Policy experts split on spyware laws
603232
(InfoWorld) - CAMBRIDGE, Mass. -- Two of the agencies most actively involved in bringing cyber-criminals to justice in the United States have expressed opposing opinions over pending anti-spyware legislation. Even as a trio of spyware bills is moving forward on Capitol Hill, officials from the Center for Democracy and Technology (CDT) and the Federal Trade Commission (FTC) said their two organizations have differing views on the need for passage of the proposed laws. At a forum sponsored by the Anti-Spyware Coalition and held here at Harvard Law School on June 27, officials from the FTC and CDT -- a Washington-based nonprofit that has become a prominent Internet policy watchdog -- detailed areas where their organizations diverge regarding Congressional anti-spyware bills. The Anti-Spyware Coalition -- a security consortium backed by industry players including AOL, Dell, Google, McAfee, Microsoft, and Yahoo -- hosted the panel that brought legal experts from the two organizations together to air their differences. The discussion was hosted by John Palfrey, executive director of the Berkman Center for Internet and Society at Harvard Law, a well-known expert in the field of Internet security and privacy issues The three pieces of legislation being debated were the Internet Spyware Prevention Act of 2007 (I-SPY Act) and Securely Protect Yourself Against Cyber Trespass Act (SPY ACT) -- both of which passed vote in the U.S. House of Representatives in May and remain up for debate in the Senate -- and the Counter Spy Act of 2007, introduced before the Senate in mid-June. While both the FTC and CDT are actively involved in attempts to bring suspected purveyors of spyware to court and stop them from distributing illegal code to end-users, the agencies appear to be divided over whether the new laws will result in more prosecutions. The CDT supports passage of all three proposed bills, claiming that any additional laws that increase civil and criminal penalties against spyware brokers and better define illegal practices will prove helpful in bringing new cases -- despite the group's recognition of flaws in all three bills. For its part, the FTC contends that the new laws may only serve to muddle its ability to go after cyber-criminals when it finds them. In outlining each of the bills for the assembled audience, CDT Deputy Director Ari Schwartz highlighted the group's hopes for each of the measures. The I-SPY Act is the least controversial of the three bills in that it merely seeks to extend penalties established in the Computer Fraud and Abuse Act -- originally passed in 1986 -- and make the legal punishments for criminal hacking more severe. The CDT is fully behind the bill and it passed through House hearings with almost no opposition, proving its overall appeal, Schwartz said. The SPY ACT -- originally written by California Republican Rep. Mary Bono and passed by the House in previous sessions -- has proven more divisive; some businesses are expressing serious concerns about the proposal's limitations on consumer information gathering and the fact that the bill would supersede existing state anti-spyware laws. Even though the CDT is against the idea of undercutting existing state laws, the group still supports the measure as it raises penalties on some criminal cyber-crimes and directly addresses troublesome spyware affiliate distribution issues, said Schwartz. The Counter Spy Act was only recently re-introduced by Arkansas Democratic Sen. Mark Pryor. Previous backers of the bill were voted out of Congress last year, making chances slim that the legislation will move forward quickly. However, the CDT favors the bill's effort to more clearly define the parameters of illegal adware programs, said Schwartz. Issues over the weighting of state and federal anti-spyware measures shouldn't stand in the way of the proposed bills, whose benefits outweigh their loopholes and could help lead to more cases against cyber-criminals, the CDT leader contends. He cited the relatively light punishment handed out in cases brought against proven spyware brokers such as DirectRevenue and Zango as proof that existing laws are insufficient. "Raising penalties is useful, DirectRevenue should have been fined more than $5 million, Zango should have been fined more than $3 million, and they would have been if we had more direct penalties," Schwartz said. "Most people are supportive of these bills, CDT would be happy with raising penalties without pre-empting the states, but most companies looking at these bills are pushing for pre-emption." On the flip side, the FTC feels that existing laws provide it with sufficient power to go after spyware providers, even though the agency has only filed a dozen such suits in recent years. Tracy Shapiro, an attorney for the FTC's Advertising Practices Division, said the federal watchdog would like to see legislation that increases civil penalties against cyber-criminals, but it feels that the new bills could eventually get in its way in bringing accused spyware companies to trial. The Computer Fraud and Abuse Act remains broad enough to provide for continued prosecution of the most significant offenders, including spyware providers, she said. "In general there doesn't need to be a law specifically outlining spyware. There's a danger in saying 'no keystroke logging' because that's too specific and someone might look at the law and say another practice is OK," said Shapiro. "Sometimes it's hard to craft legislation to address specific types of technologies; it seems like a good argument against new laws if we can get judgments already." In addition to the potential to create loopholes by limiting their scope to existing threats, the specific nature of the bills could make them hard to apply to similar threats carried out in the future on mobile devices, as opposed to today's PC-based spyware schemes, she said. On the flip side, Schwartz said the CDT has been surprised and disappointed that the FTC hasn't brought any lawsuits based on the SafeWeb Act, passed by Congress in 2006 and aimed at helping the agency fight spam, spyware, and online fraud. The expert said it was particularly puzzling that the FTC hasn't taken advantage of elements of the SafeWab law aimed at aiding in the pursuit of cyber-criminals operating in other countries -- widely recognized as one of the biggest challenges in fighting malware and online fraud. "We've seen very little action under the SafeWeb Act; there have been some joint spyware cases with Canada where U.S.-based adware companies were working within Canada, which seemed like the perfect opportunities to use it," said Schwartz. "We thought [SafeWeb] was worth passing, and we want to see some action on it soon." Shapiro admitted that she didn't know of any cases brought by the FTC that have sought to apply the SafeWeb laws. In the area of international cyber-law enforcement, she said it remains a challenge to share information with some foreign governments. Other Anti-Spyware Coalition contributors remarked that they share the FTC's concerns over passing laws that may eventually serve to handcuff enforcers with outdated terms and conditions. "We're pretty much against the laws," said Alex Eckelberry, president of anti-spyware applications vendor Sunbelt Software. "We think they will do more harm than good."
