think we are well-equipped to deal with the unscrupulous behavior with our existing prohibitions on unfair and deceptive practices,” said Howard Beales, director of the Bureau of Consumer Protection at the FTC. “The difficulty is drawing the line that makes a clear distinction between spyware that’s a problem, and legitimate and beneficial software, which you don’t want to restrict in quite the same ways.”

Some fear the legislation, particularly the Utah law, may be too broad. The challenge is crafting language that effectively addresses the spyware issue without burdening legitimate software developers or unintentionally hindering innovation, Schwartz said.

Wrongfully or rightfully, adware providers such as WhenU, Claria Corp. and 180 Solutions are often lumped in the spyware category. The companies’ ad-supported software allows for free applications, such as peer-to-peer networks, desktop toolbars and screensavers.

“There are white hats, and there are black hats,” said Nate Elliott, an analyst at New York-based Jupiter Research, explaining that some do a better job at disclosing their practices and giving consumers control. “They have very different strategies, very different practices, and you can’t put them all in the same bucket.”