II 

109TH CONGRESS 

1ST SESSION S. 1004 

To provide the Federal Trade Commission with the resources necessary to 

protect users of the Internet from the unfair and deceptive acts and 

practices associated with spyware, and for other purposes. 

IN THE SENATE OF THE UNITED STATES 

MAY 11, 2005 

Mr. ALLEN (for himself, Mr. SMITH, and Mr. ENSIGN) introduced the following bill; which was read twice and referred to the Committee on Commerce, Science, and Transportation 

A BILL 

To provide the Federal Trade Commission with the resources 

necessary to protect users of the Internet from the unfair 

and deceptive acts and practices associated with spyware, 

and for other purposes. 

1 Be it enacted by the Senate and House of Representa2 tives of the United States of America in Congress assembled, 

3 SECTION 1. SHORT TITLE. 

4 This Act may be cited as the ‘‘Enhanced Consumer 

5 Protection Against Spyware Act of 2005’’. 

6 SEC. 2. CONGRESSIONAL FINDINGS. 

7 Congress finds the following: 
2 

•S 1004 IS

1 (1) Software commonly known as ‘‘spyware’’ 

2 can cause significant harm to consumers by, among 

3 other things, deceptively or unfairly causing a com4 puter to malfunction, slow down, lose data, cease 

5 working properly, or share personal information 

6 without a consumer’s knowledge. 

7 (2) The unfair and deceptive practices associ8 ated with the distribution of spyware threaten the 

9 confidence of millions of Americans who use the 

10 Internet as a valuable medium for commerce and 

11 communications. 

12 (3) The Federal Trade Commission’s legal ac13 tions have clearly established the Commission’s au14 thority to combat unfair or deceptive acts or prac15 tices involving the Internet and consumers’ com16 puters. 

17 (4) According to the Commission’s statements 

18 to Congress, the vast majority of unfair or deceptive 

19 acts or practices involving spyware, such as decep20 tively asserting control over a consumer’s computer 

21 and capturing keystroke information, are already 

22 unlawful under the Federal Trade Commission Act. 

23 (5) The Commission has already taken legal ac24 tion against spyware purveyors. For example, in 

25 FTC v. Seismic Entertainment, the Commission re-
3 

•S 1004 IS

1 quested that a district court of the United States 

2 shut down a spyware operation that hijacks personal 

3 computers, secretly changes computer settings, bar4 rages them with pop-up ads, and installs software 

5 programs that ‘‘spy’’ on consumers’ web surfing. 

6 (6) Because the fraudulent, deceptive, or unfair 

7 installation of spyware is already a violation of Fed8 eral law, Congress must focus on providing adequate 

9 resources to combat spyware. For example, because 

10 a large percentage of the purveyors of spyware are 

11 located outside of the United States, legislation that 

12 increases the Commission’s authority to combat de13 ceptive or unfair acts or practices that occur over14 seas would promote enforcement actions against 

15 spyware purveyors. 

16 (7) Because spyware affects interstate com17 merce and over 20 States are considering legislation 

18 on spyware and 2 States have already enacted laws 

19 on spyware, Congress must establish a Federal regu20 latory and enforcement standard to protect against 

21 the growing patchwork of State laws that unneces22 sarily confuses and burdens consumers and legiti23 mate software providers. 
4 

•S 1004 IS

1 SEC. 3. SENSE OF CONGRESS. 

2 On the basis of the findings in section 2, it is the 

3 sense of the Congress that— 

4 (1) combating spyware should be established as 

5 a matter of high priority for Federal Trade Commis6 sion action; and 

7 (2) the resources and tools available to the 

8 Commission should be enhanced and expanded to in9 crease the breadth and strength of the Commission’s 

10 spyware enforcement efforts. 

11 SEC. 4. DEFINITIONS. 

12 As used in this Act: 

13 (1) CABLE OPERATOR.—The term ‘‘cable oper14 ator’’ has the meaning given such term in section 

15 602 of the Communications Act of 1934 (47 U.S.C. 

16 522). 

