```

[Senate Hearing 109-406]
[From the U.S. Government Publishing Office]

                                                        S. Hrg. 109-406
 
                           REGARDING SPYWARE

=======================================================================

                                HEARING

                               before the

        SUBCOMMITTEE ON TRADE, TOURISM, AND ECONOMIC DEVELOPMENT

                                 OF THE

                         COMMITTEE ON COMMERCE,
                      SCIENCE, AND TRANSPORTATION
                          UNITED STATES SENATE

                       ONE HUNDRED NINTH CONGRESS

                             FIRST SESSION

                               __________

                            OCTOBER 5, 2005

                               __________

    Printed for the use of the Committee on Commerce, Science, and 
                             Transportation

                    U.S. GOVERNMENT PRINTING OFFICE
27-822                      WASHINGTON : 2006
_____________________________________________________________________________
For Sale by the Superintendent of Documents, U.S. Government Printing Office
Internet: bookstore.gpo.gov  Phone: toll free (866) 512-1800; (202) 512�091800  
Fax: (202) 512�092250 Mail: Stop SSOP, Washington, DC 20402�090001

       0SENATE COMMITTEE ON COMMERCE, SCIENCE, AND TRANSPORTATION

                       ONE HUNDRED NINTH CONGRESS

                             FIRST SESSION

                     TED STEVENS, Alaska, Chairman
JOHN McCAIN, Arizona                 DANIEL K. INOUYE, Hawaii, Co-
CONRAD BURNS, Montana                    Chairman
TRENT LOTT, Mississippi              JOHN D. ROCKEFELLER IV, West 
KAY BAILEY HUTCHISON, Texas              Virginia
OLYMPIA J. SNOWE, Maine              JOHN F. KERRY, Massachusetts
GORDON H. SMITH, Oregon              BYRON L. DORGAN, North Dakota
JOHN ENSIGN, Nevada                  BARBARA BOXER, California
GEORGE ALLEN, Virginia               BILL NELSON, Florida
JOHN E. SUNUNU, New Hampshire        MARIA CANTWELL, Washington
JIM DeMint, South Carolina           FRANK R. LAUTENBERG, New Jersey
DAVID VITTER, Louisiana              E. BENJAMIN NELSON, Nebraska
                                     MARK PRYOR, Arkansas
             Lisa J. Sutherland, Republican Staff Director
        Christine Drager Kurth, Republican Deputy Staff Director
                David Russell, Republican Chief Counsel
   Margaret L. Cummisky, Democratic Staff Director and Chief Counsel
   Samuel E. Whitehorn, Democratic Deputy Staff Director and General 
                                Counsel
             Lila Harper Helms, Democratic Policy Director
                                 ------                                

        SUBCOMMITTEE ON TRADE, TOURISM, AND ECONOMIC DEVELOPMENT

                   GORDON H. SMITH, Oregon, Chairman
TED STEVENS, Alaska                  BYRON L. DORGAN, North Dakota, 
JOHN McCAIN, Arizona                     Ranking
CONRAD BURNS, Montana                DANIEL K. INOUYE, Hawaii
JOHN ENSIGN, Nevada                  JOHN D. ROCKEFELLER IV, West 
GEORGE ALLEN, Virginia                   Virginia
JOHN E. SUNUNU, New Hampshire        JOHN F. KERRY, Massachusetts
JIM DeMint, South Carolina           MARIA CANTWELL, Washington
DAVID VITTER, Louisiana              FRANK R. LAUTENBERG, New Jersey
                                     BILL NELSON, Florida
                                     E. BENJAMIN NELSON, Nebraska
                                     MARK PRYOR, Arkansas

                            C O N T E N T S

                              ----------                              
                                                                   Page
Hearing held on October 5, 2005..................................     1
Statement of Senator Allen.......................................     3
Statement of Senator Burns.......................................     3
Statement of Senator Bill Nelson.................................     2
Statement of Senator Smith.......................................     1

                               Witnesses

Majoras, Hon. Deborah P., Chairman, Federal Trade Commission.....     5
    Prepared statement...........................................     9

                                Appendix

Response to Written Questions Submitted by Hon. Frank R. 
  Lautenberg to Hon. Deborah P. Majoras..........................    25

                           REGARDING SPYWARE

                              ----------                              

                       WEDNESDAY, OCTOBER 5, 2005

                               U.S. Senate,
      Subcommittee on Trade, Tourism, and Economic 
                                       Development,
        Committee on Commerce, Science, and Transportation,
                                                    Washington, DC.
    The Subcommittee met, pursuant to notice, at 2:35 p.m. in 
room SD-562, Dirksen Senate Office Building, Hon. Gordon H. 
Smith, Chairman of the Subcommittee, presiding.

          OPENING STATEMENT OF HON. GORDON H. SMITH, 
                    U.S. SENATOR FROM OREGON

    Senator Smith. I want to thank my colleagues for being 
here, I know they share with me a deep interest and concern 
about the matter of spyware. I want to thank Chairman Majoras 
for rearranging her schedule to be here today.
    As Chairman of the Subcommittee on Trade, Tourism, and 
Economic Development, which has primary jurisdiction over the 
Federal Trade Commission and online-privacy issues, I have a 
deep interest as colleagues do in spyware and have continually 
worked on these issues to ensure protection of consumers and 
businesses.
    The FTC also has a responsibility to protect American 
consumers from all types of fraud and deception, including 
spyware.
    According to a recent survey by the National Cyber Security 
Alliance, 93 percent of people feel that spyware is a serious 
problem, and 61 percent believe that Congress should be doing 
more to combat the problem. Consumers have now downloaded free 
versions of the two most widely used anti-spyware programs over 
45 million times.
    Although spyware has been used for many deceitful purposes, 
including theft of personal information, the technology behind 
it is being used also toward legitimate ends as well. I 
strongly believe that a total ban of an entire category of 
technology or product can have many unintended and serious 
consequences. If the definition of spyware becomes too broad, 
legislation adopted in haste might not take into account the 
evolution of future technologies, and in turn, it could stifle 
innovation.
    I believe we must limit the abusive and deceitful practices 
which are allowing industry the ability to build on and improve 
existing technologies. To that end, I introduced the U.S. SAFE 
WEB Act to expand the Federal Trade Commission's current 
authority to enforce existing laws and allow the agency to 
coordinate with foreign law enforcement officials to prosecute 
deceptive online activities. I have also co-sponsored 
legislation with Senator Allen to increase the FTC's current 
authority to enforce existing laws to prevent deceitful acts of 
spyware.
    We need to give the FTC the necessary tools to go after the 
individuals who are already violating current Federal law. We 
need to address the most egregious activities and behaviors 
online without placing unnecessary restrictions on the entire 
technology industry.
    Americans must be proactive in keeping our high-tech 
industry on the cutting edge in the world market. I believe 
that an appropriate balance can be found between limiting the 
illegitimate use of existing technologies and allowing for 
technology industry to grow, expand, and innovate.
    As we continue to address this issue, I look forward to 
working with all of my colleagues to confront this growing 
problem appropriately and in a timely manner.
    With that I'll go to Senator Nelson.

                STATEMENT OF HON. BILL NELSON, 
                   U.S. SENATOR FROM FLORIDA

    Senator Nelson. I'll go to praising you Senator Burns, 
because you and I have sponsored the bill to address spyware 
problems.
    Senator Burns. That's right.
    Senator Nelson. Everything that Senator Smith has said is 
accurate. Spyware invades our privacy, leads to identity theft, 
exposes children to pornography, aids corporate espionage, 
threatens E-Commerce, and it clearly has national security 
implications. And technology and the private marketplace 
haven't found a solution to stop spyware, so we now need a 
tough Federal law Mr. Chairman, that clearly defines illegal 
conduct and gives the government more tools to go after the 
spyware companies.
    And so Senator Burns and I are sponsoring this bill called 
the Spy Block Act, along with Senators Wyden, Snowe and Boxer. 
And last year we reported this bill out of the Committee on a 
unanimous vote. And it has one simple principle, empower 
consumers to decide for themselves what software is installed 
on their computers. Now Senator Allen and others have 
introduced another spyware bill, I think that one is a little 
narrow in scope but it has some very strong components. So what 
I want to do is, all of us to work together to merge the two 
approaches and get a spyware bill marked up, so we can get it 
moving.
    The House has already passed two such bills, but it 
continues to wait on the Senate to act.
    Thank you Mr. Chairman.
    Senator Smith. Thank you Senator Nelson, and I do look 
forward to working with you on this. I think we both share the 
belief that this is a security issue that is beyond just our 
individual victimization of spies and those who would invade 
our homes, but it also has national security implications. We 
simply have to work on how broad it is, so that we don't stifle 
the future, but that we protect people presently in our country 
as well.
    Senator Burns.

                STATEMENT OF HON. CONRAD BURNS, 
                   U.S. SENATOR FROM MONTANA

    Senator Burns. Thank you very much. And thank you Mr. 
Chairman, for taking the leadership on this hearing today. We 
had a hearing before, and with most of that hearing was with 
the folks in the industry and consumer groups. Today I think 
we'll get a chance to hear from the Federal Trade Commission, 
which is--and will continue to have, an important role in anti-
spyware enforcement actions. So the two hearings are 
complementary in that respect, and will help us learn more 
about the problem of spyware.
    Also just a note, our technologies continue to grow, and 
the use of those technologies goes into many fields, especially 
in the area of electronic information and communications, with 
Voice over IP prominent now in the marketplace, national 
emergency numbers of 911 and how we apply those and protect 
those and the safety of 911 in emergency conditions are 
challenges that continue to grow for safety and security. And 
we must never lose sight of that. So we will continue to have 
problems in those areas.
    Spyware, as you know, is an increasingly dangerous threat 
to our everyday activities in cyberspace. As was the case with 
spam several years ago, I believe the solution lies in the 
right mix of technical solutions and tougher legislation. Both 
will be necessary to make a meaningful dent in the quantity and 
the types of malicious code that gets downloaded into the 
private computers of businesses and citizens without their 
consent.
