Spyware in sights of CIPPIC, industry players researching legal reform

The Canadian Internet Policy and Public Interest Clinic (CIPPIC) and its international partners in the Anti-Spyware Coalition (ASC) have issued new definitions for the scourge of spyware as a first step to building a legal framework to fight it. Spyware, surreptitious applications that can either bombard Internet users with unwanted advertising or scour hard drives for personal banking and sensitive data, is estimated to have affected the behaviour of 90% of Internet users, ultimately putting the future of ecommerce at risk. Even today, the cost of dealing with spyware is likely millions of dollars a year as residential and corporate users spend time and money to wipe the offending programs from their systems. CIPPIC says legal reform might be one solution to the problem, but that further research is needed into whether current laws are adequate to address spyware challenges, or whether new laws might be drafted. A key problem in surveying the legal landscape for solutions, however, is that until now the definition of what constitutes spyware has been loose. Further, many applications that might fall under the broad rubric of spyware are actually legitimate programs in which users give up some privacy or agree to receive advertising in return for helpful software tools. David Fewer, counsel for CIPPIC in Ottawa, says the key to recognizing inappropriate – or even fraudulent – spyware is that it usually deprives users of control with no or inadequate notice of its installation or solicitation of consent. That description has been formalized by the ASC into a definition of spyware that reads: Technologies implemented in ways that impair users’ control over: material changes that affect their user experience, privacy or system security; use of their system resources including what programs are installed on their computers; collection, use, and distribution of their personal or otherwise sensitive information. These are items that users will want to be informed about, and which the users, with appropriate authority from the owner of the system, should be able to easily remove or disable. The definition was agreed to by the ASC, which is soliciting comments on it and a background paper on the subject until August 12. The ASC is a broad group composed of public interest groups such as CIPPIC, as well as heavyweight technology and communications companies (see sidebar). With a definition in hand, the coalition can now begin to discuss the issue with government bodies, which would ultimately be responsible for initiating legislative changes should those be identified as helpful. Fewer says CIPPIC’s work with the ASC has already been brought to the attention of Industry Canada. CIPPIC is currently the only Canadian member of the group. CIPPIC’s discussions with the department are helped, he says, because the conversation is taking place in the context of an Industry Canada-led task force on spam that recently issued its report. "The people within the e-commerce branch at Industry Canada are fairly astute, and they understand that spam is just one issue, one symptom of kind of a bigger disease on the Internet. And, the disease is really exploitation of consumer trust and consumer trust on the Internet. The challenge for Canada, given our emphasis on the ecommerce and the innovation agenda that the government adopted seven years back – the challenge will be to shore up consumer confidence on the Internet and not only to ensure that Canadians go online and trust the Internet, but that that trust is warranted. (Industry Canada) has taken the recommendations of the spam task force, and viewed those recommendations more broadly as "what can we do to address the issue of consumer trust in the Internet?" A key consideration as government, industry and consumer protection groups act to mitigate the effects of spyware will be not to bring too blunt an attack or it might crush legitimate business, however. "Keep in mind, there’s two categories of spyware or other potentially unwanted technologies. The first is the bad stuff; the bad guys out there who are phishing and who are identity thieves and who are trying to steal your banking data and all that kind of stuff. It’s pretty clear that these guys are bad. But, there’s another category of spyware out there, and these are people who are trying to engage in what they regard, anyway, as legitimate businesses. And, there is an entire category of software out there that’s ad supported software, for example, that rely on advertising and these kinds of models to survive," Fewer warns. "We all agree that this is a viable business model. Ad-supported software is, generally speaking, a good thing. It’s a good business model for supporting free stuff out on the Internet, but the challenge will be to make its existence a fair one – fair to consumers, fair to competitors and that it’s behaving in ways that we’d all agree is allowable and permissable." Several possible approaches exist to fighting spyware, says Fewer, including legislative amendments or industry self-regulation. Canada already has a unique perspective on the legal framework since it was a pioneer in drafting legislation such as the Personal Information Protection and Electronic Documents Act (PIPEDA). Fewer says its Canadian perspective raised eyebrows in ASC meetings, but that the group has begun to embrace some made-in-Canada approaches. "Particularly in the privacy context, when we started to talk about best practices here, a lot of the things that are law in Canada under PIPEDA were suggested before the coalition as being best practices, and there was some resistance of coalition of members to be taking this view. You heard phrases like, ‘We don’t want to be revolutionizing how the software business is conducted in the world.’ That’s where we piped up and said, ‘Well, you know, aren’t you guys all doing this anyways in Canada? And, in Europe, it’s the law. Let’s keep in mind that this isn’t actually revolutionary and that you guys are somewhat lagging behind.’...I guess we’ll see in the future whether our Canadian perspective has any significant impact at least in that area." Fewer says the definition is just a first step, however, and that research will continue into the spyware problem, including into understanding its effects. On the heels of a similar study just released by the Pew Internet & Life Project into spyware, the Public Interest Advocacy Centre (PIAC) in Ottawa is also set to begin surveying Canadians about the problem in this country and its prevalence. Working on a commission from the Office of Consumer Affairs at Industry Canada, PIAC is preparing a consumer survey that will help answer those questions, with a report slated for completion this fall. PIAC’s John Lawford tells Canadian NEW MEDIA that the survey will run over the course of the summer. "It’s good timing to do a report on it, in light, especially, of the change to the Consumer Protection Act in Ontario for Internet sales. It all ties in with that, as well. I think you’re just starting to see this realization on the part of a lot of people that it’s gotten to the point where there’s quite a lot of ripoffs and dangers in using ecommerce, and I think people are starting to get on the same page – that we’ve got to be clear about the rules so that we can keep going."

Spyware in sights of CIPPIC, industry players researching legal reform

News | 07/20/2005 4:00 am EDT

To keep reading, get a free trial.

Already a Subscriber?

Reuse & Permissions

Inside The Wire Report

Information

Hill Times Publishing

Get in Touch With Us