17 (2) COMPUTER; PROTECTED COMPUTER.—The 

18 terms ‘‘computer’’ or ‘‘protected computer’’ have the 

19 meanings given such terms in section 1030(e) of the 

20 title 18, United States Code. 

21 (3) COMMISSION.—The term ‘‘Commission’’ 

22 means the Federal Trade Commission. 

23 (4) INFORMATION SERVICE.—The term ‘‘infor24 mation service’’ has the meaning given such term in 

25 section 3 of the Communications Act of 1934 (47 

26 U.S.C. 153). 
5 

•S 1004 IS

1 (5) INTERACTIVE COMPUTER SERVICE.—The 

2 term ‘‘interactive computer service’’ has the meaning 

3 given such term in section 230(f) of the Communica4 tions Act of 1934 (47 U.S.C. 230(f)). 

5 (6) OWNER OR AUTHORIZED USER.—The term 

6 ‘‘owner or authorized user’’ means— 

7 (A) a natural person who owns a computer 

8 for commercial, family, household, or edu9 cational purposes; or 

10 (B) an individual who operates a computer 

11 with the authorization of a natural person who 

12 owns the computer for commercial, personal, 

13 family, household, or educational purposes. 

14 (7) TELECOMMUNICATIONS CARRIER.—The 

15 term ‘‘telecommunications carrier’’ has the meaning 

16 given such term in section 3 of the Communications 

17 Act of 1934 (47 U.S.C. 153). 

18 SEC. 5. FEDERAL TRADE COMMISSION AUTHORITY TO COM19 BAT DECEPTIVE ACTS OR PRACTICES RELAT20 ING TO SPYWARE. 

21 (a) RESTATEMENT OF AUTHORITY.— 

22 (1) VIOLATION.—It is a violation of section 18 

23 of the Federal Trade Commission Act (15 U.S.C. 

24 57a) to install through deceptive acts or practices 

25 software on protected computers. 
6 

•S 1004 IS

1 (2) ENFORCEMENT.—Any violation of this Act 

2 or of any rules implementing this Act, shall be en3 forced by the Commission as if it were an unfair or 

4 deceptive act or practice proscribed under section 

5 18(a)(1)(B) of the Federal Trade Commission Act 

6 (15 U.S.C. 57a(a)(1)(B)). 

7 (b) INCREASED FINES.—For any violation described 

8 in subsection (a), the Commission may, in its discretion, 

9 penalize such deceptive acts or practices by tripling the 

10 amounts prescribed in the Federal Trade Commission Act 

11 (15 U.S.C. 41 et seq.). 

12 (c) PENALTY FOR PATTERN OR PRACTICE VIOLA13 TIONS.— 

14 (1) IN GENERAL.—Notwithstanding the Federal 

15 Trade Commission Act (15 U.S.C. 41 et seq.), in the 

16 case of a person who engages in a pattern or prac17 tice that violates subsection (a), the Commission 

18 may, in its discretion, seek a civil penalty for such 

19 pattern or practice of violations in an amount, as de20 termined by the Commission, of not more than 

21 $3,000,000 for each violation of subsection (a). 

22 (2) TREATMENT OF SINGLE ACTION OR CON23 DUCT.—For the purpose of enforcing paragraph (1), 

24 any single action or conduct that violates subsection 
7 

•S 1004 IS

1 (a) with respect to multiple protected computers 

2 shall be treated as a single violation. 

3 (d) ILL-GOTTEN GAINS.—For any violation described 

4 in subsection (a), the Commission shall have authority to 

5 disgorge and seize any ill-gotten gains procured through 

6 such deceptive acts or practices. 

7 (e) PREEMPTION OF STATE OR LOCAL LAW.—This 

8 section supersedes any provision of a statute, regulation, 

9 or rule, and any other requirement, prohibition or remedy 

10 under State law or the law of a political subdivision of 

11 a State that relates to or affects installation of software 

12 through deceptive acts or practices or the use of computer 

13 software installed by means of the Internet. 

14 (f) PRIVATE RIGHT OF ACTION.— 

15 (1) IN GENERAL.—This Act may not be consid16 ered or construed to provide any private cause of ac17 tion, including a class action. 