    We also have to be careful not to throw out the baby with 
the bathwater, by making many ordinary and positive types of 
online business practices illegal. The area of adware in 
particular is an important gray area to keep an eye on: how 
exactly online advertisements are served up to users, and what 
kind of consent is most appropriate. Most adware models are 
good for cyberspace, because it is important to have a robust 
and responsive advertising component for online businesses, but 
when it comes to installing software on private computers, we 
have to make sure we don't allow some of the more unscrupulous 
players out there to spoil the field for all the good actors 
that are just trying to make cyberspace more efficient.
    So I thank the Chairman of the FTC for coming up today, and 
I look forward to how she responds to questions, and the 
information she can share with us, and again to Senator Smith 
for setting up today's hearing, because I think it's very 
appropriate, and it is something that we have to get these 
bills moving and we need something passed and on the 
President's desk before Christmastime.
    Senator Smith. Thank you Senator Burns.
    Senator Allen.

                STATEMENT OF HON. GEORGE ALLEN, 
                   U.S. SENATOR FROM VIRGINIA

    Senator Allen. Thank you Mr. Chairman, I especially want to 
thank you for calling today's hearing, and I thank Chairman 
Majoras for being with us today.
    And I enjoyed listening to my colleagues, and maybe there 
will be a way that we can work together on this issue. Because 
the spyware issue is one of great importance. Just to set the 
parameters here of what kind of a problem we have--according to 
the Pew Internet and American Life Project study in July of 
this year, in 2005 approximately 59 million American adults, 
nearly half of the Internet users, 43 percent say they have had 
spyware on their home computer.
    It's irritating. It is a dangerous approach which is 
negatively impacting consumers confidence and harming the 
Internet as a viable mode, or medium for communications and 
also electronic commerce. And none of us here want to allow 
this to continue.
    All of us can agree that under no circumstance is it 
acceptable to deceptively monitor a consumer's activities 
online. Unfortunately we do not all agree on how best to deal 
with this problem legislatively. Now in examining this 
offensive spyware issue, which causes so much aggravation and 
degrades computer performance, we need to encourage to the 
greatest extent possible, market driven technologies solutions, 
as well as strengthen the enforcement of existing laws. In my 
view, every legitimate business associated with the Internet 
has a very important interest in eliminating spyware.
    A recent Federal Trade Commission report suggested that the 
rapid technology advancements, and this is consistent with your 
comments, Mr. Chairman, that there are a lot of advances in 
technologies to combat spyware such as firewalls, filters, 
anti-spyware tools and improved Internet browsers and operating 
systems are all the time providing easy and more affordable 
protections to consumers, whether at their homes or at their 
place of business.
    I think that the Internet's viability is being challenged 
by this deceptive spyware though, and because of these 
fraudulent and deceptive installations of spyware programs 
being a concern, it is not a concern though whether this is 
legal or not; this already is illegal under Federal law, it's a 
violation of Federal law. Such as the Federal Trade Commission 
Act, and the Computer Fraud and Abuse Act.
    So I think Congress needs to focus its efforts on adequate 
resources and penalties to combat this criminal activity. I've 
determined that Federal officials, and we'll hear from the 
Chairman, believe that they already have adequate authority 
under existing statutes to prosecute spyware purveyors. Law 
enforcement is not stymied by the lack of Federal jurisdiction 
but rather a lack of overall resources. That's why my 
legislation, S. 1004 with the support of you Mr. Chairman, 
Senators Smith, Sununu, Ensign, and Enzi, provides Federal law 
enforcement officials with the resources and the tool necessary 
to increase the breadth and the strength of anti-spyware 
enforcement efforts.
    Our legislation strikes a careful balance that you talked 
about Mr. Chairman, between pursuing illegal wrongful behavior 
while not stifling or limiting technology, innovation or 
legitimate online transactions.
    Specifically, since spyware violators are not limited to 
state or national borders to perpetrate their illegal activity, 
our legislation sets a national standard. It doesn't matter 
what state you're in, or territory of the United States. There 
ought to be that national standard for the unfair and deceptive 
practices associated with spyware. Additionally, our 
legislation provides the FTC with the authority to share and 
coordinate information with foreign law enforcement officials 
to improve their ability to bring cases and prosecute 
international spyware purveyors, your separate bill, Mr. 
Chairman, this is just a component of our bill, but yours 
covers it as well.
    But lastly, our legislation addresses the most egregious 
activities and wrongful behavior conducted via spyware, by 
significantly increasing civil and criminal penalties including 
disgorgement. We need to ensure that law enforcement officials 
can get after the illegal gains of these criminals. You can 
fine them, but if they have any assets that are traceable to 
this illegal activity it is an enterprise on their part, and 
they're selling this information. And we ought to get after 
those ill gotten gains. I don't care what it is, bank accounts, 
yachts, art objects, whatever they've bought, we need to get 
after these enterprises as well as the criminal and civil 
fines.
    I believe again, that we need to find some market driven 
solutions, technology solutions that will ultimately solve this 
problem. I want to help the FTC have the resources they need to 
get after this criminal and illegal behavior, and I look 
forward Mr. Chairman to hearing from the Chairman of the FTC, 
but most importantly if there is a way, and I'm not sure there 
is, there are some just fundamental differences, but we need to 
act.
    The Senate a lot of the times is the last to act, but I 
think there's enough will here that I hope working with my good 
friend Senator Burns that we can hopefully find a common ground 
to have the Federal Government help the FTC do its job, set a 
national standard and get you the resources to get after this 
illegal behavior.
    And I thank you again Mr. Chairman.
    Senator Smith. Thank you very much Senator Allen. Madam 
Chairman, the mike is yours, we look forward to your testimony.

 STATEMENT OF HON. DEBORAH P. MAJORAS, CHAIRMAN, FEDERAL TRADE 
                           COMMISSION

    Ms. Majoras. Thank you very much Mr. Chairman, and Members 
of the Subcommittee, and good afternoon.
    The Federal Trade Commission appreciates this opportunity 
to provide the Commission's views on the serious problems that 
spyware is causing to consumers and the steps that the FTC has 
taken to address the problem.
    Although the views expressed in the written testimony 
present the views expressed of the Commission, my oral 
presentation and responses to questions are my own, and may not 
necessarily represent the views of the Commission.
    As the Subcommittee is aware, the Commission has a broad 
mandate to prohibit unfair competition, and unfair or deceptive 
practices in the marketplace. We have actively used this 
authority to address consumer problems on the Internet, 
including Internet fraud, privacy, spam and spyware.
    The term spyware can be difficult to define. It is 
ordinarily thought of as including programs such as keyloggers, 
that can copy information from consumers' computers, as well as 
some types of adware, software that monitors computers' surfing 
habits and then serves up pop-up advertisements.
    At the FTC, our focus is on spyware and other malware that 
is downloaded without authorization, and causes consumers harm. 
The consumer harm from spyware can range from the capture of 
sensitive personal information to degradation of computer 
performance, to the nuisance and distraction of popup ads.
    To address spyware, we implemented an active program, 
combining law enforcement and consumer education supplemented 
by our research. Much of the harmful conduct associated with 
spyware is already illegal. Indeed the FTC has brought several 
cases, and today is announcing it has filed another action, FTC 
versus Odysseus Marketing. In this case, we filed a complaint 
in Federal District Court in New Hampshire against Odysseus 
Marketing and its principal, Walter Rines, charging them with 
secretly installing spyware on consumers' computers.
    Our complaint alleges that the defendants deceptively 
market and distribute a bogus program called Kazanon, which 
defendants claim will make users anonymous when using peer-to-
peer file-sharing programs.
    Not only does Kazanon not work as promised, which itself a 
violation of the FTC Act, but it also automatically installs a 
spyware program called Clientman on the users' computer. 
Clientman in turn automatically installs numerous adware and 
other programs on behalf of others. And this spyware, among 
other things, replaces or reformats Internet search engine 
results, generates pop-up ads, and captures and transmits 
information which may include personal information.
    Our complaint alleges that defendants have failed to 
disclose adequately that downloading Kazanon will install this 
spyware. In fact, the only place that Clientman's virtual 
takeover of the host computer is disclosed is in the end user 
license agreement, or as we call it the EULA.
    Consumers, however, do not need to view the EULA in order 
to download Kazanon, and even if they did they would have to 
wade through five paragraphs of dense text before they reached 
information even approaching the disclosure.
    We further allege that once Clientman is installed, 
consumers cannot remove Kazanon and Clientman from their 
computers through reasonable means. Programs do not appear on 
the desktop or in the start menu, and because they avoid being 
detected by the Microsoft Windows operating system, consumers 
cannot use Microsoft's default uninstall utilities to remove 
them.
    And defendants claim to provide an uninstall tool, but it 
doesn't work. In fact, we allege in the complaint that if you 
activate defendants' uninstall tool, typically that will result 
in having additional files being added to your computer.
    Now as we bring each spyware case, we learn more about the 
technology and tricks in the industry and we increase our 
ability to bring future cases. We've made spyware 
investigations and prosecutions an enforcement priority and we 
will file more law enforcement actions. There's no question 
however that attacking spyware is challenging.
    Given its surreptitious nature, it is often difficult to 
ascertain from whom, from where, and how spyware is 
disseminated. Many who distribute spyware are adept at hiding, 
covering their tracks, and evading responsibility.
    Further, consumer complaints about spyware are less likely 
to lead us directly to law enforcement targets than some other 
complaints. Consumers often do not know from where the spyware 
has come, or even that it was spyware that caused the problems 
to their computers in the first place.
    There are five additional points that the Commission 
believes are important to our continuing efforts to combat the 
dissemination of spyware.
    First, many spyware distributors and other Internet scam 
artists are located abroad, or mask their location by using 
foreign intermediaries to peddle their scams. A majority of 
spyware programs distributed to the United States consumers 
come from foreign distributors. In the FTC's investigations, 
staff finds that regardless of where the spyware distributors 
are physically located they are often using foreign Internet 
service providers, or web hosting companies, or domain 
registrars, which makes it difficult to crack down on who's 
ultimately responsible.
    Our ability to pursue distributors of spyware, and spam and 
other Internet threats would be significantly improved if 
Congress were pass the U.S. SAFE WEB Act. And Chairman Smith, 
we thank you for introducing S. 1608 which would give us that 
needed authority.
    Second, coordinated effort at the Federal and State level 
is essential. The Commission is continuing to cooperate with 
Federal and state partners, which now are bringing law 
enforcement actions against spyware distributors. At the 
Federal level, the Department of Justice is able to prosecute 
criminally those who distribute spyware in certain 
circumstances. And at the State level, state attorneys general 
are bringing civil law enforcement actions and both are 
critical complements to the FTC's actions.
