House Continues Anti-Spyware Push

Internet.com ^ | 3/9/05 | By Roy Mark

[Bloody Sam Roberts]

The U.S. House Energy and Commerce Committee unanimously approved its fast-track anti-spyware legislation today, pushing the bill out for a full House vote. But not before amending its language. Again.

At a January hearing on the legislation, several lawmakers, who otherwise strongly supported H.R. 29, the Securely Protect Yourself Against Cyber Trespass Act (SPY ACT), raised concerns that the bill would unintentionally target third-party cookies.

During a subcommittee vote last month, the House amended the SPY ACT in an attempt to exempt all types of cookies.

And before voting on the legislation on Wednesday, the committee further amended it to exempt HTML and Web beacons, which facilitate normal Web page construction. In addition, the bill exempts embedded advertising from the proscribed list of practices requiring notice and consent.

Although he voted for the bill, Commerce Committee ranking member John Dingell (D-Mich.) acknowledged that there are still issues with it.

"This [amendment] makes clear that cookies are not covered. But not all cookies are benign, and we may be creating dangerous loopholes."

Chairman Joe Barton (R-Tex.) said he hopes to have the legislation on President Bush's desk by the end of the year.

"By acting quickly, we will put considerable pressure on the Senate to act this year," Barton said.

The SPY ACT prohibits unfair or deceptive practices related to spyware, and it requires an opt-in notice and consent regime for legal software that collects personally identifiable information from consumers.

The spyware practices specifically targeted by the legislation include phishing, keystroke logging, homepage hijacking and ads that can't be closed except by shutting down a computer. Violators could face civil penalties of up to $3 million.

First-party cookies are placed from the same domain the user clicks on and are solely used to allow the user to access a Web site, most typically by allowing the site to remember a user name and password. Advertisers, publishers and their service providers use third-party cookies to serve, rotate, target, cap, measure and report on online advertising.

In the 108th Congress that concluded in November, the House passed two anti-spyware measures, but the legislation died when the Senate declined to consider the bills.

Originally introduced by Rep. Mary Bono (R-Calif.), the bill also exempts network monitoring from the provisions of the notice and consent requirements to the extent that the monitoring is for network or security purposes, diagnostics, technical support or repair, or the detection or prevention of fraudulent activities.

The Business Software Alliance, Dell, eBay, Time Warner, Yahoo and EarthLink have all endorsed the legislation.

[Drango]

After their last push in '04 SPAM went up and up.

[Disambiguator]

They should just legislate that web browsers have tighter security settings "out of the box".

[ShadowAce]

Tech Ping

[InterceptPoint]

As much as I hate Spyware I always worry about the Law of Unintended Consequences that apply to almost everything that Congress does but is most severe when they tackle technical issues that are way beyond their understanding.

[brownsfan]

"They should just legislate that web browsers have tighter security settings "out of the box"."

I disagree. Your table saw comes with a blade guard, it's up to you if you install or use it. As long as the settings are there, it's up to the user to implement them.
This is easier than they are making it. Just make it illegal to install an active program, or something that changes hosts/routes without expressed, informed consent of the user. Now, how do you do this? Require a seperate, unique dialog box that informs the user. Make it red with black x's or something so that the user is aware. If you still want to allow spyware on your computer in exchange for the little smiley faces.... ok.
Tough to make a law that will make stupid people smart.

[elbucko]

Congress... when they tackle technical issues that are way beyond their understanding.

Exactly. They should limit their regulation making to golf. Ball exempted. They would screw that up and make it a cube.

[The Electrician]

It's dangerous to have congressional know-nothings such as Dingell legislate in an area where they have so little understanding, because of the potential to stifle legitimate technical innovation as an unintended side effect. It's even more dangerous to have large corporate interests such as the ones identified in the article endorsing potentially flawed legislation.

Unfortunately where this is eventually headed will probably be a "secure" Internet that will remove all possibility of anonymous usage, thus giving people who have totalitarian tendencies the control that such tyrants have only dreamed of in the past. The criminals will find ways to keep on being criminals, while law-abiding people will bear the brunt of intrusions into their privacy and freedom.

[Disambiguator]

I should have posted a sarcasm tag. I'm always skeptical when legislators tackle technical issues. Although to be fair, I believe the resolution to the spyware problem will be a combination of legislation and technology.