18 (2) CIVIL ACTION.—No private civil action re19 lating to any act or practice governed under this Act 

20 may be commenced or maintained in any State court 

21 or under State law, including a pendent State claim 

22 to an action under Federal law. 

23 (g) ENFORCEMENT BY STATE ATTORNEY GEN24 ERALS.— 
8 

•S 1004 IS

1 (1) CIVIL ACTIONS.—In any case in which the 

2 attorney general of a State has reason to believe 

3 that an interest of the residents of that State has 

4 been or is threatened or adversely affected by the 

5 engagement of any person in a practice that is pro6 hibited under this section, the State, as parens 

7 patriae, may bring a civil action on behalf of the 

8 residents of that State in a Federal district court of 

9 the United States of appropriate jurisdiction, or any 

10 other court of competent jurisdiction, to— 

11 (A) enjoin that practice; 

12 (B) enforce compliance with this section; 

13 (C) obtain actual damage and restitution 

14 on behalf of residents of the State; or 

15 (D) obtain such other relief as the court 

16 may consider to be appropriate. 

17 (2) NOTICE.— 

18 (A) IN GENERAL.—Before filing an action 

19 under paragraph (1), the attorney general of a 

20 State shall provide to the Commission and the 

21 Attorney General— 

22 (i) written notice of the action; and 

23 (ii) a copy of the complaint for the ac24 tion. 

25 (B) EXEMPTION.— 
9 

•S 1004 IS

1 (i) IN GENERAL.—Subparagraph (A) 

2 shall not apply with respect to the filing of 

3 an action by an attorney general of a State 

4 under this subsection, if the attorney gen5 eral of a State determines that it is not 

6 feasible to provide the notice described in 

7 such subparagraph before the filing of the 

8 action. 

9 (ii) NOTIFICATION.—In an action de10 scribed in clause (i), the attorney general 

11 of a State shall provide notice and a copy 

12 of the complaint to the Commission and 

13 the Attorney General at the time the attor14 ney general of a State files the action. 

15 (C) ATTORNEY GENERAL’S RIGHT TO IN16 TERVENE.—After having been notified, as pro17 vided in subparagraph (A), the United States 

18 Attorney General shall have the right— 

19 (i) to file an action; 

20 (ii) to intervene in the action; 

21 (iii) upon so intervening, to be heard 

22 on all matters arising in that action; 

23 (iv) to remove the action to the appro24 priate district court of the United States; 

25 and 
10 

•S 1004 IS

1 (v) to file petitions for appeal. 

2 (D) PROHIBITION ON STATE ATTORNEY

3 GENERALS IF ATTORNEY GENERAL ACTS.—If 

4 the Attorney General institutes an action under 

5 this Act, no attorney general of a State or offi6 cial or agency of a State may bring an action 

7 under this subsection for any violation of sub8 section (a) alleged in the complaint. 

9 (E) PROHIBITION ON STATE ATTORNEY

10 GENERALS IF COMMISSION ACTS.—If the Com11 mission institutes an action under this sub12 section, no attorney general of a State or offi13 cial or agency of a State may bring an action 

14 under this subsection for any violation of this 

15 section alleged in the complaint. 

16 (h) RULE OF CONSTRUCTION.—For purposes of 

17 bringing any civil action under this section, nothing in this 

18 Act shall be construed to prevent an attorney general of 

19 a State from exercising the powers conferred on such at20 torney general by the laws of that State to— 

21 (1) conduct investigations; 

22 (2) administer oaths or affirmations; or 

23 (3) compel the attendance of witnesses or the 

24 production of documentary and other evidence. 

25 (i) VENUE; SERVICE OF PROCESS.— 
11 

•S 1004 IS

1 (1) VENUE.—Any action brought under sub2 section (g) may be brought in the district court of 

3 the United States that meets applicable require4 ments relating to venue under section 1391 of title 

5 28, United States Code. 