    Third, an educated consumer is perhaps the best defense 
against online fraud and spyware. Over the last few months the 
FTC has taken a broader look at its educational materials and 
tactics related to cyber security, online privacy, and Internet 
fraud, and we've updated our messages and outreach strategies 
to better educate consumers about these important issues.
    Just last week the Commission launched a new consumer ed 
initiative, OnGuard Online. It has general information on 
online safety, as well as sections with specific information on 
a range of topics, including spyware, and with the Chairman's 
indulgence in a few moments we'll give you a quick 
demonstration of this new website.
    Fourth, the Commission believes that legislation granting 
the Commission authority to seek civil penalties against 
spyware distributors would be useful in deterring the 
dissemination of spyware. The Commission has the authority, as 
Senator Allen referred, to file actions against those engaged 
in conduct in Federal Court, and we have the authority to 
obtain injunctive relief, including monetary relief in the form 
of consumer redress, or disgorgement of ill gotten profits.
    But in some instances it may be difficult for us to prove 
the sort of financial harm that we would need to in order to 
get that sort of redress. A civil penalty is often then the 
most appropriate remedy in those cases, and we believe it could 
serve as a strong deterrent as well.
    And finally, as with any technology problem, the most 
comprehensive response may have to come from new technology. 
Technology is what got us here, and technology should be able 
to bring us out eventually. As in other areas like spam and 
data security, it is essential that industry continue to 
develop technology to assist their own customers in combating 
the threats of spyware and other malware.
    We know that ISPs and other industry members are developing 
responses to consumer concerns about spyware and we also are 
appreciative that they have provided the Commission with 
important assistance in our investigations.
    In conclusion, Mr. Chairman, I assure you that the FTC will 
continue to aggressively attack spyware with law enforcement 
actions and with innovative consumer education. And we look 
forward to working with the Committee on the problem of 
spyware.
    Now I look forward to answering any questions you have, but 
before we begin, if it's still all right with you, Mr. 
Chairman, I'd like to ask Nat Wood, who's our Assistant 
Director for Consumer and Business Education, to just give you 
a brief demonstration of our new OnGuardOnline.gov website, 
particularly as it relates to spyware.
    All right. What you're seeing before you is the result of 
team work. The FTC, a number of other Federal agencies, and the 
technology community have teamed up to create 
OnGuardOnline.gov, which is a new site to help computer users 
guard against Internet fraud, secure their computers and 
protect their personal information. We're encouraging companies 
and other organizations to help fight spyware, spam, identity 
theft and the like, by sharing the tips on this website with 
their employees, their customers, members and constituents.
    Interestingly, this website is branded independently of the 
FTC. We are not making it FTC materials, because we want any 
organization with an interest, whether it's government, 
business, consumer groups, whatever, to take this, make it 
their own and distribute it widely across our country. Indeed, 
we now have a lot of interest that's coming from other 
organizations around the world who would like to be able to use 
these materials.
    So just quickly looking at the home page, probably the most 
important part of this is the seven practices for safer 
computing. These are practices that we want consumers to be 
using regardless of what they're doing online. These are 
general tips. The site also contains a link on which consumers 
can click if they want to receive free e-mail alerts from the 
Department of Homeland Security on various threats to the 
online world.
    Then we have the ``Learn About'' section, in which 
consumers can click on various modules to learn about different 
threats and the like, so there you see we clicked on identity 
theft, there's one on phishing, we've done this in a flexible 
way, so that as new threats develop we can add them to the 
website. And then we have an ``About Us'' page, which if you 
click on that gives you, gives the consumer, a description of 
all of the various Federal agencies and other organizations 
that they can turn to for help with respect to their online 
problems. So going back to the modules, we'll just turn quickly 
to the spyware section, and what you can see if you click on 
this section, is first and foremost you get a quick tips 
section, which tells consumers very quickly what they should 
do, then below that we have a much longer article, so that if 
consumers want to read further about spyware, its dangers and 
what they can do about it, they have that there.
    We have a place for links and resources so that they can 
link to additional anti-spyware resources, including if they 
want to learn about what anti-spyware tools are available. And 
then we have a section that tells the consumer where to report 
spyware problems and, not surprisingly, the FTC is listed 
there. Then because we know and experts have told us, and we 
did a lot of consumer testing, and the like, we know the folks 
who spend a lot of time online like to be interactive online, 
so if they think they're experts we have a quiz.
    So you click on this to begin the quiz. You get a little 
bit of information about spyware and then the quiz goes on to 
ask various questions to educate the consumers. So this one 
says a pop-up ad appears on your computer screen offering an 
anti-spyware product, ``what's your best course of action? '' 
And then gives various answers, I would click on ``C'' which 
says ``close the window if you want spyware protection 
software, get it from a provider you know and trust.'' And that 
would be--I would then hear, ``Excellent choice. The scammers 
will have to get up pretty early in the morning to pull one 
over on you,'' and the quiz goes on. And obviously if you get 
the answer wrong we explain why, in fact that would be wrong, 
and give the better course.
    So this is--we will have quizzes on all of the modules very 
soon, and I'm also pleased to report that this is also 
available in Spanish.
    So thank you very much Mr. Chairman.
    [The prepared statement of Ms. Majoras follows:]

       Prepared Statement of Hon. Deborah P. Majoras, Chairman, 
                        Federal Trade Commission
I. Introduction
    Mr. Chairman and Members of the Committee, the Federal Trade 
Commission (``Commission'' or ``FTC'') appreciates this opportunity to 
provide the Commission's views on ``spyware.'' \1\ Spyware is a serious 
and growing problem that is causing substantial harm to consumers and 
to the Internet as a medium of communication and commerce. Preventing 
spyware that causes such harms is a priority for the Commission. We 
welcome this chance to describe what the FTC is doing to try to protect 
consumers from these harms.
---------------------------------------------------------------------------
    \1\ The written statement presents the views of the Federal Trade 
Commission. Oral statements and responses to questions reflect the 
views of the speaker and do not necessarily reflect the views of the 
Commission or any other Commissioner.
---------------------------------------------------------------------------
    The Commission has a broad mandate to prevent unfair competition 
and unfair or deceptive acts or practices in the marketplace. Section 5 
of the Federal Trade Commission Act gives the agency the authority to 
challenge acts and practices in or affecting commerce that are unfair 
or deceptive. \2\ The FTC's law enforcement activities against unfair 
or deceptive acts and practices are generally designed to promote 
informed consumer choice, because an informed consumer is an empowered 
consumer.
---------------------------------------------------------------------------
    \2\ 15 U.S.C. Sec. 45.
---------------------------------------------------------------------------
    Spyware and other ``malware'' that is downloaded without 
authorization can cause a range of problems for computer users, from 
nuisance adware that delivers pop-up ads, to software that causes 
sluggish computer performance, to keystroke loggers that capture 
sensitive information. As described below, the Commission has an active 
program to address concerns about spyware and other malware, including 
research, law enforcement and consumer education. In the past year, the 
Commission has initiated five law enforcement actions addressing 
spyware and malware, and has ongoing investigations. Moreover, as in 
other areas such as spam and data security, we believe that it is 
essential that industry continue to develop technology to assist its 
customers in combatting spyware.
II. Spyware Law Enforcement
    One of the FTC's first steps in responding to the spyware problem 
was to educate ourselves in order to develop, implement, and advocate 
effective policies to respond to it. In 2004, the FTC sponsored a 
public workshop entitled ``Monitoring Software on Your PC: Spyware, 
Adware, and Other Software.'' The agency received almost 800 comments 
in connection with the workshop, and 34 representatives from the 
computer and software industries, trade associations, consumer advocacy 
groups and various governmental entities participated as panelists. In 
March 2005, the FTC released a staff report based on the information 
received in connection with the workshop. \3\ Notwithstanding 
significant challenges in defining ``spyware,'' \4\ the staff report 
recommended that the government should: (1) increase, using existing 
laws, criminal and civil prosecution of those who distribute spyware; 
and (2) increase efforts to educate consumers about the risks of 
spyware. The Commission is pleased to be able to describe today what we 
are doing to implement these recommendations.
---------------------------------------------------------------------------
    \3\ The workshop agenda, transcript, panelist presentations, and 
public comments received by the Commission are available at http://
www.ftc.gov/bcp/workshops/spyware/index.htm. The FTC Staff Report, 
Monitoring Software on Your PC: Spyware, Adware, and Other Software, 
released Mar. 2005, is available at http://www.ftc.gov/os/2005/03/
050307spywarerpt.pdf.
    \4\ At the FTC workshop, there was ``broad agreement that spyware 
should be defined to include software installed without adequate 
consent from the user,'' yet there remained ``substantial differences 
of opinion as to what distributors must do to obtain such consent.'' 
See FTC Staff Report, supra note 3, at 4-5. In addition, there was 
agreement that ``to avoid inadvertently including software that is 
benign or beneficial, the term spyware should be limited to software 
that causes some harm to consumers,'' although there were ``substantial 
differences of opinion as to when software has caused the type and 
magnitude of harm to warrant being treated as spyware.'' Id. The FTC 
staff therefore concluded that ``these fundamental issues of consent 
and harm need to be resolved before any common definition of spyware 
can be developed.'' Id. at 5.
---------------------------------------------------------------------------
    The Commission's spyware law enforcement strategy focuses on three 
key questions. First, were consumers aware of the installation of the 
software on their computers? Second, what harm did the installation of 
the software cause? Third, how difficult was it for consumers to 
uninstall the software after it had been installed?
A. Did Consumers Know?
    A common problem with spyware is that it is installed on consumers' 
computers without their knowledge. Some spyware distributors use so-
called ``drive-by'' downloads to install their software on computers 
without even any pretense of obtaining consent. In FTC v. Seismic 
Entertainment, \5\ for example, the Commission alleged that the 
defendants exploited a known vulnerability in the Internet Explorer web 
browser to download spyware to users' computers without their 
knowledge. The FTC alleged that this was an unfair act or practice in 
violation of Section 5 of the FTC Act, and a Federal district court 
entered a preliminary injunction that prohibited the defendants from 
using this method to distribute their software.
---------------------------------------------------------------------------
    \5\ FTC v. Seismic Entertainment, Inc.,  No. 04-377-JD, 2004 U.S. 