545413
For Congress to do anything that helps protect consumers and the critical Internet infrastructure as a whole, it must pass laws that require proactive processes to protect computers, not that tell people how to deal with the resulting mess, writes columnist Ira Winkler.
113606
Forget Congress' myopic efforts to outlaw spyware. What we really need is better enforcement of existing computer crime laws.
698776
Two bills designed to curb the proliferation of Internet "spyware" took another step toward law this week with overwhelming approval from the House of Representatives, but supporters said they face a tough race against the clock to get Senate approval before Congress disperses for the November elections.
417964
This year's deluge of spyware has put the need to clean up the Internet in stark relief. What's more, it has set in motion the imminent re-alignment of some of tech's marquee players - Symantec, McAfee, Microsoft, America Online and Yahoo, among them.
525061
Congressional lawmakers are taking a cue from Hollywood with an aim to beef up penalties against people who illegally swap copyrighted movies and songs over the Internet. Meanwhile, lawmakers also are targeting spyware and hackers with the threat of jail time for evil cyberspace deeds.
452640
Antispyware groups, concerned that lax consumer practices are offsetting tech gains in antispyware technology, are calling on Congress to pass laws penalizing the companies that resort to distributing the controversial programs.
533205
With the EU crafting new laws governing how data collectors such as Google protect users' personal data, lawmakers there are clashing with US business leaders over how far that protection can and should extend.
494732
California's pioneering law aimed at cracking down on spyware -- signed this week to curb the software that hides on computers and secretly follows users around the Web -- is only a partial step toward protecting consumers, critics said on Friday.
495359
Anti-spyware legislation sails through the House of Representatives, with the bill's sponsor pressing to have both houses approve a law to reign in invasive computer programs by the end of the year. By Michael Grebb.
420901
Most users think their computer is safe from adware and spyware--but they're wrong.
441496
The man at the center of the nation's first spyware case &#151; a businessman notorious for his junk Internet mailings &#151; says federal regulators were politically motivated in targeting him for enforcement of new bills outlawing intrusive software.
30570
(InfoWorld) - An antispyware bill that the U.S. House of Representatives passed this week earned praise from cybersecurity groups, but faces an uncertain future in the Senate. The bill, which would create penalties of up to five years in prison for some spyware-like behavior, is a "needed piece of legislation in order to protect consumers," said Kevin Richards, federal government relations manager for Symantec Corp. Many online identity theft schemes start with spyware on a victim's computer, he said. Though versions of the Internet Spyware Prevention Act (I-SPY) have passed through the House in the last two sessions of Congress, they stalled in the Senate. The House passed I-SPY and a second spyware bill in May 2005. But the Senate failed to act, partly because of concerns that the second proposal, called the Securely Protect Yourself Against Cyber Trespass Act or SPY Act, too broadly defined spyware. The Senate Commerce, Science and Transportation Committee also became hung up on what approach to take for a spyware bill -- a criminal penalties approach similar to I-SPY or a broader approach attempting to define spyware technologies similar to the second House bill. Concerns over the SPY Act remain. Last month, theÂ Electronic Frontier Foundation issued an alert about the SPY Act, saying it opposes the bill because it would preempt tougher state laws against spyware and hacking. "In fact, having been massaged by lobbyists for the software and adware industries, the bill would actually make things worse, insulating adware vendors from more stringent state laws and private lawsuits," wrote EFF lawyer Fred von Lohmann. Any bills that have not passed through the House and Senate during their two-year session must be reintroduced. This year the SPY Act has been approved by the House Energy and Commerce Committee but has not faced a vote on the House floor. On the other hand,Â there seems to be less opposition to I-SPY. I-SPY has "broad support from the industry," said Geoff Gray, legislative consultant for the Cyber Security Industry Alliance, a trade group. "It concentrates on bad actions as opposed to bad technologies." I-SPY now goes to the Senate for consideration. Two champions of antispyware legislation in the Senate, Republicans George Allen of Virginia and Conrad Burns of Montana, were defeated in last November's elections. Meanwhile, supporters of the I-SPY Act say they will push for passage in the Senate. Symantec is engaging senators about the need for a spyware bill and other cybersecurity measures, Richards said. Several senators seem open to cybersecurity legislation, he said. "I think there's interest there," he said. "But senators are focused on a big plate of issues." Although Burns and Allen are gone, I-SPY has a "decent" chance of passing the Senate, added Gray. The House may have given it a better shot by not passing the more controversial SPY Act at the same time, he said. "A little steam has gone out of it on the Senate side, but maybe some of the conflict as well," Gray said. A spokesman for Representative Zoe Lofgren, one of the primary sponsors of I-SPY, said it's early to gauge the bill's chances in the Senate. The California Democrat will begin pushing for the bill in the Senate soon, the spokesman said. Representatives of tech-focused senators said their bosses are looking at antispyware legislation. "It's one of our priorities," said a spokesman for Senator John Ensign, a Nevada Republican and cosponsor of an antispyware bill in the last session of Congress. Senator Ron Wyden, an Oregon Democrat, is also looking into the issue, a spokeswoman said. Wyden, cosponsor of the broader antispyware bill in the Senate last Congress, is "looking into what he feels the correct course should be legislatively ... based on the way the spyware issue has evolved over the last two years," said spokeswoman Melissa Merz.
