Internet Spyware (I-SPY) Prevention Act of 2007

Mr. Speaker, I rise in opposition to H.R. 964, the SPY Act.

The continued growth of the Internet has brought tremendous enhancements to our quality of life--from advances in the delivery of health care, to the ability of consumers to instantaneously conduct transactions online. Increasingly, consumers want a fast connection to the Internet and want the delivery of online services to be seamless and online service providers have invested significant resources to develop software to make their services as safe, reliable and fast as possible.

However, as Congress considers legislation to combat spyware, I believe that four overarching principles should guide our efforts. First, we must punish the bad actors, while protecting legitimate online companies. Second, we must not over-regulate, but rather encourage innovative new services and the growth of the Internet. Third, we must not stifle the tree market interactions between consumers and service providers. Fourth, we must target the behavior, not the technology. It is my hope that any legislation Congress enacts to combat spyware will adhere to these core principles.

On May 23, 2005, the House of Representatives passed legislation, similar to H.R. 964, which sought to solve the spyware problem by targeting the technology, instead of the criminal behavior behind the technology. However, many developments have occurred during the intervening two years which have convinced me that this regulatory approach to combating spyware is even more unwise than previously thought.

For example, just last month, the House Energy and Commerce Committee adopted an amendment to H.R. 964 that would have had enormous consequences for the Internet and online innovation. This amendment would have, in part, regulated Internet ``cookies'' for the first time under the bill. Internet cookies are used by most websites to enhance consumers' experiences with the Internet and to make the Internet more seamless and navigable with fewer stoplights. To make every online company that uses cookies comply with the notice and consent regime under the bill would have significantly interfered with consumers' Internet experiences. By forcing consumers to click through even more pre-scripted alert messages, this change would have, ironically, exacerbated the likelihood that consumers would become desensitized to these notices and click ``accept'' without reading them. In addition, this desensitization is likely to also give nefarious software installers a false legitimacy since there would be no distinction between the notices they provide and the notices legitimate online companies provide.

Apparently, the Democratic Leadership saw the error in the regulation of cookies and stripped the bill of this language just before the bill came to the Floor today. However, this mistake by the committee highlights the difficulties with trying to impose one-size-fits-all regulations to solve problems involving ever-evolving technologies.

In addition, Chairman Majoras of the Federal Trade Commission testified in October of 2005 that a notice-and-choice approach was not recommended for combating spyware for many reasons. He noted the fact that consumers will be overwhelmed by the notices they will receive when using the Internet and will most likely ignore the notices and click through them.

Furthermore, in the past few years there have been major developments in technological solutions to help consumers combat spyware. Consumer packages are becoming more and more effective in screening out unwanted spyware from their computers and are offered by many Internet service providers, as well as independent software providers.

Finally, a broad cross-section of legitimate online businesses and trade associations has expressed opposition to the regulatory approach of H.R. 964. On June 5, 2007, a coalition of over 30 trade associations and companies, including the U.S. Chamber of Commerce, the National Retail Federation, the Financial Services Roundtable, and numerous technology-based entities, sent a letter to all Members of the House of Representatives detailing their concerns with H.R. 964. This letter specifically expresses opposition to regulating Internet cookies, as well as opposition to including web sites (where consumers willingly submit information online) within in the scope of the legislation.

The better approach to combating spyware would be to target the criminal behavior of those who actually use spyware, and to continue our policy of letting innovative online companies interact with consumers to develop the exciting new online services that consumers have come to enjoy and expect from the Internet.

I have introduced legislation, along with my colleague Zoe Lofgren of California, to combat spyware by going after the criminals using spyware, rather than trying to regulate all software regardless of whether it is harmful or helpful. This legislation, H.R. 1525, was passed by the House and now awaits further action in the Senate. I urge my colleagues to support this targeted approach.

Mr. Speaker, I rise in strong support of H.R. 1525, the Internet Spyware or I-SPY Prevention Act.

I was pleased to join with my colleague from California, Representative Zoe Lofgren, to reintroduce this legislation. This bipartisan bill will impose tough criminal penalties on those that use software for nefarious purposes without imposing a broad regulatory regime on legitimate online businesses. I believe that this targeted approach is the best way to combat spyware.

