```

[Senate Hearing 110-1178]
[From the U.S. Government Publishing Office]

                                                       S. Hrg. 110-1178
 
                   IMPACT AND POLICY IMPLICATIONS OF 

                  SPYWARE ON CONSUMERS AND BUSINESSES

=======================================================================

                                HEARING

                               before the

                         COMMITTEE ON COMMERCE,

                      SCIENCE, AND TRANSPORTATION

                          UNITED STATES SENATE

                       ONE HUNDRED TENTH CONGRESS

                             SECOND SESSION

                               __________

                             JUNE 11, 2008

                               __________

    Printed for the use of the Committee on Commerce, Science, and 
                             Transportation

                  U.S. GOVERNMENT PRINTING OFFICE
76-328                    WASHINGTON : 2012
-----------------------------------------------------------------------
For sale by the Superintendent of Documents, U.S. Government Printing 
Office Internet: bookstore.gpo.gov Phone: toll free (866) 512-1800; DC 
area (202) 512-1800 Fax: (202) 512-2104  Mail: Stop IDCC, Washington, DC 
20402-0001

       SENATE COMMITTEE ON COMMERCE, SCIENCE, AND TRANSPORTATION

                       ONE HUNDRED TENTH CONGRESS

                             SECOND SESSION

                   DANIEL K. INOUYE, Hawaii, Chairman
JOHN D. ROCKEFELLER IV, West         TED STEVENS, Alaska, Vice Chairman
    Virginia                         JOHN McCAIN, Arizona
JOHN F. KERRY, Massachusetts         KAY BAILEY HUTCHISON, Texas
BYRON L. DORGAN, North Dakota        OLYMPIA J. SNOWE, Maine
BARBARA BOXER, California            GORDON H. SMITH, Oregon
BILL NELSON, Florida                 JOHN ENSIGN, Nevada
MARIA CANTWELL, Washington           JOHN E. SUNUNU, New Hampshire
FRANK R. LAUTENBERG, New Jersey      JIM DeMINT, South Carolina
MARK PRYOR, Arkansas                 DAVID VITTER, Louisiana
THOMAS R. CARPER, Delaware           JOHN THUNE, South Dakota
CLAIRE McCASKILL, Missouri           ROGER F. WICKER, Mississippi
AMY KLOBUCHAR, Minnesota
   Margaret L. Cummisky, Democratic Staff Director and Chief Counsel
Lila Harper Helms, Democratic Deputy Staff Director and Policy Director
   Christine D. Kurth, Republican Staff Director and General Counsel
                  Paul Nagle, Republican Chief Counsel

                            C O N T E N T S

                              ----------                              
                                                                   Page
Hearing held on June 11, 2008....................................     1
Statement of Senator Nelson......................................     2
Statement of Senator Pryor.......................................     1
Statement of Senator Vitter......................................     2

                               Witnesses

Butler, Arthur A., Attorney, Ater Wynne LLP, on behalf of 
  Americans for Fair Electronic Commerce Transactions (AFFECT)...    12
    Prepared statement...........................................    13
Cerasale, Jerry, Senior Vice President, Government Affairs, 
  Direct Marketing Association, Inc..............................    16
    Prepared statement...........................................    18
Edelman, Benjamin G., Assistant Professor, Business 
  Administration, Harvard Business School........................    29
    Prepared statement...........................................    31
Harrington, Eileen, Deputy Director, Bureau of Consumer 
  Protection, Federal Trade Commission...........................     3
    Prepared statement...........................................     4
Rotenberg, Marc, Executive Director, Electronic Privacy 
  Information Center (EPIC)......................................    23
    Prepared statement...........................................    24
Weafer, Vincent, Vice President, Security Response, Symantec 
  Corporation, on behalf of the Business Software Alliance (BSA).    35
    Prepared statement...........................................    36

                                Appendix

Letter dated June 24, 2008, from John P. Tomaszewski, Esq., Vice 
  President, Legal, Policy and Compliance, TRUSTe, to Hon. Mark 
  Pryor..........................................................    49
Letter dated June 25, 2008, to Hon. Mark Pryor from Arthur A. 
  Butler, Attorney, Ater Wynne LLP; on behalf of Americans for 
  Fair Electronic Commerce Transactions (AFFECT).................    52
Response to written questions submitted by Hon. David Vitter to 
  Eileen Harrington..............................................    55

 IMPACT AND POLICY IMPLICATIONS OF SPYWARE ON CONSUMERS AND BUSINESSES

                              ----------                              

                        WEDNESDAY, JUNE 11, 2008

                                       U.S. Senate,
        Committee on Commerce, Science, and Transportation,
                                                    Washington, DC.
    The Committee met, pursuant to notice, at 3:07 p.m. in room 
SR-253, Russell Senate Office Building, Hon. Mark Pryor, 
presiding.

             OPENING STATEMENT OF HON. MARK PRYOR, 
                   U.S. SENATOR FROM ARKANSAS

    Senator Pryor. Someone out there told me, don't start being 
like the airlines, being late on everything. So we won't do 
that. I'm sorry that I was a few minutes late, but I got caught 
in a previous meeting.
    I want to thank Chairman Inouye and Vice Chairman Stevens 
for holding this hearing to review the efforts by industry, the 
Federal Trade Commission, and Congress, to combat spyware and 
its effects on consumers. Specifically, this hearing will look 
at the impact of spyware on computer performance, along with 
privacy and security risks associated with this software.
    In particular, the hearing will consider a bill that I 
filed, S. 1625, the Counter Spy Act, and that I introduced with 
Senator Bill Nelson and Senator Boxer. Also, just to let other 
Senators and other staff know, we thought we'd have this 
hearing and sit down with our bill and see if we can get some 
other cosponsors and help us think through some issues there. 
So I want to thank all the witnesses today for being part of 
that process.
    Spyware is a pervasive problem that really I believe 
demands swift action by Congress to protect American consumers 
from very significant privacy and security risks. There are 
very few, if any that I can determine, legitimate reasons for 
this practice of having spyware in the first place, and there 
are numbers of reasons why we should do something to try to 
stop spyware.
    Basically, I think our bill needs to do two very important 
things. One is we need a good workable definition of spyware. 
It's hard to define, but we need to come up with a Federal 
definition where there's a standard.
    The second thing is we need to come up with some civil 
penalties in the event that someone is out there using spyware 
in an unauthorized manner. We need to have a civil penalty 
regime so that the FTC knows exactly what they need to do and 
what steps they need to take.
    I guess the other part that's kind of implicit in both of 
those is that we need to make sure that whatever we pass is 
very consumer-friendly, so consumers know that when spyware is 
present on their system or asking to be loaded or whatever the 
case may be, that the consumers have a chance to stop it from 
being added to their computers in the first place.
    So with that, what I would like to do is ask Senator Vitter 
if you have an opening statement.

                STATEMENT OF HON. DAVID VITTER, 
                  U.S. SENATOR FROM LOUISIANA

    Senator Vitter. Thank you, Mr. Chairman. I'll be very 
brief. Thank you for this hearing. This is an extremely 
important topic. I agree with you that it's a really serious 
problem that we should move absolutely as quickly as possible 
to address. I certainly want to be part of the discussions and 
the solution.
    That's the easy part. The tough part is how we do that 
effectively. I think the biggest challenge in so many of these 
issues is to come up with legislation that isn't outpaced or 
becomes outdated by technology in a month or a year. So I 
believe we should focus on passing legislation against improper 
activity and not be too technologically specific, because I 
think that's going to end up getting us in trouble, having 
unintended consequences, or just being outdated relatively 
soon.
    So I'm very interested in legislation. Some of the things I 
want to avoid is to enact things that would be technology 
mandates, to enact things that might unintentionally hamper the 
ability of the FTC and law enforcement to adopt a technology 
and that could be interpreted so broadly that it would extend 
beyond unwanted spyware to affect all web pages or to affect 
online transactions that folks do want and get some convenience 
out of.
    So thank you again for this hearing. I look forward to 
hearing from the witnesses and asking questions with the goal 
of helping develop that sort of bipartisan legislation.
    Senator Pryor. Thank you.
    Senator Nelson, I'll call on you for an opening statement 
if you'd like to make one and then ask you to introduce the 
first witness.

                STATEMENT OF HON. BILL NELSON, 
                   U.S. SENATOR FROM FLORIDA

    Senator Nelson. Mr. Chairman, you have to go back to a 
conference committee?
    Senator Pryor. Yes.
    Senator Nelson. So I will await your return.
    Senator Pryor. Thank you.
    Senator Nelson [presiding]. Consumer Reports in a recent 
edition had a survey and of the 2,000 people surveyed, one in 
eleven reported a major spyware infection on their computer. 
These infections are costly, may well cost over $100 to fix, 
and the overall calculated impact on the economy is $1.7 
billion. That's a figure that's only going to increase.
    So that's why we filed this legislation. We also hope that 
the Federal Trade Commission and other law enforcement agencies 
are going to take further action to pursue to the maximum 
extent possible foreign spyware developers.
    Now, in another arena, in the intelligence arena, in the 
defense arena, we have a particular concern which is not the 
subject of the discussion here today. But clearly that overlays 
the problem that we're talking about on consumers today.
    So we are delighted to have Ms. Eileen Harrington, Deputy 
Director of the Bureau of Consumer Protection at the FTC. So, 
Ms. Harrington, your presentation, please. Your lengthy 
statement will be a part of the record, so if you would just 
summarize, and then we'll get right into the questions. Thank 
you.

  STATEMENT OF EILEEN HARRINGTON, DEPUTY DIRECTOR, BUREAU OF 
         CONSUMER PROTECTION, FEDERAL TRADE COMMISSION

    Ms. Harrington. Thank you very much, Senator Nelson and 
Chairman Pryor and Members of the Committee. I am Eileen 
Harrington.
    Spyware and other malware causes substantial harm to 
consumers and to the Internet as a medium of communication and 
commerce. Protecting consumers from this harm is a priority for 
the Federal Trade Commission and we thank you for giving us the 
opportunity to appear here today to talk about the FTC's 
activity in this area and to comment on S. 1625, the Counter 
Spy Act, which was introduced by Senator Pryor, Senator Boxer, 
and Senator Nelson.
    Since 2004 the FTC has brought 11 spyware-related law 
enforcement actions and, while we certainly haven't solved the 
spyware problem, our law enforcement efforts have, we believe, 
had an effect and have reduced the prevalence of pop-up ads 
generated by nuisance adware. Our spyware law enforcement 
actions reaffirmed three key principles.
    The first is that a consumer's computer belongs to him or 
her, not to the software distributor, and it must be the 
consumer's choice whether or not to install software. This 
principle reflects the basic common sense notion that Internet 
businesses are not free to help themselves to the resources of 
a consumer's computer.
    The second principle articulated in our enforcement work is 
that buried disclosures of material information necessary to 
correct an otherwise misleading impression are not sufficient, 
just as they have never been sufficient in more traditional 
areas of commerce. Specifically, burying material information 
in an End User License Agreement will not shield a spyware 
purveyor from Section 5 liability.
    The third principle underscored by our work is that if a 
distributor puts a program on a computer that the consumer does 
not want the consumer should be able to uninstall or disable 
it.
    As in so many other areas, cooperation among law 
enforcement agencies is vital to successful enforcement in the 
spyware area. Many of the worst abuses connected with spyware 
are criminal activity in nature and we at the FTC coordinate 
very closely with our colleagues at the Department of Justice 
to see to it that these criminals are prosecuted. The FTC also 
coordinates closely with State law enforcement partners who 
bring enforcement actions against spyware distributors.
    Now, in addition to engaging in law enforcement and 
coordinating with others in the enforcement community, the FTC 
has made consumer education a priority. In September 2005, the 
FTC formed a partnership with other Federal agencies in the 
technology industry to launch a multimedia interactive consumer 
education initiative, OnGuard Online. The OnguardOnline.gov 
website now attracts over 350,000 unique visits each month and 
many organizations have taken the OnGuard Online materials for 
their own security training. The comprehensive website has 
general information on online safety as well as sections with 
specific information on a range of topics, including spyware.
    Turning to the bill under discussion, S. 1625, we would 
make two points. First, although we have successfully used 
Section 5 of the FTC Act to challenge conduct related to 
spyware distribution under Section 5, legislation authorizing 
the Commission to seek civil penalties in spyware cases would 
provide a welcome addition to remedies available to us. 
Currently under Section 13(b) of the FTC Act we have authority 
to file actions in Federal district court and to obtain 
injunctive and equitable monetary relief in the form of 
consumer redress or disgorgement. In spyware cases, however, 
restitution or disgorgement may be neither appropriate nor 
sufficient remedies because consumers often have not purchased 
a product or a service from the defendants, the harm to 
consumers may be very difficult to quantify, or the defendant's 
profits may be slim or difficult to calculate with certainty. 
In such cases a civil penalty may be a far better remedy and 
serve as a stronger deterrent.
    Second, under general consumer protection principles and 
traditional Section 5 jurisprudence, the Commission need not 
show knowledge or intent in order to obtain injunctive relief, 
but several sections of S. 1625 impose an overarching knowledge 
or intent threshold for enforcement that could create a higher 
and more difficult evidentiary burden for the FTC in obtaining 
injunctions in civil spyware cases.
    Section 5(m)(1) of the FTC Act already requires that the 
Commission prove knowledge in any civil penalty action. 
Eliminating the knowledge or intent threshold from S. 1625 
would not change the Commission's elevated burden regarding 
civil penalties, but it would maintain the ordinary burden that 
we have to meet in order to obtain injunctive relief. So we 
would recommend that change.
    I thank you for focusing your attention on this important 
issue and giving us the opportunity to discuss the Commission's 
enforcement record. Thank you.
    [The prepared statement of Ms. Harrington follows:]

       Prepared Statement of Eileen Harrington, Deputy Director, 
        Bureau of Consumer Protection, Federal Trade Commission
I. Introduction
    Chairman Pryor and members of the Committee on Commerce, Science, 
and Transportation, I am Eileen Harrington, Deputy Director of the 
Bureau of Consumer Protection of the Federal Trade Commission 
(``Commission'' or ``FTC'').\1\ Spyware and other malware can cause 
substantial harm to consumers and to the Internet as a medium of 
communication and commerce. Protecting consumers from such harm is a 
priority for the Commission, and the agency thanks this Committee for 
the opportunity to describe what the FTC is doing in this area and to 
provide input on S. 1625, the ``Counter Spy Act'' introduced by 
Senators Pryor, Boxer, and Nelson.
---------------------------------------------------------------------------
    \1\ The written statement presents the views of the Federal Trade 
Commission. Oral statements and responses to questions reflect the 
views of the speaker and do not necessarily reflect the views of the 
Commission or any Commissioner.
---------------------------------------------------------------------------
    This written statement provides background on the Commission's 
active program to address concerns about spyware and other malware, 
which includes law enforcement actions and consumer education efforts. 
First, it discusses the Commission's three key principles related to 
spyware as illustrated by the eleven spyware-related law enforcement 
actions the agency has initiated to date. Second, the statement 
highlights the Commission's consumer education efforts on spyware. 
Third, the statement offers the Commission's views on the proposed 
legislation, S. 1625.
    The Commission has a broad mandate to prevent unfair methods of 
competition and unfair or deceptive acts or practices in or affecting 
commerce.\2\ Although it is often challenging to locate and apprehend 
the perpetrators, the FTC has successfully challenged the distribution 
of spyware that causes injury to consumers online.
---------------------------------------------------------------------------
    \2\ 15 U.S.C.  45.
---------------------------------------------------------------------------
    Spyware and other malware that is downloaded without authorization 
can cause a range of problems for computer users, from nuisance adware 
that delivers pop-up ads, to software that causes sluggish computer 
performance, to keystroke loggers that capture sensitive information. 
As described below, the Commission has an active program to address 
concerns about spyware and other malware, including law enforcement and 
consumer education. Since 2004, the Commission has initiated eleven 
spyware-related law enforcement actions.\3\ While the problem of 
spyware has not been solved, our cases have had a significant effect 
and, based on our investigative experience, we believe the prevalence 
of pop-up ads generated by nuisance adware has been dramatically 
reduced.
---------------------------------------------------------------------------
    \3\ Detailed information regarding each of these law enforcement 
actions is available at 
http://www.ftc.gov/bcp/edu/microsites/spyware/law_enfor.htm.
---------------------------------------------------------------------------
II. Spyware Law Enforcement
A. FTC Cases
    The Commission's spyware law enforcement actions reaffirm three key 
principles. The first is that a consumer's computer belongs to him or 
her, not to the software distributor, and it must be the consumer's 
choice whether or not to install software. This principle reflects the 
basic common-sense notion that Internet businesses are not free to help 
themselves to the resources of a consumer's computer. For example, in 
FTC v. Seismic Entertainment Inc.,\4\ and FTC v. Enternet Media, 
Inc.,\5\ the Commission alleged that the defendants unfairly downloaded 
spyware to users' computers without the users' knowledge, in violation 
of Section 5 of the FTC Act. Stipulated permanent injunctions were 
entered against the defendants in both matters, and defendants were 
ordered to disgorge more than $6 million, combined.
---------------------------------------------------------------------------
    \4\ FTC v. Seismic Entertainment, Inc., No. 04-377-JD, 2004 U.S. 
Dist. LEXIS 22788 (D.N.H. Mar. 22, 2006), available at http://
www.ftc.gov/os/caselist/0423142/0423142.shtm.
    \5\ FTC v. Enternet Media, Inc., CV 05-7777 CAS (C.D. Cal., Aug. 
22, 2006), available at 
http://www.ftc.gov/os/caselist/0523135/0523135.shtm.
---------------------------------------------------------------------------
    The second principle is that buried disclosures of material 
information necessary to correct an otherwise misleading impression are 
not sufficient, just as they have never been sufficient in more 
traditional areas of commerce. Specifically, burying material 
information in an End User License Agreement will not shield a spyware 
purveyor from Section 5 liability. This principle was illustrated in 
FTC v. Odysseus Marketing, Inc.\6\ and Advertising.com, Inc.\7\ In 
these two cases, the Commission's complaint alleged (among other 
violations) that the defendants failed to disclose adequately that the 
free software they were offering was bundled with harmful software 
programs. The orders entered in both cases require the defendants to 
disclose properly the effects of software programs that they offer in 
the future.
---------------------------------------------------------------------------
    \6\ FTC v. Odysseus Marketing, Inc., No. 05-CV-330 (D.N.H. Oct. 24, 
2006) (stipulated permanent injunction), available at http://
www.ftc.gov/os/caselist/0423205/0423205.shtm.
    \7\ In the Matter of Advertising.com, Inc., FTC Dkt. No. C-4147 
(Sept. 12, 2005) (consent order), available at http://www.ftc.gov/os/
caselist/0423196/0423196.shtm.
---------------------------------------------------------------------------
    The third principle is that, if a distributor puts a program on a 
computer that the consumer does not want, the consumer should be able 
to uninstall or disable it. This principle is underscored by cases 
against Zango, Inc.\8\ and DirectRevenue LLC.\9\ These companies 
allegedly provided advertising programs, or adware, that monitored 
consumers' Internet use and displayed frequent, targeted pop-up ads--
over 6.9 billion pop-ups by Zango alone. According to the Commission's 
complaints, the companies deliberately made these adware programs 
difficult for consumers to identify, locate, and remove from their 
computers, thus thwarting consumer efforts to end the intrusive pop-
ups. Among other relief, the consent orders require Zango and 
DirectRevenue to provide a readily identifiable means to uninstall any 
adware that is installed in the future, as well as to disgorge $3 
million and $1.5 million, respectively.
---------------------------------------------------------------------------
    \8\ In the Matter of Zango, Inc. f/k/a 180 Solutions, Inc., FTC 
Dkt. No. C-4186 (Mar. 7, 2007), available at http://www.ftc.gov/os/
caselist/0523130/index.shtm.
    \9\ In the Matter of DirectRevenue LLC, FTC Dkt. No. C-4194 (June 
26, 2007), available at http://www.ftc.gov/os/caselist/0523131/
index.shtm.
---------------------------------------------------------------------------
    Similarly, in FTC v. Digital Enterprises, Inc.,\10\ the Commission 
alleged that the defendants installed software onto consumers' 
computers that repeatedly launched text and video pop-ups that 
consumers could not close or minimize. These pop-ups demanded payment 
for access to the defendants' purported entertainment websites. Among 
other relief, the September 2007 stipulated permanent injunction 
requires the defendants to provide a way for consumers to remove the 
software, bars future downloads without consumer consent, and requires 
the defendants to pay more than $500,000 for consumer redress.
---------------------------------------------------------------------------
    \10\ FTC v. Digital Enterprises, Inc. d/b/a Movieland.com, CV06-
4923 (C.D. Cal. Sept. 5, 2007), available at http://www.ftc.gov/os/
caselist/0623008/index.shtm.
---------------------------------------------------------------------------
    In addition, the agency's law enforcement efforts have alerted the 
Commission to novel spyware-related consumer protection issues such as 
the marketing of bogus anti-spyware programs. For example, in FTC v. 
MaxTheater, Inc.\11\ and FTC v. Trustsoft, Inc.,\12\ the FTC alleged 
that the defendants made false claims to consumers about the existence 
of spyware on their machines and then used these false claims to 
convince consumers to conduct free ``scans'' of their computers. These 
scans would identify innocuous software as spyware, helping to persuade 
consumers to purchase the defendants' spyware removal products at a 
cost of between $30 and $40. Moreover, the FTC alleged, the defendants 
claimed their spyware removal products could effectively uninstall many 
different types of known spyware programs, but the defendants' products 
did not perform as promised. In both cases, courts entered stipulated 
permanent injunctions prohibiting the claims and requiring the 
defendants to disgorge a total of nearly $2 million.
---------------------------------------------------------------------------
    \11\ FTC v. MaxTheater, Inc., No. 05-CV-0069 (E.D. Wa. Dec. 6, 
2005), available at 
http://www.ftc.gov/os/caselist/0423213/0423213.shtm.
    \12\ FTC v. Trustsoft, Inc., No. H-05-1905 (S.D. Tex. Nov. 30, 
2005), available at 
http://www.ftc.gov/os/caselist/0523059/0523059.shtm.
---------------------------------------------------------------------------
B. Cooperation with Department of Justice and State Law Enforcement
    As in so many other areas, cooperation among law enforcement 
agencies is vital to successful law enforcement in the spyware arena. 
Many of the worst abuses connected with spyware are criminal,\13\ and, 
in appropriate cases, the Commission coordinates closely with the 
Department of Justice. For example, in FTC v. ERG Ventures, LLC,\14\ 
the FTC's complaint alleged that the defendants secretly downloaded 
multiple malevolent software programs, including spyware, onto millions 
of computers without consumers' consent. The defendants also allegedly 
tricked consumers into downloading harmful software by hiding the 
malicious programs within seemingly innocuous free software. The U.S. 
Attorney's Office for the District of Columbia launched a parallel 
criminal investigation, and executed search warrants simultaneously 
with the filing of the FTC's civil case.\15\
---------------------------------------------------------------------------
    \13\ See, e.g., Department of Justice, Computer Crime & 
Intellectual Property Section, Computer Crime News Releases, available 
at http://www.usdoj.gov/criminal/cybercrime/ccnews.html.
    \14\ FTC v. ERG Ventures, LLC, 3:06-CV-00578-LRH-VPC (D. Nev. Oct. 
3, 2007), available at http://www.ftc.gov/os/caselist/0623192/
index.shtm. Pursuant to the stipulated order entered by the court in 
the FTC action, the defendants must disgorge $330,000. A permanent 
injunction also bars the defendants from downloading software onto 
consumers' computers without disclosing its function and obtaining 
consumers' consent prior to installation, bars them from downloading 
software that interferes with consumers' computer use, and bars false 
or misleading claims.
