Spyware, Malware, and Internet beasties
Derived From: FTC, Monitoring Software on Your PC: Spyware, Adware and other Software, pp 20-21 (March 2005)
FTC Law Enforcement
"[P]anelists from FTC staff and Department of Justice staff stated that their current statutory authority was sufficient to prosecute spyware distributors. Section 5 of the FTC Act gives the agency the authority to challenge acts and practices in or affecting commerce that are “deceptive” or “unfair.” The Commission will find that an act or practice is “unfair” if it causes or is likely to cause substantial injury to consumers, that injury is not outweighed by any countervailing benefits to consumers and competition, and consumers could not have reasonably avoided the injury.
The Commission will find deception if there is a material representation, omission, or practice that is likely to mislead consumers acting reasonably in the circumstances, to their detriment. For example, if a software distributor represented that spyware bundled with primary software would not affect the operation of a computer, this representation would be deceptive if the spyware used so much memory that it substantially slowed down the computer’s performance or otherwise significantly impaired the computer’s performance.
It is also deceptive for a seller to tell a half-truth, i.e., to fail to disclose information necessary to prevent some other statement from creating a misleading impression. So, if a software distributor expressly or impliedly represented that downloading its primary software would not cause a computer to crash, it might be deceptive to fail to disclose that accompanying spyware would substantially slow it down.
Even assuming that the amount and type of information provided about the spyware is adequate, as explained above, software distributors often present it through fine print disclosures buried deep in a lengthy document. FTC law is clear, however, that disclosures must be clear and prominent if consumers are to be able to notice, read, and comprehend them. The FTC has issued a guidance document providing sellers with information on how to present such
information in an online environment.
The FTC has substantial experience challenging unfair or deceptive acts and practices on the Internet as violating Section 5 of the FTC Act. Over the past decade, the Commission has brought over 300 law enforcement actions related to the Internet. In these cases, the FTC has obtained injunctive relief, and often, monetary relief. Specifically, the defendants in these cases have been ordered to pay more than $1 billion to redress harm to consumers.
Over the past decade, the FTC has brought 14 Internet-related cases challenging conduct that caused harms similar to those associated with spyware. The Commission, for example, has challenged: (1) hijacking computer modems for use in placing unauthorized telephone calls; (2) hijacking web pages or “copy catting” website domain names to trap consumers and subject them to a barrage of pop-up ads; and (3) using information obtained from consumers who purchased an anti-spam product to send them spam.
Drawing on its experience in challenging unfair or deceptive acts and practices on the Internet, the Commission recently sued an alleged spyware distributor. The FTC filed a complaint in federal district court alleging that Seismic Entertainment Productions, Inc., SmartBot.Net, Inc., and Sanford Wallace engaged in unfair acts and practices in violation of Section 5 of the FTC Act. The defendants allegedly operated numerous websites and used a variety of tactics, including pop-up ads, to get consumers to visit these websites. Defendants then allegedly exploited a known vulnerability in the Internet Explorer web browser to download spyware to users’ computers without the users’ knowledge or authorization.
According to the complaint, the spyware caused many different harms. Allegedly, it:
- modified the features of consumers’ web browsers and hijacked their Internet searches;
- caused consumers to receive an incessant stream of pop-up ads;
- secretly installed a number of additional software programs, including programs that
could monitor users’ Internet activity and capture information they entered into online
- caused computers to malfunction, slow down, or even crash.
Furthermore, the complaint alleges that after the defendants had infected consumers’ computers with spyware, they began to aggressively advertise to these same consumers purported “anti-spyware” programs called “Spy Deleter” or “Spy Wiper.” The ads claimed that consumers must purchase these products to remove spyware from their computers. The defendants allegedly received a sizeable commission from the anti-spyware vendors based on the number of sales attributable to the ads displayed by the defendants. On October 21, 2004, the court granted a temporary injunction against the defendants. The defendants subsequently stipulated to a preliminary injunction.
Criminal Law Enforcement
In addition to the FTC’s ability to bring Section 5 cases like Seismic Entertainment, the Department of Justice (DOJ) has statutory authority to prosecute distributors of software products, such as spyware, in cases where consumers’ privacy or security is compromised. The Computer Fraud and Abuse Act of 1984, for example, prohibits the unauthorized acquisition of data from a protected computer that results in damage.
