Union Calendar No. 15
109TH CONGRESS 
1ST SESSION 
H. R. 29
[Report No. 109–32] 
To protect users of the Internet from unknowing transmission of their person-
ally identifiable information through spyware programs, and for other 
purposes. 
IN THE HOUSE OF REPRESENTATIVES 
JANUARY 4, 2005
Mrs. BONO (for herself, Mr. TOWNS, Mr. BARTON of Texas, Mr. BUYER, Mr. 
GILLMOR, Mr. HALL, Mr. RADANOVICH, Mr. WALDEN of Oregon, Mr. 
FERGUSON, Mr. WHITFIELD, Mrs. CUBIN, Mr. STEARNS, Mr. BILIRAKIS, 
Mr. TERRY, and Mr. OTTER) introduced the following bill; which was re-
ferred to the Committee on Energy and Commerce 
APRIL 12, 2005
Additional sponsors: Mr. UPTON, Mr. GENE GREEN of Texas, Mr. BAKER, 
Ms. JACKSON-LEE of Texas, Mr. BUTTERFIELD, Mr. GORDON, Ms. 
SCHAKOWSKY, Mr. WAMP, Mr. HAYWORTH, Mr. SULLIVAN, Mr. CAL-
VERT, Mr. EHLERS, Mr. PUTNAM, Mr. MARKEY, Mr. ISRAEL, Mr. GON-
ZALEZ, Ms. SOLIS, Ms. WATSON, Mr. ENGEL, Mr. WYNN, Mr. ABER-
CROMBIE, Mr. DOOLITTLE, Ms. ESHOO, Mrs. DAVIS of California, Mr. 
STUPAK, Mr. RUSH, Mr. RYAN of Ohio, Mr. LINCOLN DIAZ-BALART of 
Florida, Mr. BOUCHER, Mr. BASS, Mr. SAM JOHNSON of Texas, Mr. 
LEWIS of Georgia, Mr. DUNCAN, Mr. BACHUS, Mr. INSLEE, Mr. SHAW, 
Mr. DINGELL, Mr. DOYLE, Mrs. MYRICK, Mr. MURPHY, Mrs. 
BLACKBURN, Mr. ROSS, Mr. ROTHMAN, Mr. SHADEGG, Mr. EDWARDS, 
Mr. MOORE of Kansas, and Mr. MCCAUL of Texas 
APRIL 12, 2005
Reported with an amendment, committed to the Committee of the Whole 
House on the State of the Union, and ordered to be printed
[Strike out all after the enacting clause and insert the part printed in italic] 
[For text of introduced bill, see copy of bill as introduced on January 4, 2005] 
A BILL 
To protect users of the Internet from unknowing trans-
mission of their personally identifiable information 
through spyware programs, and for other purposes.
Be it enacted by the Senate and House of Representa-
tives of the United States of America in Congress assembled,
SECTION 1. SHORT TITLE. 
This Act may be cited as the ‘‘Securely Protect Yourself 
Against Cyber Trespass Act’’ or the ‘‘Spy Act’’. 
SEC. 2. PROHIBITION OF DECEPTIVE ACTS OR PRACTICES 
RELATING TO SPYWARE. 
(a) PROHIBITION.—It is unlawful for any person, who 
is not the owner or authorized user of a protected computer, 
to engage in deceptive acts or practices that involve any 
of the following conduct with respect to the protected com-
puter: 
(1) Taking control of the computer by—
(A) utilizing such computer to send unsolic-
ited information or material from the computer 
to others;
(B) diverting the Internet browser of the 
computer, or similar program of the computer 
used to access and navigate the Internet—
(i) without authorization of the owner 
or authorized user of the computer; and 
(ii) away from the site the user in-
tended to view, to one or more other Web 
pages, such that the user is prevented from 
viewing the content at the intended Web 
page, unless such diverting is otherwise au-
thorized; 
(C) accessing, hijacking, or otherwise using 
the modem, or Internet connection or service, for 
the computer and thereby causing damage to the 
computer or causing the owner or authorized 
user or a third party defrauded by such conduct 
to incur charges or other costs for a service that 
is not authorized by such owner or authorized 
user; 
(D) using the computer as part of an activ-
ity performed by a group of computers that 
causes damage to another computer; or 
(E) delivering advertisements that a user of 
the computer cannot close without turning off the
computer or closing all sessions of the Internet 
browser for the computer. 
(2) Modifying settings related to use of the com-
puter or to the computer’s access to or use of the 
Internet by altering—
(A) the Web page that appears when the 
owner or authorized user launches an Internet 
browser or similar program used to access and 
navigate the Internet; 
(B) the default provider used to access or 
search the Internet, or other existing Internet 
connections settings; 
(C) a list of bookmarks used by the com-
puter to access Web pages; or 
(D) security or other settings of the com-
puter that protect information about the owner 
or authorized user for the purposes of causing 
damage or harm to the computer or owner or 
user. 
(3) Collecting personally identifiable information 
through the use of a keystroke logging function. 
(4) Inducing the owner or authorized user of the 
computer to disclose personally identifiable informa-
tion by means of a Web page that—