    \15\ See FTC News Release, Court Shuts Down Media Motor Spyware 
Operation (Nov. 13, 2006), available at http://www.ftc.gov/opa/2006/11/
mediamotor.shtm.
---------------------------------------------------------------------------
    The Commission also coordinates with state partners who bring their 
own law enforcement actions against spyware distributors. The FTC has 
established a Federal-state spyware law enforcement task force to 
discuss issues and trends in spyware law enforcement. The task force 
consists of representatives from agencies such as the Department of 
Justice and state attorneys general. Federal criminal and state law 
enforcement actions are a critical complement to the FTC's law 
enforcement actions.
III. Education
    In addition to engaging in law enforcement, the FTC has made 
consumer education a priority. In September 2005, the Commission and a 
partnership of other Federal agencies and the technology industry 
launched a multimedia, interactive consumer education initiative, 
OnGuard Online, along with a Spanish-language version, AlertaenLinea. 
The OnGuardOnline.gov site now attracts over 350,000 unique visits each 
month, and many organizations have adapted the OnGuard Online materials 
for their own security training. The comprehensive website has general 
information on online safety, as well as sections with specific 
information on a range of topics, including spyware. The spyware module 
includes up-to-date information, as well as interactive features like 
quizzes and videos. As part of the OnGuard Online initiative, the FTC 
also has distributed a million copies of the brochure and two million 
copies of the bookmark, ``Stop Think Click: 7 Practices for Safer 
Computing,'' with information on spyware and other computer safety 
topics. The FTC also has issued a Consumer Alert on spyware, as well as 
Alerts addressing other online security issues such as viruses and 
peer-to-peer file sharing.\16\
---------------------------------------------------------------------------
    \16\ See. e.g., P2P File-Sharing: Evaluate the Risks (Feb. 2008), 
available at http://www.ftc.gov/bcp/edu/pubs/consumer/alerts/
alt128.shtm; Botnets and Hackers and Spam (Oh, My!) (June 2007), 
available at http://www.ftc.gov/bcp/edu/pubs/consumer/alerts/
alt132.shtm, Spyware (July 2005), available at http://www.ftc.gov/bcp/
conline/pubs/alerts/spywarealrt.shtm:, Detect, Protect, Dis-infect: 
Consumers Online Face Wide Choices in Security Products (Sept. 2004), 
available at http://www.ftc.gov/bcp/conline/pubs/alerts/idsalrt.shtm; 
see generally http://www.ftc.gov/bcp/menus/consumer/tech/privacy.shtm.
---------------------------------------------------------------------------
IV. Legislative Steps to Address Spyware
    Although the FTC has successfully challenged conduct related to 
spyware dissemination under Section 5, legislation authorizing the 
Commission to seek civil penalties in spyware cases could add a potent 
remedy to those otherwise available to the Commission. Currently, under 
Section 13(b) of the FTC Act, the Commission has the authority to file 
actions in Federal district court and to obtain injunctive relief and 
equitable monetary relief in the form of consumer redress or 
disgorgement. It has been the agency's experience in spyware cases, 
however, that restitution or disgorgement may not be appropriate or 
sufficient remedies because consumers often have not purchased a 
product or service from the defendants, the harm to consumers may be 
difficult to quantify, or the defendants' profits may be slim or 
difficult to calculate with certainty. In such cases, a civil penalty 
may be the most appropriate remedy and serve as a strong deterrent. 
Accordingly, the Commission is pleased that S. 1625 provides the 
Commission this valuable law enforcement tool.
    Last June, FTC staff provided this Committee with technical 
comments to S. 1625. Of the various suggestions respectfully made by 
staff, one important aspect of the bill relating to both injunctive 
relief and civil penalties stands out. Under general consumer 
protection principles and traditional Section 5 jurisprudence, the 
Commission need not show knowledge or intent in order to obtain 
injunctive relief: that is, for stopping the violative conduct itself. 
But, several sections of S. 1625 impose an overarching knowledge or 
intent threshold for enforcement that could create an additional--and 
often very challenging--evidentiary burden for the FTC in obtaining 
injunctions in civil cases. Moreover, Section 5(m)(1) of the FTC Act 
already requires the Commission to prove knowledge in any action where 
civil penalties are sought. Eliminating the knowledge or intent 
threshold from the bill would not change the Commission's elevated 
burden regarding civil penalties, while maintaining the ordinary burden 
for obtaining injunctive relief.\17\ The agency looks forward to 
working with the Committee regarding the knowledge and intent aspects 
of the legislation, as well as any of the other important 
considerations raised by staff's technical comments.
---------------------------------------------------------------------------
    \17\ Indeed, removing the knowledge or intent requirements from S. 
1625 would be consistent, for example, with the approach in the CAN-
SPAM Act. See 15 U.S.C.  7706(e) (granting the FTC authority to seek 
cease-and-desist orders and injunctive relief without alleging or 
proving knowledge). Spam raises similar enforcement issues to spyware 
regarding quantifying consumer injury and defendants' profits.
---------------------------------------------------------------------------
V. Conclusion
    The FTC will continue its aggressive law enforcement and innovative 
consumer education programs in the spyware arena. The FTC thanks this 
Committee for focusing attention on this important issue, and for the 
opportunity to discuss the Commission's law enforcement program.

    Senator Nelson. Senator Vitter?
    Senator Vitter. Thank you, Mr. Chairman.
    Thank you very much for your testimony. In October 2005, 
then Chairman Majoras had a discussion with Senator Allen about 
these issues and I believe Senator Allen asked if new notice 
and consent requirements would help combat spyware. The then 
Chair testified that she didn't think that it would do so 
because studies showed the more consumers are bombarded with 
disclosure and consent requirements the more they don't read 
them and sort of let them pass by and ignore them. What's your 
reaction to that question?
    Ms. Harrington. I think probably our view has not changed, 
but, more importantly, I think the nature of the spyware 
problem has shifted some, from the sort of pervasive pop-up and 
nuisance ads that adware brought us, to far more malicious and 
malevolent consequences from spyware.
    I think that it's very unlikely that criminals using 
spyware to take over consumers' computers and cause them to do 
bad things would comply with notice requirements. These are 
criminals and their stock in trade is to sneak around.
    Senator Vitter. OK. What do you think our general approach 
should be in terms of how technology specific we have to be or 
to what extent we can avoid that?
    Ms. Harrington. Well, we certainly know from what is really 
a very brief period of time during which the Internet has 
operated as a principal method of commerce that the technology 
shifts very quickly. To the extent that the Congress chooses to 
legislate in this area, I recommend staying away from specific 
technology and favoring broad principles like those that are 
found in Section 5 of the FTC Act, which as an enforcement tool 
has proven over the decades to be a marvelously flexible and 
resilient statute. The FTC Act was adopted in the earlier part 
of the 20th century and it has stood us very well. It is the 
statute that we have used to stop spyware purveyors in 11 
enforcement actions. That kind of flexibility in a statute is 
very helpful when the technology changes virtually overnight.
    Senator Vitter. OK, that's all I have right now, Mr. 
Chairman.
    Senator Nelson. Ms. Harrington, you note that one of the 
Commission's spyware enforcement principles is a consumer 
should be able to uninstall or disable unwanted spyware. In the 
Zango and DirectRevenue consent orders, this principle was 
interpreted requiring those parties to provide a readily 
identifiable means to uninstall. How is that readily 
identifiable means identified? How is it defined?
    Ms. Harrington. The order sets the standard. The test is 
whether a reasonable consumer having the experience of having 
that software loaded onto his or her computer can readily see 
how it is that it can be uninstalled. It's really a reasonable 
consumer standard that's incorporated in those orders.
    Senator Nelson. So it's not a case by case analysis?
    Ms. Harrington. Well, do you mean for purposes of complying 
with that order, Senator, or across the board?
    Senator Nelson. Of defining it.
    Ms. Harrington. Well, we would always look case by case to 
see whether--but employing the reasonable consumer standard. 
That is how the Commission proceeds also in using Section 5 as 
an enforcement tool and it is how the courts have interpreted 
Section 5 and ordered relief.
    Senator Nelson. Do you need to include an operating system 
toolbar?
    Ms. Harrington. Do you need to?
    Senator Nelson. Does the readily identifiable means need to 
include an operating system toolbar?
    Ms. Harrington. I'm going to turn to one of our lawyers 
who's right behind me who worked on that case.
    Senator Nelson. Does the----
    Ms. Harrington. I don't want to give a wrong answer.
    Senator Nelson. OK, come on up.
    Ms. Harrington. It doesn't necessarily require a toolbar, 
Senator, but we would generally think that the consumer would 
look to the add-remove function to find and remove the 
software. Or there could be a link that the consumer could use 
to get to the add-remove.
    Senator Nelson. And if it's another kind of spyware, there 
would be another kind of toolbar to remove?
    Ms. Harrington. Any software that would be loaded onto the 
consumer's computer would need to be easily found and removed. 
I think generally we would expect that it would be very 
apparent when the add-remove function is chosen. But a link 
would work as well.
    Senator Nelson. Do you think some clear rules or 
definitions might be helpful to consumers so that they would 
know where to look for this uninstall tool?
    Ms. Harrington. I think that generally, that the standard 
that requires that it be readily apparent and useable would be 
a better standard in a situation where the technology and 
format are changing frequently. So I would be concerned about 
tying by rule to a particular technique for removal. I think 
that the better approach would be to require that it be readily 
apparent and accessible to consumers, and we would assume that 
over time what that means would change; in very specific terms 
what it means would change with the technology.
    Senator Nelson. What if the spyware is a keystroke logger 
and it's capturing all of the keystrokes that the computer user 
uses, such as it is trying to get passwords or personal 
information?
    Ms. Harrington. Well, that's criminal.
    Senator Nelson. It is. But what about a toolbar to remove 
that? How would you go about that?
    Ms. Harrington. How would I go about that? I think that it 
would be unlikely, frankly, that someone installing a keystroke 
logger would willingly put a clear and apparent tool right 
before the consumer to alert him or her to the fact that the 
keystroke logger has been loaded on and to allow them to remove 
it. The whole purpose of that kind of software is to 
surreptitiously steal information from consumers.
    Senator Nelson. So how does the consumer clean his computer 
of that spyware?
    Ms. Harrington. It may be that the consumer's security 
program that presumably includes a scan function that can be 
regularly run, will identify that program. Typically, when you 
run those kinds of scans you get a box with a report that tells 
you what you have and it's really easy to remove.
    If the software can't be detected by those kinds of 
programs, and the really bad stuff that we're talking about 
oftentimes flies under that radar, the consumer may not be able 
to discern its presence on his or her computer until something 
really bad happens, and then the consumer has to backtrack to 
try to figure out how his or her information fell into the 
hands of bad guys. It may be very tough for consumers to know 
that they have that kind of software on their computer.
    Senator Nelson. What percentage of the spyware do you think 
currently originates outside of the United States?
    Ms. Harrington. We don't have a way of measuring that, but 
we certainly know that there are problems with malevolent 
software that shows up through spyware, through e-mail on 
people's computers. We know that there are big problems with 
that kind of material originating outside of the United States. 
But we don't have a way of measuring it, just as we don't have 
a way of measuring the totality of spyware that's loaded onto 
consumers' computers, whether it comes from within or outside 
of the United States.
    Senator Nelson. Do we need to give the FTC new tools to go 
after these foreign bad actors?
    Ms. Harrington. Well, we're very grateful to the Congress 
for having given us some new tools a couple of years ago in the 
U.S. SAFE WEB Act. We have enhanced authority now to share 
information with foreign counterparts and obtain information 
from them, and we are using it in nonpublic investigations all 
the time, and we're most appreciative of the Congress for 
giving us those authorities.
    Senator Nelson. So we have enough? We don't need more?
    Ms. Harrington. We're in good shape now, thank you.
    Senator Nelson. How well do commercial anti-spyware 
applications work?
    Ms. Harrington. Well, some work well and some don't work 
well. Some anti-spyware applications are actually hawked by 
crooks to put more spyware on your computer instead of taking 
it off. So there's quite a spectrum of performance. But the 
reputable software companies that are selling anti-virus and 
security software sell reasonably good products, and if you 
visit our OnGuardOnline website, we recommend that everyone 
make sure to have good security programs on their computer and 
run them regularly.
    Senator Nelson. Well, the government and the commercial 
anti-spyware providers seem to have been talking for quite a 
while now and still the message isn't getting out to a lot of 
consumers. How can we do it better?
    Ms. Harrington. Well, first of all, we would urge everyone, 
every government and commercial entity that cares about this to 
have a link to OnGuardOnline right on their website. It is a 
very consumer-friendly site with really easy-to-understand and 
use directions about how to protect your computer from a host 
of bad things and how to prevent oneself from experiencing bad 
experiences in the online environment.
    So help us get the message out. I think that to the extent 
that the manufacturers of anti-spyware software and other 
security products can continue to make these products very user 
friendly, anything that we can do to encourage movement in that 
direction is a good thing. These products have become far more 
user friendly. I know, I can actually use them reasonably well 
myself now and I used to find them to be quite difficult.
    Senator Nelson. Yesterday's New York Times carried a story 
about the Attorney General of New York going after child 
pornography and it seemed like an inventive way that he was 
doing it, by going and holding the people who convey the 
information accountable. First of all, would you comment on 
what it is, explain it, and then tell us what you think about 
it?
    Ms. Harrington. Well, I've read the same press accounts 
that you have. That's what I know about this. But my 
understanding is that the agreement that the attorney general 
of New York entered into is with three large ISPs, and the ISPs 
have agreed to block their users from accessing sites that have 
been identified as containing child pornography material.
    This is an agreement or a settlement. I don't know what the 
underlying legal theory is. I noted in some of the press 
accounts that I read this morning that some are raising First 
Amendment concerns. Beyond that, I really don't know more about 
that agreement.
    Stepping back, there are certainly times when companies 
that operate portals or control the means of access have been 
able to step up and use that influence and leverage to shut off 
or discourage bad activity. That's not a new approach. I really 
don't know about this particular settlement and how effective 
it will be at eliminating the problem that they're seeking to 
address.
    Senator Nelson. Senator Vitter?
    Senator Vitter. I'm fine. Thank you, Mr. Chairman.
    Senator Nelson. Well, Ms. Harrington, thank you very much 
for your testimony.
    Ms. Harrington. Thank you, Senator.
    Senator Nelson. We would ask the second panel to please 
come up.
    We are very pleased to have Mr. Arthur Butler, who is with 
the Americans for Fair Electronic Commerce Transactions; Mr. 
Jerry Cerasale, who is Senior Vice President, Government 
Affairs with Direct Marketing Association; Mr. Marc Rotenberg, 
Executive Director, the Electronic Privacy Information Center; 
Dr. Benjamin Edelman, who is at the Harvard Business School; 
Mr. Vincent ``WAE-fer''----
    Mr. Weafer. ``WEE-fer.''
    Senator Nelson. ``WEE-fer,'' who is Vice President, in 
Security Response with the Symantec Corporation, and on behalf 
also of the Business Software Alliance.
    We'll start in the order that you are listed on the agenda. 
Mr. Butler. And what I want you to do, I don't want you to sit 
here and read a statement to us. We're going to take your 
printed statements. That's going to be a part of the record. So 
what we want you to do is talk to us.
    So, Mr. Butler.

  STATEMENT OF ARTHUR A. BUTLER, ATTORNEY, ATER WYNNE LLP, ON 
 BEHALF OF AMERICANS FOR FAIR ELECTRONIC COMMERCE TRANSACTIONS 
                            (AFFECT)

    Mr. Butler. Good afternoon. My name is Art Butler. I'm an 
attorney with the Ater Wynne law firm in Seattle, Washington, 
and I'm here today on behalf of AFFECT, which is a diverse 
group of nonprofits and commercial entities, including consumer 
groups, who are firmly committed to promoting the growth of 
fair and competitive transactions in software and other digital 
products.
    I first wanted to commend Senator Pryor and the other 
cosponsors of the Counter Spy Act for introducing what we think 
is a very important piece of legislation and for holding this 
hearing, because you, like the members of AFFECT, are very 
worried about the privacy and security issues that are 
presented by spyware.
    As our long statement indicates, we firmly support S. 1625 
because we believe that spyware is an insidious problem that 
desperately needs to be addressed. The sad fact is that every 
computer in the United States is under attack from numerous 
sources that are trying to surreptitiously install or prevent 
the removal of spyware programs that will allow the spies to 
intercept or gain partial control of the user's interaction 
with his or her computer without obtaining the user's informed 
consent.
    Often the spyware that is introduced contains what are 
called back doors, which essentially are ways in which a 
computer spy can get around normal authentication and remotely 
gain control over the computer and avoid detection. Once 
someone gains control of your computer, they can install all 
kinds of different devices to compromise the security of that 
computer. In fact, it is generally agreed that spyware 
represents a significant threat to the security of any user's 
computer system and data.
    While we support the bill, we do have a major concern with 
the exceptions section of the bill. That is due to, one, the 
fact that really we don't see that any of the exceptions that 
are listed there are really needed or justified. But we're 
particularly concerned about the exception in subsection 
6(a)(10) which would permit a provider to monitor or interact 
with a computer in order to prevent or detect the unauthorized 
use of software, fraudulent or other illegal activities.
    We think this language is overly broad and it would in 
effect permit or protect activities which could be harmful to 
computer users in direct opposition to the objective of the 
bill. It would in effect allow a software vendor to freely 
monitor everything that's on a user's computer, essentially 
setting them up as an ad hoc police force to conduct 
warrantless searches and seizures. We don't think that private 
entities should be allowed to engage in law enforcement 
activities.
    The most troubling fact to us is the fact that that 
language would permit a software vendor to unilaterally 
remotely disable the software on a computer or to disable a 
network connection or service. Often the question about whether 
use is unlawful or fraudulent or illegal is subject to 
legitimate dispute, and it really merits some judicial 
consideration before you allow a software vendor to 
unilaterally employ such a drastic remedy as remote 
disablement.
    This is a major concern to our members and we have in our 
long statement given examples of cases where you have seen 
software purveyors unilaterally decide that they didn't get an 
adequate license payment and then just go in and shut down 
someone's computer, causing some very significant negative 
consequences for the computer user.
    But it's also important to realize that a lot of these 
disputes never make it to the courthouse steps because the 
balance of harm that's caused by someone unilaterally shutting 
down your computer is so far against the computer user that the 
mere threat that that can be used will cause the user to 
essentially cave in to the demands of a vendor.
    We are particularly concerned about what happens when 
someone remotely accesses a computer and attempts to disable it 
because that act alone can cause damage to other files owned by 
the computer user and the simple fact is that the existence of 
that code that allows remote access and disablement can present 
a vulnerability that will allow security breaches by hackers, 
by saboteurs, by industrial and foreign government spies, and 
by terrorists.
    This is a major issue for our group, for both the smaller 
users and the large users. We have a suggestion for an 
amendment to subsection 6(a)(10) that would essentially limit 
that to the detection or prevention of fraudulent or other 
illegal activities as prohibited by the Act, which we think is 
the appropriate limitation there.
    Thank you. I'd be glad to respond to any questions.
    [The prepared statement of Mr. Butler follows:]

 Prepared Statement of Arthur A. Butler, Attorney, Ater Wynne LLP, on 
 Behalf of Americans for Fair Electronic Commerce Transactions (AFFECT)
    Good afternoon. My name is Art Butler. I am an attorney with Ater 
Wynne LLP in Seattle, Washington. I am very pleased to appear before 
you today on behalf of AFFECT (Americans for Fair Electronic Commerce 
Transactions) at this important hearing on the impact and policy 
implications of spyware on consumers and businesses. AFFECT is a 
national coalition of consumer representatives, retail and 
manufacturing businesses, insurance institutions, financial 
institutions, technology professionals, librarians, and public interest 
organizations committed to promoting the growth of fair and competitive 
commerce in software and other digital products.
    We commend you, Chairman Pryor, and all the sponsors of the Counter 
Spy Act (S. 1625), for introducing this important bill because, like 
you, our members are very worried about the privacy and security risks 
associated with spyware. AFFECT strongly supports S. 1625. However, we 
are very concerned with the exception provision and believe it is 
overly broad. In our view, it could in fact be construed to protect 
wrongful acts that can result in great harm to computer users. We 
believe this section is in direct opposition to the laudable purpose of 
the bill and hope very much that you will consider the amendment which 
we propose today.
AFFECT's Concerns with Spyware
    AFFECT has been active in representing the interests of software 
consumers in the debates about the appropriate language to be included 
in anti-spyware legislation in several states and has advocated 
strenuously that these legislatures not adopt exception language so 
broad that it swamps the prohibitions that are designed to protect 
computer users. Since AFFECT began actively educating legislators in 
the states of the potential for damage, creation of security 
vulnerabilities, and for invasion of privacy and unauthorized search 
and seizure in relation to consumers' computers due to the exception 
language in question--the language has failed to pass in even one state 
legislature.
    The sad fact is that every computer in the United States is under 
attack from numerous sources trying to surreptitiously install or 
prevent removal of spyware that will allow the spy to intercept or take 
partial control over the user's interaction with the computer, without 
the user's informed consent.
    While the term ``spyware'' suggests software that secretly monitors 
the user's behavior, the functions of spyware extend well beyond simple 
monitoring. Spyware can collect various types of personal information, 
interfere with the user's control of the computer, change computer 
settings, result in slow connection speeds, loss of Internet or other 
programs, disable software firewalls and anti-virus software, and/or 
reduce browser security settings, thus opening the system to further 
infections. It can enable identity theft and fraud.
    Often spyware will contain a ``backdoor,'' which is a method of 
bypassing normal authentication, securing remote access to a computer 
and obtaining access to plaintext, while attempting to remain 
undetected. Someone who has gained access to your computer can install 
many types of devices to compromise security, including operating 
system modifications, software worms, key loggers, and covert listening 
devices. Some backdoors, such as the Sony/BMG rootkit \1\ distributed 
silently on millions of music CDs through late 2005, are intended as 
digital rights management (DRM) measures and, in that case, as data 
gathering agents, since both surreptitious programs they installed 
routinely contacted central servers. The copy prevention software Sony/
BMG included on its CDs was automatically installed on Windows desktop 
computers when customers tried to play the CDs. The software interferes 
with the normal way in which the Microsoft Windows operating system 
plays CDs, opening security holes that allow viruses to break in, and 
causing other problems.\2\
---------------------------------------------------------------------------
    \1\ A ``rootkit'' is a program designed to take fundamental control 
of a computer system, without authorization by the system's owners and 
legitimate managers. Typically, rootkits act to obscure their presence 
on the system through subversion or evasion of standard operating 
system security mechanisms. Often, they are also Trojans as well, 
fooling users into believing they are safe to run on their systems.
    \2\ As a result, a number of parties filed lawsuits against Sony/
BMG; the company eventually recalled all the affected CDs.
---------------------------------------------------------------------------
    It is generally agreed that spyware represents a significant threat 
to the security of any computer owner's data. Even for large 
enterprises spyware represents a serious threat to the integrity of 
intellectual property, confidential data, and personally identifiable 
information of employees and customers. Accordingly, AFFECT supports 
legislative efforts, like S. 1625, that are designed to curb the use of 
harmful spyware.\3\
---------------------------------------------------------------------------
    \3\ S. 1625 (Pryor), introduced in June 2007, would protect against 
the unauthorized installation of software that is used to take control 
of a computer in order to cause damage, collect personal information 
without consent, or otherwise enable identity theft.