Dist. LEXIS 22788 (D.N.H. Oct. 21, 2004).
---------------------------------------------------------------------------
    In other instances, software distributors may violate Section 5 of 
the FTC Act by failing to disclose clearly and conspicuously to 
consumers the software that is being installed. In FTC v. Odysseus 
Marketing, Inc., \6\ the defendants offered consumers a free software 
program that purported to make the consumers anonymous when using peer-
to-peer file sharing programs. The Commission alleged, however, the 
distributors failed to disclose to consumers that this program, in 
turn, would install other, harmful software on their computers. The 
Commission recently filed a complaint in Federal court alleging that 
this failure to disclose was deceptive in violation of Section 5 of the 
FTC Act, and we are awaiting a ruling on our motion for a temporary 
restraining order. Similarly, in the Advertising.com, Inc. case, \7\ 
the respondents allegedly offered free security software, but failed to 
clearly and conspicuously disclose to consumers that bundled with it 
was software that traced consumers' Internet browsing and force-fed 
them pop-up advertising. The Commission recently issued a final consent 
order to resolve administrative complaint allegations that this failure 
to disclose was deceptive in violation of Section 5 of the FTC Act.
---------------------------------------------------------------------------
    \6\ FTC v. Odysseus Marketing, Inc.,  No. 05-CV-330 (D.N.H. filed 
Sept. 21, 2005).
    \7\ In the Matter of Advertising.com, FTC File No. 042 3196 (filed 
Sept. 12, 2005), available at http://www.ftc.gov/os/caselist/0423196/
0423196.htm.
---------------------------------------------------------------------------
    The Commission's spyware law enforcement actions reaffirm the 
principle that consumers have the right to decide whether to install 
new software on their computers. Acts and practices that undermine 
their ability to make this choice will be vigorously prosecuted.
B. Substantial Harm to Consumers
    As the Agency learned at the workshop, and through our enforcement 
actions and subsequent investigations, spyware can cause a broad range 
of injury to consumers. The harm from spyware may vary significantly in 
both type and severity.
    The allegations in the Seismic case describe a prime example of 
software causing several types of serious harm to consumers. The 
software allegedly changed the consumer's browser home page and default 
search engine, displayed an incessant stream of pop-up ads, and caused 
the user's computer to malfunction, slow down, or crash. But perhaps 
the most serious harm alleged was that the spyware secretly installed a 
number of additional software programs, including programs that could 
monitor Internet activity and capture personal information entered into 
online forms.
    Another example of serious harm to consumers allegedly caused by 
spyware arose in the Odysseus case. According to the Commission's 
complaint, the defendants surreptitiously install a spyware program 
called ``Clientman `' on the computers of consumers. Clientman, in 
turn, installs a number of adware and other programs. It also replaces 
or reformats Internet search engine results, generates pop-up ads, and 
captures and transmits information, which may include personal 
information.
    In the Advertising.com case, the Commission alleged that software 
bundled with free security software collected information about 
consumers, including the websites they visited, and then was used to 
send a substantial number of pop-up ads. Although the harm to an 
individual consumer from receiving such pop-ups ads may be less 
egregious than the harm in other FTC spyware cases to date, the harm to 
consumers in the aggregate from these pop-up ads was sufficient to 
warrant law enforcement action. The Commission alleged a violation of 
Section 5 of the FTC Act because the presence of bundled adware that 
collected information about consumers' computer use and led to numerous 
pop-up ads clearly would have been material to consumers in determining 
whether to install the free security software.
    As stated in the FTC staff spyware report, it is the combination of 
lack of knowledge and consumer harm that makes certain installation of 
software illegal under the FTC Act. \8\
---------------------------------------------------------------------------
    \8\ See generally,  FTC Staff Report, supra  note 3, at 20-21.
---------------------------------------------------------------------------
C. Uninstalling and Deleting Spyware Problems
    As described above, spyware often is installed without consumers' 
knowledge and causes consumers substantial harm. This type of 
installation should not occur, but once it has, consumers should be 
able to uninstall or disable such software. Unfortunately, the FTC's 
law enforcement experience and research shows that some software 
distributors take improper advantage of consumers' concerns about 
spyware and market bogus anti-spyware tools. In addition, in the FTC's 
experience, some spyware programs are difficult to identify and 
uninstall or disable.
    Many consumers who want to determine whether there is spyware on 
their personal computers acquire and run an anti-spyware program. An 
anti-spyware program usually identifies each software program that it 
concludes is spyware and then gives the consumer the option of deleting 
it. Some software distributors, however, take advantage of consumers 
looking for anti-spyware products by falsely representing to consumers 
that spyware resides on their computers and making false claims about 
the ability of their products to remove spyware. In two recent cases, 
FTC v. MaxTheater and FTC v. Trustsoft, \9\ the FTC alleged that the 
defendants made false claims to consumers about the existence of 
spyware on their machines. According to the FTC's complaint, the 
defendants then used these false claims to convince consumers to 
conduct free ``scans'' of their computers. These scans identified 
innocuous software as spyware, helping to persuade consumers to 
purchase defendants' spyware removal products at a cost of between $30 
and $40. Moreover, the FTC alleged, the defendants claimed their 
spyware removal products could effectively uninstall many different 
types of known spyware programs, but the defendants' products did not 
perform as promised. The Commission filed actions alleging that the 
perpetrators of these scams violated Section 5 of the FTC Act, and the 
courts have entered preliminary injunctions in both cases that prohibit 
the claims.
---------------------------------------------------------------------------
    \9\ FTC v. MaxTheater, Inc.,  No. 05-CV-0069 (E.D. Wa. filed Mar. 
7, 2005), available at http://www.ftc.gov/opa/2005/03/maxtheater.htm; 
FTC v. Trustsoft, Inc., No. H-05-1905 (S.D.Tex. filed May 31, 2005), 
available at http://www.ftc.gov/opa/2005/06/trustsoft.htm. 
---------------------------------------------------------------------------
    Software falsely billed as an anti-spyware product certainly can 
make it difficult for consumers to identify and uninstall or disable 
spyware programs. Furthermore, even if consumers can identify spyware 
programs, some of them are particularly difficult to remove or disable. 
In the Odysseus case, the complaint alleged that consumers could not 
uninstall the software through any reasonable means, such as by using 
the standard ``Add/Remove'' program on the Microsoft Windows operating 
system. According to the Commission's complaint, although the 
defendants purport to provide instructions for uninstalling the 
program, those instructions are not only extremely difficult for 
consumers to find, they simply do not work. The complaint alleged that 
the defendants' failure to provide users with a reasonable means to 
locate and remove the program is an unfair act or practice in violation 
of Section 5 of the FTC Act.
    The FTC's law enforcement actions under Section 5 of the FTC Act 
have focused on preserving consumers' ability to decide what software 
programs to install and retain on their computers, and preventing 
substantial harm from software programs installed or remaining against 
the consumers' wishes.
III. Additional Steps to Address Spyware
    Given the prevalence of spyware and the consumer harm it inflicts, 
the FTC has made spyware investigations and prosecutions an enforcement 
priority, and we will continue to file law enforcement actions against 
those who distribute spyware in violation of the FTC Act. The 
Commission would like to emphasize four additional measures that it 
believes would enhance its efforts to combat the dissemination of 
spyware.
    First, the FTC supports legislation that would enhance its ability 
to investigate and prosecute spyware distributors that are located 
abroad or who try to mask their location by using foreign 
intermediaries to peddle their scams. Webroot, a well-known anti-
spyware product distributor, recently reported that a majority of 
spyware programs distributed to United States consumers come from 
foreign distributors. \10\ In the FTC's investigations, staff finds 
that, regardless of where spyware distributors are physically located, 
they often use foreign Internet service providers, web hosting 
companies, and domain registrars to create their websites, so that it 
is difficult for the agency to track down who is ultimately 
responsible.
---------------------------------------------------------------------------
    \10\ Webroot Software, Inc., State of Spyware Q2 2005, released 
Aug. 2005, at 26, available at http://www.webroot.com/land/
sosreport.php.
---------------------------------------------------------------------------
    The FTC's ability to pursue distributors of spyware, spam, and 
other Internet threats to consumers would be significantly improved if 
the Congress were to pass the U.S. SAFE WEB Act, introduced by Chairman 
Smith in the Senate as S. 1608. The Act makes it easier for the FTC to 
share information and otherwise cooperate with foreign law enforcement 
officials. The Internet knows no boundaries, and it is critical to 
improve the FTC's ability to work with the officials of other countries 
to prevent online conduct that undermines consumer confidence in the 
Internet as a medium of communication and commerce.
    Second, the Commission will continue to coordinate with its Federal 
and state partners who are starting to bring their own law enforcement 
actions against spyware distributors to make law enforcement as 
effective as possible. At the Federal level, the Department of Justice 
is able to prosecute criminally those who distribute spyware in certain 
circumstances. In August 2005, for instance, the Department announced 
the indictments of the creator and marketer of a spyware program called 
``Loverspy `' and four others who used the program to break into 
computers and illegally intercept the electronic communications of 
others. \11\ At the state level, state attorneys general are bringing 
civil law enforcement actions. Federal criminal and state law 
enforcement actions are a critical complement to the FTC's law 
enforcement actions.
---------------------------------------------------------------------------
    \11\ Press Release, Department of Justice, Office of the United 
States Attorney, Southern District of California Carol C. Lam, News 
Release Summary (Aug. 26, 2005), available at
http://www.usdoj.gov/usao/cas/pr/cas50826.1.pdf.
---------------------------------------------------------------------------
    Third, the FTC and others need to continue to play an active role 
in educating consumers about the risks of spyware and anti-spyware 
tools. The FTC has issued a Consumer Alert specifically on spyware, as 
well as four other Alerts addressing other online security issues such 
as viruses and peer-to-peer file sharing. The Spyware Alert lists clues 
that indicate spyware may have been installed and also discusses 
measures consumers can take to get rid of spyware or to reduce their 
chances of getting spyware in the first place. The Spyware Alert has 
been accessed over 100,000 times since it was released in October 2004, 
and the tips it includes have been repeated in dozens of print and 
broadcast media stories.