502244
While a bill passed by the House last month put stricter requirements on software to protect consumers from spyware, the body has passed another bill with even stricter policies.
490613
(InfoWorld) - When it comes to who can and who can't be a hacker, the German government appears to want its cake and eat it, too. AfterÂ passing antihacking legislationÂ earlier this year to crack down on the sharp rise in computer attacks in the public and private sectors, the government is now floating a plan to develop and smuggle its own spyware on to the hard drives of suspected terrorists through e-mail messages. German Interior Minister Wolfgang SchÃ¤uble has been feverishly seeking support for a new security law that would allow federal authorities to investigate suspects' Internet use and stored data without their knowledge, ever since the country's Federal Court of JusticeÂ halted their cybersnooping activitiesÂ in February. The judges argued that the hacking of computers by the police is not permitted under Germany's strict phone-tapping laws and that legislation would be needed to enable covert surveillance. SchÃ¤uble's efforts to introduce a security law with wider police surveillance powers have, however, led to a heated debate that nearly exploded late last week when a copy of the proposed security law was leaked to the German media. The measure would allow authorities to install Trojans carrying remote forensic software on suspects' hard drives. While SchÃ¤uble has said that government cyberspying would only be conducted in a handful of exceptional cases and only on those suspected of planning terrorist attacks, critics say he may have overstepped his bounds. Max Stadler, a security expert with the German Free Democratic Party, warned in a ZDF television interview last week that the Interior Ministry's spyware plan would weaken the trust of German citizens in government. He referred to the government Trojan as "an invasion into the private sphere." Magnus Kalkuhl, a virus specialist at the German office of Russian security software vendor Kaspersky Lab, said the plan "would undermine the very purpose of security software, which is to plug -- not make -- security holes." The idea of allowing officials in one specific country to snoop also disturbs Kalkuhl. "What's going to prevent police in Germany from breaking into computers in Italy?" he asked. And even if the government approves the use of spyware, Wolfgang Wieland, a member of the Green Party, told the Berliner Zeitung newspaper last week that he questions the success of a measure that assumes suspects know little about computers and won't detect and remove Trojans and other spyware. It's naive to believe that terrorists, who live in a world of conspiracy, would trip over something as obvious as e-mail from an unfamiliar source, he said. In defense of the plan, SchÃ¤uble said in an interview with Deutschlandradio last week that police need to keep pace with terrorists and criminals, who shouldn't be allowed to use cyberspace as a protected area. The plan, he said, isn't to control everyone's computer but rather only those machines used by suspected criminals and terrorists and only for a limited period of time. JÃ¶rg Ziercke, president of the Federal Criminal Police Office (BKA), said in an interview with the German magazine Stern that the planned remote forensic software can't be used broadly because it must be tailored to run on each targeted computer. "We're talking about 10 such measures a year," he said. The German government has released no technical details of how the sypware will operate. A spokesman for the Interior Ministry declined to comment, citing security regulations. The use of spyware by crime fighters isn't new. For instance, the U.S. Federal Bureau of Investigation uses a tool, called CIPAV (computer and Internet Protocol address verifier), which can record IP addresses and send this data back to government computers. Nor is Germany the only European country debating spyware legislation. Neighboring Switzerland and Austria are reportedly considering laws that will give police greater powers to monitor computers online. Neither of the countries has released any information on their spyware plans. No firm date is set when German parliamentarians are expected to vote on the proposed security law. But with Islamic radicals targeting German troops and others working in Afghanistan in recent weeks, SchÃ¤uble has spoken of a heightened threat level that makes the spyware issue of increasing urgency. Â
122416
With temporary spy law expansion set to expire Feb. 1, the Bush administration is ratcheting up pressure for a broader permanent replacement. Not so fast, say Democratic leaders.
418319
Spyware legislation that would allow fines of up to $3 million for makers of spyware software will get a second look even though the U.S. Congress failed to pass the legislation last year.