Congress Takes Aim at Spyware

(page 2 of 2)

"We wouldn't want to upset the normal functioning of the Internet," says Markham Erickson, a partner at Holch & Erickson and executive director of the NetCoalition, which lobbies on behalf of Google, Yahoo, and IAC/Interactive Corp. (IACI), owner of the Match.com, Evite, and Ticketmaster sites. The coalition opposes the Bono-Towns bill, known as the Spy Act. As written, that measure would prohibit Web sites from installing software that collects and reports information about browsing sessions unless they notify users first.

Industry Prefers Lofgren Bill

Erickson says the Spy Act's language would make Web sites less interactive by forcing them to furnish users with lengthy contracts that they'll rarely read. Such agreements could become especially cumbersome on cell phones and other mobile devices. "Legislating based on today's technology is always fraught with peril," he says. "It has to be done in a way that doesn't create collateral damage." On June 6, NetCoalition and other trade groups sent a letter to House Speaker Nancy Pelosi (D-Calif.) supporting the Internet Spyware Prevention Act authored by Lofgren, whose district includes much of Silicon Valley.

The Lofgren bill would supply the Justice Dept. with $10 million a year from 2008 to 2011 to fight spyware and other online scams. The bill also would impose up to five years of jail time for spyware distributors who use the technology to commit another federal crime such as fraudulent use of stolen credit-card information. Somewhat similarly, the Pryor bill would provide the Federal Trade Commission with new powers to bring civil and criminal cases against makers of deceptive software.

Lofgren, who voted against Bono's measure (though Bono voted for Lofgren's), says her Internet Spyware Prevention Act targets bad actors on the Internet without deterring innovation. For technology companies, the freedom to design new products is "like breathing the air at home," says Lofgren in an interview. "If it's a regulatory approach, I won't vote for it."

Lofgren also contends Bono's bill will be ineffective because it focuses on asking Internet users to opt in before receiving ads. "If you just focus on opt-in, it's never going to work because people don't read opt-ins," she says.

Jason Vasquez, a spokesman for Bono, dismisses criticism that opt-in agreements would bog down Web surfers, and says the Spy Act's language is broad enough to garner bipartisan support. "How is a user's experience seamless if spyware is introduced into their computer?" he says.

Urgent Need for Policing

Few argue against the need to do something, especially with new culprits always popping up: In the latest Internet Security Threat Report from Symantec, the top 10 emerging dangers were all newly identified Web sites that distribute spyware or malware. And hackers are using new mechanisms, such as online videos, to deliver their malicious software payloads (see BusinessWeek, 8/16/06, "Spyware's Growing Arsenal").

Computers plagued with spyware are also being recruited into "botnets," armies of compromised PCs enlisted by cybercriminals to send spam or distribute more malicious software. The Federal Bureau of Investigation on June 13 said it's nabbed three botnet operators as part of a sting, and is working with Microsoft and Carnegie Mellon University to catch more.

"Congress needs to address the issue of spyware with renewed urgency," says Kevin Richards, federal government relations manager at Symantec, which supports both House antispyware bills. "A lot of spyware purveyors get a slap on the wrist, and they factor in the fines as a cost of doing business." As for criticism of the Spy Act's consent requirements, "If you have an honest business model, you don't have anything to fear from this legislation," he says.

Microsoft, which has supported both House measures, declined to comment, as did Google.

Ad-serving Software in Crossfire

Backers of both House bills say differences could be ironed out in the Senate, and hope a compromise bill gets drafted before the current session ends in the fall. For that to happen, lawmakers will need to clarify some of the fuzzy lines between legitimate ad-serving software and the more insidious varieties users don't want. Privacy advocates have been pushing the FTC, for example, to require that Web sites alert visitors to tracking cookies and other monitoring software on their pages (see BusinessWeek.com, 11/15/06, "Taking Aim at Targeted Advertising").

What all sides seemingly want to avoid is a law with broad wording that might provide a back door to sue large tech companies. "People are looking at Google sitting on top of their billions of dollars trying to figure out any way they can to get their fingers on it," says SRI's Sachs.

Yet the future of software from Google, Microsoft, Yahoo, and other major industry players looks increasingly reliant on advertising embedded in products. How lawmakers and companies resolve their differences over the proposed spyware laws could be only the first salvo in a lengthy process of defining that future.

Ricadela is a writer for BusinessWeek.com in Silicon Valley.