Statements on Introduced Bills and Joint Resolutions

STATEMENTS ON INTRODUCED BILLS AND JOINT RESOLUTIONS

S. 2131. A bill to regulate the unauthorized installation of computer software, to require clear disclosure to computer users of certain computer software features that may pose a threat to user privacy, and for other purposes; to the Committee on Commerce, Science, and Transportation.

Mr. WYDEN. Mr. President, my good friend Senator Burns and I have pioneered a number of legislative efforts aimed at protecting ordinary computer users from the tricks and schemes of those who would abuse the open and interconnected nature of the Internet. From online privacy to spam, we have sought to establish some basic, commonsense rules to address sleazy, intrusive, and anti-consumer practices that have arisen in the new world of the Internet. In each case, our goal has not been to stifle or restrict legitimate and innovative modes of e-commerce, but rather to promote them by reining in unfair and annoying behavior that undermines consumer confidence and use of the Internet.

Today, we continue on that path by introducing the "SPY BLOCK" Act, together with our colleague Senator Boxer.

This legislation will put the brakes on the growing problem of software being installed secretly on people's computers, for purposes they might object to if given the chance. Sometimes, the problem is a "drive-by download," where the consumer's mere visit to a website or decision to click on an advertisement secretly triggers the downloading of software onto the consumer's machine. Or, it can be a "double whammy download," where the consumer's voluntary download of one software program also triggers the inadvertent download of a second software program which, although it may serve a very different purpose, has been bundled together with the first one.

Once installed, the unwanted software operates in the background, performing functions that ordinary computer users cannot detect. As a result, the computer user may never even know the software is there, let alone what it is doing. And to add insult to injury, software that spreads in this fashion often is designed to be nearly impossible to uninstall.

What might such software do, once it is installed? The legislation we are introducing today identifies several possible functions that pose concerns. First, some software, often referred to as "spyware," collects information about the computer user and transmits that information over the Internet to the spyware's author. Second, software sometimes referred to as "adware" causes pop-up ads to appear on the user's computer, perhaps based on the user's apparent interests or on the websites he or she visits. Third, some software essentially hijacks the computer's processing and communications capability to forward spam, viruses, or other messages, all without the user's knowledge. Finally, some software changes user settings-for example, overriding the user's intended choice of homepage.

If a computer user truly understands what the software is going to do and knowingly consents to it, that's fine. The issue really comes down to user knowledge and control. Too often, software like this allows a third party to wrest control of some of the computer's functions and commandeer them for the third party's own purposes. The software is essentially a parasite-it attaches itself without consent to the host computer and taps into the host's resources, making use of them for its own selfish purposes. Our bill would make such unauthorized practices clearly unlawful.

How common is all this? There is little hard data, but one report last year estimated that 20 million people have downloaded software that serves them targeted advertising. I have to suspect that many of these downloads did not involve informed consent. It has also been widely reported that many of the most popular peer-to-peer file sharing software programs come packaged with other software that is not clearly disclosed to the user. So the number of affected users is likely very high.

The bill we are introducing today would, for the first time, establish a clear legal principle that you cannot cause software to be installed on somebody else's computer without that person's knowledge and consent. This general notice and consent requirement could be satisfied by something as simple as an on-screen dialogue box telling the user that clicking "ok" will trigger the download of, say, a particular game program. In addition, the bill says that software must be capable of being uninstalled without resorting to extraordinary and highly technical procedures.

Beyond these general requirements, the legislation calls for certain types of software features-those performing the four functions I discussed a moment ago-to be specifically and separately brought to the user's attention prior to installation. For example, if a software program has a spyware feature designed to collect and transmit information about the user, the user would need to be provided with sufficient notice based on criteria set forth in the bill. That notice would need to explain the types of information that would be collected and the purposes for which the information would be used. Following this notice, the user would have the option of granting or withholding consent. In the absence of such notice and consent, it would be unlawful to download the software onto the user's computer, or subsequently to use the software to gather information about that user.

The bill contains some exceptions, for example, for pre-installed software and software features that are necessary to make basic features like e-mail or Internet browsing function properly. Enforcement under the bill would be by the Federal Trade Commission and state Attorneys General.

I recognize that the bill we introduce today may benefit from further attention and input on the particular wording of the definitions, on the types of software or software features that should be listed in the exceptions, and so forth. Senator Burns, Senator Boxer, and I are open to further discussion about fine tuning the scope of the bill, so that we don't create a regime that ends up being impractical or imposing undue burdens on legitimate and useful software. This is the starting point, not the end point.

It is important, however, to get this process moving. I believe it's time to send a clear message that unauthorized and privacy-compromising spyware, adware, and other software are unlawful and punishable. I urge my colleagues to join Senators Burns, Boxer, and myself in supporting this bill.