    And, just last week, the Commission launched a new consumer 
education initiative, OnGuard Online. Over the past few months, the FTC 
staff has taken a broader look at its education materials and tactics 
related to cybersecurity, online privacy, and Internet fraud, and 
updated its messages and outreach strategies to better educate computer 
users about these important issues. The FTC's new website--
OnGuardOnline.gov--has general information on online safety, as well as 
sections with specific information on a range of topics, including 
spyware. This structure allows us to add to the site as new topics 
arise. The spyware module includes up-to-date information, as well as 
interactive features like quizzes and videos. The FTC has also printed 
a million copies of a brochure, ``Stop Think Click: 7 Practices for 
Safer Computing,'' with information on spyware and other computer 
safety topics. The site and the brochure have information on various 
technologies, but the agency is also emphasizing behavioral changes 
that computer users can make to stay safe online--for example ``protect 
your personal information,'' and ``know who you're dealing with.'' By 
taking this approach, the FTC can ensure that the tips remain relevant 
even as technology evolves.
    Our partners in the OnGuard Online initiative include: the 
Department of Homeland Security, the U.S. Postal Inspection Service, 
the Department of Commerce, Technology Administration, the Internet 
Education Foundation, the National Cyber Security Alliance, the Anti-
Phishing Working Group, TRUSTe, iSafe, AARP, the National Consumers 
League, and the Better Business Bureaus. In an effort to ensure maximum 
distribution of these materials, we have not branded them as our own. 
Instead, we are encouraging any organization interested in computer 
security to link to OnGuardOnline.gov, distribute our free brochure, or 
reprint the OnGuard Online materials.
    Fourth and finally, the Commission believes that legislation 
granting the Commission authority to seek civil penalties against 
spyware distributors may be useful in deterring the dissemination of 
spyware. As described above, the Commission has challenged conduct 
related to spyware dissemination as unfair or deceptive acts or 
practices in violation of Section 5 of the FTC Act. Under Section 13(b) 
of the FTC Act, the Commission has the authority to file actions 
against those engaged in this conduct in Federal district court and 
obtain injunctive relief, including monetary relief in the form of 
consumer redress or disgorgement of ill-gotten profits. However, it may 
be difficult in some instances for the FTC to prove the sort of 
financial harm to consumers needed to order consumer redress, or the 
ill-gotten gains necessary to order disgorgement. A civil penalty is 
often the most appropriate remedy in such cases, and serves as a strong 
deterrent.
IV. Technological Solutions
    Reducing the problems associated with spyware and other malware 
will require the efforts of government, consumers, and industry acting 
both individually and in concert. As in other high-technology areas, 
the best and most comprehensive responses to misuse of technology will 
often be improved technology. At this time there are certain 
technologies consumers can use to help protect themselves, but none is 
completely effective and further developments are needed to enhance 
security.
    The primary technological tools that consumers can use right now to 
protect themselves from spyware are detection programs. These programs 
can scan consumers' computers, inform them whether there is spyware, 
and offer them the option of disabling it, deleting it, or leaving it 
alone. To be effective, however, these programs must be updated on a 
regular basis. In addition, they are inherently variable depending on 
what they classify as ``spyware.'' Furthermore, they only detect 
spyware once it has been installed; they do not prevent its 
installation. Some Internet service providers have made spyware 
scanners and removers available to their subscribers. Firewalls also 
provide some protection from spyware, but, like scanners, they do not 
prevent spyware from being installed. Rather, they alert consumers if 
installed spyware attempts to send out information it has collected.
    Other technological solutions at the browser and operating system 
level are being developed. The Commission's experience in other 
technological areas suggests that market forces will provide the high-
tech industry with incentives to develop technological solutions, 
although it is not clear exactly what that technology will be or when 
it will be available.
V. Conclusion
    The FTC will continue to execute aggressive law enforcement and 
innovative consumer education programs in the spyware arena. The FTC 
thanks this Committee for focusing attention on this important issue, 
and for giving me an opportunity to discuss the Commission's 
enforcement program. The Commission looks forward to working with the 
Committee on the problem of spyware.

    Senator Smith. Thank you Ms. Majoras. I assume from your 
testimony that the FTC could use some more authority, because 
it supports the Allen bill that I've introduced with him. Is 
that accurate, you could use some more authority to do more 
rulemaking on this issue?
    Ms. Majoras. Well, we could, as you and Senator Allen have 
pointed out, we do believe that we have legal authority to 
attack spyware and we've already done it in five different 
cases, but we would like additional authority to work with our 
counterparts overseas, we think that's absolutely critical and 
we think we really could use civil penalty authority to assist 
us in bringing actions and remedying them.
    Senator Smith. And how about more resources? If you had 
your druthers would you be getting more authority or more 
resources to prosecute cases?
    Ms. Majoras. That's always a tough question whether we need 
more resources. We work very hard on the budget process with 
Congress to get whatever resources we think we're going to need 
for the year. It's tough for me to turn down more resources if 
they're being offered. But I don't think--resources have been 
less a problem than I think, folks are concerned about the 
bigger problem, which has been finding the folks who are 
distributing the spyware and then being able to serve them. 
They obviously can hide behind the Internet, they can skip 
town, they can skip the country, they go to other countries and 
hide, and that has actually been the biggest problem. We are 
using our resources as wisely as we can. We are squeezing every 
bit we can out of every dollar, and our anti-spyware program is 
part of the larger program that includes spam, and Internet 
fraud, on which we're devoting substantial resources.
    Senator Smith. What percentage would be coming into our 
country from abroad, and what percentage starts here in the 
United States?
    Ms. Majoras. We don't have exact percentages, it's very 
hard to tell. But certainly we think a great majority of 
spyware is either coming in from outside the United States, or 
is making use of a foreign intermediary in some way to attack 
consumers in the United States.
    Senator Smith. And in the global economy in which we live, 
you need more authority to deal with the international 
component, I think that has been very clearly demonstrated.
    Senator Nelson.
    Senator Bill Nelson. Good afternoon Madam Chairman. Tell me 
if you agree with the following statement of principles, that 
software should not be installed without a consumers knowledge 
and consent.
    Ms. Majoras. If it harms consumers, I do agree with that.
    Senator Bill Nelson. Consumers should know who is 
installing the software on their computer.
    Ms. Majoras. Generally, yes.
    Senator Bill Nelson. Consumers should have the ability to 
completely remove software from their computers.
    Ms. Majoras. Again, most of it, yes.
    Senator Bill Nelson. If software is going to collect 
information about a consumer, the software should inform the 
consumer first.
    Ms. Majoras. Generally yes.
    Senator Bill Nelson. If software is going to cause ads to 
appear it should make clear what is causing the ads.
    Ms. Majoras. That one is a little bit trickier, we have 
taken that on a case-by-case basis.
    Senator Bill Nelson. In your testimony, we're going to--
you've addressed it and we've got to confront the question of 
preemption. Do you think that it's important to preserve 
general state consumer protection laws as potential state-level 
tools against software?
    Ms. Majoras. We do. In almost any context, we support 
allowing the state attorneys general to continue to enforce 
their consumer protection statutes. Having said that, there are 
certainly instances in which businesses really need 
consistent--if businesses are going to get guidance, we all 
benefit if it's consistent across the Nation.
    Senator Bill Nelson. Do you think it would be helpful to 
have some baseline standards for what kind of behavior is 
acceptable, what disclosures should be given to consumers, and 
a statement of the right to uninstall software?
    Ms. Majoras. Well, with respect to disclosures, the FTC has 
provided general guidance to companies for a number of years in 
the form of something we call Dot Com Disclosures, so we've 
already provided some general guidance. Our only concern about 
making the guidance too specific Senator Nelson, is that the 
landscape keeps changing and those who insist on perpetrating 
fraud and harming consumers find new ways to do it. And so the 
concern with being too specific about what is permitted and 
what isn't, not only is you have to get the words exactly 
right, so that you don't prevent what should be legal conduct, 
but also we have to worry about the future, and we don't want 
to bring a case, and only to be told, well, because that 
particular practice wasn't specifically listed in the piece of 
legislation, therefore the FTC cannot attack it.
    Senator Bill Nelson. I understand. I'm talking about more 
baseline standards, on behaviors, on disclosures, and on the 
right to uninstall.
    Ms. Majoras. We think the FTC has put a lot of that out 
there, but yes, there's no question that business can always 
use guidance, and those businesses who actually have an 
interest in complying with the law.
    Senator Bill Nelson. And give us your opinion about the 
basic right of a consumer to have the ability to remove 
software from his or her computer?
    Ms. Majoras. Well, we've actually brought cases in which we 
have alleged violations of the FTC Act because consumers do not 
have that right, including the case that I mentioned earlier 
today, Odysseus Marketing. So we do think it is a violation if 
software is downloaded to a consumer's computer that is causing 
some harm, and the consumer cannot find a reasonable means to 
remove it.
    Senator Bill Nelson. Thank you.
    Senator Smith. Senator Burns.
    Senator Burns. Madam Chairman, thank you again for coming 
today. You're probably aware that there are several industry 
groups working on definitions of spyware. It always seems like 
when we get into these kind of situations we all define the 
same thing in different ways and usually definitions are what 
lawyers make a living at, and enforcement becomes more 
difficult. To what degree, do you think the FTC can work with 
these industry groups, and to get efforts underway and do you 
think it is important that we have a public rulemaking process? 
We all say awareness is everything, and a public process in 
which we make the rules and then we define the terms. What's 
your attitude toward a situation like that?
    Ms. Majoras. Well, I certainly think that working together 
with industry is critical in attacking spyware and obviously if 
legislation is being considered it's critical because these 
folks are the experts. And they can tell us, not only explain 
to us not only what's out there today, but they're also 
thinking several steps ahead. And that can be very important if 
we're trying to put in place rules that are going to work on a 
going forward basis. So I think that can be very important. One 
thing I would caution against though is I know that many in 
industry have been anxious to really come up with the 
definition of spyware. And I think part of the reason why it's 
been difficult to come up with a definition that everyone can 
agree on is again, because we have a bit of a moving target. 
And so what we've tried to do at the FTC is we're really 
looking at two things: whether the software has been downloaded 
without the consumer's permission, and causes some substantial 
harm to the consumer; that is really what we've been operating 
under. Call it spyware, call it adware, call it malware, that 
is what we have been looking at when we bring a case.
