FIFTEENTH CONGRESS OF THE REPUBLIC 
) 
,_> r' 
OF THE PHILIPPINES 
) 
First Regular Session 
) 
~j3Ni1,f . 
S. No. 
75 
}{'i~J;E1Vr~) $:,y' 
Introduced by Senator Miriam Defensor Santiago 
EXPLANATORY NOTE 
r-,:.,....,~-, '-0 
\' 
.' ., 
Grayware (or greyware) is a general classification for applications that behave in a 
manner that is annoying or undesirable. Grayware encompasses spyware, adware, dialers, joke 
programs, remote access tools, and any other unwelcome files and programs apart from viruses 
that can harm the performance of computers on your network. The term has been in use since at 
least as early as September 2004. 
Grayware refers to applications or files that are not classified as viruses or trojan horse 
programs, but can still negatively affect the performance of the computers on your network and 
introduce significant security risks to your organization. Often grayware performs a variety of 
undesired and threatening actions such as irritating users with pop-up windows, logging user key 
strokes, and t;xposing computer vulnerabilities to attack. This bill aims to address the growing 
problem of grayware among computer users in the Philippines. 
1 


1 
2 
FIFTEENTH CONGRESS OF THE REPUBLIC 
) 
OF THE PHILIPPINES 
) 
First Regular Session 
) 
~l~C~-:~Vf n f'\\-' , 
Introduced by Senator Miriam Defensor Santiago 
AN ACT 
, PROTECTING CONSUMERS FROM COMPUTER GRA YWARE 
Be it enacted by the Senate and the House of Representatives of the Philippines in 
Congress assembled: 
3 
SECTION 1. Short Title. - This Act shall be known as the "Consumer Protection against 
4 
Computer Grayware Act." 
5 
SECTION 2. Definition of terms. -As used in this Act, the tern-
6 
(A) "Advertisement" is any communication, the primary purpose of which is the 
7 
commercial promotion of a commercial product or service, including content on an Internet web 
8 
site operated for a commercial purpose; 
9 
(B) "Authorized user," with respect to a computer, is a person who owns or leases a 
10 
computer or is authorized by the owner or lessee to use the computer. Authorized user shall not 
11 
include a person or entity that has obtained authorization to use the computer solely through the 
12 
use of an end-user license agreement; 
13 
(C) "Computer software" is a sequence of instructions written III any programming 
14 
language that is executed on a computer; 
15 
(D) "Computer virus" or malware is a computer program or other set of instructions that 
16 
is designed to degrade the performance of or disable a computer or computer network and is 
17 
designed to have the ability to replicate itself on other computers or computer networks without 
18 
the authorization of the owners of those computers or computer networks; 
19 
(E). "Consumer" is an individual who uses a computer for whatever purpose; 
1 


I 
(F) "Grayware" refers to applications or file.s that are not classified as viruses or trojan 
2 
horse programs, but can still negatively affect the performance of the computers on your network 
3 
and introduce significant security risks, it includes spyware and adware; 
4 
(1) "Spyware" refers to software that installs components on a computer for the 
5 
purpose of recording Web surfing habits (primarily for marketing purposes). 
Spyware 
sends 
6 
this information to its author or to other interested parties when the computer is online; 
7 
(2) "Adware" is software that displays advertising banners on Web browsers such 
8 
as Internet Explorer and Mozilla. While not categorized as mal ware, 
many 
users 
consider 
9 
adware invasive. Adware programs often create 
unwanted effects on a system, such as 
10 
annoying popup ads and the general degradation in either network connection or system 
II 
performance. Adware programs are typically installed as separate programs that are bundled with 
12 
certain free software. 
13 
(G) "Execute," when used with respect to compnter software, means the performance of 
14 
the functions or the carrying out of the instructions of the computer software; 
15 
(H) "rntentionally deceptive" is any ofthe following: 
16 
(1) By means of an intentionally and materially false or fraudulent statement; 
17 
(2) By means of a statement or description that intentionally omits or 
18 
misrepresents material information in order to deceive the consumer; 
19 
(3) By means of an intentional and material failure to provide any notice to an 
20 
authorized user regarding the download or installation of software in order to deceive the 
21 
consumer; 
22 
(1) "Internet" is the global information system that is linked together by a globally unique 
23 
address space based on the Internet protocol, or its subsequent extensions, and that is able to 
24 
support communications using the Transmission Control Protocol/Internet Protocol suite, or its 
25 
subsequent extensions, or other Internet protocol-compatible protocols, and that provides, uses, 
26 
or makes accessible, either publicly or privately, high level services layered on the 
27 
communications and related infrastructure described in this subdivision: 
28 
(J) "Person" refers to any individual, partnership, corporation, or any kind of 
29 
organization, or any combination thereof; 
2 


1 
(K) "Damage" refers to any significant impairment to the integrity, functionality or 
2 
availability of data, software, a computer, or a system; 
3 
(L) "Personally identifiable information" is any of the following: 
4 
(I) A first name or first initial in combination with last name; 
5 
(2).Any credit or debit card numbers or other financial account numbers; 
6 
(3) A password or personal identification number required to access an identified 
7 
financial account; 
8 
(4) A Social Security number; 
9 
(5) Any of the following information in a form that personally identifies an authorized 
10 
user: 
11 
(a) Account balance; 
12 
(b) Overdraft history; 
13 
(c) Payment history; 
14 
(d) History of web sites visited; 
15 
(e) Home address; 
16 
(1) Work address; 
17 
(g) Record of a purchase or purchases. 
18 
SECTION 3. Prohibited Acts. - A person or entity that is not an authorized user shall not, 
19 
with actual knowledge, with conscious avoidance of actual knowledge, or willfully, cause 
20 
computer software to be copied onto the computer of a consumer and use the software to do any 
21 
of the following: 
22 
(A) Modify, through intentionally deceptive means, any of the settings related to the 
, 
23 
computer's access to, or use of, the Internet; 
24 
(B) Collect, through intentionally deceptive means, personally identifiable information 
25 
that meets any of the following criteria: 
26 
(1) It is collected through the use of a keystroke-logging function that records all 
27 
keystrokes made by an authorized user who uses the computer and transfers that 
28 
information from the computer to another person; 
3 