---------------------------------------------------------------------------
AFFECT's Concerns with the Exception Provision of S. 1625
    AFFECT has concerns with the exception section of S. 1625, section 
6, which is overly broad and could be construed to protect wrongful 
acts that can result in great harm to computer users in direct 
opposition to the purpose of the bill.
    We are particularly concerned about Subsection 6(a)(10), which 
would permit a provider to monitor or interact with an individual's 
computer, or Internet or other network connection or service for the 
``detection or prevention of the unauthorized use of software 
fraudulent or other illegal activities.'' The reference to 
``unauthorized'' is too vague and raises a number of questions. 
``Authorized'' by whom? What is the process for authenticating the 
identity of the person using the software? And what are the standards 
for determining whether that person has the authority to perform a 
certain operation, and who decides?
    This language would allow a software vendor to surreptitiously 
download code onto a user's computer and freely violate the user's 
privacy by monitoring everything on his or her computer, as long as it 
did so under the guise of looking for unauthorized use, fraudulent, or 
illegal activities. It would allow the provider to set itself up as an 
ad hoc police force to conduct warrantless searches and to act as judge 
and jury to conduct unilateral seizures. Private entities do not and 
should not have the right to conduct law enforcement activities.
    More troubling is the fact that the language of Subsection 6(a)(10) 
would effectively allow a software provider to unilaterally decide to 
remotely shut down the user's computer or Internet or other network 
connection or service. But whether the use of a particular software is 
``unauthorized,'' ``fraudulent,'' or ``illegal'' is often subject to 
legitimate dispute and merits some judicial consideration before a 
provider is allowed to unilaterally employ a drastic remedy like remote 
disablement.
    Permitting unilateral remote disablement is simply bad public 
policy. Unilateral remote disablement can cause great harm to any 
computer owner who depends on access to and use of that computer, 
connection or service. For example, the shutdown of an owner's system 
can cause great harm to:

   a teacher using a computer to prepare for classroom 
        lectures;

   an insurer depending on a computer system to pay claims;

   a manufacturer trying to deliver its products to meet 
        contractual commitments; or

   the public's access to online library materials.

    That harm can be significantly larger than the harm to the software 
vendor (not getting a license fee).
    Even large enterprises are concerned about the threat of remote 
disablement. There have been a number of reported cases where software 
developers unilaterally determined that licensees didn't make 
appropriate payments and simply shut down the computer programs.\4\ The 
most widely reported was a case where a small software developer, 
Logisticon, Inc., installed malware within warehouse-management 
software delivered to cosmetic company, Revlon Inc. When the parties 
got into a dispute over whether the software had bugs and didn't 
perform as promised, Revlon withheld payment. Logisticon then tapped 
into Revlon's computers and disabled the program, which paralyzed 
Revlon's shipping operations for 3 days. Losses to Revlon were about 
$20 million. Revlon sued, charging extortion. Logisticon claimed this 
was simply ``electronic repossession.'' The case was settled out of 
court.
---------------------------------------------------------------------------
    \4\ Other cases include the following: In 1998 in Franks & Sons, 
Inc. v. Information Solutions, Inc., the software developer installed a 
``drop-dead'' code in the program. When the customer failed to pay as 
promised, the developer activated the drop-dead code, which prevented 
the customer from accessing the software as well as any stored 
information. The customer didn't know about the drop-dead code, and the 
court found that it would be unconscionable to allow the software 
developer to hold the licensee ransom as it did.
    In 1991, in American Computer Trust Leasing v. Jack Farrell 
Implement Co., 763 F. Supp. 1473 (D. Minn. 1991), the software 
developer, in a dispute over payment for the software, remotely 
deactivated the software. The contract provided that the developer, who 
owned the software, could remotely access the licensee's computer in 
order to service the software and that, if the licensee defaulted, the 
agreement was canceled. When the licensee didn't pay, the developer 
told the licensee that it was going to deactivate the program, which it 
promptly did. The licensee sued for damages, but the court ruled in 
favor of the developer on the grounds that the deactivation was 
``merely an exercise of [the developer's] rights under the software 
license agreement . . .''
    There have been many other cases involving software developers 
either putting drop-dead code in their products or remotely disabling 
code when they thought the other party was in breach. For example, a 
Dallas medical device software developer was sued in 1989 for using a 
phone line to deactivate software that compiled patients' lab results. 
The case was settled. In 1990, during a dispute about the performance 
of a piece of code, the developer simply logged in and removed the 
code, until the licensee released the developer from any liability. The 
licensee claimed that the general release was signed under duress, 
since he was being held economic hostage. Art Stone Theatrical Corp. v. 
Technical Programming & Support Systems, Inc., 549 N.Y.S. 2d 789 (App. 
Div. 1990).
    In 1991, in Clayton X-Ray Co. v. Professional Systems Corp., 812 
S.W.2d 565 (Mo. Ct. App. 1991), a company involved in a payment dispute 
logged into the licensee's computer and disabled the software. When the 
licensee tried to log on to see its files, all it saw was a copy of the 
unpaid bill. A jury awarded the licensee damages.
    In Werner, Zaroff, Slotnick, Stern & Askenazy v. Lewis, 588 N.Y.S. 
2d 960 (Civ. Ct. 1992), a law firm contracted with a company to develop 
billing and insurance software. When the software reached a certain 
number bills, and when the developer decided it had not been paid 
sufficiently, it shut down the software disabling access to the law 
firm's files. The law firm sued successfully.
---------------------------------------------------------------------------
    Clearly many disputes never make it to the courthouse steps because 
the balance of harm to be done via exercise of remote disablement is so 
overwhelmingly against the computer user that the mere threat of its 
use puts the user in an unfair position, and it must cave to the 
demands of the software vendor. The ability to unilaterally disable a 
user's computer or critical software running on it provides the 
software, network, or service provider undue leverage in a dispute even 
if the remedy is not exercised. Faced with a crippling and possibly 
even fatal disruption of its business, a user could be intimidated into 
relinquishing its rights and setting up precedents for its further 
disadvantage. This is because the risk to the provider that it will be 
held to have acted improperly is indefinite and its potential liability 
severely limited. Even if a provider wrongly exercises the remote 
disablement, it is unlikely the injured user will be able to recover 
money damages for the harm resulting from this action, including losses 
to the user's business attributable to the wrongful act, because 
providers routinely disclaim consequential damages in their licensee 
agreements; in fact, they routinely limit recoverable damages to the 
amount of the license fee.
    Moreover, in reaching into an individual's computer remotely to 
disable software residing on that computer, the software provider may 
not only violate privacy rights, but also damage the computer owner's 
other files. And the monitoring and remote disablement of software on 
an owner's computer by an outsider may compromise private information 
of employees, confidential and proprietary information of the owner, 
and, in some cases, national security information. As a result, it is 
possible that they could put an owner into breach of obligations it has 
under other laws (e.g., Health Insurance Portability and Accountability 
Act).
    The simple fact is that the code used to remotely enter a computer 
and disable the software or the network connection makes the computer 
vulnerable to security breaches by hackers, saboteurs, industrial and 
foreign governmental spies, and terrorists. The consequences of a 
successful intentional or even accidental misuse of a computer system 
range from loss of confidentiality to loss of system integrity, which 
may lead to more serious concerns, like data theft or loss, or, in the 
case of a business, significant financial losses or worse. When there 
is an opportunity to negotiate, many enterprises, including 
governmental entities, will insist that their software license 
agreements contain a warranty prohibiting any ``self-help code'' or 
other software routing designed to disable a computer program 
automatically or that is under the positive control of a person other 
than the licensee of the software. Unfortunately, with mass market 
licenses individual consumers and businesses are not able to negotiate 
for a ``no self-help code'' warranty.
Proposed Amendment
    S. 1625 is a commendable piece of legislation that addresses a real 
problem faced by computer users throughout this country. AFFECT 
supports it, but strongly recommends that the exception provision of S. 
1625 should only limit liability for interaction with a network, 
service, or computer that is undertaken to detect or prevent fraudulent 
or other illegal activities as prohibited by the act itself. Therefore, 
AFFECT proposes that Section 6(a)(10) of the bill be amended as 
follows:

        ``(10) detection or prevention of the unauthorized use of 
        software fraudulent or other illegal activities as prohibited 
        by this Act.''
Conclusion
    On behalf of AFFECT, thank you very much for the opportunity to 
appear before you today and for your consideration of our concerns. I 
would be happy to answer any questions you might have.

    Senator Nelson. Mr. Cerasale?

STATEMENT OF JERRY CERASALE, SENIOR VICE PRESIDENT, GOVERNMENT 
          AFFAIRS, DIRECT MARKETING ASSOCIATION, INC.

    Mr. Cerasale. Senator Nelson, Members of the Committee: 
Thank you for the opportunity to appear here today. I'm Jerry 
Cerasale, Senior Vice President for Government Affairs for the 
Direct Marketing Association, an association of 3,600 marketers 
who present offers and services to consumers directly.
    It is important in that kind of a business model that we 
have trust, that the consumer trust the marketer, but the 
consumer also has to trust the channel of marketing, and that's 
what we're here talking about today. In the past 3 years we 
have moved quite a ways in trying to prevent spyware, and I 
think we have to praise quite a few groups. One is Congress for 
constantly looking at this and putting pressure on us.
    The second are the software vendors, one of whom is sitting 
here on the table with me, for producing excellent products to 
go after and being able to remove objectionable software.
    Third, organizations, TRUSTe and even DMA, for setting up 
guidelines and establishing education. DMA has worked with, 
partnered with, the Federal Trade Commission and OnGuard 
Online.
    Finally but not least, law enforcement, looking at the 
Federal Trade Commission, the Department of Justice, and the 
State Attorneys General, pursuing bad actors.
    DMA supports removal of objectionable software and the 
means to do that. Our guidelines that we produce that all our 
members have to follow--and it's attached to my larger 
testimony--bans or prohibits putting on software that takes 
over someone's computer. It requires for installing other 
software that there be notes, that there be an easy means to 
uninstall or disable the program, that there be contact 
information concerning the organization that put the software 
on the computer so that the consumer can contact them, and that 
there be an easy, identifiable link to the privacy policy of 
that organization.
    So we have taken these steps and will continue to look at 
it more, and we had to write these guidelines in looking at it 
being not technologically, not focused on one technology, but 
to try and be broader so that as we get changes tomorrow and 
the next day, that we do not have to go back and rewrite our 
guidelines.
    We have a few specific comments concerning S. 1625. As we 
look at Section 4(b)(2) of the bill, we think also that this 
can be read very broadly and can in fact be used to cover 
legitimate advertising practices, those same practices that 
have helped create Cyber Monday to be a larger shopping day 
than Black Friday or support the great amount of free content 
on the Internet.
    We think, our suggestion is, in the previous Congress 
Section 4(b)(2) had an additional provision in it dealing with 
bad acts, and we think that that is a suggestion we have for 
Section 4(b)(2).
    As we look on, and I have to comment on Section 6(a)(10), 
one of the things to be careful about when looking at 
legislation or regulation in anti-fraud arenas is that we have, 
many of our members have anti-fraud provisions and those are 
out there to protect users from identity theft, and they have 
been fairly successful and successful in stopping credit card 
fraud and so forth. So as you look at things looking at the 
exceptions in 6(a)(10) is to make sure that we don't have 
unintended consequences there.
    Finally, 6(a)(8) and (9), giving limited liability. Our 
concern here is that it will remove accountability for software 
vendors. We think that this is very important, to have this 
accountability. Objectionable software is a subjective term and 
you can disagree on it. Many DMA members have written to and 
contacted software vendors whose software has removed their 
particular software on someone's computer and they have been 
able to work it out, very, very reputable organizations. 
Sometimes there has not been a resolution, and where do you go 
if there's not a resolution on this subjective term?
    Finally, there are some software vendors who don't answer 
phone calls, who don't respond to letters, and who don't 
respond to e-mails. If you have this kind of argument on a 
subjective issue, where do you go? So we're very concerned that 
you, Congress not eliminate accountability.
    Thank you very much.
    [The prepared statement of Mr. Cerasale follows:]

     Prepared Statement of Jerry Cerasale, Senior Vice President, 
         Government Affairs, Direct Marketing Association, Inc.
I. Introduction and Summary
    Good morning, Mr. Chairman and Members of the Committee. I am Jerry 
Cerasale, Senior Vice President for Government Affairs of the Direct 
Marketing Association, and I thank you for the opportunity to appear 
before the Committee as it examines S. 1625 and the spyware issue in 
general.
    The Direct Marketing Association, Inc. (``DMA'') (www.the-dma.org) 
is the leading global trade association of businesses and nonprofit 
organizations using and supporting multichannel direct marketing tools 
and techniques. DMA advocates industry standards for responsible 
marketing, promotes relevance as the key to reaching consumers with 
desirable offers, and provides cutting-edge research, education, and 
networking opportunities to improve results throughout the end-to-end 
direct marketing process. Founded in 1917, DMA today represents more 
than 3,600 companies from dozens of vertical industries in the U.S. and 
50 other nations, including a majority of the Fortune 100 companies, as 
well as nonprofit organizations. Included are catalogers, financial 
services, book and magazine publishers, retail stores, industrial 
manufacturers, Internet-based businesses, and a host of other segments, 
as well as the service industries that support them.
    DMA and our members appreciate the Committee's outreach to the 
business community on this important issue. I note at the outset that 
this is a complicated issue. In part due to congressional attention, 
over the past several years there have been significant developments 
that have fundamentally improved the consumer experience as it relates 
to spyware. Where once, just three short years ago, invasive pop-up 
ads, drive-by downloads, and software that hijacked computers were on 
the rise, consumers in 2008 experience fewer such unwanted practices. 
Industry guidelines for legitimate software downloads, strong self-
regulation, major technological improvements, and Federal Trade 
Commission (``FTC'') and state Attorney General enforcement have all 
contributed to the current, significantly improved environment where 
the prevalence of spyware has been vastly reduced. While DMA supports 
the Committee's interest in combating spyware, given that the 
marketplace has evolved considerably since previous Congresses 
considered this issue, we believe that a statutory approach that would 
cover a broad range of software downloads and online marketing might 
not achieve the desired purpose of limiting spyware, but might have the 
unintended effect of interfering with important e-commerce and 
marketing functionalities.
    Internet growth over the past 10 years has been nothing short of 
remarkable, and this growth is fueled by the seamlessness of 
interactions of content, software, advertising, and other services. The 
dramatic rise of the Internet is evident in the dollar amounts 
consumers spend purchasing products through Internet sales. Last year, 
on Cyber Monday, the busiest Internet shopping day of the year, 
shoppers spent more than $733 million online.\1\ This represents an 
increase of 21 percent from the same day the previous year and is more 
than the amount shoppers spent on Black Friday.\2\
---------------------------------------------------------------------------
    \1\ Cyber Monday is the first Monday following Thanksgiving. In 
2007, Cyber Monday fell on November 26. The Friday after Thanksgiving 
Day is known as Black Friday and is traditionally the largest brick and 
mortar shopping day of the year.
    \2\ See http://www.comscore.com/press/release.asp?press=1921.
---------------------------------------------------------------------------
    Additional statistics demonstrate the staggering growth in e-
commerce. The U.S. Census Bureau, which releases quarterly retail e-
commerce statistics, recently reported that estimated retail e-commerce 
sales for the 1st quarter of 2008 were $33.8 billion, an increase of 
13.6 percent from the 1st quarter of 2007. The Census Bureau also noted 
that 1st quarter e-commerce sales accounted for 3.4 percent of total 
sales.\3\
---------------------------------------------------------------------------
    \3\ U.S. Census Bureau, Quarterly Retail E-commerce Sales, 1st 
Quarter 2008, May 15, 2008. See http://www.census.gov/mrts/www/data/
pdf/08Q1.pdf.
---------------------------------------------------------------------------
    As these and similar figures suggest, the Internet revolution has 
had a tremendous impact on economic growth. The Internet has become a 
preferred mechanism of commerce for many consumers, and a key part of 
multi-channel sales efforts for businesses. This phenomenon has changed 
the way products and services reach the market, and enables consumers 
to shop in an environment that knows no restrictions on time or place.
II. Strong Guidelines, Technology, and Enforcement Have Reduced the 
        Need for Legislation
    The combination of strong industry guidelines, anti-spyware 
technologies, and enforcement of existing laws over the past 3 years 
has limited pernicious software downloads, reducing spyware's threat to 
the positive consumer experience online. Together, we are winning the 
battle against such malicious practices. That said, this battle will be 
ongoing. Today's solutions and remedies may be obsolete tomorrow. As 
technology continues to evolve rapidly, so too will the challenges 
posed by spyware and related bad practices.
A. Industry Guidelines
    DMA has long been a leader in establishing comprehensive self-
regulatory guidelines for its members on important issues related to 
privacy and e-commerce, among many others. DMA and its member companies 
have a major stake in the success of electronic commerce and Internet 
marketing and advertising, and are among those benefiting from its 
growth. Our members understand that their success on the Internet is 
dependent on consumers' confidence in the online medium, and they 
support efforts that enrich a user's experience while fostering 
consumer trust in online channels. Understanding the importance of 
standards and best practices in building consumer confidence, DMA, 
working with its members, in 2006 developed and adopted standards for 
software downloads as part of our Guidelines for Ethical Business 
Practice (``Guidelines''), to specifically discourage illegitimate 
software download practices that threaten to undermine electronic 
commerce and Internet advertising.\4\ In our experience, industry 
guidelines are the most effective way to address concerns that arise in 
the continuously changing technological landscape. Such guidelines are 
flexible and adaptable in a timely manner so as to cover bad practices 
and not unintentionally or unnecessarily cover legitimate actors. These 
software guidelines and an analysis of their requirements are attached.
---------------------------------------------------------------------------
    \4\ Use of Software or Other Similar Technology Installed on a 
Computer or Similar Device, DMA Guidelines for Ethical Business 
Practice, at 21 (attached) (available at http://www.the-dma.org/
guidelines/EthicsGuidelines.pdf).
---------------------------------------------------------------------------
B. Current Law Enforcement Efforts
    Technology, self-regulation, and enforcement of existing laws are 
adequately addressing the problems caused by spyware. In the past 
couple of years, law enforcement officials have been using existing 
enforcement tools to pursue sources of spyware. The FTC has 
aggressively pursued adware companies engaging in improper business 
practices. Since 2004, the Commission has brought more than 10 such 
cases under its deceptive and unfair practices authority.\5\ In 
addition, the Department of Justice (``DOJ'') is actively combating 
spyware under the Computer Fraud and Abuse Act and the Wiretap Act, 
also with more than 10 cases to date.\6\ The states have been an 
important part of the enforcement efforts in this area as well, with 
state attorneys general using their fraud and consumer protection laws 
to target distributors of spyware.\7\ Strong enforcement of existing 
laws, combined with industry self-policing and innovative technologies, 
thus, have drastically slowed the spread of spyware and its effects. As 
these efforts indicate, continued dedication of resources to 
enforcement has proven an effective response to spyware.
---------------------------------------------------------------------------
    \5\ See, e.g., In the Matter of DirectRevenue LLC, FTC File No. 
052-3131 (filed Feb. 16, 2007); In the Matter of Sony BMG Music 
Entertainment, FTC File No. 062-3019 (filed Jan. 30, 2007); FTC v. ERG 
Ventures, LLC, FTC File No. 062-3192 (filed Nov. 29, 2006); In the 
Matter of Zango, Inc. f/k/a 180solutions, Inc., FTC File No. 052-3130 
(filed Nov. 3, 2006).
    \6\ CFAA, 18 U.S.C.  1030; Wiretap Act, 18 U.S.C  2511. See, 
e.g., U.S. v. Jerome T. Heckenkamp, http://www.usdoj.gov/criminal/
cybercrime/heckenkampSent.htm; U.S. v. Christopher Maxwell, http://
www.usdoj.gov/criminal/cybercrime/maxwellPlea.htm.
    \7\ For example, New York attorneys general over the past few 
years, as well as other attorneys general, have been actively pursuing 
cases against companies for deceptive practices in connection with 
spyware and adware. See New York Attorney General settlement with 
online advertisers, http://www.oag.state.ny.us/press/2007/jan/
jan29b_07.html; settlement with DirectRevenue, http://
www.oag.state.ny.us/press/2006/apr/apr04ab_06.html.
---------------------------------------------------------------------------
C. Marketplace Technology Has Adapted to Combat Spyware
    The technological tools available to consumers to prevent spyware 
also have seen significant improvement in their effectiveness. These 
tools are highly sophisticated, user friendly, and widely available, 
and in many instances are available at no cost to the consumer. For 
instance, today's anti-spyware software is proactive in detecting 
malware before it can penetrate a consumer's personal computer, thereby 
eliminating frustrations of spyware by preventing it from ever being 
downloaded. Consumers also have access to new web browsers with 
stronger security features and better warning features. In addition, as 
spyware became a problem, industry responded by installing anti-spyware 
software onto personal computers before shipping them to customers. 
This service provides personal computers with an early vaccination 
against spyware.
III. Specific Concerns about S. 1625
    I would like to take this opportunity to discuss specific comments 
regarding S. 1625, which is pending before the Committee. We believe 
that the significant developments described warrant reevaluation of 
certain provisions of this legislation by the Committee, which we hope 
that the sponsors of this bill and the members of the Committee will 
consider.
    DMA is concerned that Section 4(b)(2) of the bill could create 
compliance uncertainty, which could, in turn, limit current and future 
critical e-commerce functions designed to make the Internet browsing 
experience seamless. For this reason, DMA believes that Section 4(b)(2) 
should be tailored to specifically target ``bad practices,'' rather 
than create the regulation of many legitimate information practices 
resulting from software. The current language in Section 4(b)(2) could 
be interpreted to extend well beyond regulating ``surreptitious 
surveillance'' practices. We recommend that any restriction on data 
collected and correlated with a user's online history be narrowed, as 
this bill did the last time it was considered and approved by this 
Committee by adding the language contained in the previous bill. Our 
suggestion would apply only if the computer software was installed in a 
manner designed to conceal from a computer user the fact that the 
software was being installed and would perform an information 
collection function. This type of approach would make clear that the 
bill targets deceptive acts--which should be the objective of any such 
legislation--and does not restrain legitimate practices.
    DMA also is concerned about Sections 6(a)(8) and (9), the 
provisions that would bestow limited liability on a business that 
removes ``objectionable content'' or software used in violation of the 
Act. While on its face, the authority to remove ``objectionable 
content'' may appear reasonable, the term ``objectionable'' is not 
defined and, as a consequence, section 6(a)(8) would allow any anti-
spyware entity to act unilaterally, and without review, to block any 
material that it defines as ``objectionable.'' Under this authority, 
for example, an anti-spyware tool would be free to identify and remove 
anti-fraud software from a computer, with no liability for doing so, or 
for fraudulent activities that may then be perpetrated, or it could use 
the unfettered discretion provided for in this subsection to block a 
competitor's access even if that competitor has the specific consent of 
the user. Moreover, it could do so without any notice whatsoever to the 
user. We are, therefore, concerned that this provision would grant full 
immunity to a business that oversteps its power to remove legitimate 
content and causes harm to another business or the user. This type of 
broad immunity would have negative consequences for consumers by 
undermining their personalized Internet experience. For instance, what 
may be ``objectionable content'' to an anti-spyware entity may be a 
consumer's valued tool bar or personalized cookie.