    Senator Burns. And also on the awareness, that same thing, 
now you've got some proceedings going on for consumers. Can you 
tell us how those proceedings are going, were there fines 
levied where if individual consumers, their computers were 
hurt, or crashed, did they get compensated, their computers 
back up and running again, or new hard drive, or whatever. Did 
they get their money back on their software of whatever, can 
you give us some kind of an idea of the results you've had in 
these proceedings?
    Ms. Majoras. Yes Senator, we've brought five cases since 
last October, both the first case, and the last case we brought 
are still in litigation. In the first case we brought we were 
able to get a preliminary injunction against the conduct and 
that was a case in which we alleged in the complaint that in 
fact, yes, the purveyor of the spyware hijacked the consumers' 
computers and changed their settings and the like, changed 
their home pages, and downloaded personal information. That 
case is still in litigation, similarly obviously we've just 
announced the case we filed last week, in which spyware was 
downloaded without consumers' permission and again, essentially 
in this case what we allege in the complaint is that it has 
taken over the consumer's computer. That's still in litigation. 
We've brought a couple of cases against those who claim that 
they're selling an anti-spyware solution, when in fact it's a 
solution that doesn't work, and so in those two instances both 
of those respondents did settle those cases with us, and we 
were able to get some consumer redress, if I recall correctly.
    And we brought one additional case in which the respondent 
advertised a free download of security software. But then 
didn't tell consumers that if they downloaded this free 
security software they would also get adware attached to their 
computer, so then they would be barraged with pop-up ads and 
the like and that case also settled.
    Senator Burns. In other words they used the spy block 
technology to implant their own adware stuff without telling 
the customers, is that correct?
    Ms. Majoras. I'm not sure which technology they used, but 
without sufficient disclosure to the consumer they did download 
adware to the computer.
    Senator Burns. Now since these proceedings have been filed 
and you've been in them, are there any surprises about--do you 
have resources to take the case to final?
    Ms. Majoras. We do have resources I think to take these 
cases to final. The biggest surprises probably have been--
really probably came in the beginning. We started trying to 
figure out a way how we were going to investigate these cases 
and we infected two of our own computers so badly with spyware 
that they couldn't be used anymore and so we learned a lot. And 
so one of the things we've done during this time period as 
we've been bringing these cases is, we've bought some new 
computers, some new software, and some new hardware to assist 
us in going forward. As I said, we're learning as we go through 
this.
    Senator Burns. Well, I thank you for your work. And I don't 
think there's a person up here today that doesn't want to get 
you some legislation and empower with you a little more power 
than you have now, because I think you're on the right track. 
And also the differences that we have, we'll get those worked 
out and I would hope that we could have something on the 
President's desk and for you to look at pretty quickly. So 
thank you for your testimony. I read your testimony, and I 
concur in a lot of the subjects that you brought up there, so 
thank you for coming today.
    Mr. Chairman, thank you.
    Senator Smith. Thank you Senator Burns.
    Senator Allen.
    Senator Allen. Thank you Mr. Chairman, four different 
things, trying to get some clarification here. One is 
authority, second is resources, third is penalties, and fourth 
is what jurisdiction or standards we should be applying. 
Insofar as authority, and I'll ask you some questions, it seems 
like you have all the authority you need. Resources, you say 
you don't need more, but you--then on authority, the area that 
you need it more in, is not necessarily domestic but 
international. Resources you say you have enough, penalties, 
you need stronger penalties, particularly civil penalty 
standards. The question is whether you have 50 or 40 different 
standards, or a standard for all the United States and its 
territories. Now has there ever been a situation where the FTC 
could not bring a case because you don't have sufficient 
authority under existing laws, other than, aside from the U.S. 
SAFE WEB Act, which is incorporated in part, and this is 
Senator Smith's measure. Is there any new authority that the 
FTC needs if you find in other words that somebody regardless 
of what their doing, if it's fraudulent and deceptive you can 
prosecute them, if it is misleading, if it is false and so 
forth. Has there ever been a situation where you didn't have 
the legal authority to prosecute within the United States?
    Ms. Majoras. With respect to spyware, I'm not aware of any, 
no.
    Senator Allen. So you feel that other than internationally, 
but within these orders of the United States, and our 
territories, you feel the FTC has the authority regardless of 
what the technology or method of deception is utilized?
    Ms. Majoras. Well, we've successfully brought cases, we've 
got more in the pipeline. So that's correct. Other than what 
I've said about civil penalty authority, yes.
    Senator Allen. What you do want is you want more civil 
authority. Civil penalties, I guess you could call that 
authority as well.
    Ms. Majoras. We think that could be very helpful.
    Senator Allen. And that's included in the measure the 
Chairman and I have introduced. Now if the Congress codified 
prescriptive definitions of illegal behavior that are specific 
to current technology, could we run the risk that this law 
could be obsolete as new technology continues to develop.
    In other words by defining a specific illegal behavior, are 
we creating loopholes for spyware purveyors who figure out ways 
to get around the law?
    Ms. Majoras. Well, that is possible. I mean, obviously 
Section 5 of the FTC Act would still be in effect, so we would 
hope that there was something that [inaudible] cracks, but we'd 
be able to use our broad authority to go after them. But what 
we wouldn't want is for a court to say, well it's not on the 
list, so therefore, sorry FTC, you can't go after them. That's 
really our only reservation.
    Senator Allen. Because in effect, you could end up with a 
safe harbor for those using these fraudulent deceptive 
practices if they're not on that list, the court could say, 
well they're not on the list, so therefore you cannot 
prosecute.
    Ms. Majoras. It's possible, we can't say for sure that's 
how a court would interpret it.
    Senator Allen. Now so far, on the issue of jurisdiction, in 
the standard, so far 18 states have enacted legislation 
regarding spyware and many new laws are pending in several 
states. Since spyware, clearly by its nature is national, in 
fact it's international in its scope. Do you agree that a 
national framework is necessary to ensure a patchwork of state 
laws do not unnecessarily confuse and burden consumers and 
legitimate software providers?
    Ms. Majoras. I think it's possible, depending on the 
differences among the various state laws that--probably 
consumers, less so--but that those who are actually trying to 
comply with the law. I mean they simply can't in the Internet 
context comply with multiple standards. I mean basically they 
would have to figure out what the highest standard is, I 
believe, and then comply with that one. And so--and if that 
weren't the Federal, if there are Federal standards, and that 
ends up not being the highest one, then I suppose whichever 
state had the highest standard would become the de facto 
standard for the Nation.
    Senator Allen. Well, for your enforcement would it not be 
best to have a--the best standard, the strongest standard, the 
most effective standard that's set for the Nation by the 
Federal Government and Congress?
    Ms. Majoras. Well, I think a consistent standard would help 
all of us. And the fact of the matter is the state attorneys 
general are critical partners to us in this fight, but if we're 
all singing from the same hymn book sort of speak, I think we 
can be very effective.
    Senator Allen. Well, our measure does have the attorneys 
general of the states involved, with a national standard, but 
have them helping enforce it, because in some cases the Federal 
Government can't do it all.
    Ms. Majoras. That's exactly right. We would want the states 
to absolutely have authority.
    Senator Allen. All right. Now on the questions of notice, 
and the notice and consent regime. According to this July 2005 
Pew Internet and American Life Project, 73 percent they found 
according to them, 73 percent of Internet users do not always 
read user agreements, privacy statements, or other disclaimers, 
before downloading, or installing programs. There are some of 
us who will click through things real quickly because you want 
to read something. In fact, one study of a user agreement 
included a clause that promised $1,000 to the first person to 
write in and request that $1,000. The agreement was downloaded 
more than 3,000 times before somebody finally read the fine 
print and claimed the reward. Now do you believe that 
subjecting the entire software industry to a new notice and 
consent regime will help combat spyware?
    Ms. Majoras. Overall, no, I don't think that would be the 
most effective tool. Our experience, while I don't have 
statistics, comports very closely with the conclusion of that 
survey. And that is, for better or for worse, consumers don't 
read these disclosures, and the more they are bombarded with 
similar disclosures, the less likely they are to read them. And 
what our concern has been is that we could have a spyware 
distributor who is distributing spyware that is very, very 
harmful to consumers, but then can just say, well I disclosed 
it to consumers that this is what I was going to do, so too bad 
for them. And while that has, no question, sensational appeal, 
because none of us want to be extraordinarily paternalistic to 
American consumers. When we know that they don't read these 
disclosures when they're downloading software, it makes it hard 
to say that's what we think would truly, would truly protect 
consumers.
    What we're doing in our casework, is looking at disclosures 
on a case-by-case basis to see if we think they're adequate.
    Senator Allen. Thank you, Mr. Chairman.
    Senator Smith. Thank you, Senator Allen.
    Senator Allen. Thank you, Madam Chairman.
    Senator Smith. To Senator Allen's point and your answer, 
that you today announced the Odysseus case that you're 
pursuing, and is this not a company that offers through peer-
to-peer enticements to children, free music and other things 
that they readily go past the disclosures to get what's free, 
but in the end it's maybe very promotional, and a very 
degrading thing?
    Ms. Majoras. It's similar, they were working in the peer-
to-peer realm. And the representation they made was that by 
downloading their software, your peer-to-peer presence would be 
anonymous and no one would be able to trace you. That, we 
alleged, isn't true. And then, in addition, they've downloaded 
a lot of other software, which in essence as we say in the 
complaint, just to summarize it here, hijacks the consumer's 
computer.
    Senator Smith. Isn't that already illegal?
    Ms. Majoras. Yes. We've filed a suit under Section 5 of the 
FTC Act.
    Senator Smith. Do you think you'll win, if it's already 
illegal? Because I want to make sure it's illegal.
    [Laughter.]
    Ms. Majoras. Well, I certainly understand that Senator, and 
I can't--I couldn't tell you that nobody would ever challenge 
our authority or that a judge would never--you know could never 
find that we didn't have such authority, but it's not been a 
problem to date. And we feel that this isn't a close call under 
Section 5 of the FTC Act and so we brought the case.
    Senator Smith. So the people who are maybe here, or 
interested in it. I understand that the software actually 
changes your search results that consumers get from search 
engines, like Google and Yahoo, and that this is done without 
the consumers knowledge.
    Ms. Majoras. That's exactly right. I mean we don't think 
that they have a way necessarily of knowing. So as you know 
it's important to some, to be the first in a Google search 
results, or what have you, and this apparently can change the 
results around, but again, no, the consumers wouldn't 
necessarily know that was even happening to them.