Spyware is software that provides a tool for criminals to secretly crack into computers to conduct nefarious activities such as altering a user's security settings, collecting personal information to steal a user's identity or to commit other crimes. A recent study done by the National Cybersecurity Alliance revealed that over 90 percent of consumers had some form of spyware on their computers, and most consumers were not aware of it.

The I-SPY Prevention Act would impose criminal penalties on the most egregious behavior associated with spyware. Specifically, this legislation would impose up to a 5-year prison sentence on anyone who uses software to intentionally break into a computer and uses that spyware in furtherance of another Federal crime.

In addition, it would impose up to a 2-year prison sentence on anyone who uses spyware to intentionally break into a computer and either alter the computer's security settings or obtain personal information with the intent to defraud or injure a person, or with the intent to damage a computer. By imposing stiff penalties on these bad actors, this legislation will help deter the use of spyware and will thus help protect consumers from these aggressive attacks.

Enforcement is also crucial in combating spyware. The I-SPY Prevention Act authorizes $10 million for fiscal years 2008 through 2011 to be devoted to prosecutions involving spyware, phishing and pharming scams, and expresses the sense of Congress that the Department of Justice should vigorously enforce the laws against these crimes.

Phishing scams occur when criminals send fake e-mail messages to consumers on behalf of famous companies and request account information that is later used to conduct criminal activities.

Pharming scams occur when hackers redirect Internet traffic to fake sites in

order to steal personal information such as credit card numbers, passwords and account information.

This form of online fraud is particularly egregious because it is not as easily discernible by consumers. With pharming scams, innocent Internet users simply type the domain name into their Web browsers and the signal is rerouted to the devious Web site.

The I-SPY Prevention Act is a targeted approach that protects consumers by imposing stiff penalties on the truly bad actors, while protecting the ability of legitimate companies to develop new and exciting products and services online for consumers.

The I-SPY Prevention Act also avoids excessive regulation and its repercussions, including the increased likelihood that an overly regulatory approach focusing on technology would have unintended consequences that could discourage consumer use of the Internet, as well as the creation of new technologies and services on the Internet. By encouraging innovation, the I-SPY Prevention Act will help ensure that consumers have access to cutting-edge products and services at lower prices.

In addition, the approach of the I-SPY Prevention Act does not interfere with the free market principle that a business should be free to react to consumer demand by providing consumers with easy access to the Internet's wealth of information and convenience. Increasingly, consumers want a seamless interaction with the Internet, and we must be careful to not interfere with businesses' ability to respond to this consumer demand with innovative services. The I-SPY Prevention Act will help ensure that consumers, not the Federal Government, define what their interaction with the Internet looks like.

Finally, by going after the criminal behavior associated with the use of spyware, the I-SPY Prevention Act recognizes that not all software is spyware and that the crime does not lie in the technology itself but rather in actually using the technology for criminal purposes. People commit crimes; software doesn't.

H.R. 1525 is an effective, targeted approach to combating spyware, and I urge my colleagues to support this important legislation.

Mr. Speaker, I move to suspend the rules and pass the bill (H.R. 964) to protect users of the Internet from unknowing transmission of their personally identifiable information through spyware programs, and for other purposes, as amended.

Mr. Speaker, I ask unanimous consent that all Members may have 5 legislative days to revise and extend their remarks and to include extraneous material on the bill under consideration.

Mr. Speaker, I yield myself such time as I may consume.

Mr. Speaker, today the House takes up H.R. 964, the Securely Protect Yourself Against Cyber Trespass Act, or SPY Act.

This bill is not unfamiliar to the House of Representatives. Twice this body has passed the SPY Act with overwhelming margins, and it is my hope that today will be the third time. H.R. 964 aggressively tackles the problem of ``spyware,'' the insidious software that consumers unwittingly download onto their computers, only to have their personal private information extracted for commercial or fraudulent purposes.

In the past two Congresses, Mrs. Bono and Mr. Towns introduced the bipartisan SPY Act, and both times the bill enjoyed overwhelming support. This year, Mr. Towns and Mrs. Bono have once again teamed up to introduce the SPY Act as H.R. 964. And on March 15, the Consumer Protection Subcommittee held another legislative hearing on the bill. On May 10, 2007, the Energy and Commerce Committee unanimously reported H.R. 964, the SPY Act, as amended.

