Title: An act relating to computer spyware.

Brief Description: Regulating computer spyware.

Sponsors: Representative Morris.

Brief History:

Technology, Energy & Communications: 1/11/05, 2/17/05 [DPS].

HOUSE COMMITTEE ON TECHNOLOGY, ENERGY & COMMUNICATIONS

Majority Report: The substitute bill be substituted therefor and the substitute bill do pass. Signed by 11 members: Representatives Morris, Chair; Kilmer, Vice Chair; Crouse, Ranking Minority Member; Haler, Assistant Ranking Minority Member; Ericks, Hudgins, Nixon, P. Sullivan, Sump, Takko and Wallace.

Staff: Kara Durbin (786-7133).

Background:

Spyware:
The term "spyware" generally describes any software that is placed on a user's computer to monitor, collect, and transmit personally identifiable information without the user's knowledge or consent. It is also sometimes referred to as "adware."

Spyware programs can be difficult to identify and remove, and can cause problems ranging from advertisements to computer viruses to identity theft. Frequently, spyware is hidden within a larger software package that the consumer purposely installs (such as a media player or game), but spyware can also be installed by visiting a web site.

Existing law does not regulate computer spyware.

Consumer Protection Act:
The Washington Consumer Protection Act (Act) declares that unfair and deceptive practices in trade or commerce that harm the public interest are illegal. The Act gives the Office of the Attorney General the authority to bring lawsuits against businesses, and to ask the court for injunctions and restitution for consumers. It also allows individuals to hire their own attorneys to bring consumer protection lawsuits. If the consumer wins in court, the law allows the court to award triple damages, up to $10,000, as well as attorney's fees.

Summary of Substitute Bill:

The unauthorized installation of software programs, collectively known as "spyware," is prohibited. This prohibition would prevent a wide range of malicious online action, including the collection of personal information through various means.

Specifically, a number of different types of spyware activities are prohibited. These include:

• collecting personally identifiable information through keystroke logging;
• collecting web browsing histories;
• taking control of a user's computer to send unauthorized emails or viruses;
• creating bogus financial charges;
• orchestrating group attacks on other computers;
• opening aggressive pop-up advertisements;
• modifying security settings; and
• generally interfering with a user's ability to identify or remove the spyware.

These prohibitions do not apply to any monitoring of a subscriber's internet service by a telecommunications carrier, cable operator, computer hardware or software provider, or provider of information service for network or computer security purposes.

An injured person may bring a civil action in superior court to enjoin further violations, or to seek up to $1,000 per violation, or actual damages, whichever is greater. Individuals may not bring their cause of action as a class action. In addition, a court may increase the damage award up to three times if the defendant has engaged in a pattern and practice of engaging in the prohibited activities. The court may also award costs and reasonable attorneys' fees to the prevailing party.

This Act does not expand, contract, alter or amend any cause of action allowed under the Consumer Protection Act and does not affect in any way the application of the Consumer Protection Act to any future case or fact pattern.

There is a severability clause.

Substitute Bill Compared to Original Bill:

The definition of "authorized user" is removed and replaced with the definition of "owner or operator." A private right of action is added, which allows an injured individual to bring a civil action to enjoin further violations or seek damages of up to $1,000. Individuals are prohibited from bringing an action as a class action. A savings clause is added, which states that these prohibitions do not expand, contract, alter, or amend any cause of action allowed under the Act.

Appropriation: None.

Fiscal Note: Available.

Effective Date of Substitute Bill: The bill takes effect 90 days after adjournment of session in which bill is passed.

Testimony For: (With amendments) This bill is needed. Washington is the best place to address this emerging problem. This bill focuses on bad conduct, not on technology. This legislation needs to exclude certain types of security activities in order for software companies and e-commerce to continue to maintain its security practices. The Universal License Agreement language in the bill needs to be removed. This bill raises concerns over liability for transmission by innocent intermediaries. The enforcement provision needs to be revised so that it allows individual companies to bring actions to limit spyware activity in our state.

As drafted, this bill has a high intent standard, which would be difficult to prove in an action brought under the Act. Other parts of the Act have a lower intent standard of merely proving deceptive intent.

(Neutral) The definitions and some of the other language in this bill need to be revised. This bill focuses on bad conduct, not on technology, which is appropriate.

Testimony Against: None.

Persons Testifying: (In support with amendments) Representative Morris, prime sponsor; Scott Hazlegrove, Microsoft and Ebay; and Steve Larsen, Office of the Attorney General, Consumer Protection Division.

(Neutral) Nancy Atwood, AeA.

Persons Signed In To Testify But Not Testifying: None.