6 (2) SERVICE OF PROCESS.—In an action 

7 brought under subsection (g), process may be served 

8 in any district in which the defendant— 

9 (A) is an inhabitant; or 

10 (B) may be found. 

11 SEC. 6. LIMITATIONS ON LIABILITY. 

12 (a) LAW ENFORCEMENT AUTHORITY.—Section 5 

13 shall not apply to the transmission, installation, or execu14 tion of a computer program in compliance with a law en15 forcement, investigatory, national security, or regulatory 

16 agency or department of the United States, or any State 

17 in response to a request or demand made under authority 

18 granted to that agency or department, including— 

19 (1) a warrant issued under the Federal Rules 

20 of Criminal Procedure; 

21 (2) an equivalent State warrant; or 

22 (3) a court order or other lawful process. 

23 (b) PASSIVE TRANSMISSION, HOSTING, OR LINK24 ING.—A person shall not be deemed to have violated any 

25 provision of this Act solely because the person provided— 
12 

•S 1004 IS

1 (1) the Internet connection, telephone connec2 tion, or other transmission or routing function 

3 through which software was delivered to a protected 

4 computer for installation; 

5 (2) the storage or hosting of software or of an 

6 Internet website through which software was made 

7 available for installation to a protected computer; or 

8 (3) an information location tool, such as a di9 rectory, index, reference, pointer, or hypertext link, 

10 through which a user of a protected computer lo11 cated software available for installation. 

12 (c) EXCEPTION RELATING TO SECURITY.—Nothing 

13 in this Act shall apply to— 

14 (1) any monitoring of, or interaction with, a 

15 consumer’s Internet or other network connection or 

16 service, or a protected computer, by a telecommuni17 cations carrier, cable operator, computer hardware 

18 or software provider, or provider of information serv19 ice or interactive computer service, to the extent that 

20 such monitoring or interaction is for network or 

21 computer security purposes, network management, 

22 maintenance, diagnostics, technical support or re23 pair, or for the detection or prevention of fraudulent 

24 activities; or 
13 

•S 1004 IS

1 (2) a discrete interaction with a protected com2 puter by a provider of computer software solely to 

3 determine whether the user of the computer is au4 thorized to use such software, that occurs upon— 

5 (A) initialization of the software; or 

6 (B) an affirmative request by the owner or 

7 authorized user for an update of, addition to, or 

8 technical service for, the software. 

9 (d) LIMITATION ON LIABILITY.—A manufacturer or 

10 retailer of computer equipment shall not be liable under 

11 this Act to the extent that the manufacturer or retailer 

12 is providing third party branded software that is installed 

13 on the equipment the manufacturer or retailer is manufac14 turing or selling. 

15 (e) COMPLIANCE WITH LAW.—No person shall be lia16 ble under this Act for engaging in any activity that is ex17 pressly permissible under any other provision of Federal 

18 law. 

19 (f) COMMISSION AUTHORITY.—In addition to the lim20 itation of liability specified in this section, the Commission 

21 may by regulation establish additional limitations or ex22 ceptions upon the finding that such limitations or excep23 tions are reasonably necessary to promote the public inter24 est. 
14 

•S 1004 IS

1 SEC. 7. INTERNATIONAL CONSUMER PROTECTION AU2 THORITY. 

3 (a) AVAILABILITY OF REMEDIES.—Section 5(a) of 

4 the Federal Trade Commission Act (15 U.S.C. 45(a)) is 

5 amended by adding at the end the following: 

6 ‘‘(4)(A) For purposes of this subsection, the term 

7 ‘unfair or deceptive acts or practices’ includes unfair or 

8 deceptive acts or practices involving foreign commerce 

9 that— 

10 ‘‘(i) cause or are likely to cause reasonable fore11 seeable injury within the United States; or 

12 ‘‘(ii) involve material conduct occurring within 

13 the United States. 

14 ‘‘(B) All remedies available to the Commission with 

15 respect to unfair and deceptive acts or practices shall be 

16 available for acts and practices described in this para17 graph, including restitution to domestic or foreign vic18 tims.’’. 

