U.S. House subcommittee approves spyware bill

A U.S. House subcommittee has approved a spyware bill that would allow fines up to $3 million for collecting personal information, diverting browsers and delivering some pop-up advertisements to computer users without their consent.

The Securely Protect Yourself Against Cyber Trespass Act (SPY ACT), which bears little resemblance to the bill it replaced, also requires software that collects the personal information of computer users to notify the users of its installation, to get the users’ consent before installation, and to provide users with easy uninstall options.

SPY ACT was approved by the House Subcommittee on Commerce, Trade and Consumer Protection Thursday as an amendment to a spyware bill introduced last year by Representative Mary Bono (R-Calif.). Bono praised the amendment, offered by subcommittee chairman Cliff Stearns (R-Fla.), as making “substantial progress in improving” her bill.

Stearns called his amendment an attempt to outlaw bad actions without outlawing technologies similar to spyware that have legitimate uses, such as parental monitoring software or anti-virus software.

An early version of Bono’s original bill, called the Safeguard Against Privacy Invasions Act, defined all computer programs that transmit information without action from the user as spyware. But that raised objections from several IT vendors, including anti-virus companies. A later draft of Bono’s bill, which authorized the U.S. Federal Trade Commission to create rules for spyware notice and consent, includes several exceptions, including parental control software, antivirus software and software that scans for license compliance.

“While we have wrestled with numerous and thoughtful definitions of what spyware is or isn’t, the simple fact is that everyone has a right to safeguard their personal property and keep unwanted guests out of their homes and private lives,” Stearns said. “To me, it all comes down to good manners – when I invite someone into my home, or in this case my computer, I expect them to behave and leave when asked.”

The Stearns amendment allows fines of up to $3 million for actions unauthorized by a computer’s owner, including highjacking browsers, changing a browser’s default home page, changing the security settings of a computer, logging keystrokes, and delivering advertisements that the computer user cannot close without turning off the computer or closing all sessions of the browser.

The bill requires computer users be notified and be allowed to give consent before software that collects and transmits personal information is installed on their computers. But the notice provision in the bill may not be strong enough, said Ari Schwartz, associate director of the Center for Democracy and Technology.

Although the bill requires the spyware notice be “distinguished” from other notices, the spyware notice could end up buried at the end of a lengthy end user license agreement, Schwartz said. “Then we end up where we are now,” he said. “Can we do a notice provision that won’t confuse consumers more?”

SPY ACT is now headed to the full House Energy and Commerce Committee. Bono said she expects the bill to pass through the full committee. “We are one step closer to restoring safety, confidence and control to consumers when using their own computers,” she said.