The DOJ also has authority, under a variety of statutes that regulate communications, to pursue actions against entities that acquire information fraudulently, such as through the use of a keylogger program. For example, the DOJ recently indicted an individual who installed a keylogger on a computer at his place of employment, and also prosecuted a defendant who had installed a keylogger on several public computers located in a Kinko’s store.
As explained above, federal officials believe that they have adequate authority under their existing criminal and civil statutes to take law enforcement action against those who disseminate spyware. Spyware is a serious and growing problem, and it has the potential to cause substantial harm to consumers and businesses. Notwithstanding the challenges posed by investigating acts and practices related to spyware, FTC staff believes that law enforcement officials should increase criminal and civil prosecution under existing laws of those who distribute spyware.
- FTC, Monitoring Software on Your PC: Spyware, Adware and other Software, pp 20-21 (March 2005)
- Counter Spy Act of 2007, S 1625
- FTC Testifies on Spyware, FTC 6/13/2008
- Commerce Committee Announces Witnesses for Spyware Hearing, Senate 6/10/2008
- Commerce Committee to Examine Impact of Spyware on Consumers and Businesses, US Senate 6/6/2008
- FTC assassinates Spyware Assassin - censures spokane based company, Broadband Reports 3/14/2006
- FTC Shuts Down Spyware Operation, FTC 11/15/2005
- FTC Testifies on Spyware, FTC 10/7/2005
- FTC Seeks to Halt Illegal Spyware Operation, FTC 10/5/2005
- FTC Spyware Workshop
- FTC To Host Spyware Workshop, FTC 2/18/2004
- Federal Register Notice
- FTC, Monitoring Software on Your PC: Spyware, Adware and other Software (March 2005)
- Spyware: What You Don't Know Can Hurt You, House Subcommittee on Commerce, Trade, and Consumer Protection April 29, 2004
© Cybertelecom ::
Liability of AntiSpyware, Antimalware Providers
- See protection under Good Samaritan Provisions of the Communications Decency Act.
- Daniel B. Garrie, et. al, The Legal Status of Spyware, 59 FED. COMM. L.J. 157 (2006)
- Spyware, Pew 7/8/2005
- OnGuard Spyware
- FTC Consumer Alert Spyware 2004
- Spyware [TXT] [PDF]
- US CERT Recognizing and Avoiding Spyware
- CDTs Ghosts in Our Machines: Background and Policy Proposals on the Spyware Problem,
- 2004 April FTC Forum: Monitoring Software on Your PC: Spyware, Adware, and Other Software
- 2000 "Gibson Research launched the first anti-spyware product, OptOut." - FTC Spyware Report
- 1999 "“Spyware” first began to be used in the computer software context in 1999 when Zone Labs used it in a press release for its Zone Alarm firewall product." - FTC Spyware Report
- Center for Democracy and Technology
- CDT Campaign Against Spyware
- Consumers Union
- Internet Privacy Conservation Council
- In re Bonzi Software, Inc., FTC Dkt. No. C- 4126 (Oct. 6, 2004);
- FTC v. BTV Industries, Inc., Civ. Act. No. CV-S-02-0437-LRH-PAL (D. Nev. Feb. 11, 2004);
- FTC v. Baith, Civ. Act. No. CV S-03-1306-LRH-RJJ (D. Nev. Feb. 11, 2004);
- FTC v. D-Squared Solutions, LLC, Civ. Act. No. AMD 03-CV310 (D. Md. Nov. 6, 2003);
- FTC v. Alyon Technologies, Inc., Civ. Act. No. 1: 03-CV-1297 (N.D. Ga. May 15, 2003)
- FTC v. Verity Int’l Ltd., Civ. Act. No. 00-Civ. 7422 (LAK) (S.D.N.Y. Nov. 21, 2002);
- FTC v. NetSource One, Civ. Act. No. 022-3077 (W.D. Ky. Nov. 2, 2002);
- FTC v. John Zuccarini, Civ. Act. No. 01-CV-4854 (E.D. Pa. May 24, 2002);
- FTC v. RJB Telecom, Inc., Civ. Act. No. 00201-7 (Phx) (D. Az. Sept. 26, 2001);
- FTC v. Hillary Sheinkin, Civ. Act. No. 2-00-3636-18 (D.S.C. Aug. 29, 2001);
- FTC v. Ty Anderson, Civ. Act. No. C00-1843P (W.D. Wash. Aug. 29, 2001);
- FTC v. Carlos Pereira d/b/a atariz.com, Civ. Act. No. 99-1367-A (N.D. Va. Feb. 12, 2001)
- FTC v. Audiotext Communications, Civ. Act. No. Cv-97 0726 (DRH) (E.D.N.Y. Nov. 4, 1997);
- In re Beylen Telecom, Ltd., 125 F.T.C. 276 (1998).