19 SEC. 8. PENALTIES FOR CERTAIN UNAUTHORIZED ACTIVI20 TIES RELATING TO COMPUTERS. 

21 (a) IN GENERAL.—Chapter 47 of title 18, United 

22 States Code, is amended by inserting after section 1030 

23 the following: 

24 ‘‘§ 1030A. Illicit indirect use of protected computers 

25 ‘‘(a) FURTHERANCE OF CRIMINAL OFFENSE.—Who26 ever intentionally accesses a protected computer without 
15 

•S 1004 IS

1 authorization, or exceeds authorized access to a protected 

2 computer, by causing a computer program or code to be 

3 copied onto the protected computer, and intentionally uses 

4 that program or code in furtherance of another Federal 

5 criminal offense shall be fined under this title or impris6 oned not more than 5 years, or both. 

7 ‘‘(b) SECURITY PROTECTION.—Whoever intentionally 

8 accesses a protected computer without authorization, or 

9 exceeds authorized access to a protected computer, by 

10 causing a computer program or code to be copied onto 

11 the protected computer, and by means of that program 

12 or code intentionally impairs the security protection of the 

13 protected computer shall be fined under this title or im14 prisoned not more than 2 years, or both. 

15 ‘‘(c) INDIVIDUAL EXEMPTION.—A person shall not 

16 violate this section who solely provides— 

17 ‘‘(1) an Internet connection, telephone connec18 tion, or other transmission or routing function 

19 through which software is delivered to a protected 

20 computer for installation; 

21 ‘‘(2) the storage or hosting of software, or of an 

22 Internet website, through which software is made 

23 available for installation to a protected computer; or 

24 ‘‘(3) an information location tool, such as a di25 rectory, index, reference, pointer, or hypertext link, 
16 

•S 1004 IS

1 through which a user of a protected computer lo2 cates software available for installation. 

3 ‘‘(d) NETWORK EXEMPTION.—A provider of a net4 work or online service that an authorized user of a pro5 tected computer uses or subscribes to shall not violate this 

6 section by any monitoring or, interaction with, or installa7 tion of software for the purpose of— 

8 ‘‘(1) protecting the security of the network, 

9 service, or computer; 

10 ‘‘(2) facilitating diagnostics, technical support, 

11 maintenance, network management, or repair; or 

12 ‘‘(3) preventing or detecting unauthorized, 

13 fraudulent, or otherwise unlawful uses of the net14 work or service. 

15 ‘‘(e) EXCLUSIVE JURISDICTION.—No person may 

16 bring a civil action under the law of any State if such 

17 action is premised in whole or in part upon the defendant’s 

18 violation of this section. 

19 ‘‘(f) DEFINITIONS.—As used in this section: 

20 ‘‘(1) COMPUTER; PROTECTED COMPUTER.—The 

21 terms ‘computer’ or ‘protected computer’ have the 

22 meanings given such terms in section 1030(e) of this 

23 title. 

24 ‘‘(2) STATE.—The term ‘State’ includes each of 

25 the several States, the District of Columbia, Puerto 
17 

•S 1004 IS

1 Rico, and any other territory or possession of the 

2 United States.’’. 

3 (b) CONFORMING AMENDMENT.—The table of sec4 tions at the beginning of chapter 47 of title 18, United 

5 States Code, is amended by inserting after the item relat6 ing to section 1030 the following new item: 

‘‘1030A. Illicit indirect use of protected computers.’’. 

7 SEC. 9. PRESERVATION OF FEDERAL TRADE COMMISSION 

8 AUTHORITY. 

9 Nothing in this Act may be construed in any way to 

10 limit or affect the Commission’s authority under any other 

11 provision of law, including the authority to issue advisory 

12 opinions, policy statements, or guidance regarding this 

13 Act. 

14 SEC. 10. AUTHORIZATION OF APPROPRIATIONS. 

15 There is authorized to be appropriated, to the Com16 mission for the purposes of enforcing violations relating 

17 to the unfair and deceptive practices associated with com18 puter and Internet related crimes, not more than 

19 $10,000,000 for each fiscal year beginning with fiscal year 

20 2006. 

Æ