H.R. 964 provides a broad regulatory framework that empowers consumers with knowledge and the ability to control what software is installed, and is not installed, on their personal computers. This bill prohibits unfair or deceptive acts and practices related to spyware and creates an ``opt in'' regime whereby entity cannot execute any program that collects a person's personal information without, first, giving explicit notice to the consumer and second, receiving his or her consent. H.R. 964 provides that the FTC will enforce the SPY Act and will have the authority to impose significant civil penalties. During both the full committee and the subcommittee markups of H.R. 964, I introduced manager's amendments tweaking provisions of the bill, and they were the work product of deliberative bipartisan cooperation. This bill has been thoroughly honed to be effective without being overbearing.

Mr. Speaker, the SPY Act is a quality piece of legislation that all Members of the House should enthusiastically support. The full Committee on Energy and Commerce and the subcommittee that I am privileged to chair, the Subcommittee on Commerce, Trade and Consumer Protection, have a long history of bipartisan cooperation, and this bill is an extension of that longstanding tradition.

I urge my colleagues to vote ``yes'' on the bill.

Mr. Speaker, I reserve the balance of my time.

Mr. Speaker, I am pleased to yield 5 minutes to the gentleman from New York, my colleague, my friend (Mr. Towns).

Mr. Speaker, as was indicated earlier, this is the third time that this bill has been before this body. It was passed overwhelmingly two times in prior Congresses. We really believe that the third time should be the charm. This bill should pass out of this House with the same kind of margins that it passed out of two previous Congresses, and I would urge my colleagues to vote for this bill once again.

This bill needs to become law. This bill protects the American consumer. This bill protects the American economy. This is a good bill. It needs to become law.

None of the practices outlawed by section 2 of the bill are ``legitimate.'' As for section 3's consumer notice, consent, identification, and easy disabling requirements, legitimate business practices are exempted by the exceptions in section 3(b)(2) and the limitations in section 5 of the SPY Act. The committee added new rule- making authority to exempt a broad class of entities operating Internet Web sites that collect information if the FTC finds that their notice to consumers is adequate.

Mr. Speaker, we have corrected the bill, made minor tweaking improvements on the bill, and I urge my colleagues to support this bill.

Mr. Speaker, I yield back the balance of my time.

Mr. Speaker, I move to suspend the rules and pass the bill (H.R. 1525) to amend title 18, United States Code, to discourage spyware, and for other purposes, as amended.

Mr. Speaker, I yield myself as much time as I may consume.

Software and electronic communications are increasingly being used by criminals to invade individuals and businesses' computers without authorization. These practices undermine consumer confidence in the integrity and security of the Internet itself. Two particularly egregious examples involve the use of spyware and phishing scams.

Spyware is a form of software that helps gather information about an individual or organization without their knowledge. It also can be used to take control of someone else's computer and surreptitiously send information stored in that computer, such as the individual's personal information and passwords, to another entity where it can then be redirected for criminal purposes, including fraud, larceny, theft or other cybercrimes.

According to a survey last year by the FBI, computer security practitioners say that spyware is among the most critical threats to the security of our Nation's computer systems.

Phishing is another form of cybercrime. It is a scheme by which a criminal creates a Web site or sends e-mails that copy a well-known, legitimate business in an attempt to deceive Internet users into revealing personal information. Through phishing, for example, a criminal can trick an Internet user into revealing his bank account numbers or passwords.

Pharming is a version of phishing, and that involves the fraudulent use of domain names. In pharming, hijackers hijack a legitimate Web site's domain site and redirect traffic intended for the Web site to their own Web site where users may unknowingly provide personal information to the hacker.

This measure before us, H.R. 1525, aims to put a stop to these kinds of crimes that invade our privacy. It amends title 18 of the United States Code to impose criminal penalties, including up to 5 years in prison, on those who intentionally engage in spyware-related behavior in furtherance of other Federal criminal offenses.

Another thing the bill does is impose fines and imprisonment up to 2 years for anyone who engages in such practices with the intent to defraud or injure a person.

Finally, this measure authorizes $10 million per each fiscal year, 2008 through 2011, to help the Department of Justice combat these crimes.

