On our first day, Marc received a last-minute invitation to testify before a Senate subcommittee regarding S.1625, the "Counter-Spy Act," which would expand the FTC's leverage against purveyors of spyware. By tomorrow night, he needed a briefing on the FTC's current authority against spyware. "My suspicion --" mused Marc as we returned to our desks, "-- is that this bill will snag on the definition spyware."

I was gratified when they also asked for a volunteer to write EPIC's new spyware info page. For reasons outside my control, my work never reached EPIC's website. However, I found the process of researching, understanding, and formulating the spyware-definition problem to be both fulfilling and insightful. I enjoy journalistic writing, I believe there exists a best possible way to translate arcana into public language, and I felt that if I was to distinguish EPIC's new spyware page from all the competition on the web, I had to write that translation. One Senator (yes, it was Alaska Senator Ted Stevens!) asked an FTC commissioner, "Do you believe that there is such a thing as legitimate spyware?" Senator Stevens is not the only person who asks this fraught question, and that commissioner is not the only person with no idea how to answer it. If the definition of spyware was (in Marc's opinion) the snag, then it seemed worthwhile for me to try to define it -- or to account for the controversies that complicate the effort.

In the spyware context, I found four major areas of disagreement which few people take the trouble to make explicit.

1. What constitutes “knowledge and consent”?

Everyone agrees that “spyware” should only apply to software that operates without the user’s knowledge and consent. However, that definition begs the question of how and when consumers need to be told about software installed on their computers for consent to be adequate. For example, the Anti-Spyware Coalition, which sets standards for anti-spyware vendors, models spyware as a balance between “risk” factors and mitigating “consent” factors. But it then concedes that “ultimately, the decision on what rating to give and what risk model to use falls to the individual Anti-Spyware vendor.” Elsewhere, the ASC more broadly defines (pdf) spyware as “technologies deployed without appropriate user consent and/or implemented in ways that impair user control over (1) material changes that affect their user experience, privacy or system security; (2) use of their system resources, including what programs are installed on their computers; and/or (3) collection, use, and distribution of their personal or other sensitive information.

The ASC’s definitions are intentionally vague precisely where it matters: by not defining “consent” and “risk”, it leaves to the various anti-spyware companies to decide whether targeted advertising benefits consumers, or what constitutes sufficient consent in a EULA.

The ASC is right to concede that this ambiguity cannot be removed. With proper “notice, consent, and control,” the same technologies that have been used to harm or annoy computer users can provide important benefits: “Tracking can be used for personalization, advertisement display can subsidize the cost of a product or service, monitoring tools can help parents keep their children safe online, and remote control features can allow support professionals to remotely diagnose problems.”

2. What constitutes “harm”?

Again, the ASC's "risk" factors beg the question of what constitutes a harm. Some treat software that “trespasses” on a computer as spyware because they consider trespass to be per se harmful, even if the software is otherwise benign or beneficial. Others focus on “nuisance” software, such as software that provides pop-up ads. But these definitions omit the invisible harm in data-gathering software that does not rise to a nuisance and is undetectable, because it does not alert a user to remove it from his computer. Other externalities are also not felt as "harms" by the user. An innocent user’s hard drive may unknowingly be used to generate “zombies,” or automated spam emails. ISPs or computer makers often bear the blame for harms caused by spyware. And spyware may also defraud legitimate online advertisers, for example by automatically activating pay-per-click advertisements.

I, however, entered the Senate hearing room pumped for the next step. While my fellow interns collapsed in their chairs after our marathon preparations, I was scribbling notes and circling hyperlinks in the printouts of the witnesses' testimony that I'd stolen from the press table. I had volunteered to write EPIC's new spyware info page. I enjoy journalistic writing, I believe there exists a best possible way to translate arcana into public language, and I felt that if EPIC's new spyware page was to distinguish itself from all the competition on the web, I had to find it. If the definition of spyware was (in Marc's opinion) the snag, then I would define it -- or account for the controversies that complicate the effort.

As you have noticed, there is no new spyware info page. Like Michelangelo's most puzzling experiments, it never got beyond the drafts.

My summer was swell. I interned at EPIC. You have to admire how Marc Rotenberg has stretched a small office, small resources, and a select team into outsized influence among many issues and bureaucrats. We interns helped make that ratio possible: for every Marc Rotenberg there were three full-time staff and seven full-time interns (plus an eighth, a GW undergrad who signed on mid-summer, was a tad boastful about his side business investing his friends' profits from dealing pot, invited me to participate, and on the third day vanished without explanation. And what charisma.)

This was my first chance to apply my new "legal skills" to practical problems. My transition from school to career would succeed, I discovered, only so much as I was willing to abandon the intensity that had succeeded, somewhat, in school -- particularly if I wanted to transition into the fast-paced world of Capitol Hill, even more so if I was interested in the faster-paced world of electronic privacy. Assignments changed too quickly, and their subject matter was too novel and complex, for me to put off work until I had analyzed every facet and contingency of every possible issue. With each successive project that passed my desk, my intensity loosened a little, my ability to satisfy myself with sufficient work-product rather than perfect work-product grew a little. As a result, my first project was my favorite.

-- AndrewGradman - 18 Dec 2008

Set ALLOWTOPICVIEW = < AndrewGradman, EbenMoglen >

-- AndrewGradman - 18 Dec 2008

<--/commentPlugin-->