Washington Enacts Spyware Law

Washington has become the latest state to enact a law against spyware. On May 17 Governor Christine Gregoire signed House Bill 1012, which will allow the state Attorney General to seek damages up to $100,000 per violation or actual damages, whichever is greater. The new law will also allow business victims of spyware attacks to sue spyware purveyors.

"Computer users expect their property and privacy to be protected from criminals who would steal their personal information or trespass on their computers. This new law sends a clear warning that secretly implanting spyware and other unwanted programs will be punished," said Rep. Jeff Morris, the sponsor of the spyware bill and chair of the House Technology, Energy and Communications Committee.

The law provides tha "It is unlawful for a person who is not an owner or operator to transmit computer software to the owner or operator's computer with actual knowledge or with conscious avoidance of actual knowledge and to use such software to do any of the following:
(1) Modify, through intentionally deceptive means, settings that control any of the following:
     
(a) The page that appears when an owner or operator launches an internet browser or similar computer software used to access and navigate the internet;
(b) The default provider or web proxy the owner or operator uses to access or search the internet; and
(c) The owner or operator's list of bookmarks used to access web pages;
     
(2) Collect, through intentionally deceptive means, personally identifiable information:
(
a) Through the use of a keystroke-logging function that records all keystrokes made by an owner or operator and transfers that information from the computer to another person;
(b) In a manner that correlates such information with data respecting all or substantially all of the web sites visited by an owner or operator, other than web sites operated by the person collecting such information; and
(c) Described in section 1(9) (d), (e), or (f)(i) or (ii) of this act by extracting the information from the owner or operator's hard drive;
     
(3) Prevent, through intentionally deceptive means, an owner or operator's reasonable efforts to block the installation or execution of, or to disable, computer software by causing the software that the owner or operator has properly removed or disabled automatically to reinstall or reactivate on the computer;
     
(4) Intentionally misrepresent that computer software will be uninstalled or disabled by an owner or operator's action; and
     
(5) Through intentionally deceptive means, remove, disable, or render inoperative security, antispyware, or antivirus computer software installed on the computer.

It is unlawful for a person who is not an owner or operator to transmit computer software to the owner or operator's computer with actual knowledge or with conscious avoidance of actual knowledge and to use the software to do any of the following:

(1) Take control of the computer by:

(a) Accessing or using the modem or internet service for such computer to cause damage to the computer or cause an owner or operator to incur financial charges for a service that is not authorized by the owner or operator;
(b) Opening multiple, sequential, stand-alone advertisements in the owner or operator's internet browser without the authorization of an owner or operator and that a reasonable computer user cannot close without turning off the computer or closing the internet browser;
     
(2) Modify any of the following settings related to the computer's access to, or use of, the internet:

(a) Settings that protect information about the owner or operator in order to steal the owner or operator's personally identifiable information; and
(b) Security settings in order to cause damage to a computer; and

(3) Prevent an owner or operator's reasonable efforts to block the installation of, or to disable, computer software by doing any of the following:

(a) Presenting the owner or operator with an option to decline installation of computer software with knowledge that, when the option is selected, the installation nevertheless proceeds; and
(b) Falsely representing that computer software has been disabled.

It is unlawful for a person who is not an owner or operator to do any of the following with regard to the owner or operator's computer:

(1) Induce an owner or operator to install a computer software component onto the computer by intentionally misrepresenting the extent to which installing the software is necessary for security or privacy reasons or in order to open, view, or play a particular type of content; and

(2) Deceptively cause the execution on the computer of a computer software component with the intent of causing the owner or operator to use the component in a manner that violates any other provision of this section.