I want to lift up the names of two of our Judiciary Committee members, Congresswoman Zoe Lofgren of California, and of course, Bob Goodlatte of Virginia, both of whom have put this legislation together and shepherded it through the hearing and the processes of the Judiciary Committee. I'd like to commend them for hard, effective work in developing and moving this bill on a bipartisan basis.

This is a targeted measure, ladies and gentlemen, that protects consumers by providing appropriately strong penalties for egregious behavior. I urge my colleagues to join us in support of it.

Mr. Speaker, I reserve the balance of my time.

Mr. Speaker, the gentlelady from California, Zoe Lofgren, is the principal mover of this bill, and I'm pleased now to yield her as much time as she may consume.

Mr. Speaker, I am now pleased to yield such time as he may consume to the chairman of the Subcommittee on Crime of the Judiciary Committee, the gentleman from Virginia, Mr. Bobby Scott.

Mr. Speaker, this is a very important measure. We are finally dealing with those spyware crimes that invade our financial privacy, and I commend all of the actors on the Judiciary Committee that played a role in bringing this to our attention. Mr. Ric Keller has done an excellent job as well.

Mr. Speaker, I ask unanimous consent that all Members may have 5 legislative days to revise and extend their remarks and include extraneous material on the bill under consideration.

Mr. Speaker, I yield back the balance of my time.

Mr. Speaker, I yield myself such time as I may consume. Mr. Speaker, I am pleased again, I have been here a number of times, to consider H.R. 964, the SPY Act, a bill which is important to fight Internet privacy. In the past and as we speak on the floor today, this has bipartisan support with bipartisan leadership. It has been offered by my colleague from California, Mary Bono, and my colleague from New York, Ed Towns. Both of them have worked dutifully to try to pass this bill. And, unfortunately, the last time we passed it overwhelmingly in the House, it did not get through the Senate; so we are back at it again.

I also want to thank the new chairman of the committee that I chaired last year, Mr. Rush, for his commitment to maintaining a bipartisan process in this, and that is why we are here on the floor today. If it hadn't been for the leadership of these individuals combined with what I think is a Federal Trade Commission commitment and the stakeholders in the community in this process, we would not have had a workable legislative solution.

So I think today that we have to realize that even at the last 11th hour we might have some people who don't totally agree, but I think the bill is a strong bill. It takes a firm and, I think, a fair on balance approach in balancing the need to address bad actors and the need to protect the functions of legitimate business tools.

Both at the committee level and on the floor, we have voted on this spyware before, as I mentioned, three times. Three times we have gone through the process of holding hearings, receiving testimony from many witnesses, listening to the horrors of spyware and how it can be a tool of identity thieves, and we know how identity theft is prevalent today, conducting negotiations, and we have asked for ways to improve the bill. So we have seen support across the board in industry for this bill. We asked what is the best way to improve this bill. So I think we have worked hard on this legislation.

And, my colleagues, I think it is time we move this to the Senate, and if there are any further problems with this bill, we certainly can handle these problems in the conference between the House and the Senate.

Now, you should realize that there are some in the business community who have raised a 11th hour concern about a specific provision that was added at the full committee markup. Not in our subcommittee, Mr. Speaker, but in our full committee. I have been through seven hearings on the question of privacy on the question of opt in and opt out. I am well aware of the feelings of Members dealing with opt in and opt out, depending upon how you view this process. So I share some of the concerns of the business community in their 11th hour attempt to bring this to our attention. But the responsibility of continuing to move this process forward, I think, is important. That is why I have decided to vote ``yes'' today to support this bill. And, hopefully, when the Senate has it, they can make the changes. If not, we can do it in conference. But to take a bill that has been in this long process and has had so many hearings for so many years and decide that it should not go forward is not the right process.

And we all in Congress here know that sometimes the enemy of the good is the perfect.

So we can solve this issue, I think, to satisfy all interested parties. It is a strong piece of legislation; and I cannot think of a reason why our Senate colleagues should not act on it, also.

So, in closing, the SPY Act is a solid consumer protection bill that returns control of personal computers and private information to where it belongs, and that is to the consumer.

I urge my colleagues to vote ``yes'' on H.R. 964.

With that, Mr. Speaker, I reserve the balance of my time.

Mr. Speaker, I yield 5 minutes to the author of the bill, the gentlelady from California (Mrs. Bono).

Mr. Speaker, I yield back the balance of my time.