    For similar reasons, DMA has concerns about Section 6(a)(9), which 
would permit a business to remove software used in violation of 
sections 3, 4, or 5 the Act. In previous versions of this bill, this 
type of immunity has been referred to as a ``Good Samaritan'' 
provision. We are concerned that providing limited liability to 
providers acting under ``Good Samaritan'' protection may also have 
unintended consequences for consumers and businesses. DMA supports a 
provider's ability to remove or disable a program employed to 
perpetrate a bad act. However, we are concerned that a provision as 
broad as Section 6(a)(9) would allow a provider to remove legitimate 
software without consequence. The current framework, under which 
existing laws are used to hold anti-spyware companies liable for 
removal of legitimate software, has served as an important check on 
overreaching by such providers and should be preserved.
    In addition, the policy goal underlying a ``Good Samaritan'' 
exemption is unclear. This type of protection would limit liability for 
violations for providers of anti-spyware software that remove spyware 
from a computer. The operative provisions of Sections 3, 4, and 5 
impose liability for causing the installation of software on a machine, 
not removing software. Thus, it is unclear why a provision limiting 
liability for ``removal'' of software is even necessary. Given the fact 
that it would limit liability where none exists in the first instance, 
DMA suggests that this provision be deleted.
    Finally, DMA recommends that the exemption provided in the 
definition of ``software'' (Section 12(14)) be modified to include 
``cookies and any other software that performs a similar or identical 
function or functions.'' By limiting the exemption solely to cookies, 
the bill is essentially regulating technology rather than conduct. As a 
result, the bill would foreclose the inclusion of new and innovative 
technologies that perform a similar or identical function as a cookie. 
This type of limitation would stifle innovation.
IV. Conclusion
    In summary, the combination of advances in industry self-
regulation, enforcement, and technology, coupled with concerns about 
interfering with legitimate uses of software for marketing purposes, 
necessitates that certain sections of S. 1625 be revisited. If 
regulation is necessary, and we believe that it is unclear that a need 
for legislation remains in light of recent technological innovations, 
it should be drafted in manner that does not undermine current efforts 
or upset consumers' expectations regarding the types of available, 
legitimate online marketing.
    I thank you for your time and the opportunity to speak before your 
Committee. I look forward to your questions and to working with the 
Committee on this legislation.
                              Attachment 1
Analysis of DMA Guidelines
    The Direct Marketing Association requires member organizations to 
adhere to its Guideline on Use of Software or Other Similar Technology 
Installed on a Computer or Similar Device, which encourages members to 
provide notice and choice regarding software that may be downloaded 
onto a consumer's personal computer or similar devices (attached). This 
Guideline clearly states that marketers should not install, have 
installed, or use, software or other similar technology on a computer 
or similar device that initiates deceptive practices or interferes with 
a user's expectation of the functionality of the computer and its 
programs. Such practices include software that takes control of a 
computer, modem hijacking, denial of service attacks, and endless loop 
pop-up advertisements. This Guideline also is clear that businesses 
should not deploy programs that deceptively modify or disable security 
or browser settings or prevent the user's efforts to disable or 
uninstall the software. DMA's Ethics Policy Committee evaluates 
compliance with its guidelines and regularly publishes summaries of 
outcomes of matters considered. Penalties can include removal from 
membership, referral to the Federal Trade Commission, and public 
disclosure of concern.
    This Guideline also details responsible practices for marketers 
offering software or other similar technology that is installed on a 
computer used to further legitimate marketing purposes. Specifically, 
such programs must provide a user with clear and conspicuous notice and 
choice at the point of joining a service or before the software or 
other similar technology begins operating on the user's computer, 
including notice of significant effects of having the software or other 
similar technology installed. Marketers also must give the user an easy 
means to uninstall the technology and/or disable all functionality. 
Finally, marketers should always provide an easily accessible link to 
privacy policies and contact information, as well as clear 
identification of the company making the offer.
    Given the rapid evolution of technology, DMA believes that self-
regulation is the most effective means for setting business standards 
for legitimate marketing. Guidelines like those published by DMA and 
TRUSTe condemn deceptive practices, strive to protect consumers, and 
foster legitimate Internet advertising and marketing. Guidelines are 
flexible and adaptable to changes in markets, business practices, and 
advances in technology.
    Another issue that DMA has sought to address through self-
regulatory best practices is the role of advertisers in ensuring that 
their advertisements are being disseminated responsibly. In some 
instances, there may be advertisers with good intentions who do not 
understand where their ads are appearing online. To help address some 
of these issues, DMA adopted best practices regarding online 
advertising networks and affiliate marketing.\8\ These best practices 
state, among other things, that marketers should obtain assurances that 
their partners will comply with legal requirements and DMA's Guidelines 
for Ethical Business Practice, undertake due diligence in entering into 
these partnerships, define parameters for ad placement, and develop a 
monitoring system for online advertising and affiliate networks. These 
should limit the appearance of advertisements related to spyware.
---------------------------------------------------------------------------
    \8\ See DMA Best Practices for Online Advertising Networks and 
Affiliate Marketing (attached) (available at http://www.the-dma.org/
guidelines/onlineadvertisingandaffiliatenetworkBP.pdf).
---------------------------------------------------------------------------
                              Attachment 2

     Excerpt from the DMA Guidelines for Ethical Business Practice

Use of Software or Other Similar Technology Installed on a Computer or 
        Similar Device
Article #40
    Marketers should not install, have installed, or use, software or 
other similar technology on a computer or similar device that initiates 
deceptive practices or interferes with a user's expectation of the 
functionality of the computer and its programs. Such practices include, 
but are not limited to, software or other similar technology that:

   Takes control of a computer (e.g., relaying spam and 
        viruses, modem hijacking, denial of service attacks, or endless 
        loop pop-up advertisements)

   Deceptively modifies or deceptively disables security or 
        browser settings or

   Prevents the user's efforts to disable or uninstall the 
        software or other similar technology

    Anyone that offers software or other similar technology that is 
installed on a computer or similar device for marketing purposes 
should:

   Give the computer user clear and conspicuous notice and 
        choice at the point of joining a service or before the software 
        or other similar technology begins operating on the user's 
        computer, including notice of significant effects* of having 
        the software or other similar technology installed

   Give the user an easy means to uninstall the software or 
        other similar technology and/or disable all functionality

   Give an easily accessible link to your privacy policy and

   Give clear identification of the software or other similar 
        technology's name and company information, and the ability for 
        the user to contact that company

  * Determination of whether there are significant effects includes, 
        for example:

     Whether pop-up advertisements appear that are 
            unexpected by the consumer

     Whether there are changes to the computer's home page 
            or tool bar

     Whether there are any changes to settings in security 
            software, such as a firewall, to permit the software to 
            communicate with the marketer or the company deploying the 
            software, or

     Whether there are any other operational results that 
            would inhibit the user's expected functionality

    Cookies or other passive means of data collection, including web 
beacons, are not governed by this Guideline. Article #37 provides 
guidance regarding cookies and other passive means of data collection.
                              Attachment 3
                                                          June 2006
DMA's Internet Marketing Advisory Board (IMAB) Best Practices for 
        Online Advertising Networks and Affiliate Marketing
    Online marketers using advertising and affiliate networks should:

        1. Obtain assurances that the online advertising and affiliate 
        network is in full compliance with state law, Federal law, and 
        the DMA Guidelines for Ethical Business Practice.

        2. Perform due diligence on prospective network advertising 
        partners and make sure you are working with reputable firms. 
        Additionally (if possible), obtain a sample list of current 
        advertising clients. Due diligence should also include either: 
        (1) asking for a full disclosure of eligible sites, or (2) a 
        review of processes to limit access to unwanted sites or 
        channels. When partnering with an aggregate site online 
        advertising and affiliate networks should provide the marketer 
        with a sampling of sites that are in their network. Due 
        diligence should encompass the entire process from the marketer 
        to the end consumer.

        3. Always utilize a written contract/agreement. This will 
        provide you the greatest possible control over your ad 
        placement. This will also be the mechanism by which you devise 
        and enforce formulas and/or guidelines for where and how online 
        ads will be placed.

        4. Include specific parameters that must be employed to 
        determine placement of your online ads in written agreements. 
        Altering of offer by an advertising or affiliate network is 
        prohibited. If laws, guidelines or set standards are violated 
        your contract with the violating advertising or affiliate 
        network should be terminated.

        5. Develop a system to routinely monitor your ad placements as 
        well as your contract with any online advertising or affiliate 
        network.

    Senator Nelson. Mr. Rotenberg?

  STATEMENT OF MARC ROTENBERG, EXECUTIVE DIRECTOR, ELECTRONIC 
               PRIVACY INFORMATION CENTER (EPIC)

    Mr. Rotenberg. Thank you very much, Senator, and thank you 
for the opportunity to testify today. The Electronic Privacy 
Information Center has a long-term interest in the ability of 
the Federal Trade Commission to police business practices that 
impact American consumers. We have worked with the FTC now for 
almost a decade to try to ensure that the Section 5 authority 
is used to protect consumers because if consumers do not have 
trust and confidence in the electronic marketplace clearly it's 
not good for consumers or businesses.
    Of course, the concerns about spyware are very real and the 
costs are very real. For consumers it's not only their privacy 
and personal information, it's also the risk that financial 
details of bank account information, checking account 
information will be disclosed to others. It's the risk of 
identity thieves. It's the risk frankly simply of the hassle of 
having to monitor your personal computer to make sure that 
there's no improper surveillance taking place on your private 
activity.
    So we see a real urgency in addressing the spyware issue 
and ensuring that the Federal Trade Commission has the 
authority, has the necessary tools to crack down on these 
activities.
    Now, since you've asked us to make some brief remarks and 
because my full statement will be entered into the hearing 
record, I thought it might be helpful to place this bill a 
little bit in the context of where we've been and where I think 
we may be going. This bill addresses the specific problem of 
products, applications and techniques that are placed on the 
consumer's computer that surreptitiously take information from 
the user or exploit vulnerabilities on the computer's system.
    Clearly these are bad practices. They should be prohibited. 
I think there are some changes that could be made in terms of 
scope and definition that might make the bill a little bit more 
effective. But I also think it's important to understand that 
this is simply one category of spyware and that there are other 
types of activities which I think you need to be aware of.
    We have concerns, for example, about Internet service 
providers that now view the opportunity to intercept 
communications, the routine Internet traffic of their 
customers, for advertising purposes. From our perspective 
that's a form of spyware and if it's not addressed in this 
legislation perhaps it could be addressed somewhere else.
    We're concerned about similar techniques that might be 
deployed against mobile telephones. A lot of information, 
personal information, is available on phones. These phones are 
becoming more sophisticated. They're essentially mobile 
computers and many of the same concerns about privacy 
protection and spyware exist there as well. Even the 
advertising techniques on social networking sites such as 
Facebook which make it possible for third party developers to 
get access to a lot of detailed personal information they don't 
really need access to is another issue we hope the Committee 
will consider.
    Again, it may not be possible to get to all these issues 
with this legislation, and we do think this legislation is a 
step in the right direction. But I think it is important as the 
Committee thinks broadly about evolving business practices to 
be aware of these threats.
    Now, to speak specifically about some of the 
recommendations that we would make for S. 1625, which we do 
favor--it's an important bill--we think it is clearly important 
to expand the FTC authority in this area so that when they do 
pursue these investigations we think it's important that the 
FTC authority not preempt State authority. We already have very 
important examples. In Washington State, for example, the State 
attorney general was able to go after a company that actually 
claimed it was offering a product to help people with spyware. 
The way it did it was to put up advertising on the user's 
computer which said: Oh, we've detected spyware on your 
computer; you need to purchase our product.
    Well, the State attorney general was able to go after that 
company and reached a million dollar settlement. We think those 
types of innovative investigations and prosecutions are very 
important.
    There is an issue with the exclusion for liability. A 
company under one provision in the bill would be given very 
broad authority to install spyware and we think that really 
needs to be reined in a bit and it is an exception. I don't 
think it's too difficult to deal with.
    Finally, the category of information that the bill 
protects, what we think of as personally identifiable 
information, of course is changing very rapidly. Ten years ago 
we might have said, well, it's a person's telephone number and 
maybe their Social Security number. Now we need to think about 
their identity or user number on a Facebook or social 
networking service, because that's also a unique identifier 
that makes it possible to identify someone.
    Even a person's password information, the person's Internet 
protocol address that's uniquely linked to a computer, is a 
type of personally identifiable information. We think those 
changes could be made in the bill as well.
    But it is important legislation. It takes on part of the 
problem and I hope the Committee will be able to act favorably 
on it.
    [The prepared statement of Mr. Rotenberg follows:]

       Prepared Statement of Marc Rotenberg, Executive Director, 
              Electronic Privacy Information Center (EPIC)
    Senator Pryor, Chairman Inouye, Senator Stevens and members of the 
Committee, thank you for the opportunity to testify today on the topic 
of spyware and S. 1625, the Counter Spy Act. My name is Marc Rotenberg 
and I am Executive Director of the Electronic Privacy Information 
Center. EPIC is a non-partisan research organization based in 
Washington, D.C. EPIC was founded in 1994 to focus public attention on 
emerging civil liberties issues and to protect privacy, the First 
Amendment, and constitutional values. EPIC recently filed a complaint 
at the Federal Trade Commission on the specific problem of commercial 
spyware.\1\
    Spyware, adware, and other information collection techniques are a 
growing threat to the privacy of Internet users. Computer users have 
noticed the effects. Ninety percent of users say they have adjusted 
their online behavior out of fear of falling victim to software 
intrusions.\2\ The Webroot automated threat research tool has 
identified more than half a million different potential malware sites 
since January 2005.\3\ Spyware can cause significant degradation in 
system performance, result in loss of Internet access and impose 
substantial costs on consumers and businesses.\4\ Spyware can assert 
control over the operation of computers.\5\ The privacy risks of 
spyware include the theft of private information, monitoring of 
communications and tracking of an individual's online activity.\6\
    Importantly, privacy threats are growing not just in numbers, but 
also in type. Traditional spyware, adware and tracking cookies are now 
joined by other threats such as mobile device spyware,\7\ 
``stalkerware,'' and the potential for social networking applications 
to function as spyware. Spyware comes from several sources including 
online attackers, organized crime, marketing organizations and trusted 
insiders.\8\
    A new motivation for the cyber criminal is that spyware has become 
a profitable business.\9\ Individuals can also deploy spyware against 
each other.\10\ Some ISP's have also begun to install their own 
spyware-like services.\11\
    These threats require vigorous policy response. Policy must be able 
to innovate to recognize new challenges while substantively protecting 
consumer privacy.
Notice and Consent Schemes Do Not Adequately Protect User Information
    Ultimately, users must be able to control how and when information 
about them is used, disclosed and held. Solutions which rely on simple 
notice and consent will not adequately protect users. A recent survey 
of California consumers showed that they fundamentally misunderstand 
their online privacy rights.\12\ In two separate surveys almost 60 
percent of consumers incorrectly believed that the presence of 
``privacy policy'' meant that their privacy was protected.\13\ In a 
different survey, 55 percent of participants incorrectly believed that 
the presence of a privacy policy meant that websites could not sell 
their address and purchase information.
    Users also routinely click through notices. The Pew Internet and 
American Life Project found that 73 percent of users do not always read 
agreements, privacy statements or other disclaimers before downloading 
or installing programs.\14\ In such an environment, merely giving 
notice to users before the collection of sensitive information from 
their computers fails to adequately protect privacy in the way 
consumers expect.
    Consumer data should instead receive substantive protection. 
Information should be kept securely, and users should have the ability 
to know what data about them is being kept, who it has been shared 
with, and to withdraw consent for the holding of this data. Further, 
data should only be collected and kept for specified purposes.
    Important security information should also receive protection, even 
if it does not identify a user. The Counter Spy Act places conditions 
on software that collects information such as the user's Social 
Security number and driver's license number. It also protects as 
``sensitive personal information'' information such as financial 
account numbers when combined with passwords or other security 
codes.\15\ Password and access information to other accounts, such as 
e-mail or social networking, are not included.
    EPIC recommends that strict protection be afforded to security 
information, such as username/password pairs, encryption keys, 
biometric data, or other access control information. The mining of this 
information may not lead directly to identity theft and other financial 
harm, but facilitates its spread. Gaining access to a user's non-
financial accounts allows further information to be collected and 
further crimes perpetrated. Compromised accounts may have valuable 
information stored in them or be used to originate further malware 
attacks, including by impersonating the compromised account.
Privacy Requires Strong and Innovative Enforcement
    EPIC supports giving the FTC the ability to seek treble fines and 
penalize pattern or practice violations, as section 7 of the Counter 
Spy Act does. These changes will improve the FTC's effectiveness in 
pursuing repeat offenders, and also change the economic incentives and 
disincentives for purveyors of spyware.
    Several states are using innovative policies to protect their 
citizens' privacy. Spyware legislation has been passed in several 
states, including Alaska,\16\ Arizona,\17\ California,\18\ Florida,\19\ 
Georgia,\20\ Illinois,\21\ Indiana,\22\ Iowa,\23\ Louisiana,\24\ 
Nevada,\25\ New Hampshire,\26\ Rhode Island,\27\ Texas,\28\ Utah,\29\ 
and Washington.\30\ The Utah statute, for example, makes provision for 
a private cause of action which may be brought by a mark owner who does 
business in Utah and is directly and adversely affected by the 
violation.\31\ In such a suit a mark owner may recover the greater of 
$500 per each ad displayed or actual damages.\32\
    State Attorneys General have pursued spyware providers under state 
spyware laws. Washington State successfully applied the Washington 
State Computer Spyware Act \33\ (Spyware Act) to stop Secure Computer's 
use of their free computer scan that always detects spyware leading to 
instructions to buy their Spyware Cleaner product in a $1,000,000 
settlement.\34\ The State alleged violations under the state's Spyware 
Act, Federal and state spam laws, and the state Consumer Protection 
Act.\35\ The Attorney General's Office accused the company of ``falsely 
claiming computers were infected with spyware'' to entice the consumer 
to pay for their program that claimed to remove it.\36\ The settlement 
required the company to inform consumers of their right to a refund and 
pay a $1,000,000 judgment.
    For these reasons EPIC recommends that the Counter Spy act not 
preempt state laws and state enforcement actions, as section 11(b) 
does. Federal law should set a baseline of privacy protection. It 
should not cap it.
    EPIC recommends that the limitation in section 6(a)(10) be removed. 
The Counter Spy Act's liability limitations broadly permit monitoring 
of users' computers and personal information for the ``detection or 
prevention of the unauthorized use of software fraudulent or other 
illegal activities.'' \37\ These limitations should be scaled back. The 
determination of whether uses are unauthorized, fraudulent or illegal 
may be complicated.
Privacy Threats Beyond Traditional Spyware Programs
    Information collection online is not performed solely with spyware 
programs executed on user's computers. Third-party and opt-out cookies 
present growing threats. The proliferation of mobile devices means a 
potential new place for spyware to act. Internet service providers are 
begging to deploy their own adware and profiling services in ways which 
users will find difficult, if not impossible, to detect. Important user 
information is leaving the desktops and instead is residing on online 
social networking profiles. This information includes sensitive 
personal information such as contact information, one's social and 
business relationships, political interests, sexual orientation, as 
well as the contents of communications. Further, online social 
networking sites are increasing their own information collection 
practices.
    A ``cookie'' is information about a particular user's identity and 
browsing behavior that web servers store on his computer, typically 
without his consent.\38\ Cookies permit a user to customize his 
interface with a particular website, for example by automatically 
entering his username and password.\39\ However, since cookies can 
match an individual user to his interests and browsing habits, they are 
increasingly placed, gathered, and exploited by advertisers and others 
with a commercial interest in precisely targeting ads and services.\40\ 
Anyone with access to that user's cookies can track his browsing 
history and gather information about his behavior and identity.\41\ As 
a result, Internet users who are concerned about privacy are widely 
encouraged to routinely purge the cookies they have accumulated or to 
refuse cookies from websites that require them.\42\
    The recent Google/Doubleclick merger raises significant privacy 
issues because of the planned merger of the Google search engine 
database with Doubleclick's extensive data collection accomplished with 
third-party cookies.\43\ EPIC filed a complaint with the FTC urging the 
Commission to impose privacy protections upon the merger, concluding:

        Google's proposed acquisition of DoubleClick will give one 
        company access to more information about the Internet 
        activities of consumers than any other company in the world. 
        Moreover, Google will operate with virtually no legal 
        obligation to ensure the privacy, security, and accuracy of the 
        personal data that it collects. At this time, there is simply 
        no consumer privacy issue more pressing for the Commission to 
        consider than Google's plan to combine the search histories and 
        website visit records of Internet users.\44\

    In November 2007 Facebook launched its Beacon service.\45\ Beacon 
collects information from Facebook users when engaged in actions on 
other websites. Facebook then uses this information to broadcast 
advertisements to that user's friends on Facebook, alerting them of the 
actions that the user took on these other websites. Initially, Facebook 
only provided a brief opportunity for an opt-out. Facebook later added 
an opt-in system, and the option to globally opt out of Beacon. Shortly 
after Beacon's launch, security researchers showed that Facebook is 
receiving information even from those who are not logged in to Facebook 
and are not Facebook members.\46\
    Users of social networking sites are also exposed to the 
information collection practices of third party social networking 
applications. On Facebook, installing applications grants this third 
party application provider access to nearly all of a user's 
information.\47\ Significantly, third party applications do not only 
access the information about a given user that has added the 
application. Applications by default get access to much of the 
information about that user's friends and network members that the user 
can see. This level of access is often not necessary. Researchers at 
the University of Virginia found that 90 percent of applications are 
given more access privileges than they need.\48\
    These features may be exploited and the information used for other 
purposes. Investigators at the BBC took 3 hours to write an application 
that collected information that had been marked as unable to be shared 
with friends.\49\ Facebook, as part of its response, cautioned that 
users should ``employ the same precautions while downloading software 
from Facebook applications that they use when downloading software on 
their desktop.'' \50\
    Mobile device spyware also presents a future privacy threat, with 
unique features due to the mobile environment. In December 2006, McAfee 
reported on a new kind of mobile phone spyware, called SymbOS/
Mobispy.A.\51\ SymbOS/Mobispy.A installed on phones and recorded 
incoming and outgoing SMS messages.\52\ It also tracked the phone 
numbers of all dialed and received calls. Mobile tracking presents 
unique dangers because it allows the tracker to determine the user's 
location. While the data may be able to follow users anonymously it may 
also easily identify them--they are likely at home in the evenings. 
Location information should receive significant protection from 
tracking applications.
    A new more insidious form of adware has been tested in the United 
Kingdom, and at least one U.S. company has announced it will also use 
the system.\53\ British Telecom contracted with the former adware 
company Phorm to create secret profiles of its users.\54\ Users' 
traffic was routed via Phorm boxes, which replaced ads on the pages 
users were visiting with its own targeted ads. In the U.S., Charter 
communications announced that it will monitor consumers' browsing in 
order to serve them targeted ads.\55\ Charter sent several of its users 
cryptic notices of an ``enhancement'' to their web browsing 
experiences.\56\ The letter pointed users to a website with more 
details, including the claim that ``[t]here is no application 
downloaded onto a user's computer and, therefore, there is no 
``adware'' or ``spyware'' on your computer from Charter in this 
enhanced service.'' \57\ Thus a system that is functionally equivalent 
to spyware, and more dangerous due to its undetectability, is touted as 
safer because it does not reside on the victim's computer.
    Finally, some companies market spyware directly for consumers to 
use for stalking and other criminal activities. These technologies are 
promoted to consumers to spy on e-mail and instant message exchanges, 
record websites visited, and capture passwords and logins. EPIC has 
filed a complaint with the FTC against such ``Stalker spyware,'' 
highlighting the unfair and deceptive practices used to market this 
software.\58\ These practices include the promotion of illegal 
surveillance targets, the promotion of ``Trojan Horse'' e-mail attacks, 
and the failure to warn purchasers of the legal consequences of illegal 
use.
