FTC Targets Spyware
Posted by Ronald London
The Federal Trade Commission has reported to Congress that spyware and other "malware" downloaded to consumers' computers without their consent is a serious and growing problem that harms consumers and the Internet, in testimony that coincided with new enforcement action the agency brought alleging a company distributed file-sharing programs that included spyware. In testimony before the Senate Commerce Committee's Subcommittee on Trade, Tourism, and Economic Development, FTC Chair Deborah Majoras stated that spyware causes problems that range from sluggish computer performance to lost personal data, and that the FTC has active programs targeting spyware concerns, including law enforcement initiatives. The testimony comes as Congress has before it several bills that would regulate spyware at the federal level.
The FTC testimony supported a variety of legislative measures to tackle spyware. For example, it claimed that authority to seek civil penalties against spyware distributors may be useful in deterring its dissemination. It also advocated passage of the U.S. SAFE WEB Act (S.1608) to aid the FTC's ability to pursue spyware distributors by making it easier to share information and cooperate with foreign law enforcers. The testimony echoed an FTC staff report issued this past March which recommended that, notwithstanding significant challenges in defining "spyware," the government should use existing laws to increase criminal and civil prosecution of spyware distributors, and bolster efforts to educate consumers about the risks that spyware poses.
The FTC reported that, given the prevalence of spyware and the consumer harm that arises from it, the agency has made spyware an enforcement priority. The FTC's strategy focuses on three key areas in each case - whether consumers were aware of the installation of the software in question on their computers, what harm the installation caused, and how difficult was it for consumers to uninstall the software. In this regard, the FTC has alleged that purveyors of free software have an obligation to disclose that downloading their programs causes spyware and/or adware to be installed on the users' computer.
These principles were evident in the FTC v. Odysseus Marketing, Inc., case that the FTC filed in a New Hampshire federal court contemporaneously with Chairwoman Majoras's testimony. The case alleges that the defendants not only deceptively claimed their free software would make illegal peer-to-peer file-sharing anonymous, they also did not disclose that the program automatically installed other software on users' computers. This included spyware called Clientman, which downloads dozens of other software programs that degrade computer performance and memory by, among things, replacing or reformatting search engine results. With Clientman, the FTC alleged, consumers who received the spyware and attempted to conduct a Google or Yahoo! Search would receive results that appear to be from Google or Yahoo!, but in reality are copy-cat site where the order of the results is rigged to place the defendants' clients first. The FTC alleged that the software also generates pop-up ads and captures and transmits information from consumers. In addition, the FTC alleged that the defendants deliberately made the software difficult to detect and impossible to remove using standard software utilities, and in fact the "uninstall" tool that comes with the program does not work but rather installs more software.
In other enforcement actions, the FTC has leveled allegations regarding "drive-by" downloads to install their spyware in violation of the FTC Act, the bundling of adware with free security software that secretly collected information on consumers and pelted them with pop-ups, and the offering of spyware removal programs under false claims about the presence of spyware on consumers' computers. The FTC stated that it will work in conjunction with federal and state authorities to continue aggressive enforcement and innovative consumer education on spyware.