    Senator Smith. Well, if you find out it isn't illegal, let 
us know.
    Ms. Majoras. You would be the first call we would make.
    Senator Smith. I mean our bill does address this very kind 
of thing. And so you know, that's why we keep asking you if you 
need any more resources, do you need more authorities? Because 
this really gets to the heart of what we're trying to 
accomplish for the protection of American consumers without 
stifling innovation in future technologies. Do you see a way? I 
mean you've heard all of us up here, all agreeing there's a 
problem we want to fix, and the difference and the difficulty 
is in the breadth of how we would go about it. I guess as you 
evaluate the two different bills that are represented here, is 
there a way to merge them in your mind?
    Ms. Majoras. Well, I think there's probably, there probably 
is a way to bring it together and one--I mean if we could 
classify them, your bill restates the FTC's authority to attack 
software, but in a more general way. The other bill tries to be 
a bit more specific about it. And I would just caution that if 
specifics are going to be added to any legislation that becomes 
law that it is made absolutely clear that other types of 
conduct may also be illegal, within this same family and that 
the FTC's authority is not being narrowed by this.
    Senator Smith. And if we leave it broad, to the degree you 
need to make it narrower, do you have rulemaking authorities to 
make it narrower?
    Ms. Majoras. Well, we would have rulemaking authority if 
you gave it to us, if it was needed. The one area where I think 
it's difficult to reconcile is with respect to notice. Which 
again I agree has very--has facial appeal, it does to me too, 
but I just don't--our experience is it doesn't actually protect 
consumers. And since that's our job, it's hard for me to 
support that.
    Senator Smith. And there's a lot of advertising that is 
actually promoting very valuable things, and useful products 
and we don't want to get in the way of that.
    Ms. Majoras. No. No, we don't want to get in the way of it, 
and in fact there may be First Amendment issues if we tried to 
go too far.
    Senator Smith. As I understand the U.S. SAFE WEB Act which 
you have indicated your support for, its provisions are really 
not all that new or unusual, there are other agencies in the 
government that already have these powers, is that your 
understanding?
    Ms. Majoras. Absolutely. The SEC, the CFTC, and banking 
agencies.
    Senator Smith. You need them too?
    Ms. Majoras. We do, I can't emphasize it enough Chairman 
Smith.
    Senator Smith. Well, Chairwoman Majoras, thank you very 
much. Yes, please.
    Senator Allen. My time has expired but may ask some 
questions.
    Senator Smith. Yes, please go ahead.
    Senator Allen. I just want to follow up on your good 
probative questions. Your caution trying to figure these things 
out, several things that you asked for, you asked for the 
international authority, the U.S. SAFE WEB Act, that's part of 
our measure, it is not part of Senator Burns' measures. So that 
was one thing where you wanted regular authority. That probably 
can be merged together. We do have a fundamental difference on 
the jurisdiction and how you define illegal behavior, which 
right now is very broad. If it's fraudulent or deceptive, if 
it's misleading, you know, it's illegal which is what you'd 
want. You could limit yourself by prosecutorial discretion I 
suppose, and in a court the trier of fact would say, well no 
that isn't deceptive. As opposed to specifying a bunch of 
different specific illegal methods, which could end up with a 
safe harbor if it's not on that list. And maybe the solution to 
that, is to say well these are illegal but they are not the 
only ones that are illegal. Anything is, but then the other 
side feels like all right, we've at least specified these. I 
suppose that could be worked out. The notice issue is one that 
I do think is irreconcilable. Because as I was--there was a 
reason I asked that question, and why some 3,000 hits are 
getting $3,000. Folks just simply don't read it, they don't 
have time for it. Even looking on this--who's going to go 
through--now I think it's helpful for those in the IT 
departments of companies, somebody's going through all that, 
and seeing which are good spyware blocker programs. But a 
normal person in their home is just generally not going to go 
through all that. So there does need to be a better business 
bureau approach. And I see that's what that is. Now you get 
into the issue of jurisdiction. That's a key one as to whether 
you have a national standard, or 50 or 40 different states 
standards. I think to make companies to have to comply with 40 
different standards, and maybe different nuances and different 
case law and all the rest makes it very difficult. To me that 
is not irreconcilable difference. Now I think it's important to 
respect the rights, and prerogatives of the states, and 
prosecution and that's why in our measure we do have the 
attorneys general brought in.
    You wanted also the civil fines, which will be helpful. The 
one thing I find interesting though was your answer on the 
question of, you don't need any more resources. Here's my 
perspective of that. Is that this is so pervasive and you have 
nearly 50 percent of all computers being hit with this spyware, 
and it's great that you've brought these big cases, and you've 
knocked down organizations, spyware organizations and you say 
how difficult it is to prosecute and find these people, well if 
you're dealing with normal criminal behavior and you have a 
certain amount of resources, if you actually had more 
detectives so to speak, more investigators, more funds if there 
were drug dealing for undercover agents, or making drug buys, 
or--those resources do matter in combating illegal drug 
activity.
    So I find it interesting that you say that you don't need 
any more resources when this is such a big pervasive problem of 
this fraudulent and deceptive activity. If you have the civil 
penalties and I don't know the answer to this, but where do the 
fines, if fines are--does that go to the general fund, or does 
that go--would that go to further law enforcement efforts?
    Ms. Majoras. I believe it goes to the general fund, yes. It 
goes into the Treasury. It goes into the Treasury.
    Senator Allen. All right. In drug dealing, with asset 
forfeiture, for those assets that are traceable to illegal drug 
dealing, that actually goes Mr. Chairman to law enforcement so 
that they use it for undercover drug buys, paying overtime, 
surveillance costs, sometimes paying informants for example, 
it's like catching the shark and cutting it up for bait. Use 
the assets to catch more sharks. Why do you say that you don't 
need more resources with--and maybe this is what the 
Administration wants you to say and I understand that, having 
been a Governor, I expected all my agency heads to tow the 
line. But with something that is so pervasive, and obviously of 
bipartisan concern, and not just us, but obviously to the 
American people and to the technology community generally and 
the Internet, why would it not be helpful for you to have more 
personnel to actually get after this obviously growing, 
disruptive, illegal behavior?
    Ms. Majoras. Well, I appreciate the question and, no, 
Senator, nobody's asked me to tow any line on this. You know 
we've actually been very pleased. We think as other agencies 
have been cut back in the last couple of years, as some belts 
have been tightened, we think that Congress has been very 
generous with us, which we appreciate and that they recognize 
the importance of our work.
    Look, if you give us more resources, we'll----
    Senator Allen. What would you do with them?
    Ms. Majoras.--certainly use them. Well, probably one of the 
things I would do, is I would hire some more tech experts, who 
can help us with some of the difficulties in actually hunting 
down these folks, or in helping us find ways to push industry 
in the right direction. Because I do think that ultimately 
technology will--is what will help us prevail. So I think we 
can. But the only issue I would say with respect to having a 
very large amount of new funds, which are actually earmarked 
for a particular purpose, is that what tends to happen is then 
if priorities shift and change, because for example new spyware 
tools come out and that tends to be less a problem, and the bad 
guys, if you will, have moved on to something else, then we 
have to come back to you and say, look we have this pot of 
money, which you wanted us to use for this purpose, but quite 
frankly priorities have changed, and they would have even 
changed for you. And so that's part of something that we 
obviously would have to work with you on, Senator.
    But obviously our job is to enforce the laws that Congress 
passes and to take our lead from consumers first, and obviously 
you are the elected representatives who represent them. So if 
you want us to have more resources to send the message to us 
that I've got to put more investigators on this, then obviously 
we will do that.
    Senator Allen. Well, in the event you actually solve this 
problem quickly, obviously appropriations are annual. Even if 
appropriations actually get done in a timely manner, I suspect 
that the fines and forfeitures that you will glean from these 
added--not that the law enforcement is simply to gain money for 
the government, but I suspect with greater enforcement not only 
will you have the Internet being more useful and less 
aggravating and less--fewer computers shut down because they're 
clogged up with all of this spyware, is that you'll actually 
end up getting more fines and forfeitures, and assets seized 
than that $10 million over the period of this measure. And if 
you didn't need the money, you can always say, we need it more 
for something else. But I don't see this getting solved in the 
next few years. I think it could be ameliorated, I think it 
could be mitigated, but this is--it's too lucrative a business, 
illegal enterprise right now, and to the extent you drive it 
out of this country, you're still going to have it overseas, 
and that's why the U.S. SAFE WEB Act is so important and have 
the international community caring as much about this as we try 
to get the international community to care about intellectual 
property rights for example.
    Ms. Majoras. That's right.
    Senator Allen. To the extent you ever get it to that point, 
fine, we'll save some money there. And you're doing a great 
job, and you've had some good noteworthy cases, but you also 
recognize that it's just the tip of the iceberg in this illegal 
spyware enterprise.
    Ms. Majoras. Indeed, not only do we recognize it, but we 
would hate to raise expectations way too high, because we're 
going to keep at this. I mean, you know, we talk all the time 
about how the worst thing that could happen to us would be for 
our consumers to just simply lose faith in this wonderful new 
medium that we have that is the Internet. And we can't let that 
happen, and we have to--we really have to guard and protect 
consumer's confidence in it. So we're going to keep at it. But 
I point out the difficulties in tracking these folks down and 
so forth, only to remind us again that it won't be just law 
enforcement that's going to tackle this problem, we need new 
technology.
    And the good news is, that if we do get these additional 
international resources, we can leverage that. We spend a lot 
of resources trying to chase down people in countries where 
we're trying to hire lawyers who know what they're doing over 
there when we don't, and so on and so forth, and we could use 
our counterparts and vice versa, then we will be actually a lot 
more efficient even in our use of resources.
    So I appreciate your point Senator Allen.
    Senator Allen. Well, thank you. And thank you, Mr. 
Chairman, just understand Madam Chairman that the Chairman here 
and this Senator want to work with you and do this effectively. 
And we do feel that you need out of jurisdiction as you say, or 
added authority. And I do feel that you do need more resources 
to get the job done, and it shouldn't just be the government, 
it does need to be the technology industry. They are the ones 
who are the most creative in coming up with the firewalls, and 
the filters, and the ways to block unwanted spyware, or illegal 
spyware. There is some spyware which has--and you were very 
clever answering those questions of Senator Nelson. But you 
know in some cases it's not harmful, it's not deceptive and so 
forth. I do think it's going to take a concerted team effort on 
the part of the technology community and actually probably 
can--I just have faith in their innovative, creative 
capabilities to make sure the Internet stays a great invention 
for the dissemination of information and ideas, and commerce, 
and education, and tele-medicine, and in so many ways, 
improving our lives in commerce. So I thank you again Mr. 