    We hope the FTC will take action on this complaint and take action 
against these firms.
Conclusion
    Privacy online continues to face many threats, both from criminal 
entities as well as intrusive commercial ventures. Substantive consumer 
protections and innovative enforcement strategies are necessary to 
protect consumers from the evolving threat of information collection 
online. These threats include not just traditional spyware, but also 
the merger of online consumer databases, new social networking 
features, mobile spyware and stalker spyware.
    EPIC recommends passage of Counter Spy Act in line with the changes 
pointed out above. The Counter Spy Act should not preempt state law or 
enforcement; it should protect important security information like 
username/login pairs; and the liability limitations should be narrowed. 
Congress should also be aware of other developing threats to privacy 
beyond traditional spyware programs.
Footnotes
    \1\ Complaint, Request for Investigation, Injunction and Other 
Relief, In the Matter of Awarenesstech.com, et al., (March 6, 2008), 
http://epic.org/privacy/dv/spy_software.pdf.
    \2\ Pew Internet & American Life Project, Spyware: The Threat of 
Unwanted Software Programs is Changing the way People use the Internet, 
2 (July 2005), available at http://pewinternet.org/pdfs/
PIP_Spyware_Report_July_05.pdf [hereinafter PEW Spyware Report].
    \3\ Webroot, State of Spyware Report Q2, (2006), available at 
http://www.webroot.com/pdf/2006-q2-sos-US.pdf.
    \4\ Fed. Trade Comm'n, Spyware Workshop--Monitoring Software on 
your PC: Spyware, Adware, and other software, 8 (Mar. 2005) available 
at http://www.ftc.gov/os/2005/03/050307spywarerpt.pdf.
    \5\ Id. at 9.
    \6\ Id.
    \7\ Joseph De Avila, Do Hackers Pose a Threat to Smart Phones?, The 
Wall Street Journal, D1, May 27, 2008, available at http://
online.wsj.com/article/SB121184343416921215
.html?mod=todays_us_personal_journal.
    \8\ Aaron Hackworth USCERT, Spyware, 3 (2005) available at http://
www.uscert.gov/reading_room/spyware.pdf.
    \9\ See Guillaume Lovet, Dirty Money on the Wires: The Business 
Models of Cyber Criminals, (2006), available at http://
www.momindum.com/ressources/produits/fortinetFlash/content/_libraries/
_documents/index1/GL_Business_Models_of_Cybercriminals.pdf.
    \10\ EPIC, Personal Surveillance Technologies (May 2008), http://
epic.org/privacy/dv/personal_surveillance.html.
    \11\ Saul Hansell, Charter Will Monitor Customer's Web Surfing to 
Target Ads, The New York Times, May 14, 2008, http://
bits.blogs.nytimes.com/2008/05/14/charter-will-monitor-customers-web-
surfing-to-target-ads/.
    \12\ Joseph Turow, Deirdre Mulligan, and Chris Jay Hoofnagle, 
Consumers Fundamentally Misunderstand the Online Advertising 
Marketplace (Oct. 2007), available at http://groups
.ischool.berkeley.edu/samuelsonclinic/files/
annenberg_samuelson_advertising.pdf.
    \13\ Id. at 1.
    \14\ Pew Spyware Report, supra note 2, at 6.
    \15\ S. 1625, 110th Cong.  12(13)(B) (2008).
    \16\ Alaska Stat.  45.45.792, 45.45.794, 45.45.798, 45.45.471 
(2007).
    \17\ Ariz. Rev. Stat.  44-7301 to -7304 (2008).
    \18\ Cal. Bus. & Prof. Code  22947 (2008).
    \19\ Fla. Stat.  934.02, .03, .06 (2008).
    \20\ Ga. Code Ann.  16-9-152, -157 (2008).
    \21\ 720 Ill. Comp. Stat. 5/16D-3 (2008).
    \22\ Ind. Code.  24-4.8-1 to -3 (2008).
    \23\ Iowa Code  715 (2008).
    \24\ La. Rev. Stat. Ann.  51:2006-14 (2008).
    \25\ Nev. Rev. Stat. Ann.  205.4737 (2007).
    \26\ N.H. Rev. Stat. Ann.  359-H:1-6 (2008).
    \27\ R.I. Gen. Laws  11-52.2-7 (2008).
    \28\ Tex. Bus. & Com. Code  48.001-4, .051-057 (2008); Tex. Bus. & 
Com. Code  324.001-7, .051-055, .101-.102 (2008).
    \29\ Utah Code Ann.  13-40-101 to -401 (2008).
    \30\ Wash. Rev. Code  19.270.010-.080,.900 (2008).
    \31\ Utah Code Ann.  13-40-301.
    \32\ Id.
    \33\ Wash. Rev. Code  19.270.010-.080,.900.
    \34\ State of Washington v. Secure Computer, LLC, No. C06-0126RSM 
(W.D. Wash. Nov. 30, 2006) (Consent Decree as to Defendants Secure 
Computer, LLC and Paul E. Burke), http://www.atg.wa.gov/uploadedFiles/
Another/News/Press_Releases/2006/SecureComputerConsentDecree112906.pdf.
    \35\ Press Release, Washington State Office of the Attorney 
General, Attorney General McKenna Announces $1M Settlement in 
Washington's First Spyware Suit (Dec. 4, 2006), available at http://
www.atg.wa.gov/pressrelease.aspx?id=5926.
    \36\ Id.
    \37\ S. 1625, 110th Cong.  6(a)(10) (2008).
    \38\ Cookiecentral.com, The Cookie Concept, http://
www.cookiecentral.com/c_concept.htm (last visited June 6, 2008).
    \39\ Cookiecentral.com, Purpose of Cookies: The Cookie Controversy, 
http://www.cookie
central.com/ccstory/cc2.htm (last visited June 6, 2008).
    \40\ Id.
    \41\ EPIC, Cookies, http://epic.org/privacy/internet/cookies/.
    \42\ EPIC, Does AskEraser Really Erase?, http://epic.org/privacy/
ask/default.html.
    \43\ See EPIC, Privacy? Proposed Google/DoubleClick Deal, http://
epic.org/privacy/ftc/google/
    \44\ EPIC Complaint, In the Matter of Google Inc. and DoubleClick 
Inc., 10 (April 20, 2007), http://epic.org/privacy/ftc/google/
epic_complaint.pdf.
    \45\ Facebook Beacon, http://www.facebook.com/business/?beacon.
    \46\ CA Security Advisor, Facebook's Misrepresentation ofBeacon's 
Threat to Privacy: Tracking Users Who Opt Out or Are Not Logged In, 
(Dec 3, 2007), http://community.ca.com/blogs/securityadvisor/archive/
2007/11/29/facebook-s-misrepresentation-of-beacon-s-threat-to-privacy-
tracking-users-who-opt-out-or-are-not-loggedin.aspx.
    \47\ EPIC, Facebook Privacy, http://epic.org/privacy/facebook/.
    \48\ Privacy Protection for Social Networking APIs, http://
www.cs.virginia.edu/felt/privacy/ (last visited June 6, 2008).
    \49\ Press Release, BBC, Facebook's loophole places personal 
profile data at risk--BBC investigation (May 1, 2008), http://
www.bbc.co.uk/pressoffice/pressreleases/stories/2008/05_may/01/
click.shtml.
    \50\ Q&A: Facebook Response, BBC, May 1, 2008, http://
news.bbc.co.uk/2/hi/programmes/click_online/7375891.stm.
    \51\ McAfee Avert Labs Blog, http://www.avertlabs.com/research/
blog/?p=145 (last visited June 5, 2008).
    \52\ Id.
    \53\ See EPIC, Deep Packet Inspection and Privacy, http://epic.org/
privacy/dpi/.
    \54\ Chris Williams, BT and Phorm secretly tracked 18,000 customers 
in 2006, The Register, April 1, 2008, http://www.theregister.co.uk/
2008/04/01/bt_phorm_2006m_trial/.
    \55\ Saul Hansell, Charter Will Monitor Customers' Web Surfing to 
Target Ads, The New York Times, May 14, 2008, http://
bits.blogs.nytimes.com/2008/05/14/charter-will-monitor-customers
web-surfing-to-target-ads/.
    \56\ Charter Letter, available at http://www.epic.org/privacy/dpi/
subscriber_ltr.pdf.
    \57\ Charter Communications, Enhanced Online Experience Frequently 
Asked Questions, http://connect.charter.com/landing/op1.html#6.
    \58\ Complaint, Request for Investigation, Injunction and Other 
Relief, In the Matter of Awarenesstech.com, et al., (March 6, 2008), 
http://epic.org/privacy/dv/spy_software.pdf.

    Senator Pryor [presiding]. Dr. Edelman?

               STATEMENT OF BENJAMIN G. EDELMAN,

         ASSISTANT PROFESSOR, BUSINESS ADMINISTRATION,

                    HARVARD BUSINESS SCHOOL

    Dr. Edelman. Thank you, Senator Pryor, Senator Nelson, 
Members of the Committee.
    Senator Pryor, I want to structure my remarks around your 
initial question about the proper definition of spyware and 
Senator Vitter's response immediately thereafter, concerned 
about both the risk of being over-inclusive and the risk of 
being under-inclusive, either of which would be a serious 
problem in making the legislation as effective as the Committee 
hopes.
    I spend perhaps too much of my time in my lab testing 
spyware, going to the sorts of sites where users get infected, 
infecting my computer over and over, measuring the effects on 
it, figuring out how it gets infected and what it would take to 
clean the infections off. Well, two examples that I've seen in 
the past months I think are instructive for identifying 
potential under-inclusiveness of this legislation and then in 
rethinking alternative approaches that might help the Committee 
be that much more effective.
    So here's one that I saw just 2 weeks ago in fact. A pop-up 
ad promised that it could, quote, ``stop spam.'' Upon clicking 
on the pop-up, I received a long text, several hundred words, 
center-aligned. Part of the text was off screen. It was very 
hard to read, in short.
    But if you read it carefully, you would find that it says 
it will show special offers in pop-up windows. OK, so it's 
saying it's going to show pop-up ads, but it's in a small font. 
The word ``pop-up'' is actually off-screen, so you'd have to 
scroll around to find it.
    If you press ``yes'' the software will track the websites 
that you visit and the search terms that you enter and then, 
sure enough, it will show you pop-up ads, quite a few of them.
    So what about that program vis a vis this legislation? Can 
you point to a clause of this legislation that that program 
violates? It's awfully hard to do actually. The program tracks 
some of the websites you visit, but when you look in Section 4, 
it needs to track those websites in a very particular way in 
order to fall afoul of that clause of Section 4. The underlying 
deception of having the tricky disclosure that's hard to read, 
you won't find anything about that in this legislation.
    Here's another one: a program that tracks a user's name, 
street address, and all of the web searches that they do, then 
sends that to their server for a variety of purposes, market 
research, perhaps some kind of marketing. There too, it's hard 
to point to the clause in this legislation that the program 
violates. When you read through the specific data elements that 
are prohibited under Section 4, you don't see the data that I 
listed that the program copies.
    I think members of this committee would be concerned to 
have that sort of software on their computers, and would want 
it removed if they found it there and certainly the public 
shares that view, but it seems that this legislation wouldn't 
cover at least those two examples.
    So what do we make of that? Well, Senator Pryor, as you and 
Senator Vitter immediately recognized, practices change 
quickly, and at our peril do we make a list of all the specific 
practices that ought to be prohibited, because the next day 
there will be more practices that we didn't think of, despite 
our best efforts.
    So coming back to Ms. Harrington's remarks, I think she's 
absolutely right to emphasize the effectiveness on a long-term 
basis of the FTC Act. By prohibiting acts that have a tendency 
to deceive, that tend to be unfair to consumers--that is the 
sort of language that can prevent these one-sided bargains, 
where they show you pop-up ads and you don't get anything in 
return, or they track you in great detail without telling you. 
That is an approach that has lasted for decades and will serve 
us well going forward.
    So what could this legislation do that would be helpful? 
Well, one, it seems the FTC lacks the statutory authority to 
get quite as large penalties as they ought to be able to 
receive. Imagine the settlement discussions between the FTC and 
a so-called adware maker. The adware maker is sitting there 
realizing that all the FTC can get is disgorgement of ill-
gotten gains, and the company managed not to make a profit last 
year. So what's the disgorgement? The disgorgement is zero. How 
much of a penalty can the FTC really extract under those 
circumstances?
    Consider a statutory grant of greater authority, of bigger 
penalties, of liquidated damages perhaps or some amount certain 
as a floor. ``Even if you didn't manage to make money, well, 
we're going to make certain you lost money if you went around 
causing the kind of harm that's at issue.'' That could be very 
helpful. So I think that's an approach the Committee might want 
to consider, avoiding attempting to define spyware because we 
have enough of that under the FTC Act, but instead granting 
greater statutory protections in the form of increased 
liability.
    My written remarks flag two other issues I hope the 
Committee will consider. For one, preemption of State law 
doesn't seem to me a good idea, given that there's more than 
enough work to go around to keep everyone busy and some 
innovative statutory approaches. Second, the Committee should 
avoid legislation that doesn't quite fill the field and makes 
it too easy for a vendor to claim to not be spyware. A vendor 
might claim: ``We are federally certified good software; we 
passed Senator Pryor's standard and therefore we must be 
good.'' But in fact that vendor could still be pretty sneaky 
and could continue to cause users substantial harm.
    So I'd caution the Committee at setting low standards. We 
need to be tough on spyware for the protection of all the users 
counting on this committee and this legislation for protection 
going forward.
    Thank you for your interest in this matter.
    [The prepared statement of Dr. Edelman follows:]

    Prepared Statement of Benjamin G. Edelman, Assistant Professor, 
                        Harvard Business School
    Chairman Inouye, Senator Pryor, Members of the Committee:

    My name is Benjamin Edelman. I am an Assistant Professor at the 
Harvard Business School, where my research focuses on the design of 
electronic marketplaces, including designing online marketplaces to 
assure safety, reliability, and efficiency. My full biography and 
publication list are at http://www.benedelman.org/bio and http://
www.benedelman.org/publications.
    Today the Committee considers the important problems of Internet 
spyware and deceptive adware--scourges that threaten the reliability, 
trustworthiness, and overall utility of many users' Internet's access.
    My bottom line:
    Despite some recent progress, spyware and adware continue to 
present substantial harms to Internet users and to the Internet as a 
whole.
    Many improper practices are already prohibited under existing 
statutes including the FTC Act, state consumer protection statutes, and 
state anti-spyware legislation. These statutes have given rise to a 
series of cases, both public and private, that have somewhat reined in 
the problems of spyware and adware.
    Tough Federal legislation could assist in bringing spyware and 
adware purveyors to justice, and in further deterring creation and 
support of this noxious software.
    But the bill at hand addresses only a portion of the problem, while 
in some ways reducing the effectiveness of existing efforts. By 
prohibiting specific individual practices, the bill invites 
perpetrators to comply with the letter of the law while continuing to 
harm and deceive consumers. Moreover, perpetrators are likely to boast 
of compliance--despite offering software no reasonable user would want. 
These loopholes are inevitable in the bill's ``laundry list'' approach, 
which unavoidably omits deceptive schemes not yet invented.
    Pages five and six set out my detailed suggestions for revision. I 
favor a rewrite that emphasizes consumer protection fundamentals such 
as a consumer's right to know what software runs on his PC, and to 
grant or deny consent to each program that asks to be installed. But 
the FTC has already established these principles through its existing 
anti-spyware litigation. Thanks to existing legislation plus the FTC's 
work to date, this bill can accomplish its apparent purpose without 
adding new prohibitions. Instead, this bill can grant the FTC 
discretion to seek increased penalties under existing statutes--sparing 
this committee the challenging task of deciding exactly what practices 
to prohibit.
The Consumer Victims of Spyware and Adware
    Discussion of spyware and adware typically seeks, in the first 
instance, to attempt to protect the users who receive such software. 
After all, a computer with spyware or adware is often virtually 
crippled--filled with so many popups that doing other work is 
impossible or impractical, and slowed so dramatically that it is 
unappealing to use the computer for ordinary purposes. Legislation and 
enforcement can help prevent such damage.
    Adware vendors often claim their software arrives on users' 
computers only after users agree. As a threshold matter, my hands-on 
testing has repeatedly proven that adware can become installed without 
a user's consent.\1\ But even if a user did accept the software, adware 
popups can nonetheless present substantial concern. For example, some 
adware popups are sexually-explicit--sometimes appearing without any 
obvious way to close the resulting windows to remove the explicit 
images.\2\ Other adware popups resort to deception to try to sell their 
wares--combining the interruption of popups with the trickery of false 
advertising.\3\ Moreover, adware popups appear separate from the 
programs that caused them--making it hard for users to understand where 
the ads came from, why they're there, and how to make them stop.
---------------------------------------------------------------------------
    \1\ See e.g., ``Who Profits from Security Holes?'' http://
www.benedelman.org/news/111804-1.html. See also ``Nonconsensual 180 
Installations Continue . . .'' http://www.benedelman.org/news/022006-
1.html. See also ``Spyware Installation Methods.'' http://
www.benedelman.org/spyware/installations/.
    \2\ ``Spyware Showing Unrequested Sexually-Explicit Images.'' 
http://www.benedelman.org/news/062206-1.html.
    \3\ See e.g., ``Zango Practices Violating Zango's Recent Settlement 
with the FTC'' (heading ``Zango Ads for Bogus Sites that Attempt to 
Defraud Users''). http://www.benedelman.org/spyware/zango-violations/.
---------------------------------------------------------------------------
    Users face a variety of costs in restoring a computer to good 
working order after an infection of spyware and/or adware. Some users 
hire technicians to make appropriate repairs. Others buy anti-spyware 
software. Furthermore, during the period in which spyware or adware 
impair a computer's operation, the user loses some or all access to the 
system he or she has paid for. These are real and troubling costs--out-
of-pocket expense, lost time, and reduced productivity.
    These harms are not outweighed by any countervailing benefits. Rare 
is the user who receives anything of genuine value from spyware or 
adware. Some vendors claim their software is useful, e.g., letting a 
user ``participate in a market research community'' or ``access premium 
content.'' But these claims rarely survive scrutiny. For example, it is 
hard to see a benefit in being tracked for market research, when 
standard practice is to pay participants to allow their behavior to be 
tracked. Moreover, when a vendor promises ``premium content'' in 
exchange for popups, it turns out the supposed premium material is 
often readily available elsewhere for free, and/or material the vendor 
lacks proper license to redistribute.\4\
---------------------------------------------------------------------------
    \4\ See e.g., ``Debunking Zango's `Content Economy.' '' http://
www.benedelman.org/news/052808-1.html.
---------------------------------------------------------------------------
    The harms caused by spyware and adware fall within the general 
realm of anti-consumer practices addressed by decades of consumer 
protection law. For example, just as other industries resorted to fine 
print to hide the unsavory aspects of their products,\5\ so too do 
adware vendors often turn to lengthy texts, scroll boxes, or euphemisms 
to ``disclose'' key effects of their software.\6\ Similarly, just as 
door-to-door salesmen made misleading claims to get consumers to let 
them in--literally, to ``get a foot in the door'' \7\--so too do adware 
vendors invoke deceptive campaigns to try to attract interest in their 
products.\8\ That the truth is (in some way) made known prior to 
purchase (or installation) is no defense: Once a vendor has resorted to 
deception, caselaw indicates that the deception cannot be cured through 
a (supposed) corrective disclosure. Legislation ought to consider these 
myriad deceptive practices--including anticipating that practices will 
continue to change as tricksters find new ways to deceive unsuspecting 
users.
---------------------------------------------------------------------------
    \5\ See e.g., Haagen-Dazs Co., 119 F.T.C. 762 (1995) (challenging 
effectiveness of fine-print footnote modifying ``98 percent fat free'' 
claim for frozen yogurt products that were not low in fat).
    \6\ See e.g., ``Gator's EULA Gone Bad.'' http://www.benedelman.org/
news/112904-1.html.
    \7\ See e.g., Encyclopedia Britannica, 87 F.T.C. 421 (1976), aff'd, 
605 P.2d 964 (7th Cir. 1979), cert. denied, 445 U.S. 934 (1980) 
(rejecting ``deceptive door opener'' sales pitches).
    \8\ See e.g., ``Zango Practices Violating Zango's Recent Settlement 
with the FTC'' (heading ``Widespread Zango Banner-Based Installations 
without Unavoidable, Prominent Disclosure of Material Terms (XP SP2)'') 
(supra).
---------------------------------------------------------------------------
The Deeper Problem: Imposing Negative Externalities on Others
    In my view, spyware and adware legislation should also consider the 
substantial negative externalities that such programs impose on others.
    For example, spyware and adware impose large costs on ISPs, 
computer makers, and software developers. In practice, users often turn 
to their ISPs and/or computer makers for assistance with problems 
caused by spyware and adware. Meanwhile, independent software makers 
must consider how their software interacts with spyware or adware 
unexpectedly on a user's computer--adding additional complexity and 
unpredictability.
    Spyware and adware cause further harm to the Internet's 
infrastructure and to Internet users generally--even users who are not 
themselves infected with spyware or adware. As much as half of spam now 
comes from ``zombie'' infections.\9\ Even if you keep your computer 
clean, others may not--and their computers may be used to send you 
spam.
---------------------------------------------------------------------------
    \9\ Xie et al., ``How Dynamic Are IP Addresses?'' http://
research.microsoft.com/projects/sgps/sigcomm2007.pdf.
---------------------------------------------------------------------------
    Furthermore, spyware and adware often attempt to defraud online 
advertisers--typically by claiming to show ads that were never actually 
shown, or by showing ads that users never agreed to receive. My 
research has uncovered spyware and adware performing click fraud--
automatically activating pay-per-click advertisement links where 
advertisers are only supposed to pay if a user specifically and 
intentionally clicks such links.\10\ Spyware and adware even interfere 
with advertising strategies widely perceived to present a lower risk of 
fraud. For example, some advertisers pay advertising commissions only 
upon a user's purchase--protecting against click fraud.\11\ But pay-
per-purchase advertisers can nonetheless be tricked by spyware and 
adware. For example, spyware and adware popups sometimes claim 
commissions on purchases they actually did nothing to facilitate.\12\
---------------------------------------------------------------------------
    \10\ ``The Spyware--Click-Fraud Connection.'' http://
www.benedelman.org/news/040406-1.html.
    \11\ These pay-per-purchase advertising systems are also known as 
cost-per-acquisition or ``CPA.''
    \12\ See e.g., ``Spyware Still Cheating Merchants . . .'' http://
www.benedelman.org/news/052107-1.html.
---------------------------------------------------------------------------
    In short, spyware and adware make the Internet a place where ISPs 
and computer makers incur unexpected costs they must ultimately pass 
back to customers; where even those who keep their computers safe 
nonetheless suffer from the infections that plague others; where 
advertisers cannot feel confident in the leads they pay to receive. The 
resulting costs make the Internet a weaker platform on which to do 
business, to all our detriment.
How to Stop the Problems of Spyware and Adware
    Unlike the viruses of prior decades, spyware and adware tend to be 
created by business enterprises--groups that design this unwanted 
software, foist it onto users' computers, and reap the rewards. The 
appropriate response: Find the perpetrators and hold them accountable.
    The past 4 years have brought considerable progress in identifying 
spyware and adware purveyors, and holding them accountable for what 
they have done. The New York Attorney General's office brought the 
first major case against a spyware vendor, Intermix, whose KeenValue, 
IncrediFind, and other programs were widely installed on users' 
computers without any consent at all, and also without meaningful, 
informed consent. Subsequent litigation has pursued a variety of other 
vendors, with cases brought by the FTC, the City of Los Angeles, and 
Attorneys General in New York, South Carolina, Texas, and Washington. 
