Anti-Spyware Legislation

The United States House of Representatives has decided to give it another shot, passing a bill to streamline Internet Security and Consumer Convenience. This time it deals with spyware. After the incredibly successful antispam bill (which legalized spam), why not?

The first antispyware bill:

Bill imposes hefty 'spyware' fines

The second antispyware bill, which throws jail time into the mix:

Bill Imposes Prison Time Over 'Spyware'

What these articles don't address, is why the spyware is getting on the machines in the first place. There are two methods: The user installs software that includes the spyware, or the user runs a software with security holes in it that allow spyware to be installed without notice.

When the term "spyware" was first coined, it existed via the first method. A user would install a screensaver, a shareware or freeware program that showed ads, or one of many pier-to-pier file sharing programs (for downloading music and videos). Nothing is ever free - developers and businesses need to make money somehow. As long as the software installation contained a license agreement that noted what info was being tracked (the same license that nobody ever reads), then this "spyware" was completely legitimate.

Now for the second method. After Microsoft won the web browser wars, almost everybody had Internet Explorer. The spyware programmers now had a new avenue of installing (infecting?) their tracking and advertisement products. But even then, how do they get it to your machine? The user still has to do something - whether it be install a program that has ads or visit a site hosting the spyware (pornographic, casinos, games, etc.). About the same time a new trend was started in the way the ads were displayed - popups and popunders. Of course these use Internet Explorer, and an advertisement affiliate will use the legitimate and legal freeware to spread their unethical trash.

But now back to the new bill. Is this going to help? Yes, a little. Much of the spyware these days are behind the scenes, the user never has a chance to decline them. Now we can go back to the days of license agreements that nobody reads - but at least the software companies that aren't trying to do any harm are also protected.

But how is this bill going to handle foreign spyware programmers? It will be as effective as we have been in cracking down on those Nigerian scam letters. Our best approach is to make software without the security holes (which is a nearly impossible task these days) and penalize those companies for damages resulting in those holes. Of course this would put Microsoft out of business.