Title: An act relating to computer spyware.

Brief Description: Regulating computer spyware.

Sponsors: By House Committee on Technology, Energy & Communications (originally sponsored by Representatives Morris, Hudgins, Simpson, Nixon, Anderson, Morrell, Linville, B. Sullivan and Ormsby).

Brief History:

Technology, Energy & Communications: 1/11/05, 2/17/05 [DPS].

Floor Activity:

Passed House: EnterDate, EnterVote.

HOUSE COMMITTEE ON TECHNOLOGY, ENERGY & COMMUNICATIONS

Majority Report: The substitute bill be substituted therefor and the substitute bill do pass. Signed by 11 members: Representatives Morris, Chair; Kilmer, Vice Chair; Crouse, Ranking Minority Member; Haler, Assistant Ranking Minority Member; Ericks, Hudgins, Nixon, P. Sullivan, Sump, Takko and Wallace.

Staff: Kara Durbin (786-7133).

Background:

Spyware:
The term "spyware" generally describes any software that is placed on a user's computer to monitor, collect, and transmit personally identifiable information without the user's knowledge or consent. It is also sometimes referred to as "adware."

Spyware programs can be difficult to identify and remove, and can cause problems ranging from advertisements to computer viruses to identity theft. Frequently, spyware is hidden within a larger software package that the consumer purposely installs (such as a media player or game), but spyware can also be installed by visiting a web site.

Existing law does not regulate computer spyware.

Consumer Protection Act:
The Washington Consumer Protection Act (Act) declares that unfair and deceptive practices in trade or commerce that harm the public interest are illegal. The Act gives the Office of the Attorney General the authority to bring lawsuits against businesses, and to ask the court for injunctions and restitution for consumers. It also allows individuals to hire their own attorneys to bring consumer protection lawsuits. If the consumer wins in court, the law allows the court to award triple damages, up to $10,000, as well as attorney's fees.

Summary of Engrossed Substitute Bill:

The unauthorized installation of software programs, collectively known as "spyware," is prohibited. This prohibition would prevent a wide range of malicious online action, including the collection of personal information through various means.

Specifically, a number of different types of spyware activities are prohibited. These include:

• collecting personally identifiable information through keystroke logging;
• collecting web browsing histories;
• taking control of a user's computer to send unauthorized emails or viruses;
• creating bogus financial charges;
• orchestrating group attacks on other computers;
• opening aggressive pop-up advertisements;
• modifying security settings; and
• generally interfering with a user's ability to identify or remove the spyware.

These prohibitions do not apply to any monitoring of a subscriber's internet service by a telecommunications carrier, cable operator, computer hardware or software provider, or provider of information service for network or computer security purposes.

The Attorney General, a provider of computer software, or an owner of a web site or trademark may bring a civil action to enjoin further violations and recover either actual damages, or $100,000 per violation, whichever is greater. The maximum allowable damage award is $2 million. In addition, a court may increase the damage award up to three times if the defendant has engaged in a pattern and practice of engaging in the prohibited activities. The court may also award costs and reasonable attorneys' fees to the prevailing party.

This Act does not expand, contract, alter or amend any cause of action allowed under the Consumer Protection Act and does not affect in any way the application of the Consumer Protection Act to any future case or fact pattern.

There is a severability clause.

Appropriation: None.

Fiscal Note: Available.

Effective Date: The bill takes effect 90 days after adjournment of session in which bill is passed.

Testimony For: (With amendments) This bill is needed. Washington is the best place to address this emerging problem. This bill focuses on bad conduct, not on technology. This legislation needs to exclude certain types of security activities in order for software companies and e-commerce to continue to maintain its security practices. The Universal License Agreement language in the bill needs to be removed. This bill raises concerns over liability for transmission by innocent intermediaries. The enforcement provision needs to be revised so that it allows individual companies to bring actions to limit spyware activity in our state.

As drafted, this bill has a high intent standard, which would be difficult to prove in an action brought under the Act. Other parts of the Act have a lower intent standard of merely proving deceptive intent.

(Neutral) The definitions and some of the other language in this bill need to be revised. This bill focuses on bad conduct, not on technology, which is appropriate.

Testimony Against: None.

Persons Testifying: (In support with amendments) Representative Morris, prime sponsor; Scott Hazlegrove, Microsoft and Ebay; and Steve Larsen, Office of the Attorney General, Consumer Protection Division.

(Neutral) Nancy Atwood, AeA.

Persons Signed In To Testify But Not Testifying: None.