Several class actions have also challenged nonconsensual and deceptive 
installations.\13\
---------------------------------------------------------------------------
    \13\ See e.g., Sotelo v. DirectRevenue LLC, No. 05 C 2562 (N.D. 
Ill. Aug. 29, 2005).
---------------------------------------------------------------------------
    The prospect of similar litigation has pushed some spyware and 
adware vendors to substantially cease operations. For example, in the 
face of litigation against several of its competitors, Manhattan-based 
eXact Advertising shut its ``adware'' business, thereby ceasing the 
nonconsensual installation of its software that had previously been so 
prevalent.
    Yet litigation has not stopped the deceptive practices of all 
vendors. Consider the actions of Bellevue, Washington-based Zango, Inc. 
During an FTC investigation of its practices, Zango stopped its 
partners from placing its software on users' computers without first 
obtaining user consent. But despite its settlement with the FTC, Zango 
continues installations that are predicated on deception. For example, 
Zango continues to solicit installations via fake-user interface banner 
advertisements which deceptively masquerade as bona fide messages from 
software already on a user's computer.\14\ Moreover, despite a 
settlement requirement that every Zango advertisement be ``clearly and 
prominently'' identified with the name of the program that delivered 
that ad, some Zango advertising toolbars still lack the required 
label.\15\
---------------------------------------------------------------------------
    \14\ See e.g., ``Zango Practices Violating . . .'' (heading 
``Widespread Zango Banner-Based Installations without Unavoidable, 
Prominent Disclosure of Material Terms (XP SP2)'') (supra). More recent 
(May 2008) proof on file.
    \15\ See e.g., ``Zango Practices Violating Zango's Recent 
Settlement with the FTC'' (heading ``Unlabeled Ads--Toolbars, Desktop 
Icons, and Pop-Ups''). http://www.benedelman.org/spyware/zango-
violations/. May 2008 proof on file.
---------------------------------------------------------------------------
    More generally, experience and economic intuition confirm the need 
for tough litigation to adequately deter sophisticated corporate 
wrongdoers. At present, FTC actions typically seek disgorgement of ill-
gotten gains. But effective deterrence requires a penalty that exceeds 
disgorgement, since investigation and litigation are less than certain. 
(Otherwise, a rational perpetrator would proceed in expectation of 
sometimes getting to keep the proceeds.) Experience shows inadequate 
deterrence to be a real problem. Consider the FTC's $1.5 million 
settlement with DirectRevenue--letting the company's principals retain 
$20 million of ill-gotten gains. As FTC Commissioner Leibowitz pointed 
out in his dissent to that settlement, spyware purveyors ought not reap 
windfalls from their deceit. To that end, I support the bill's granting 
of a fine of three times the amount otherwise available. (Sec. 
7(b)(1).)
    Increasingly, purveyors of spyware and adware are not major U.S. 
companies that investigators can easily locate. Instead, surviving 
vendors tend to reside abroad, or at least tend to attempt to hide 
their true location. Despite their far-flung location, these vendors 
sometimes cause even more harm than American counterparts--seemingly 
taking greater liberties with users' computers on the view that they 
are beyond prosecutorial reach. Legislation ought to seek to disrupt 
these businesses and limit the harm they cause. In my view, the most 
promising approach comes through financial investigations: Although 
they're off-shore, these vendors still want to make money, and their 
primary revenue sources remain U.S. advertisers and ad networks. The 
New York Attorney General has already pursued selected advertisers that 
intentionally purchased large amounts of ``adware'' advertising.\16\ It 
would be little stretch to pursue advertisers and ad networks that 
intentionally fund remaining spyware vendors.
---------------------------------------------------------------------------
    \16\ Assurances of Discontinuance--Cingular, Priceline, 
Travelocity. http://www.oag.state.ny.us
/press/2007/jan/adware-scannedAODs.pdf.
---------------------------------------------------------------------------
Specific Concerns in the Legislation at Hand
    Let me now turn to S. 1625, my specific suggestions, and some areas 
of concern.
S. 1625 Risks Setting Low Standards that Do Little to Protect Against 
        Remaining ``Adware''
    S. 1625 rightly prohibits a range of outrageous and extreme 
behaviors. For example, it would be hard to defend the ``endless loop 
popups'' prohibited by Sec. 3(1)(D).
    But it is possible to skirt the bill's prohibitions while causing 
consumers substantial harm and continuing the same practices 
traditionally associated with spyware and adware. Rather than showing 
so many popups that a user ``cannot close the advertisements without 
turning off the computer'' (Sec. 3(1)(D)), a program might show one 
popup per minute--still a substantial intrusion, yet nowhere proscribed 
by S. 1625 as it stands. Similarly, rather than tracking the specific 
information prohibited under Sec. 4(a), a program might monitor 
``only'' a user's name, street address, phone number, and all web 
searches conducted. Although remarkably intrusive, such tracking is 
seemingly permitted under Sec. 4. Thus, S. 1625's approach creates a 
serious risk that spyware and adware vendors can continue business 
substantially as usual.
    Moreover, spyware and adware vendors are likely to attempt to use 
any Federal legislation as a ``shield'' to deflect criticism of their 
practices. Indeed, Zango already invokes its settlement with the FTC as 
a supposed indicator of endorsement. Last year, Zango staff wrote to 
security vendors to say Zango has received ``certification with the 
FTC.'' \17\ More recently, Zango claimed that security vendors ought 
not block or remove Zango software because if Zango's software were 
harmful, ``the FTC would not have entered into a consent agreement 
permitting Zango to market that software.'' \18\ Far from setting a 
minimum standard that vendors will aspire to exceed, this bill thus 
risks creating a new supposed ``certification'' (or other low standard) 
that vendors may invoke as a defense against allegations of 
impropriety. As a result, weak legislation could actually make the 
spyware and adware problem worse.
---------------------------------------------------------------------------
    \17\ Forwarded e-mail on file in my possession.
    \18\ Reply Brief of Appellant. Zango, v. Kaspersky Lab. U.S. Court 
of Appeals for the Ninth Circuit. No. 07-35800.
---------------------------------------------------------------------------
    Prohibiting the full spectrum of deceptive adware would require 
substantial reworking of S. 1625. Rather than prohibiting a lengthy 
list of specific bad acts, a rewrite would probably begin with basic 
consumer protection fundamentals, e.g., that software must only be 
installed on a user's computer after clear and prominent disclosure as 
well as meaningful consent.
    If S. 1625 is to retain its present approach, a partially-
responsive revision would add a preface or other comment to explicitly 
confirm the Committee's intention--that compliance with S. 1625, in and 
of itself, does not assure that software is ethical, effective, 
desirable, or even useful. I realize that such an addition may seem 
vacuous--for of course the bill does not aspire to define what software 
is desirable or useful. But as the bill stands, adware vendors are 
virtually certain to attempt to invoke S. 1625 defensively--claiming 
that their software must be desirable since it meets the bill's 
requirements. An appropriate preface could prevent that unwelcome 
strategy.
S. 1625 Should Protect Security Vendors Assisting Users
    Security vendors face a barrage of complaints and, in some 
instances, litigation claiming that security firms err in removing 
harmful or deceptive software from users' computers. See e.g. Zango, 
Inc. v. Kaspersky Lab, Inc. and New.net v. Lavasoft. Federal anti-
spyware legislation offers a natural context in which to grant Good 
Samaritan protection to computer security software--immunizing the 
efforts of bona fide security vendors, in the ordinary course of 
business, to identify, block, and/or remove software users reasonably 
view as objectionable. S. 1625 could and should include such an 
immunization.
S. 1625 Should Not Preempt Tougher State Laws
    As it stands, S. 1625 preempts tougher state laws. Given S. 1625's 
limited prohibitions--a list of some specific bad acts, rather than a 
comprehensive framework for effective notice and consent--such 
preemption seems unwarranted.
    In particular, S. 1625 leaves ample room for states to do more to 
protect their consumers. For example, states could identify additional 
specific bad acts that ought not be permitted. Alternatively, states 
could identify alternative methods of enforcement--perhaps private 
litigation by those who are harmed (be they consumers, websites, 
computer makers, advertisers, ad networks, or otherwise). With so much 
room for innovation to further address these important problems, I see 
no proper basis for preemption of state legislation.
A Simplified Bill Could Increase Penalties while Avoiding Other 
        Questions
    A simplification of S. 1625 would strike all language except 
authorization of increased penalties. The treble fine in Sec. 7(b) 
would apply to all FTC actions under existing legislation, pertaining 
to software installed on a user's computer that tracks user 
characteristics or activities, or that shows advertising. This dramatic 
simplification would relieve the Committee from the challenging 
questions of what specific behaviors to prohibit, and would side-step 
all the concerns identified in my testimony. Yet this revision would 
offer major benefits--letting the FTC better sanction and deter 
perpetrators. I urge the Committee to consider this approach.

    Senator Pryor. Thank you.
    Mr. Weafer?

          STATEMENT OF VINCENT WEAFER, VICE PRESIDENT,

       SECURITY RESPONSE, SYMANTEC CORPORATION, ON BEHALF

            OF THE BUSINESS SOFTWARE ALLIANCE (BSA)

    Mr. Weafer. Mr. Chairman, Members of the Committee: Thank 
you very much for the opportunity to testify.
    Let me start with a question that was raised earlier, which 
is how large is the problem. If we look at spyware and 
malicious code in general, there is about 1.8 million pieces of 
unique code. Now, that's a large number, but if you remember 
that about 800,000 of those malicious codes came in all of last 
year, so if you look at all the previous years last year 
represented the vast majority of those pieces of spyware and 
malicious code. In the first 6 months of this year, we've 
already surpassed what we saw last year, in 2007.
    Looking another way, we did a survey of people's machines 
where we looked and we found about 57,000 unique pieces of 
files on their machine--Office, Windows, operating system 
files. 65 percent of those files were deemed to be potentially 
malicious or spyware on their machines.
    The Organization for Economic Cooperation and Development 
has estimated that something like 95 million U.S. people are 
sitting with spyware on their machines. It's a large problem 
and it's still growing. Now, this includes not just the grey 
actors, but also the black actors, the criminalization that's 
occurring very much at the moment as well.
    In terms of S. 1625, one of the areas we definitely want to 
focus on is on the focus of behavior, not technologies. So we 
certainly want to prohibit bad conduct rather than pick certain 
technologies and say this act is good or this is bad, because 
that frequently forms a low bar for companies that try and 
target or simply raise themselves to that minimum level and 
say: We're certified.
    Second, we do want to include our support for the 
legislation, the so-called Good Samaritan portion. So a Federal 
court recently ruled in the Kaspersky case that the 
Communications Decency Act gives such protection to providers 
of anti-spyware solutions.
    Now, we're not seeking unlimited protection. In fact, we 
believe the legislative codification of Kaspersky could include 
language requiring good faith as well as a fair and effective 
dispute resolution process. There should be a process, it 
should be fair, it should be open. That's what we're looking 
for as part of this provision.
    We also want to commend you for including in your bill a 
provision for allowing perfectly legitimate activities, such as 
the detection and prevention of unauthorized use of the 
software. This is essential to our industry, the software 
industry, because fraud or piracy also includes almost $50 
billion in damage every year. So we believe this is also an 
important part.
    I'll keep my remarks short and just thank you very much for 
your time.
    [The prepared statement of Mr. Weafer follows:]

    Prepared Statement of Vincent Weafer, Vice President, Security 
   Response, Symantec Corporation on Behalf of the Business Software 
                             Alliance (BSA)
    Mr. Chairman, Mr. Ranking Member, Members of the Committee, good 
afternoon. Thank you very much for the opportunity to testify here 
today. My name is Vincent Weafer and I am Vice President of Security 
Response at Symantec Corporation. I will be testifying today on behalf 
of the Business Software Alliance (BSA).
    Symantec is one of the world's leading software companies. We are 
headquartered in Cupertino, California, operate in 40 countries 
worldwide and have more than 17,500 employees. Symantec's mission is to 
help individuals and enterprises assure the security, availability, and 
integrity of their electronic information. As the global leader in 
information security, we protect more people from online threats than 
anyone in the world. Symantec offers our customers products that detect 
and remove spyware and harmful adware, and our Norton brand of products 
is the worldwide leader in consumer security and problem-solving 
solutions.
    The Business Software Alliance (www.bsa.org) \1\ is the foremost 
organization dedicated to promoting a safe and legal digital world. BSA 
is the voice of the world's commercial software industry and its 
hardware partners before governments and in the international 
marketplace. Its members represent one of the fastest growing 
industries in the world. BSA programs foster technology innovation 
through education and policy initiatives that promote copyright 
protection, cyber security, trade and e-commerce.
---------------------------------------------------------------------------
    \1\ BSA members include Adobe, Apple, Autodesk, Avid, Bentley 
Systems, Borland, CA, Cadence Design Systems, Cisco Systems, CNC 
Software/Mastercam, Corel, Dell, EMC, HP, IBM, Intel, McAfee, 
Microsoft, Monotype Imaging, PTC, Quark, Quest Software, SAP, Siemens 
PLM Software, SolidWorks, Sybase, Symantec, Synopsys, and The 
MathWorks.
---------------------------------------------------------------------------
    It is a pleasure to be here today to discuss the serious issue of 
cyber security: protecting millions of computer users from those who 
maliciously install software on computers to compromise and steal 
sensitive, personal information. Such software goes by the name of 
``spyware.'' Mr. Chairman, I commend you and your colleagues, Senator 
Boxer and Senator Nelson for your leadership in addressing this 
invasive and deceptive practice through the Counter Spy Act (S. 1625).
    Today, I would like to make three points:

        First, spyware and harmful adware represent a critical threat 
        to security and privacy on the Internet. It is a threat that 
        must be met and defeated.

        Second, legislation can and should play an important role. We 
        urge the Committee to consider language which focuses on the 
        malicious intent behind this reprehensible behavior, not 
        ``bad'' technological tools like computers, software and the 
        Internet. We want to work with you to ensure that anti-spyware 
        legislation moving through Congress targets reprehensible 
        behavior and avoids the trap of defining ``good'' or ``bad'' 
        technology.

        Third, we believe that legislation should contain specific 
        provisions to ensure that developers of anti-spyware tools can 
        protect their customers without fear of threats and legal 
        harassment.

        And fourth, we commend you for including in your bill a 
        provision clarifying that security and anti-piracy activities 
        are not in fact spyware.
What Threat Are We Facing?
    Mr. Chairman, we commend you for your leadership in addressing the 
real threat and grave threat of spyware and harmful adware.
    Spyware and harmful adware are stand-alone programs that can 
monitor system activity and either relay the information back to 
another computer or hold it for subsequent retrieval.
    Spyware programs are placed on a user's system--often times without 
the knowledge of the user--in order to steal confidential information, 
such as usernames, passwords and credit card details. This can be done 
through keystroke logging, or capturing e-mail and instant messaging 
traffic. Spyware is of particular concern because of its potential for 
use in identity theft and fraud.
    A growing type of spyware is rogue anti-spyware/anti-virus 
applications. They deceive users by displaying scary warnings about the 
computer being infected with a large number of fake threats, and then 
ask the user to buy the software to fix the problems. Another recent 
trend is programs that attempt to use the license agreement to prevent 
the end-user from sending any portion of the spyware program to anti-
spyware companies.
    Harmful adware programs capture information about the computer 
usage and Internet browsing habits of the user (such as websites 
visited and e-commerce purchases made). They generate a deluge of 
disruptive ads, usually in the form of pop-up windows, on the 
computer's screen. This represents a potential violation of privacy, 
and degrades user experience and computer performance by bogging down a 
computer's normal functions.
    How prevalent is the problem of spyware and harmful adware?
    Symantec publishes twice a year the Internet Security Threat Report 
(ISTR), a comprehensive compilation of Internet threat data, which 
gives us a unique perspective on the prevalence of spyware. The ISTR 
includes analysis of network-based attacks, a review of known 
vulnerabilities, and highlights of malicious code and additional 
security risks. We compile our data from more than 24,000 sensors 
monitoring network activity in over 180 countries, as well as 
information compiled from over 120 million client, server and gateway 
systems that have deployed our antivirus products, and through the 25 
million e-mail messages we filter for our customers everyday.
    According to our most recent Internet Security Threat Report, 
spyware continues to be a serious security risk for consumers. The 
latest Internet Security Threat Report released by Symantec in April 
2008 reveals that Attackers have adopted stealth tactics that prey on 
end-users on individual computers via the World Wide Web, rather than 
attempting high-volume broadcast attacks to penetrate networks. This 
may be because enterprise network attacks are now more likely to be 
discovered and shut down, whereas specifically targeted malicious 
activity on end-user computers and/or websites is less likely to be 
detected. Site-specific vulnerabilities are perhaps the most telling 
indication of this trend. During the last 6 months of 2007, there were 
11,253 site-specific cross-site scripting vulnerabilities = Cyber 
criminals continue to refine their attack methods in an attempt to 
remain undetected and to create global, cooperative networks to support 
the ongoing growth of criminal activity.
    Adware and spyware continue to propagate, according to the ISTR. At 
the beginning of June 2008, there are over 1.8 million known malware 
and security risks with the majority of these being discovered in the 
past 18 months. In the last 6 months of 2007, threats to confidential 
information made up 68 percent of the volume of the top malicious code 
samples. Malicious code can expose confidential information in a 
variety of ways, including exporting user and system data, exporting e-
mail addresses, recording keystrokes and allowing remote malicious 
access to a computer. At the same time, today's attacks are more 
surreptitious than ever before, less likely to be detected rapidly, and 
more likely to have a direct impact on a user's finances.
    As an illustration of the scale of the problem, a recent report by 
the Organization for Economic Cooperation and Development (OECD), 
estimates that 59 million users in the U.S. have spyware or other types 
of malware on their computers.
    In summary, spyware and harmful adware are, quite simply, a 
critical threat to our online security and privacy. It is wrong and it 
must be stopped.
Ban Bad Behavior, not Technology
    Fortunately, the marketplace is responding to the need to address 
this challenge.
    Cyber security companies are investing heavily in newer generations 
of classification, behavioral detection and white listing technologies 
to handle the increasing volume and variety of spyware and malicious 
code threats. For example, Symantec creates security programs that 
watch out for known malicious threats, as well as unknown software that 
exhibits suspicious characteristics. Symantec products classify and 
categorize programs according to functionality. This allows a user to 
select an acceptable risk level and detect only programs that fall 
outside the user's own acceptable limits We continually add new 
definitions and new defenses to address the ever evolving dangers in 
the Internet threat landscape such as worms, spyware, spam, and 
phishing.
    In addition, critical technologies such as web browsers are being 
revamped with more security, as they increasingly become a focus for 
attacks. Web browser security is particularly important because 
browsers come in contact with more untrusted or potentially hostile 
content than most other applications.
    We believe however that, in addition to the response of the 
marketplace, legislation can and should play a role. Spyware is a 
serious online threat to the public interest. As you have recognized, 
Mr. Chairman, this threat requires Congress to empower Federal agencies 
to enforce prohibitions that will help curb the scourge of spyware and 
harmful adware.
    We want to work with you to ensure that legislation moving through 
Congress targets reprehensible behavior, rather than attempts to define 
``good'' or ``bad'' technology.
    We believe that legislation should not prohibit specific 
technologies. Computers, software and the Internet are tools that are 
used in thousands of ways to enhance how we work, study, communicate 
and live. These tools are an indispensable part of our daily lives. The 
fact that a number of bad actors have figured out how to use these 
tools for illegitimate purposes does not mean the tools themselves are 
the cause of the harm.
    If technology was to be constrained or regulated, we would lose 
much of the richness and power that computing has brought to our modern 
lives.
    Let me put it a different way. We don't ban crowbars because some 
people use them to break into houses. We don't ban cars because some 
people use them to flee from the scene of a crime.
    Prohibiting conduct, rather than technology, avoids the danger of 
dictating the design and operation of computer software and hardware. 
Congress has wisely avoided imposing a number of technology mandates to 
maintain the U.S. technology industry as the envy of the world. It has 
been responsible for incredible improvements in productivity, millions 
of jobs, billions of dollars in exports, and immense benefits to every 
consumer. Government intervention that replaces marketplace solutions 
with governmental decisions endangers America's technology leadership. 
It hurts users of technology products by stifling innovation, freezing 
in place particular technologies, impairing product performance, and 
increasing consumer costs.
    Mr. Chairman, Symantec and other BSA member companies want to work 
with you and your staff to ensure that S. 1625 focuses even more 
clearly on harmful activities, rather than on the technology that is 
misused to perform these activities.
    Currently, S. 1625 includes a few provisions that risk affecting 
legitimate software and Internet functionalities, and thus compromise 
the operations of today's computers--as well as the direction of future 
technology. Let me give you just a few examples:

   Section 3(1)(A) prohibits the installation of software that 
        transmits or relays commercial electronic mail. This would 
        constrain the development and use of legitimate and innovative 
        methods to generate and send electronic communications;

   Section 3(3)(B) regulates how software that is installed on 
        a computer must be named and where it must be located, and how 
        it can be uninstalled. Again, this would constrain how 
        legitimate software is deployed and operates.

    We believe the problems inherent in such an approach can be avoided 
if Congress instead focuses directly on the behavior we are trying to 
stop: the use of unfair or deceptive means to install software on 
computers, as well as the unauthorized acquisition, use or 
commercialization of information from individuals. This is for example 
what section 2 and section 4(a) of your bill do. We commend you for the 
inclusion of such provisions, which strike at the heart of the spyware 
and harmful adware problem and which we believe would be useful tools 
in the hands of enforcement agencies.
    Such an approach significantly mitigates the risk that legislation 
may hamper or constrain the development and use of technology, while 
achieving your objective of protecting computer users. In addition, 
while products can be moved offshore and out of reach of our laws, the 
collection of information from computers within our borders is a 
problem that we can more easily and effectively address.
Enable Anti-Spyware Companies to Continue to Best Protect Computer 
        Users
    Developers of anti-spyware solutions are providing effective 
protection to computer users against online threats. Unfortunately, 
they are threatened with lawsuits for defamation and interference with 
their business by spyware and harmful adware companies. These spurious 
threats force anti-spyware companies to divert precious resources to 
fight to protect themselves in Court. This is intended to disrupt and 
deter the development of tools that empower consumers to stop unwanted 
software from being put on their computers.
    BSA supports including in anti-spyware legislation what is often 
called a ``Good Samaritan'' provision. This would limit remedies 
against developers of anti-spyware tools. This would be far from 
unprecedented. In fact, Congress has repeatedly legislated targeted 
protection for a host of similarly beneficial activities, such as 
charitable food donations, the use of Automated External 
Defibrillators, or liability arising from sharing information about the 
Y2K problem.\2\ Last but not least, in June of last year the House of 
Representatives supported, by an overwhelming majority of 368 to 48, 
H.R. 964, the Spy Act. The Spy Act includes such a Good Samaritan 
provision for anti-spyware activities.
---------------------------------------------------------------------------
    \2\ The Bill Emerson Good Samaritan Food Donation Act (42 U.S.C. 
1791) precludes civil and criminal liability arising from food donated 
in good faith, except in cases of gross negligence or intentional 
misconduct. The Cardiac Arrest Survival Act of 2000 (42 U.S.C. 238q) 
precludes civil liability arising from any harm resulting from the use 
of an Automated External Defibrillator, except where there was no 
proper notification of emergency personnel, maintenance of the 
defibrillator or employee training. The Year 2000 Information and 
Readiness Disclosure Act (15 U.S.C. 1) precludes liability arising from 
statements and disclosures regarding the Y2K problem, except in cases 
of recklessness or intent to deceive.
