IIB 
109TH CONGRESS 
1ST SESSION 
H. R. 29
IN THE SENATE OF THE UNITED STATES 
MAY 24, 2005
Received; read twice and referred to the Committee on Commerce, Science, 
and Transportation 
AN ACT 
To protect users of the Internet from unknowing trans-
mission of their personally identifiable information 
through spyware programs, and for other purposes.
Be it enacted by the Senate and House of Representa-
tives of the United States of America in Congress assembled,
HR 29 RFS 
SECTION 1. SHORT TITLE. 
This Act may be cited as the ‘‘Securely Protect Your-
self Against Cyber Trespass Act’’ or the ‘‘Spy Act’’. 
SEC. 2. PROHIBITION OF [UNFAIR OR] DECEPTIVE ACTS OR 
PRACTICES RELATING TO SPYWARE. 
(a) PROHIBITION.—It is unlawful for any person, 
who is not the owner or authorized user of a protected 
computer, to engage in unfair or deceptive acts or prac-
tices that involve any of the following conduct with respect 
to the protected computer: 
(1) Taking control of the computer by—
(A) utilizing such computer to send unso-
licited information or material from the com-
puter to others; 
(B) diverting the Internet browser of the 
computer, or similar program of the computer 
used to access and navigate the Internet—
(i) without authorization of the owner 
or authorized user of the computer; and 
(ii) away from the site the user in-
tended to view, to one or more other Web 
pages, such that the user is prevented from 
viewing the content at the intended Web
HR 29 RFS 
page, unless such diverting is otherwise au-
thorized; 
(C) accessing, hijacking, or otherwise using 
the modem, or Internet connection or service, 
for the computer and thereby causing damage 
to the computer or causing the owner or au-
thorized user or a third party defrauded by 
such conduct to incur charges or other costs for 
a service that is not authorized by such owner 
or authorized user; 
(D) using the computer as part of an ac-
tivity performed by a group of computers that 
causes damage to another computer; or 
(E) delivering advertisements that a user 
of the computer cannot close without undue ef-
fort or knowledge by the user or without turn-
ing off the computer or closing all sessions of 
the Internet browser for the computer. 
(2) Modifying settings related to use of the 
computer or to the computer’s access to or use of 
the Internet by altering—
(A) the Web page that appears when the 
owner or authorized user launches an Internet 
browser or similar program used to access and 
navigate the Internet;
HR 29 RFS 
(B) the default provider used to access or 
search the Internet, or other existing Internet 
connections settings; 
(C) a list of bookmarks used by the com-
puter to access Web pages; or 
(D) security or other settings of the com-
puter that protect information about the owner 
or authorized user for the purposes of causing 
damage or harm to the computer or owner or 
user. 
(3) Collecting personally identifiable informa-
tion through the use of a keystroke logging function. 
(4) Inducing the owner or authorized user of 
the computer to disclose personally identifiable infor-
mation by means of a Web page that—
(A) is substantially similar to a Web page 
established or provided by another person; and 
(B) misleads the owner or authorized user 
that such Web page is provided by such other 
person. 
(5) Inducing the owner or authorized user to 
install a component of computer software onto the 
computer, or preventing reasonable efforts to block 
the installation or execution of, or to disable, a com-
ponent of computer software by—
HR 29 RFS 
(A) presenting the owner or authorized 
user with an option to decline installation of 
such a component such that, when the option is 
selected by the owner or authorized user or 
when the owner or authorized user reasonably 
attempts to decline the installation, the installa-
tion nevertheless proceeds; or 
(B) causing such a component that the 
owner or authorized user has properly removed 
or disabled to automatically reinstall or reac-
tivate on the computer. 
(6) Misrepresenting that installing a separate 
component of computer software or providing log-in 
and password information is necessary for security 
or privacy reasons, or that installing a separate com-
ponent of computer software is necessary to open, 
view, or play a particular type of content. 
(7) Inducing the owner or authorized user to 
install or execute computer software by misrepre-
senting the identity or authority of the person or en-
tity providing the computer software to the owner or 
user. 
(8) Inducing the owner or authorized user to 
provide personally identifiable, password, or account 
information to another person—