- FTC forces Sears, Kmart out of the spyware business, Ars Technica 9/15/2009
- FTC Takes Aim at "Stalker Spyware" Company, CDT 11/18/2008
- Court Orders Halt to Sale of Spyware, ftc 11/18/2008
- New U.S. 'antispyware' bill invites fight with Net firms, CNET 6/15/2007
- House Passes I-SPY Act, Technology & Marketing Law Blog 6/1/2007
- US House Moves to Squelch Spyware, Ecommerce Times 5/25/2007
- Court puts halt to alleged spyware distributor, CNET 11/14/2006
- U.S. warns about Canadian spy coins, USA Today 1/12/2007
- Spitzer Sues 'Spyware' Co. Over Pop-Up Ads, Wash Post 4/5/2006
- U.S. Senate Goes After Spyware, Information Week 11/18/2005
- FTC Pulls Plug On $100 Million Adware Business, InternetWeek 11/15/2005
- Users want ISPs to filter spyware, Register 10/11/2005
- P: Susan Crawford, First do no Harm: The Problem of Spyware, SSRN 10/11/2005
- Feds Point Finger at US Spyware Operation, ECT 10/7/2005
- Spyware Plagues Online Ad Networks, Internet Week 9/20/2005
- Anti-Spyware Coalition Proposes Standardized Definitions, ITU 7/26/2005
- Spyware Floods In Through BitTorrent, eweek 6/15/2005
- Group revives effort to define spyware, CNET 6/3/2005
- Spyware bills pass House, ACM 5/27/2005
- House votes to outlaw computer spyware, CW 5/21/2005
- House approves spyware bill--again, CNET 5/21/2005
- CDT Lays Out Affiliate Schemes Behind Spyware, CDT 5/13/2005
- N.Y. attorney general takes aim at an Internet menace, Baltimore Sun 4/29/2005
- State Sues Major "SPYWARE" Distributor, NY 4/29/2005
- Congress Moving to Tackle Spyware Problem, Wash Post 4/15/2005
- FTC Adds Spy Wiper to Seismic Spyware Case, CDT 4/11/2005
- FTC Bars Bogus Anti-Spyware Claims, FTC 3/15/2005
- FTC Assassinates Spyware Spoofer, Ecom times 3/15/2005
- FTC Releases Staff Report on Spyware Workshop, FTC 3/9/2005
- House panel approves spyware bill, CNET 2/18/2005
- Spy software watches you work, BBC 5/4/2004
- FTC officials blast spyware measures, CNET 4/30/2004
- House probes spyware, CNN 4/30/2004
- Lawmakers Promise Spyware Bill, Reuters 4/30/2004
- Spyware Poses Risk to Consumers - FTC, FTC 4/30/2004
- Sharon Wienbar, The Spyware Inferno, CNET (Aug. 13, 2004).
- New bill aims to shine light on spyware, CNN 3/4/2004
- PCs 'infested' with spy programs, BBC 4/16/2004
- FTC to shine light on spyware, CNET 4/16/2004
- PCs Infested with 30 Pieces of Spyware, Newsfactor 4/16/2004
- The Spies in Your Computer, New York Times Editorial, February 18, 2004
- John Borland, Spyware and its discontents, CNET.com, February 12, 2004
- John Borland, Stealth P2P network hides inside Kazaa, CNet News.com, April 1, 2002
- From spam king to spymaster?, CNET 10/12/2004
- FTC Cracks down On Spyware Operation, FTC 10/12/2004
- FTC Files First Spyware Case, WSJ 10/8/2004
- House Passes Second Anti-Spyware Bill, Newsfactor 10/8/2004
- Spyware opponents win another battle, CNET 10/26/2004