---------------------------------------------------------------------------
    Mr. Chairman, I want to bring to your attention an important 
Federal court case, Zango v. Kaspersky. In August 2007, the U.S. 
District Court for the Western District of Washington ruled that the 
protection afforded by section 230(c)(2) of the Communications Decency 
Act (CDA) of 1996 (47 U.S.C. 230), to providers of solutions that 
filter objectionable content, covers providers of anti-spyware 
solutions.\3\
---------------------------------------------------------------------------
    \3\ Zango has appealed the ruling and BSA, as well as several other 
online consumer protection organizations such as the AntiSpyware 
Coalition (ASC), the Center for Democracy and Technology (CDT) and the 
Electronic Frontier Foundation (EFF), have filed an Amicus Brief asking 
the Court of Appeals for the Ninth Circuit to affirm the District 
Court's decision.
---------------------------------------------------------------------------
    Mr. Chairman, we understand why a former Attorney General like 
yourself would exercise caution in limiting judicial remedies. In fact, 
we are not seeking unlimited protection. We fully agree that good faith 
and due process must be applied by an anti-spyware provider when his 
product targets a software application for removal by the computer 
user.
    We believe that the protection provided by Congress in section 
230(c)(2) of the CDA can only extend to software providers who are 
truly seeking to empower users to exercise control over objectionable 
content received over the Internet. This protection does not apply if 
they are pursuing, for example, fraudulent or anti-competitive 
objectives (such as an anti-spyware company's product blocking the 
installation of a competitor's security solution.)
    Mr. Chairman, BSA believes that legislative codification of the 
Kaspersky ruling, including language that requires good faith and fair 
and effective dispute resolution would in fact exceed the safeguards 
provided by the House when it passed H.R. 964 last year. It would thus 
provide a strong foundation for the Senate to work with the House 
toward enactment of legislation, which is a priority that BSA shares 
with you.
Security and Anti-Piracy Activities Are Not Spyware
    Mr. Chairman, before I conclude my testimony, I would like to 
commend you for including in section 6(a) of your bill a provision 
allowing legitimate security and anti-piracy activities.
    This exemption has been supported at the Federal and state levels 
by a host of technology industry organizations representing telecom 
providers, cable companies, software producers, and Internet service 
providers. The activities in question are perfectly legitimate, such as 
diagnostics, network or computer security, repairs, network management, 
etc. All these activities are conducted by network administrators to 
maintain and secure their systems.
    Section 6(a) also covers the detection and prevention of the 
unauthorized use of software. This is essential to our industry's 
ability to protect our products against theft. Software piracy results 
in almost $50 billion in losses to the software industry each year, 
including more than $8 billion in the U.S. alone. Given these massive 
losses, it is absolutely critical that companies that engage in 
otherwise lawful conduct to detect or prevent piracy or other unlawful 
acts are not unwittingly subject to liability under anti-spyware laws. 
Section 6(a) is narrowly and carefully drafted to address this 
important goal.
    Certain interest groups may seek to drastically weaken or delete 
this provision. They may claim that it creates a license to snoop on 
people's computers, shut down their IT networks, or circumvent state 
consumer protection, privacy, and contract laws. This is patently 
false. The provision does not go beyond limiting liability under your 
bill, and it limits liability under your bill only. Anyone who engages 
in an act that violates any other Federal or state law is and will 
remain fully liable under those laws. The purpose of weakening this 
provision is not to protect against spyware, but to make it harder for 
legitimate companies to fight piracy, or other fraudulent or illegal 
activities. The laudable anti-spyware goals of the Act should not be 
subverted for this purpose.
    Thank you again for this opportunity to comment on the issue of 
spyware and the Counter Spy Act. I would be happy to answer any 
question you may have.

    Senator Pryor. Well, thank you.
    Let me go ahead and start with you, Mr. Weafer, because I 
assume that your company has a working definition of spyware. 
Do you have a definition of spyware?
    Mr. Weafer. Yes, we do.
    Senator Pryor. And as I understand it, the Federal Trade 
Commission does not have an adequate definition of spyware; is 
that right?
    Mr. Weafer. That's right. There are different definitions 
out there. One thing we have done as an industry is come 
together to try and create a common definition of spyware. So 
we're part of a coalition, the Anti-Spyware Coalition. We have 
posted what we believe is a shared and fair assessment of what 
spyware is.
    Even within that definition, there is some degree of what 
is included, what is considered personally identifiable 
information. We do believe there are fairly good standards 
relating to what is spyware and why the concern is there.
    Senator Pryor. So is there then an industry consensus on 
what spyware is and what it's not?
    Mr. Weafer. We believe there is, even though there is 
probably some differences or subtleties in the language 
themselves.
    Senator Pryor. Do we have that definition? Have you 
provided that to the Committee?
    Mr. Weafer. If we haven't, we will provide.
    Senator Pryor. That would be great because I think that 
would be helpful for us.
    If I may, Mr. Edelman, it sounds like you spend a lot of 
time trying to figure out what's out there and you know how it 
infects people's computers and what it does. Tell me what 
you're seeing out there, two or three of the most prevalent 
forms of spyware that are currently infiltrating people's 
computers?
    Dr. Edelman. Well, it's easy to be complacent and think 
that the problem of unwanted pop-up ads is over. That's not 
what I see in testing the sorts of websites where users get 
infected. I still see plenty of websites that will fill your 
computer with pop-ups and make money from those pop-ups through 
the biggest American ad networks out there. Maybe I shouldn't 
name any names today, but you can imagine the sort of 
advertising intermediaries who fund all kinds of behavior on 
the web and, remarkably, continue to fund the pop-ups that 
users so despise.
    Separate from that, there are so-called market research 
companies that track users' behavior in great detail--every 
website you visit, every search you make, every product you 
buy, every product you look at but don't buy. That's a little 
spooky to me, frankly. I'm not sure I want those records about 
me kept anywhere. What if it gets hacked? You know, what if 
that goes on the web somewhere and everyone can see it?
    Beyond that, I do see serious criminal enterprises taking 
over users' computers, using them to send spam. I have to 
defend my computer so that when I allow my computer to be 
infected by spyware, it doesn't go around sending spam. So 
there's a little bit of complication even for me just in safely 
testing the software.
    Denial of service attacks. Often you'll see programs that 
take over a user's computer and use it to attack some other 
computer.
    All of these behaviors still remain prevalent, the same 
kinds of problems we were talking about 2 years ago, 3 years 
ago, 4 years ago still occurring, albeit some of them somewhat 
harder to track down.
    Senator Pryor. You mentioned that you go to the types of 
websites that will contain spyware. What types of websites 
typically expose people to spyware?
    Dr. Edelman. Well, it can happen anywhere. You know, 
historically there have been examples even of mainstream news 
sites being hacked so that they would distribute spyware. But 
the sites that I find the most reliable tend to be second-tier 
entertainment sites. There's a wrestling site that is awfully 
effective at giving me spyware, with no offense intended to 
those who like professional wrestling, but this site isn't the 
one to go to. Again, I'll leave it unnamed.
    Sites and programs that provide assistance in downloading 
copyrighted music and videos, sometimes massive copyright 
infringement frankly. You go to a site that purports to provide 
assistance in that regard and then you might or might not get 
the copyrighted material you were seeking, but in any event 
your computer would be destroyed, which certainly wasn't part 
of the bargain that you were expecting.
    But again, it can happen anywhere and so we should not 
paint a picture of victims as somehow having brought this on 
themselves. Maybe in a few instances that's the case, but as a 
general rule that's really not true.
    Senator Pryor. Mr. Edelman, in your experience and in your 
opinion, is there any legitimate use for spyware?
    Dr. Edelman. The programs that people call spyware are such 
a broad swath of programs, it's hard even to answer the 
question crisply. Is there any legitimate use for a program 
that takes over a user's computer and uses it to send 
unsolicited commercial e-mail to a variety of recipients who 
never asked for it, without telling the user that their 
computer would be so used? Absolutely not. How about a program 
that monitors what you're doing and shows pop-up ads? You know, 
some marketers say that that could be useful. You didn't know 
that American Airlines existed until you went to United.com and 
up came an ad for American Airlines, which, to be clear, they 
would never do because they are good advertisers and are 
actually very careful about that sort of thing.
    In principle, it could be good for competition, I guess, to 
have pop-ups telling users about alternatives. But in practice 
I'm pretty suspicious. I think these pop-ups tend to promote 
software and services that users don't really want. If they 
want them they already know about them and no one wants to be 
interrupted by that sort of thing. So I don't see a lot of use 
for it.
    Senator Pryor. Mr. Cerasale, are there legitimate purposes, 
legitimate uses for spyware?
    Mr. Cerasale. Well, again the term ``spyware'' means lots 
of things. Clearly, taking over someone's computer and so 
forth, is just not allowed. That's spyware, bad stuff. But 
certain toolbars, plug-ins, and web browsers, those types of 
things going on people's computers clearly are things that 
individuals want and so forth.
    Looking at the definition of trying to be any kind of 
software, you even have requirements for e-mail notices. There 
are things called web beacons that are computer code, software 
code, to tell people whether or not an e-mail has been opened. 
Some of those things are used, for example, if there is a 
compelled e-mail notice to ensure that you have informed 
individuals of this notification. Those kinds of web beacons 
and things of that sort are definitely helpful and helpful to 
meet legal requirements.
    So the definition--as you look at definition of what is 
spyware, and actually as you go down further, the definition of 
what is software, becomes very, very complicated. We have to be 
careful with that. If you look at the attachment to my 
testimony, the DMA Guidelines, we have a thing on the bottom, 
this does not include cookies or similar types of software, 
because we had difficulty trying to define this.
    As we go further along with new technology, I think just 
defining software becomes a major problem. There are things 
that go on people's computers that can be easily defined as 
software, that are advantageous to them. Now, our guidelines 
would say you've got to allow me to take it off if I suddenly 
don't want it. But that's the kind of thing that we think is--
there are some legitimate uses for.
    There are major, major illegitimate uses for it that are 
already illegal. Many of the things that have been said here 
are already under Section 5 of the FTC Act, would be barred in 
its own right.
    Senator Pryor. Does the Direct Marketing Association have a 
good and working definition of spyware?
    Mr. Cerasale. We do not. If you look at that, the 
attachment to my testimony, we just talk about computer 
software, ``install software or other similar technology,'' 
because we don't know what's coming next, and then define some 
of the bad practices. So that's what we've done, and then 
defining if you're going to put this software or similar 
technology on someone's computer with notice, easy to 
uninstall, you have to let them know who it is and the privacy 
policy. That's the way we had to go. We felt that trying to 
define software would in essence--was first of all very 
difficult to try and discern; but technology is going to change 
the definition of software as we move forward, and we want to--
and I think that our decision was to focus more on the acts and 
try and stop that, no matter what means was used for it.
    Senator Pryor. Mr. Butler, do you have a good working 
definition of spyware? Do you differentiate spyware from adware 
and other types of software?
    Mr. Butler. To us, spyware is software that is 
surreptitiously installed on someone's computer, that allows 
the outsider to intercept or to seize even partial control over 
the user's interaction with the computer, without that user's 
informed consent. Anything that meets that definition we think 
is spyware.
    Senator Pryor. Mr. Cerasale, you just heard his definition. 
You said the DMA doesn't differentiate between different types 
of software, but based on that definition you just heard, are 
you aware of any legitimate purpose for that type of software, 
surreptitiously installed, et cetera, et cetera, like he said?
    Mr. Cerasale. As our guidance says, surreptitiously 
installed would violate our guidelines. So yes, that clearly 
fits within where DMA is. I think the one exception might be in 
an area where Mr. Butler and I would disagree, in areas of 
trying to look at anti-fraud areas, that that might be 
something where there may be an exception here. But not talking 
about that, looking at it from that score, his definition, 
surreptitiously put on, would violate our guidelines, so even 
without our definition.
    Senator Pryor. Let me ask this also if I may, Mr. Cerasale. 
That is, a couple of the witnesses either in their written 
testimony or what they said here today encouraged us to focus 
on behavior, not technology.
    Mr. Cerasale. Correct.
    Senator Pryor. Is that where the direct marketers are as 
well?
    Mr. Cerasale. I believe so, yes.
    Senator Pryor. Because the technology will change, but we 
know that the type behavior that we want to prevent, presumably 
we know the type of behavior we want to prevent, but the 
technology--there are lots of different ways to get there; is 
that fair?
    Mr. Cerasale. That's fair, and it may be tomorrow it will 
be something new.
    Senator Pryor. Mr. Butler, do you agree with that?
    Mr. Butler. I think so.
    Senator Pryor. Because I think what Senator Vitter said was 
that he was concerned about the definition and I think the 
idea, if I'm hearing the panel correctly, is that if you have a 
definition that's really based on a technology or a specific 
process of some sort, that could change because some programmer 
out there could change that tomorrow and the law we pass today 
could be obsolete. But if we focus on, I guess, the end result 
and the behavior that we're trying to prevent, then regardless 
of what technology gets us there, I think that gets us what 
we're trying to do.
    Do you agree with that, Mr. Edelman?
    Dr. Edelman. I think that's fine as far as it goes, but 
it's still possible to be both over-inclusive and under-
inclusive as to behaviors. So it's possible to write a list of 
20 bad behaviors and miss three other behaviors that either the 
Committee didn't notice or they haven't started yet, but will 
start next week.
    Similarly, it's possible for there to be some behavior for 
which the behavior itself is neither good nor bad; it's the 
deceptive practice of that behavior, doing it in a way that has 
a tendency to deceive, based on the totality of the 
circumstances, the context, the method in which it is promoted, 
the nature of the disclosure, the nature of the consent 
procedure.
    So the suggestion that behavior versus technology is the 
magic bullet that solves the bill's problems, I'm not sure it 
gets you all the way there.
    Senator Pryor. Mr. Rotenberg?
    Mr. Rotenberg. Senator, I've worked on quite a lot of 
privacy bills over the years and I just want to say I very much 
support your approach. By way of example, the Federal Privacy 
Act, the legislation that protects the privacy of citizens with 
respect to their records held by Federal agencies, was passed 
more than 30 years ago. It actually said almost nothing about 
technology. It spoke about the collection and use of personal 
data, who would have access to it, how you could obtain it, and 
what the penalties would be. It still works today.
    By comparison, the privacy provisions in the Cable 
Communications Act of 1984, which are very good privacy 
provisions, was actually quite specific about the type of 
industry that would be covered. In 1984 there was a clear 
understanding of what the cable industry looked like, what 
interactive television looked like, and what privacy protection 
would require.
    Well, today we have a great deal of interactive media, but 
those provisions from 1984 no longer apply because they were 
too technologically specific. So I think we need to focus on 
the activity, and of course I think it's possible by means of 
committee report or other means to give some examples. You can 
say with respect to current business practice, we want to 
prohibit surreptitious collection of a person's personal data 
without their consent, and an example might be, and then we can 
talk about some of the things that are taking place right now.
    Senator Pryor. Well, I would hope that all the panelists 
here would help us as we work on this bill and help us make 
sure we get it right, because, assuming the Senate passes this 
and the House passes it and the President signs it, we are 
trying to address this problem, and a wrong definition or a 
wrong section in the bill could totally undermine the purpose 
of what we're trying to do.
    So I'd love to have all of you help us draft this. You all 
raise good points.
    Let me ask, if I may, let me ask Mr. Weafer about the cost 
associated with a consumer having spyware on his computer and 
having to do something to get rid of that infection. What does 
it typically cost John Q. Public out there when he's on his 
computer? What does it typically cost him to get rid of the 
spyware once it has infected his computer?
    Mr. Weafer. There is two parts to that answer. One is the 
actual physical damage, for example having to go in and remove 
pop-ups, unwanted software, which can range in terms of dollars 
from hundreds of dollars to thousands depending on how many 
machines, whether it's to be completely re-imaged, and who's 
doing the work.
    The bigger, greater cost is really on the personal privacy. 
If data has been exposed or is assumed to be exposed, then the 
cost in terms of cleaning up their identity, their privacy, 
going after that, actually is very difficult to calculate. But 
I think that's the greater concern and the greater danger to a 
lot of users.
    Senator Pryor. Will a software product sold by Symantec 
stop spyware from being added in the first place or does it 
remove it once it's on there, or both?
    Mr. Weafer. It tries to do both. So first of all, we're 
really just trying to give the tools to the end-users to 
identify what's on their machine. We classify according to 
large spyware, which is a general category of software, 
including actual spyware, remote access programs, tracking 
tools, hacking tools, and information, preventing them getting 
on. They're deemed to be high risk or low risk, to help the 
user. Then if they are on the system, helping them remove them 
from the system itself.
    In some cases we can actually work with the vendors. If 
they've got a reasonable uninstaller, we can actually just call 
that and that becomes the uninstallation. For some of the more 
malicious, insidious programs, we have to do it ourselves.
    Senator Pryor. Symantec has a number of competitors out 
there that are offering spyware protection as well, right?
    Mr. Weafer. That is correct.
    Senator Pryor. About how many are in that marketplace right 
now that are offering anti-spyware programs or software of some 
sort?
    Mr. Weafer. There is at least 20 major vendors who are 
offering similar programs.
    Senator Pryor. Which ones are the best?
    [Laughter.]
    Mr. Weafer. Symantec. I'm a little bit biased toward the 
Norton brand.
    Senator Pryor. I just couldn't resist that one.
    But nonetheless, there may be some ways for some computer 
users to get anti-spyware software free, but a lot of people 
have to pay for it as well. It kind of depends on your 
situation. So definitely there's a lot of cost associated with 
this, not just to the machine but also to your personal 
situation.
    Mr. Cerasale, you said in your testimony that you think the 
industry--you prefer self-regulation, is that right?
    Mr. Cerasale. That's correct.
    Senator Pryor. Well, when I hear the numbers of some of the 
statistics, I get the very distinct impression that self-
regulation isn't working. So do you disagree with me on that?
    Mr. Cerasale. I do. What we heard a lot of today and a lot 
of the statistics are basically criminal activity, activity 
that is deceptive, activity that already violates Section 5 of 
the Act or other criminal codes. Self-regulation requires law 
enforcement to stop criminal activities. Self-regulation is not 
there and cannot be there to prevent criminal activity.
    I think the area we're looking at and the area that we're 
concerned in is going after the bad guys, the criminals, and 
being careful to protect the legitimate uses on the Internet 
that foster commerce. And I think in that arena self-regulation 
works well, for DMA members to have to follow our guidelines, 
the ability for us to quickly change guidelines, to take a look 
at new technologies when they come up. We have our own ethics 
procedure to go after and try and stop certain activities.
    I think in that arena it works. It does not work in the 
criminal arena and we don't intend it to, and we want you to 
give the FTC as much money as they can to go out and try and 
enforce it.
    Senator Pryor. I do think one of the shortcomings of self-
regulation is something you alluded to, and that is I think you 
have a lot of members who are acting responsibly and are out 
there trying to do the right thing and they're legitimate 
companies trying to be in this for the long term. But not all 
direct marketers are members of the DMA and a lot of them don't 
acknowledge or recognize or even consider your guidelines that 
you lay out.
    So this may be one of those situations where the good 
actors out there may have to undergo some additional regulation 
to try to get the bad actors out of the marketplace.
    Mr. Cerasale. We have supported legislation in the past, 
such as CAN-SPAM and in other areas, where we felt that self-
regulation didn't work, and we pledge and have in the past and 
continue to work with you on this legislation, with you and the 
Committee on this legislation, and others in this area.
    Our biggest concern is unintended consequences hurting 
legitimate business and that's where we want to work.
    Senator Pryor. Mr. Weafer, let me ask another question of 
you, and that is--we have heard some statistics today that are 
helpful, but I'm curious about, from your company's standpoint 
and just from your personal research and your experience, is 
spyware a growing problem? Is it becoming more prevalent or 
less prevalent?
    Mr. Weafer. In my opinion, the broader aspect of spyware is 
actually becoming more prevalent. We're seeing more and more 
spyware. Now, most of this is driven by the underground 
economy. A lot of it is the criminalization of this. We're 
certainly seeing in many cases up to 500 percent year over year 
increases in the amount and variety of this type of spyware 
coming out.
    We are continuing to see the shady commercialization as 
well, which are programs which are continuing to drive pop-ups, 
programs which are continuing to be fraudulent, programs which 
are still not giving users control, consent, and notification. 
So we do applaud the self-regulation, but we want to see 
additional remedies on top of that.
    Senator Pryor. Well, I agree with you. I think that that's 
what you're seeing out there. I just know really anecdotally 
from talking to people--just as an example, not too long ago I 
was talking to someone about their computer and they were 
getting all these pop-ups. They were getting a new toolbar, 
they were getting all this stuff, and they didn't know where it 
came from or how it came on there.
    It's very frustrating for people. For most people, like for 
home use, your personal computer is your personal property and 
you don't want it to be infected and somehow damaged by other 
people, and certainly you don't want your personal information 
out there going to people that you don't want to have it.
    So this is a serious problem. We do have this piece of 
legislation. All of you pointed out your thoughts on the 
legislation, even some of the shortcomings of the legislation. 
We appreciate that. We take all of that as constructive 
criticism.
    What we're going to do is we're going to take our 
legislation, we're going to talk to the Members of the 
Committee, and we're going to see if we can help shape it and 
get it in the type of form where it's ready to move and move 
through the system. And hopefully some time in the next, I 
don't know, several months, maybe the next year, we'll have a 
very, very strong piece of legislation, very bipartisan, to try 
to make a big difference in the marketplace.
    So I just want you to know you've been a very important 
part of this process and we appreciate you. Like I said, we 
definitely would appreciate your input as we go along, and 
always feel free to share your opinions or give us your 
insights because we don't claim the expertise here. We know who 
the experts are.
    So with that, what I'm going to do is I'm going to adjourn 
the hearing here in just 1 minute. But first let me say that 
we're going to keep the record open and Senators may have 
additional questions or follow-up questions. So we'll get those 
to you and we'd love for you to get those back to us. We'll try 
to leave the record open for 2 weeks, so if you could get those 
back to us as quickly as you can.
    Also, if there are documents--I think someone mentioned a 
study or some statistics or whatever it may be. If there are 
documents that you want to submit for the record, again the 
record will be open for 2 weeks and just get that to Committee 
staff and they'll distribute it as it should be.
    So we appreciate your time, we appreciate you looking at 
the legislation, and we appreciate your being here today. With 
that, we're going to adjourn the hearing, and just say thank 
you.
    [Whereupon, at 4:28 p.m., the hearing was adjourned.]
                            A P P E N D I X

                                                     TRUSTe
                                   San Francisco, CA, June 24, 2008
Hon. Mark Pryor,
Chairman,
Subcommittee on Consumer Affairs, Insurance, and Automotive Safety,
U.S. Senate,
Washington, DC.

Dear Chairman Pryor,

    I am writing to respectively request that this letter be added to 
the official record of the Senate Commerce Committee's hearing on June 
11, 2008 entitled ``The Impact and Policy Implications of Spyware on 
Consumers and Businesses.''
    I am the Vice President in charge of legal policy and compliance 
matters for TRUSTe. We are an independent, nonprofit organization with 
the mission of advancing privacy and trust for a networked world. 
Through long-term supportive relationships with our licensees, 
extensive interactions with consumers in our Watchdog Dispute 
Resolution program, and with the support and guidance of many 
established companies and industry experts, TRUSTe has earned a 
reputation as the leader in promoting privacy policy disclosures, 
informed user consent, and consumer education.
    TRUSTe applauds the Committee's work on the issue of spyware. We 
have long articulated a public policy for privacy protection that 
incorporates the strength of government oversight, the discipline of 
industry self-governance, and the innovation of privacy-enhancing 
technology.
