 |
 |
From: [log in to unmask] [mailto:[log in to unmask]] On Behalf Of CDT Info Sent: 28 January 2005 14:36 To: [log in to unmask] Subject: Policy Post 11.03: CDT Renews Call For Privacy Legislation At First Commerce Committee Hearing CDT POLICY POST Volume 11, Number 3, January 28, 2005 A Briefing On Public Policy Issues Affecting Civil Liberties Online from The Center For Democracy and Technology (1) CDT Renews Call For Privacy Legislation At First Commerce Committee Hearing (2) Spyware Epidemic Continues to Grow Despite Initial Enforcement Success (3) CDT Testimony Emphasizes Harms of Affiliate Networks --------------------------------------- (1) CDT Renews Call For Privacy Legislation At First Commerce Committee Hearing Testifying on January 26 at the year's first hearing of the House Commerce Committee, CDT warned that the continually growing spread of spyware represents a major threat to Internet users, as well as to the long-term health of the Internet. CDT highlighted three areas where action is necessary to stem this disturbing trend toward a loss of control for Internet users: * enforcement of existing law; * better consumer education, industry self-regulation, and anti-spyware technologies; * baseline Internet privacy legislation. The Commerce Committee hearing was held to consider H.R. 29, "The SPY ACT." The bill is sponsored by Representatives Bono and Towns, and is identical to H.R. 2929, which passed the House overwhelmingly last year, but failed to gain support from the Senate. Committee Chairman Barton said at Tuesday's hearing that he aims to put the legislation on a "fast track" this year. CDT strongly supports provisions in H.R. 29 to raise penalties on the worst types of deceptive software practices online. However, CDT continues to believe that notice and consent issues are best addressed in a technology neutral matter as part of general online privacy legislation. CDT also used its testimony to highlight the central problem of affiliate networking, which creates a marketplace in which legitimate companies unwittingly support illegal activities through a maze of distributors and affiliates. * Testimony of Ari Schwartz before the House Committee on Energy and Commerce on "Combating Spyware: H.R. 29, the SPY ACT" -- http://www.cdt.org/testimony/20050126schwartz.pdf * HR 29, the SPY ACT -- http://thomas.loc.gov/cgi-bin/bdquery/z?d109:hr29: * CDT's Spyware Page -- http://www.cdt.org/privacy/spyware/ __________________________________________________ (2) Spyware Epidemic Continues to Grow Despite Initial Enforcement Success A recent survey of IT managers found that almost two-thirds rated spyware as the number one cybersecurity threat in the coming year. While it is difficult to obtain precise data on the prevalence of the spyware problem, the best study done to date, conducted by AOL and the National CyberSecurity Alliance, found that 80% of broadband and dial-up users had adware or spyware programs running on their computers. Based on the complaints CDT has received through our "Campaign Against Spyware," we believe that the prevalence of spyware violations, especially egregious and clearly unlawful behaviors, has increased dramatically. Of particular concern is the use of security holes in web browsers to silently force software onto users' computers. In October, the FTC brought its first enforcement action against Sanford Wallace and Seismic Entertainment on the basis of a complaint filed earlier by CDT. The case has resulted in an injunction requiring that Wallace and his companies cease exploiting security vulnerabilities to force software onto Internet users' computers. The order also gives the FTC access to company business records. CDT believes that further FTC investigation in the Seismic case will provide ample basis for the Commission to pursue Seismic affiliates that were also acting deceptively, and we expect that the Commission will announce further actions as other bad actors come to light. In order to have a genuine impact on the spyware problem, both the FTC and other national and state level law enforcement agencies will have to actively pursue additional cases. While the FTC's first spyware case was an important milestone, both the number and frequency of cases must be dramatically increased if law enforcement is to provide a significant deterrent to purveyors of spyware. The continued, dramatic growth of the spyware problem demonstrates that law enforcement is still losing the battle against egregious spyware purveyors clearly guilty of violating the law. * CDT's Campaign Against Spyware -- http://www.cdt.org/action/spyware * Preliminary Injunction Order in FTC v. Seismic -- http://www.cdt.org/privacy/spyware/20041220seismicorder.pdf _________________________________________________________ (3) CDT Testimony Emphasizes Harms of Affiliate Networks In CDT's complaint to the FTC regarding Seismic Entertainment and MailWiper, we highlighted the problem of affiliate relationship being "exploited by companies to deflect responsibility and avoid accountability." CDT used this week's hearing to draw attention to this issue, which is at the heart of the spyware problem. Adware companies have a superficially simple business model: Consumers agree to download a piece of adware in exchange for access to a piece of free software that the adware company has a bundling agreement with. In fact, many adware companies and other software bundlers operate through complex networks of affiliate arrangements involving adware makers, software providers, websites, advertisers, and advertising brokers. The consequence of these affiliate arrangements is that when an adware program ends up on a user's computer, the adware program is often many steps removed from the maker of the software itself. This complex network of intermediaries exacerbates the spyware problem in several ways: * Industry Responsibility: Adware companies, advertising brokers, and others all may disclaim responsibility for attacks on users' computers, while encouraging these behaviors through their affiliate schemes and doing little to police the networks of affiliates acting on their behalf. Advertisers should be pushed to take greater responsibility for the companies they advertise with. * Enforcement: Complex webs of affiliate relationships obstruct law enforcement efforts to track back parties responsible for attacks. The complexity of these cases puts an extreme strain on enforcement agencies, which struggle to tackle the problem with limited resources. * Consumer Notice: Adware companies and their affiliates have been reluctant to clearly disclose their relationships in a way that is transparent to consumers. CDT's testimony illustrated specific ways in which adware companies could improve transparency in bundling and ad-support arrangements. Companies have resisted these changes. Efforts to bring transparency to the full chain of affiliate and distribution arrangements have met with even greater opposition. For these reasons, the affiliate issue has become a central aspect of the spyware epidemic. Finding ways to effectively reform affiliate relationships will make it easier to hold accountable the purveyors of spyware. --------------------------------------- Detailed information about online civil liberties issues may be found at http://www.cdt.org/ . This document may be redistributed freely in full or linked to http://www.cdt.org/publications/pp_11.03.shtml . Excerpts may be re-posted with prior permission of [log in to unmask] Policy Post 11.03 Copyright 2005 Center for Democracy and Technology _______________________________________________ http://www.cdt.org/mailman/listinfo/policy-posts -- This message has been scanned for viruses and dangerous content by the NorMAN MailScanner Service and is believed to be clean. The NorMAN MailScanner Service is operated by Information Systems and Services, University of Newcastle upon Tyne. ==== This e-mail is intended solely for the addressee. It may contain private and confidential information. If you are not the intended addressee, please take no action based on it nor show a copy to anyone. Please reply to this e-mail to highlight the error. You should also be aware that all electronic mail from, to, or within Northumbria University may be the subject of a request under the Freedom of Information Act 2000 and related legislation, and therefore may be required to be disclosed to third parties. This e-mail and attachments have been scanned for viruses prior to leaving Northumbria University. Northumbria University will not be liable for any losses as a result of any viruses being passed on. ************************************************************************************ Distributed through Cyber-Society-Live [CSL]: CSL is a moderated discussion list made up of people who are interested in the interdisciplinary academic study of Cyber Society in all its manifestations.To join the list please visit: http://www.jiscmail.ac.uk/lists/cyber-society-live.html *************************************************************************************