Congress targets computer spyware
Published 4:00 am Monday, March 1, 2004
WASHINGTON – Mike Brown’s computer was acting funny. Simple applications took longer to run, pop-up advertisements flooded his screen every time he clicked on a new Web page and his homepage often changed to unfamiliar sites.
Then one day Brown, owner of Lifetime Memory Albums, a personalized photo album store in Bend, tried to open a program instrumental to his business, and the computer froze.
”I tried for hours and hours to fix it, but I couldn’t,” Brown said.
”Eventually, I had to pay a computer repair specialist to fix it.
”It shut us down for about a week and a half. Luckily we weren’t too busy.”
Turns out Brown was the victim of a malicious technology called spyware, a form of hidden downloads.
On Thursday Congress targeted spyware in a proposed bill that would make installation of such programs more evident.
Spyware is software secretly installed onto a computer that aids in gathering information about a person or organization without their knowledge.
The software then relays that information to advertisers or other interested parties.
Spyware is most commonly obtained through an e-mail virus or as a surreptitious add-on to a newly installed program, such as the so-called Trojan Horse software that comes bundled with some software used to access file sharing services. It is often difficult if not impossible to remove these programs.
Some of the most invasive spyware programs may record passwords, steal credit card numbers or simply provide a conduit for annoying pop up advertisements.
The new legislation, dubbed the SPYBLOCK Act, would target three aspects of spyware. It would impose new rules that would require companies to obtain consent from users before installing data monitoring programs; require easy removal directions and options; and prohibit software intended primarily to cause harm.
Sen. Ron Wyden, D-Ore., fresh off a campaign to eradicate spam e-mail, is one of the bill’s sponsors.
”The Internet is a window on the world, but spyware allows virtual peeping Toms to watch where you go and what you do,” said Wyden. ”Computer users should have the security of knowing their privacy isn’t being violated by software parasites that have secretly burrowed into their hard drive.”
Brown knows the problem firsthand. The computer expert who fixed his machine found 2,000 programs that Brown did not even know had been installed.
But, as Brown discovered, in addition to the privacy concerns, spyware has some serious financial ramifications as well. Brown says the whole thing cost him between $300 and $400.
Kelly Preuitt, who runs Computer Help by Kelly and worked on Brown’s machine, said that spyware removal has become a major part of his business recently. Preuitt charges $60 an hour and said that cleaning up a spyware-infected computer can take as long as four hours, depending on the extent of the problem. Preuitt said that he services at least two computers a week that have been overwhelmed by spyware, and that about 50 percent of those machines had to be completely reformatted. That means that unless users had backed up their files all of their data is lost.
”Most of this technology, once the spyware is on the machine it can’t be removed,” Preuitt said. ”They have safeguards that protect the file from being deleted or removed.”
Preuitt said that spyware can also slow down a user’s Internet connection by clogging it with all the information it is sending to its parent company. Users with dial-up Internet connections will be most affected, Preuitt said.
While many in the industry agree that Congressional action is the only thing that can combat the technology, some experts question the ability of any legislation to tackle the most destructive applications.
Robert Bagnall, an intelligence director at iDefense, a cyber security firm, said that spyware will be impossible to combat in the United States until cyber law enforcement authorities develop better relationships with other countries.
”The only companies (the SPYBLOCK bill) is going to affect are the legitimate spyware distributors and those who can be reached out and touched by U.S. law enforcement,” Bagnall said. ”When you get to Eastern Europe and Asia, law is not going to have many teeth.”
Chris Hoofnagle, associate director of the Electronic Privacy Information Center, a research center focused on electronic privacy issues, says that the bill’s greatest weakness is that by leaving enforcement up to the Federal Trade Commission and state attorneys general it does not empower the individual to take action against spyware distributors.
Hoofnagle also said that another complication the bill will face as it goes through the Senate is coming up with an agreeable definition of spyware. Expect to see that definition evolve as special interests, such as data collection agencies, start getting involved, Hoofnagle said.
In the meantime, users can fight spyware by downloading free software like Spybot Search and Destroy and X-Cleaner. Such programs include features that scan a computer for all parasite software, remove that software and then immunize against it getting installed again.