On our first day, Marc received a last-minute invitation to testify before a Senate subcommittee regarding S.1625, the "Counter-Spy Act," which would expand the FTC's leverage against purveyors of spyware. By tomorrow night, he needed a briefing on the FTC's current authority against spyware. "My suspicion --" mused Marc as we returned to our desks, "-- is that this bill will snag on the definition spyware."

I was gratified when they also asked for a volunteer to write EPIC's new spyware info page. For reasons outside my control, my work never reached EPIC's website. However, I found the process of researching, understanding, and formulating the spyware-definition problem to be both fulfilling and insightful. I enjoy journalistic writing, I believe there exists a best possible way to translate arcana into public language, and I felt that if I was to distinguish EPIC's new spyware page from all the competition on the web, I had to write that translation. One Senator (yes, it was Alaska Senator Ted Stevens!) asked an FTC commissioner, "Do you believe that there is such a thing as legitimate spyware?" Senator Stevens is not the only person who asks this fraught question, and that commissioner is not the only person with no idea how to answer it. If the definition of spyware was (in Marc's opinion) the snag, then it seemed worthwhile for me to try to define it -- or to account for the controversies that complicate the effort.

In the spyware context, I found four major areas of disagreement which few people take the trouble to make explicit.

1. What constitutes “knowledge and consent”?

Everyone agrees that “spyware” should only apply to software that operates without the user’s knowledge and consent. However, that definition begs the question of how and when consumers need to be told about software installed on their computers for consent to be adequate. For example, the Anti-Spyware Coalition, which sets standards for anti-spyware vendors, models spyware as a balance between “risk” factors and mitigating “consent” factors. But it then concedes that “ultimately, the decision on what rating to give and what risk model to use falls to the individual Anti-Spyware vendor.” Elsewhere, the ASC more broadly defines (pdf) spyware as “technologies deployed without appropriate user consent and/or implemented in ways that impair user control over (1) material changes that affect their user experience, privacy or system security; (2) use of their system resources, including what programs are installed on their computers; and/or (3) collection, use, and distribution of their personal or other sensitive information.

The ASC’s definitions are intentionally vague precisely where it matters: by not defining “consent” and “risk”, it leaves to the various anti-spyware companies to decide whether targeted advertising benefits consumers, or what constitutes sufficient consent in a EULA.

The ASC is right to concede that this ambiguity cannot be removed. With proper “notice, consent, and control,” the same technologies that have been used to harm or annoy computer users can provide important benefits: “Tracking can be used for personalization, advertisement display can subsidize the cost of a product or service, monitoring tools can help parents keep their children safe online, and remote control features can allow support professionals to remotely diagnose problems.”

2. What constitutes “harm”?

Again, the ASC's "risk" factors beg the question of what constitutes a harm. Some treat software that “trespasses” on a computer as spyware because they consider trespass to be per se harmful, even if the software is otherwise benign or beneficial. Others focus on “nuisance” software, such as software that provides pop-up ads. But these definitions omit the invisible harm in data-gathering software that does not rise to a nuisance and is undetectable, because it does not alert a user to remove it from his computer. Other externalities are also not felt as "harms" by the user. An innocent user’s hard drive may unknowingly be used to generate “zombies,” or automated spam emails. ISPs or computer makers often bear the blame for harms caused by spyware. And spyware may also defraud legitimate online advertisers, for example by automatically activating pay-per-click advertisements.