    In his testimony before the Committee on June 11, Jerry Cerasale, 
senior vice president of government affairs for the Direct Marketing 
Association, referenced the self regulatory work underway to develop 
standards for downloadable software. He spoke of the work that TRUSTe 
has undertaken to develop a program of best practices. I would like to 
tell the Committee a little more about our Trusted Download Program.
    TRUSTe has partnered with major online consumer portals and other 
industry leaders to develop the Trusted Download Program, a standards 
and a certification program for downloadable consumer desktop 
applications.
    Program objectives:

   Empower consumers to make informed decisions.

   Establish the leading industry-wide standards for developers 
        of downloadable applications.

   Identify and elevate trustworthy consumer applications for 
        distributors and marketers.

   Protect the valued brands of online advertisers by enabling 
        them to know which applications are trustworthy and which are 
        not.

    The Trusted Download Program certification combines strict 
standards, thorough review, ongoing monitoring, enforcement mechanisms 
and powerful market incentives.
    The Program elevates those applications that meet the certification 
requirements through a whitelist, thereby providing consumer portals 
and other businesses a tool to distinguish responsible software 
applications. For downloadable desktop software developers, the program 
provides guidance on responsible behavior. A Trusted Download Seal at 
the point of download allows consumers to recognize applications that 
provide improved disclosures, more explicit control mechanisms, easier 
uninstall, and more respect for their personal information.
    Trusted Download Sponsors and Advisory Committee Members are CNET 
download.com, Microsoft, Yahoo!, and the Center for Democracy and 
Technology (CDT).
Incentives for Compliance
    TRUSTe serves a ``whitelist'' of certified applications to 
advertisers, distributors, consumer portals and other interested 
parties. In a market where the conduct of partners can be as important 
as the conduct of your own organization, businesses are turning to 
TRUSTe to help determine which applications they want to be affiliated 
with. The Program's whitelist is regularly used to influence 
decisionmaking in advertising buys, bundling and distribution 
opportunities, and to resolve errant blacklistings.
    The whitelist, provides an economic incentive for software 
providers to achieve and maintain certification. In addition, the 
Trusted Download Seal at the point of download reassures consumers and 
increases downloads, providing a direct economic benefit to software 
developers.
Scope
    While there are exceptions, the program is aimed at consumer 
downloadable desktop software applications. It does not cover software 
downloaded exclusively to handheld devices (i.e., mobile phones). While 
there are additional specific requirements for advertising and tracking 
software, many requirements also apply to all consumer downloadable 
applications. Advertising and tracking software providers will likely 
need to significantly change current practices to earn certification. 
In addition, the program will provide standards for all applications to 
offer consumers enhanced disclosures, easier uninstall and other 
benefits.
Certification
    Application providers submit to TRUSTe a contract and a completed 
questionnaire including questions about how the application is 
distributed. TRUSTe conducts a thorough evaluation of the downloadable 
applications against the program standards to ensure they do not 
involve activities that are prohibited by the Program. Additional 
compliance assurance is being provided by AppLabs, a third party 
software testing lab that will evaluate the application's relay of 
information and interaction with the recipient's operating system.
Key Program Elements
    The Program outlines certain requirements for all software and 
specifies additional requirements for advertising and tracking 
software. This approach ensures that the Program addresses practices 
that historically have created consumer confusion and anxiety. However, 
all software must meet specific program requirements and is tested for 
monitoring, relays, and behaviors that have historically been 
considered deceptive.
Notice
    The Program imposes a layered approach, via a primary notice and 
reference notices such as the End User License Agreement, EULA, and the 
privacy statement. The primary notice must explain functionalities that 
impact the consumer experience and must be unavoidable, to ensure that 
users understand what they are downloading. EULAs and ``opt-out'' 
mechanisms are insufficient for providing such notice or obtaining 
consent. For example, unavoidable notice of any material changes to 
certain specified consumer settings is required for ail software. 
Further, all ads delivered in certified advertising software must be 
labeled, and unavoidable notice of certain ad features must be 
provided.
Consent to Install is Required
    Consumers must be offered notice and an opportunity to consent that 
is described in plain language and is as prominently displayed as the 
option to not install, Consent to install may not be obtained with a 
pre-selected option.
Easy Uninstall
    Instructions for uninstallation must be easy to find and easy to 
understand, and methods for uninstalling must be available in places 
where consumers are accustomed to finding them, such as the Add/Remove 
Programs feature in the Windows Control Panel, or the Add-On management 
menus in browsers for browser Add-Ons. Uninstallation must remove all 
software associated with the particular application being uninstalled 
(with a few specific exceptions carved out in the Program 
Requirements), and cannot be contingent on a consumer's providing 
Personally Identifiable Information, unless that information is 
required for account verification.
Prohibited Activities
    No company can have an application certified if any of its 
applications exhibits a behavior listed in the Program's Prohibited 
Activities section.
    Examples of prohibited activities include:

   Taking control of a consumer's computer.

   Modifying security or other settings of the computer to 
        cause damage or harm.

   Spyware tactics for surveillance and tracking, such as 
        keystroke logging.

   Preventing reasonable efforts to block installation or to 
        uninstall.

   Allowing a certified application to be bundled with any 
        application currently engaging in any of the prohibited 
        activities.
Special Protections for Children
    Companies in the Program must prevent the distribution of their 
advertising or tracking software on children's websites--including by 
prohibiting their distribution partners and affiliates from such 
distribution.
Affiliate Controls
    Since many advertising and tracking applications are distributed 
through second and third-party affiliates and/or bundled with other 
programs; relationships must be disclosed in attestations. Certified 
software is subject to random testing on instances found wherever an 
individual might encounter them.
Prior Behavior
    The Program includes provisional certification for companies that 
have previously engaged in prohibited activities or other behaviors 
that call into question the Participant's ability to comply with the 
Program Requirements on an ongoing basis. In order to be certified, 
these companies will be subject to additional oversight including 
enhanced monitoring and a requirement to go back to all users who 
downloaded an uncertified version of the software application and 
obtain their opt-in consent.
Segregated Ad Inventory
    Companies in the Program must maintain segregated ad inventory in 
certified versus uncertified applications. The application provider 
must be able to serve ads to users from whom consent was obtained 
versus users from whom consent has not been acceptably obtained.
Monitoring
    Certified applications are monitored by TRUSTe for ongoing 
compliance with the Program's strict standards. A company risks 
termination from the program if any one of its certified applications 
violates the standards.
Enforcement
    If monitoring uncovers suspected non-compliance, an application, or 
in some cases all of a company's applications, will be subjected to 
enforcement procedures by TRUSTe. Depending on severity and the results 
of a TRUSTe investigation, an application may be temporarily suspended 
or permanently removed from the program whitelist. In certain cases, a 
company or application may be terminated from the Program and the fact 
of its termination made public.
    I have attached a copy * of the Trusted Download Program 
certification requirements to this letter and request that it also be 
included in the Committee's spyware hearing record.
---------------------------------------------------------------------------
    \*\ This document is retained in the Committee files.
---------------------------------------------------------------------------
    TRUSTe appreciates your work in this area and would be pleased to 
serve as a resource should you or your staff have any questions. If you 
have any questions, please do not hesitate to contact me.
            Sincerely,
                                  John P. Tomaszewski, Esq.
                        Vice President, Legal, Policy & Compliance.
                                 ______
                                 
       Americans for Fair Electronic Commerce Transactions 
                                                   (AFFECT)
                                                      June 25, 2008
Hon. Mark Pryor,
U.S. Senate Committee on Commerce, Science, and Transportation,
Washington, DC.

       Re: Follow-up Comments for the Record of the Hearing on the 
      ``Impact and Policy Implications of Spyware on Consumers and 
                                                       Businesses''

Dear Senator Pryor:

    Thank you for the opportunity to submit additional comments on 
behalf of AFFECT (Americans for Fair Electronic Commerce Transactions) 
on the impact and policy implications of spyware on consumers and 
businesses and on the Counter Spy Act (S. 1625).
    As I stated in my testimony during the June 11, 2008 hearing, 
AFFECT is concerned about the exception section of the Counter Spy Act, 
Section 6(a). That section says that the list of prohibited acts in 
Sections 3, 4, and 5 of the bill ``do not apply to any monitoring of or 
interaction with, a subscriber's Internet or other network connection 
or service, or a protected computer, by or at the direction of a 
telecommunications carrier, cable operator, computer hardware arc or 
software provider, financial institution or provider of information 
services or interactive computer service . . .''
    These entities have immunity under the Counter Spy Act when what 
they're doing is done for a number of innocuous-sounding purposes. The 
first nine of these liability exemptions include network or computer 
security, diagnostics, technical support, repair, network management, 
authorized updates of software or system firmware, authorized remote 
system management, authorized provision of protection for users of the 
computer from objectionable content, and authorized scanning for 
computer software used in violation of sections 3, 4, or 5 for removal 
by an authorized user.
    As I said at the hearing, AFFECT sees no legitimate reason why any 
of these nine activities would need an exemption from the actions 
prohibited by the bill because:

   none of them justifies an outside entity in installing 
        zombies, engaging in modern hijacking for the purpose of 
        causing damage to the computer or causing the authorized user 
        to incur unauthorized financial charges, causing a denial of 
        service attack for the purpose of causing damage, causing 
        endless loop pop-up ads (Section 3(1));

   none of them justifies an outside entity in modifying an 
        authorized user's security settings for the purpose of stealing 
        the user's sensitive personal information, or disabling 
        security settings for the purpose of causing damage to the 
        computer or another computer, or through unfair or deceptive 
        means modifying browser settings (Section 3(2));

   none of them justifies, without authorization, an outside 
        entity in preventing a user's reasonable efforts to block 
        installation, to disable, or to uninstall software by unfair or 
        deceptive means (Section 3(3));

   none of them justifies an outsider in installing software 
        that collects sensitive personal information from an authorized 
        computer user without that user's informed consent, logs 
        keystrokes, collects and correlates personal information with a 
        history of websites visited, extracts the substantive contents 
        of files or communications, or prevents an authorized user from 
        uninstalling or disabling software (Section 4); and,

   none of them justifies an outsider in installing adware that 
        conceals its operation (Section 5).

    An exemption from the prohibited activities listed in the bill is 
simply not needed to allow or protect any legitimate activity.
    AFFECT is particularly concerned about Subsection 6(a)(10). That 
tenth and final exemption would be granted when the otherwise 
prohibited acts are done for: ``detection or prevention of the 
unauthorized use of software fraudulent or other illegal activities.'' 
The troubling questions raised by 6(a)(10) were pointed out in my 
written testimony, namely that the exemption would allow a software 
vendor to surreptitiously download code onto a user's computer and 
freely violate their privacy. It would allow the provider to set itself 
up as an ad hoc police force to conduct warrantless searches and to act 
as judge and jury to conduct unilateral seizures. Private entities do 
not and should not have the right to conduct law enforcement 
activities.
    More troubling is the fact that the language of Subsection 6(a)(10) 
would effectively allow a software provider to unilaterally decide to 
remotely shut down the user's computer or Internet or other network 
connection or service. But whether the use of a particular software is 
``unauthorized,'' ``fraudulent,'' or ``illegal'' is often subject to 
legitimate dispute and merits some judicial consideration before a 
provider is allowed to unilaterally employ a drastic remedy like remote 
disablement.
    In his written testimony, Vincent Weafer, the Symantec vice 
president who was representing the Business Software Alliance (BSA) at 
the hearing, praised Section 6(a)(10) as ``essential to our industry's 
ability to protect our products against theft. Software piracy results 
in almost $50 billion in losses to the software industry each year, 
including more than $8 billion in the U.S. alone. Given these massive 
losses, it is absolutely critical that companies that engage in 
otherwise lawful conduct to detect or prevent piracy or other unlawful 
acts are not unwittingly subject to liability under anti-spyware 
laws.''
    Contrary to Mr. Wearer's statement, exemption from the prohibited 
actions listed in the bill is neither essential to a software vendor's 
legitimate efforts to protect against piracy, nor is it essential to 
protect legitimate activities from liability under the bill. Software 
vendors have a variety of legal remedies to attack piracy. If a 
software contract, for example, an End User License Agreement (EULA), 
is breached, the vendor would have the right to sue and collect 
damages. It could seek an injunction against further use. In addition, 
statutes, like the U.S. Copyright Act, or international copyright laws, 
may grant other rights and remedies, including access to Federal court 
and statutory damages, perhaps even enforcement by the FBI. In 
addition, the BSA itself is a well-known and very effective enforcement 
arm of the software industry.
    Further, there is no reason the software industry can't employ 
technological approaches to combating piracy without remotely accessing 
software resident on the user's computer and unilaterally shutting it 
down. For example, the agreement between the software vendor and the 
user could clearly provide for a limited period of use and a ``time 
bomb'' built into the software that disables its operation at the 
expiration of the named period of time. The parties then could agree 
that the period of limited use could be renewed by the user obtaining a 
``key'' from the vendor or sending a ``validation'' to continue the 
use.
    It is not necessary to reach into a user's computer, to poll the 
machine, extract data, and phone home. It is not necessary to build in 
a ``backdoor'' which will make the computer vulnerable to exploitation 
by spies, hackers, saboteurs, or terrorists. And, there is no 
legitimate reason why a software vendor, network provider, or other 
outside entity should be allowed to unilaterally decide to remotely 
shut down the user's computer or Internet or other network connection 
or service. At a minimum, a software vendor who thinks it has not been 
paid, should be required to give notice, an opportunity to cure, and 
obtain a court order before employing remote disablement.
    The Business Software Alliance appears to want to use Section 6 of 
your bill to gain the approval of policymakers for their use of 
electronic self-help. The fact of the matter is that this is an anti-
spyware bill, not a bill designed to address tools for dealing with 
piracy.
    During the hearing on June 11, you specifically asked for 
suggestions about how to define spyware. AFFECT offered the following 
definition: Spyware is computer software that is surreptitiously 
installed on a computer that allows an outsider to intercept or take 
partial control over the user's interaction with the computer, without 
the user's informed consent. We believe this definition is broad enough 
to cover technologies that arc deployed without appropriate user 
consent or are implemented in ways that impair user control over 
material changes that affect their experience, privacy, or system 
security; their use of their system resources, including what software 
is installed on their computers; and the collection, use, and 
distribution of their personal or other sensitive information. We also 
believe it should cover all of the prohibited behaviors currently 
listed in the bill.
    AFFECT also sees the merit in the suggestions of spyware expert Ben 
Edelman, who advocated for a simplification of the approach of S. 1625 
that would focus on increasing the penalties such as a treble fine in 
FTC actions. That approach was also expressed by the FTC in its 
testimony.
    Finally, I want to express AFFECT's support for the three key 
principles expressed by Ms. Eileen Harrington, Deputy Director of the 
Bureau of Consumer Protection of the FTC, in her written and oral 
statements: (1) a consumer's computer belongs to him or her, not to the 
software distributor, and it must be the consumer's choice whether or 
not to install software; (2) burying in an End User License Agreement 
(EULA) material disclosures necessary to correct an otherwise 
misleading impression should not be sufficient to allow a spyware 
purveyor to escape liability; and (3) a consumer should be able to 
uninstall or disable any program he or she does not want on a computer.
    AFFECT has long favored a competitive and fair marketplace. A 
cornerstone of AFFECT's efforts was the creation of ``12 Principles for 
Fair Commerce in Software and Other Digital Products'' (http://
www.ucita.com/pdf/AFFECTbrochure2-05.pdf). Two of those key principles 
are that: (1) customers are entitled to control their own computer 
systems; and (2) customers arc entitled to control their own data. We 
believe these two principles are consistent with the three expressed by 
Ms. Harrington and should guide the Committee and the Congress in 
shaping its approach to dealing with the insidious problem of spyware.
    Thank you very much for the opportunity to submit these additional 
comments for the hearing record. AFFECT remains willing and interested 
in working with the Committee on S. 1625 and will be glad to be of 
whatever help we can.
            Sincerely,
                                          Arthur A. Butler,
                                          Attorney, Ater Wynne LLP.
                                 ______
                                 

 Americans for Fair Electronic Commerce Transactions (AFFECT) Concerns 
                     with S. 1625, Section 6(a)(10)

    Americans for Fair Electronic Commerce Transactions (AFFECT) is a 
national coalition of consumers, retail and manufacturing businesses, 
insurance institutions, financial institutions, technology 
professionals and librarians committed to promoting the growth of fair 
and competitive commerce in software and other digital products.
    S. 1625 (Pryor), introduced in June 2007, would protect against the 
unauthorized installation of software that is used to take control of a 
computer in order to cause damage, collect personal information without 
consent, or otherwise enable identity theft.
    AFFECT strongly supports S. 1625's purpose to curb the use of 
harmful spyware. However, it has great concerns with S. 1625 (6), the 
exception section, which is overly broad and could be construed to 
protect wrongful acts that can result in great harm to computer users--
which is in direct opposition to the purpose of S. 1625.
    AFFECT strongly recommends that the exception provision of S. 1625 
should only limit liability for interaction with a network, service, or 
computer that is undertaken to detect or prevent fraudulent or other 
illegal activities as prohibited by the act itself. Therefore, AFFECT 
proposes that Section 6(a)(10) of the bill be amended as follows:

        (10) detection or prevention of fraudulent or other illegal 
        activities as prohibited by this Act.

    Subsection 6(a)(10), as it is currently written, would permit a 
provider to monitor or interact with an individual's computer or 
Internet or other network connection or service for the ``detection or 
prevention of the unauthorized use of software for fraudulent or other 
illegal activities.'' This would allow the provider to unilaterally 
decide to remotely shut down the user's computer or Internet or other 
network connection or service. But whether the use of a particular 
software is ``unauthorized,'' ``fraudulent,'' or ``illegal'' is often 
subject to legitimate dispute and merits some judicial consideration 
before a provider is allowed to unilaterally employ a drastic remedy 
like remote disablement.
    Permitting unilateral remote disablement is bad public policy. It 
allows the provider to set itself up as an ad hoc police force to 
conduct warrantless searches and to act as judge and jury to conduct 
unilateral seizures in the name of protecting against piracy, fraud, or 
other illegal activities. Private entities do not and should not have 
the right to conduct law enforcement activities.
    Also, remote disablement can cause great harm to the owner who 
depends on access to and use of that computer, connection or service.

   For example, the shutdown of an owner's system can cause 
        great harm to:

     a teacher using a computer to prepare for classroom 
            lectures;

     an insurer depending on a computer system to pay 
            claims;

     a manufacturer trying to deliver its products to meet 
            contractual commitments; or

     the public's access to online library materials.

   In reaching into an individual's computer remotely to 
        disable software residing on his computer, the provider may not 
        only violate privacy rights, but also damage his other files.

   The monitoring and remote disablement of software on an 
        owner's computer by a provider may compromise private 
        information of employees, confidential and proprietary 
        information of the owner, and, in some cases, national security 
        information.

   The code used to remotely enter a computer and disable the 
        software or the network connection (often called ``black 
        holes'') make the computer vulnerable to security breaches by 
        hackers and terrorists. When there is an opportunity to 
        negotiate, many enterprises, including governmental entities, 
        will insist that their software license agreements contain a 
        warranty prohibiting any ``self-help code'' or other software 
        routing designed to disable a computer program automatically or 
        that is under the positive control of a person other than the 
        licensee of the software. Unfortunately, with mass market 
        licenses individual consumers and businesses are not able to 
        negotiate for a ``no self-help code.''

    It is important to recognize that these harms that can result from 
permitting remote disablement can be significantly larger than the harm 
to a software vendor in not getting a license fee.
                                 ______
                                 
    Response to Written Questions Submitted by Hon. David Vitter to 
                         Eileen Harrington \1\
---------------------------------------------------------------------------
    \1\ As with my responses to the Committee's questions at the 
hearing, these answers present my personal views and do not necessarily 
represent the views of the Federal Trade Commission or of any 
Commissioner.
---------------------------------------------------------------------------
    Question 1. Who do you think would define ``objectionable'' in S. 
1625 section 6(a)(8), and what does that term mean?
    Answer. The term ``objectionable content'' is left undefined by the 
Counter Spy Act, S. 1625. Absent a clear definition in the bill, 
``objectionable content'' will need to be interpreted by the courts. As 
drafted, however, ``objectionable content'' is sufficiently broad that 
it might include content or software (such as advertising software, 
toolbars, etc.) about whose value reasonable people may disagree. 
Accordingly, a covered party could have considerable discretion under 
the bill to identify and remove software as ``objectionable'' without 
giving specific notice to, and perhaps against the intentions of, the 
consumer.

    Question 2. Under section 6(a)(9) of S. 1625, would a consumer's 
purchase and use of a computer with pre-loaded operating system and 
anti-spyware software be sufficient ``authorization'' to allow some 
software to remove or disable other software on the computer without 
notifying the computer user or obtaining her consent?
    Answer. The Commission and the courts would need to approach 
scenarios like the one posed by Question 2 on a case-by-case basis, 
weighing the nature of the software and its potential for harm against 
the nature and timing of notice and consent--if any--provided. In the 
case of pre-installed anti-spyware software, we would need to know how 
much notice the consumer is given regarding the existence and function 
of the software, and whether the consumer is given notice before the 
anti-spyware software removes or disables other software on the 
computer. If any pre-installed software caused the type of harms 
outlined in sections 3, 4, or 5 of S. 1625, it is doubtful that the 
Commission would deem the mere acts of buying and turning on a computer 
to be sufficient ``authorization.''
    Linking exemptions and immunity in section 6(a) to particular 
functions that are purportedly ``authorized'' poses the risk of 
creating a safe harbor based on unknowing authorization. For example, a 
software provider, an information services provider, or an ISP might 
argue that a provision buried deep in an End User License Agreement or 
privacy policy provides sufficient authorization for much of the 
conduct prohibited by the bill.

    Question 3. Should we be careful when providing (broad) exemptions 
or immunity for software removal, given the FTC actions against 
companies that might represent their software as legitimate ``anti-
spyware'' in order to scam consumers?
    Answer. Yes. I share Senator Vitter's concern that there is a need 
for caution in providing broad exemptions and immunity for software 
removal when addressing the problems of spyware. If not carefully 
drafted, these broad exemptions can create safe harbor loopholes that 
can be exploited by clever spyware and malware purveyors. Under the 
bill as drafted, virtually any ``software provider'' or ``provider of 
information services'' who can muster some plausible pretense of the 
list of the enumerated services will raise the exemption as a defense 
to enforcement.
    Take the example of a purveyor of what has been termed ``rogue 
anti-spyware'' software. Rogue anti-spyware software is usually sold 
via deceptive tactics. A broad ``anti-spyware'' exemption may shield 
the rogue anti-spyware sellers from liability for their deceptive 
tactics. Moreover, it could potentially permit the seller to download 
other harmful software, such as a keylogger, if that seller can 
convince a court that the other harmful software in any way could be 
used to provide functions enumerated by sections 6(a)(1) through (10).
    If the main purpose of including section 6(a) is to limit liability 
among and between civil litigants regarding questions about what is 
``authorized,'' or what is ``objectionable'' (e.g., where an anti-
spyware company is sued by a software provider whose product is deemed 
objectionable), it is misplaced because S. 1625 does not provide a 
private right of action. Accordingly, such broad exemptions from law 
enforcement in this legislation are unnecessary. At bottom, the broad 
scope of section 6(a)'s limitations on liability--both in terms of the 
number of exempted parties as well as the breadth of the exempted 
conduct--may make the FTC's job more challenging and potentially do 
more harm than good in terms of effective spyware law enforcement.

                                  

```