I 
(2) It includes all or substantially all of the web sites visited by an authorized user, 
2 
other than web sites of the provider of the software, if the computer software was 
3 
installed in a manner designed to conceal from all authorized users of the computer the 
4 
fact that the software is being installed; 
5 
(3) It is a data element described in paragraph K of Section 2, that is extracted 
6 
from the consumer's computer hard drive for a purpose wholly unrelated to any of the 
7 
purposes of the software or service described to an authorized user. 
8 
(C) Prevent, without the authorization of an authorized user, through intentionally 
9 
deceptive means, an authorized user's reasonable efforts to block the installation of, or to disable, 
10 
software, by causing software that the authorized user has properly removed or disabled to 
11 
automatically reinstall or reactivate on the computer without the authorization of an authorized 
12 
user; 
13 
(D) 'Intentionally misrepresent that software will be uninstalled or disabled by an 
14 
authorized user's action, with knowledge that the software will not be so tminstalled or disabled; 
15 
(E) Through intentionally deceptive means, remove, disable, or render inoperative 
16 
security, antispyware, or antivirus software installed on the computer. 
17 
(F) Take control of the consumer's computer by doing any of the following: 
18 
(1) Transmitting or relaying commercial electronic mail or a computer virus from 
19 
the consumer's computer, where the transmission or relaying is initiated by a person other 
20 
than the authorized user and without the authorization of an authorized user; 
21 
(2) Accessing or using the consumer's modem or Internet service for the purpose 
22 
of causing damage to the consumer's computer or of causing an authorized user to incur 
23 
financial charges for a service that is not authorized by an authorized user; 
24 
(3) Using the consumer's computer as part of an activity performed by a group of 
25 
computers for the purpose of causing damage to another computer, including, but not 
26 
limited to, launching a denial of service attack; 
27 
(4) Opening multiple, sequential, stand-alone advertisements in the consumer's 
28 
Internet browser without the authorization of an authorized user and with knowledge that 
4 


1 
a reasonable computer user cannot close the advertisements without turning off the 
2 
cOlJlPuter or closing the consumer's Internet browser; 
3 
(G) Modify any of the following settings related to the computer's access to, or use of, the 
4 
Internet: 
5 
(1) An authorized user's security or other settings that protect information about 
6 
the authorized user for the purpose of obtaining personally identifiable information of an 
7 
authorized user; 
8 
(2) The security settings of the computer for the purpose of causing damage to 
9 
one or more computers; 
10 
(H) Prevent, without the authorization of an authorized user, an authorized user's 
11 
reasonable efforts to block the installation of, or to disable, software, by doing any of the 
12 
following: 
13 
(1) Presenting the authorized user with an option to decline installation of 
14 
software with knowledge that, when the option is selected by the authorized user, the 
15 
installation nevertheless proceeds; 
16 
(2) Falsely representing that software has been disabled; 
17 
(3) Causing the installation of computer software in an intentionally deceptive 
18 
manner so as to evade an authorized user's attempts to remove the computer software 
19 
from the computer; 
20 
(I) Remove, disable, or render inoperative, through intentionally deceptive means, 
, 
21 
security, antispyware, or antivirus software installed on the computer; 
22 
(J) Induce an authorized user to install a software component onto the computer by 
23 
misrepresenting that installing software is necessary for security or privacy reasons or in order to 
24 
open, view, or playa particular type of content; 
25 
(K) Deceptively causing the copying and execution on the computer of a computer 
26 
software component with the intent of causing an authorized user or computer to use the 
27 
component in a way that violates any other provision of this section; 
5 


1 
SECTION 4. Exceptions. - Nothing in the preceding section shall apply to any 
2 
monitoring of, or interaction with, an authorized user's Internet or other network connection or 
3 
service, or a protected computer, by a telecommunications carrier, cable operator, computer 
4 
hardware or software provider, or provider of information service or interactive computer 
5 
authorized service for authorized network or computer security purposes, authorized diagnostics, 
6 
technical support, network management, authorized maintenance or repair, authorized updates of 
7 
software or system firmware, authorized remote system management, or authorized detection or 
8 
prevention of the unauthorized use of or fraudulent or other illegal activities in counection with a 
9 
network, service, or computer software, including scauning for and removing software 
• 
10 
proscribed under this Act. 
11 
SECTION 5. Separability Clause. - If any provision, or part hereof is held invalid or 
12 
unconstitutional, the remainder of the law or the provision not otherwise affected shall remain 
13 
valid and subsisting. 
14 
SECTION 6. Repealing Clause. - Any law, presidential decree or issuance, executive 
15 
order, letter of instruction, administrative order, rule or regulation contrary to or inconsistent 
16 
with, the provisions of this Act is hereby repealed, modified, or amended accordingly. 
17 
SECTION 7. Effectivity Clause. - This Act shall take effect fifteen (15) days after its 
18 
publication in at least two (2) newspapers of general circulation. 
Approved, 
6