Chairman for your leadership, look forward to working with you, 
and Madam Chairman, thank you for articulate principled 
leadership.
    Ms. Majoras. Thank you very much, Senator Allen.
    Senator Smith. And Madam Chairman, to Senator Allen's 
point, I think if you hear anything today it is that this is an 
enormous problem and it requires urgent effort, and so please 
know we're counting on you, we appreciate you, and we hope you 
convey to everyone at the FTC we appreciate their good work. We 
recognize in our mailboxes that there is growing alarm and we 
need to be ahead of it. So thank you, and with that we're 
adjourned.
    Ms. Majoras. Thank you very much, Senator.
    [Whereupon, at 3:40 p.m., the Committee adjourned.]

                            A P P E N D I X

Response to Written Questions Submitted by Hon. Frank R. Lautenberg to 
                        Hon. Deborah P. Majoras

Response to Questions One and Three
    Your letter poses two questions about the nature and efficacy of 
the FTC's consumer education efforts related to spyware. Your letter 
commends the FTC and industry for launching a new website, 
www.OnGuardOnline.gov., but expresses the concern that the website uses 
technical terms (e.g., updating operating systems, firewalls, and 
drive-by installations) that consumers, particularly seniors, may not 
understand. Your letter also cites statistics as to the prevalence of 
spyware on computers and asks about the Commission's short-term and 
long-term goals to decrease its prevalence through consumer education.
    The Commission shares your concern about the importance of 
educating consumers about problems in electronic commerce, including 
spyware. To inform consumers about spyware and other threats on the 
Internet, the Commission launched its OnGuard Online initiative, with 
the OnGuardOnline.gov website as its primary consumer education tool. 
The initiative was developed to address the need for a comprehensive, 
consistent set of educational messages for consumers. It incorporates 
the best learning of the Internet community and presents it in a 
complete and accessible format. In consultation with communications 
experts, it was designed to be usable by consumers with a broad range 
of familiarity with the Internet and technology. The comprehensive 
website uses interactive activities, articles, videos, and tips that 
address topics important to consumers, including ways that consumers 
can lower their risk of spyware infections, clues as to whether spyware 
is on their computer, and an informative spyware quiz. Consumers are 
also able to report via the website if they have been a victim of 
spyware.
    Because people learn in a variety of ways, the FTC has made the 
OnGuard Online information available in many forms. The 
OnGuardOnline.gov website includes video tutorials prepared by the 
Internet Education Foundation with visual instructions to ``click here, 
then here,'' to turn on the security features in various types of 
software. The site also presents a series of videos prepared by 
Microsoft with the information presented in an accessible format.
    Some consumers, including many seniors, may not be familiar with 
technical terms used to describe technology. The OnGuard Online 
initiative therefore uses plain language to describe technical 
concepts. For example, the OnGuard Online brochure explains that 
``[f]irewalls help keep hackers from using your computer to send out 
your personal information without your permission.'' In addition, the 
OnGuard Online bookmarks and posters have quick tips written in plain 
language, and the OnguardOnline.gov website includes an extensive 
glossary of computing terms, for consumers who need more information 
about the terms used. Finally, the AARP is a partner in the OnGuard 
Online initiative.

Response to Question Two
    Your letter asks whether it is deceptive to fail to disclose that 
spyware will be installed. Your letter also asks whether it is 
deceptive to disclose only in the end-user license agreement that 
spyware will be installed.
    It is well-established that a failure to disclose adequately 
material facts to consumers may be unfair or deceptive in violation of 
Section 5 of the FTC Act. The FTC has alleged a failure to disclose 
information in a number of Internet-related deception cases. \1\ The 
Commission staff also has issued a guidance document that provides 
advertisers with advice as to how to apply traditional FTC disclosure 
principles to the online environment, including advertising and 
marketing software on the Internet. \2\
---------------------------------------------------------------------------
    \1\ See, e.g., Juno Online Services, Inc., FTC Dkt. No. C-4016 
(June 29, 2001) (failure to disclose that some subscribers to its ISP 
service would incur long distance telephone charges while connecting to 
the Internet) (consent order); BUY.COM, Inc., FTC Dkt. No. C-3978 
(Sept. 8, 2000) (failure to disclose restrictions and costs associated 
with purchasing a ``free'' or ``low-cost'' personal computer in 
exchange for agreeing to purchase Internet service) (consent order); 
Value America, Inc., FTC Dkt. No. C-3976 (Sept. 8, 2000) (same).
    \2\ Federal Trade Commission Staff Working Paper, Dot Com 
Disclosures: Information About Online Advertising (May 3, 2000), 
available at http://www.ftc.gov/bcp/conline/pubs/buspubs/dotcom/
index.html.
---------------------------------------------------------------------------
    The Commission has addressed the failure to disclose adequately to 
consumers the material fact that spyware would be installed on their 
computers. In particular, disclosing the presence of bundled software, 
including spyware, only in the end-user licensing agreement may be 
unfair or deceptive. For example, in FTC v. Odysseus Marketing, Inc., 
the defendants offered consumers a free software program that purported 
to make the consumers anonymous when using peer-to-peer file-sharing 
programs. \3\ The Commission alleged, however, that the distributors 
failed to disclose to consumers that this program, in turn, would 
install other, harmful software on their computers. Similarly, in 
Advertising.com, Inc., the respondents allegedly offered free security 
software, but bundled with it software that caused consumers to receive 
a substantial number of pop-up ads. \4\ Although the presence of this 
software was disclosed in the end-user license agreement, the 
Commission alleged that this disclosure was inadequate. The Commission 
therefore is using its authority to prohibit unfair or deceptive acts 
and practices to take law enforcement action against those who fail to 
disclose adequately to consumers that spyware will be installed on 
their computers. It is important to note that, as I indicated in my 
testimony, such a case-by-case approach that focuses on bringing law 
enforcement action where a failure to disclose has harmed consumers is 
preferable to requiring disclosure for all software, no matter how 
innocuous.
---------------------------------------------------------------------------
    \3\ The Commission recently filed a complaint in Federal court 
alleging that this failure to disclose was deceptive in violation of 
Section 5 of the FTC Act. The parties stipulated to a preliminary 
injunction order, which was entered on October 11, 2005. FTC v. 
Odysseus Marketing, Inc., No. 05-CV-330 (D.N.H. filed Sept. 21, 2005), 
available at http://www.ftc.gov/opa/2005/10/odysseus.htm.
    \4\ In the Matter of Advertising.com, FTC Dkt. No. C-4147 (consent 
order Sept. 12, 2005), available at http://www.ftc.gov/os/caselist/
0423196/0423196.htm.
---------------------------------------------------------------------------
Response to Question Four
    As the Commission indicated in its testimony, \5\ our main tool for 
combating spyware is bringing law enforcement actions challenging acts 
and practices as unfair or deceptive in violation of Section 5 of the 
FTC Act. Your letter asks how many spyware-related law enforcement 
actions we have brought in 2005, as well as for a description of our 
efforts to investigate spyware, given that many consumers may not know 
that they have spyware on their computers.
---------------------------------------------------------------------------
    \5\ Federal Trade Commission, Prepared Statement Before the 
Committee on Commerce, Science, and Transportation Subcommittee on 
Trade, Tourism, and Economic Development, United States Senate (Oct. 5, 
2005), available at http://www.ftc.aov/os/testimonv/
051005spywaretest.pdf.
---------------------------------------------------------------------------
    Thus far, the FTC has brought six law enforcement actions involving 
spyware, including five law enforcement actions to date in 2005. The 
FTC's written testimony at the recent hearing describes the FTC's first 
five actions. Our sixth law enforcement action was filed after the 
hearing. \6\ In the Enternet Media, Inc. case, the FTC alleged that the 
defendants distributed via the Internet exploitive software code dubbed 
``Search Miracle'' and ``EliteBar,'' onto the computers of unsuspecting 
consumers. With the aid of their network of affiliates, the complaint 
alleged, the defendants trick consumers into downloading and installing 
their exploitive code by disguising it as harmless, free software, such 
as Internet browser upgrades, music files, cell phone ring tones, and 
song lyrics. However, contrary to their representations, the 
defendants' code is not a browser upgrade or security patch, nor is it 
any type of harmless free software. Rather, it functions as a type of 
spyware that substantially interferes with the functionality of 
consumers' computers, such as by tracking consumers' Internet activity, 
changing consumers' homepage settings, inserting a new toolbar onto 
consumers' Internet browsers, inserting an obtrusive window onto 
consumers' computer screens that displays advertisements, and 
displaying voluminous pop-up advertisements, even when consumers' 
Internet browsers are closed. To make matters worse, the FTC alleges, 
it is extremely difficult for consumers to uninstall the exploitive 
code, and that the defendants' uninstall instructions do not work. A 
Federal district court granted a temporary restraining order; a 
preliminary injunction hearing has been scheduled for the near future. 
Using this law enforcement approach, we were also able to freeze $2 
million in the defendants' bank accounts.
---------------------------------------------------------------------------
    \6\ FTC v. Enternet Media, Inc., No. CV-05-7777 (C.D. Cal. filed 
Nov. 1, 2005).
---------------------------------------------------------------------------
    Spyware investigations and prosecutions are a priority for the 
Commission. We are actively looking at a wide variety of sources of 
information about the identity and location of those distributing 
spyware that is causing harm to American consumers. We are consulting 
with Federal and state criminal and civil law enforcement agencies. We 
also are receiving critical information from high-tech companies, such 
as anti-spyware companies and operating system companies. We further 
are receiving valuable information from consumer groups, anti-spyware 
organization websites, academics, and the technology press. I 
appreciate the assistance that we are receiving from these groups, and 
I look forward to continue working with them to make our spyware 
investigations and prosecutions as effective as possible.
    Thank you for providing me with an opportunity to supplement my 
answers at the hearing concerning the FTC's law enforcement record as 
it pertains to spyware. If you would like additional information, 
please contact Anna Davis, the Director of the Office of Congressional 
Relations, at (202) 326-3680.

                                  

```