The New York State Attorney General's office today announced it has filed a lawsuit against Intermix Media for deceiving users into installing and using spyware. The complaint charges Intermix civilly with several violations of New York statute and common law. The lawsuit is a step forward for end-users' rights to control their own computers, and shows the right way to address the spyware problem: with lawsuits, not new laws.

The New York State complaint and attached affirmation run through a veritable catalogue of deceptive acts and practices perpetrated on users: surreptitious installation of browser toolbars that link to Intermix sites; interception of web requests to redirect users to Intermix websites; hijacking of users' browser homepages; installation of hidden programs and controls to report user activity back to Intermix and display advertising; and addition of an "updater" program that allowed Intermix remotely and secretly to install new programs on users' computers.

The only notice provided to users, who thought they were merely downloading screensavers or visiting websites with active plugins, would have come if they followed through six screens to a tiny link to "Terms of Service," passed disclaimers that asserted "Virus-Checked: Passed," and "Spyware-Checked: Passed," read through a cryptic "End-User License Agreement," and found its buried references to the ride-along "GripPack" and "NetGuide" -- a process that would still not have alerted them to the full activities of the host of programs taking up residence on their computers.

Spitzer's complaint charges Intermix with violating New York state's General Business Law sections 349 and 350, prohibitions on "deceptive acts or practices" and "false advertising." It also charges the company with "trespass to chattels" for interfering with the use of personal computers onto which the software was downloaded. Any user who has unwittingly found a computer infested with these rogue programs will likely concur.

The complaint is only the beginning of a lawsuit, of course, but the screenshots and descriptions it attaches leave little doubt that promoting spyware in the guise of a screensaver is a "deceptive act." If the company doesn't agree to stop on its own, it's quite likely a judge will put an end to these practices -- using the tools provided by existing laws similar to those available in many states.

The lawsuit comes as Congress and many state governments consider anti-spyware legislation. Bills have been introduced in both the House and Senate with detailed lists of prohibited activities, such as "modifying settings relating to the use of the computer or to the computer's access to or use of the Internet, including ... altering the default Web page that initially appears when a user of the computer launches an Internet browser" (S. 687) or prescribing specific wording to be used in gaining user consent: "'This program will collect and transmit information about you and your computer use and will collect information about Web pages you access and use that information to display advertising on your computer. Do you accept?'" (H.R. 29).

While the Congressional efforts are well-meaning, such specific legislation is bound to be both too narrow and too broad. A law that targets web browser bookmarks and start pages says nothing about instant messenger traffic. And what about the portable device that connects to the Internet but offers no way to accept or reject the terms of a useful new feature? New tech-specific laws will look outdated in five years (if not sooner) as the technology changes. Moreover, some of the federal proposals would preempt state law, blocking the very laws that may be most effective against malware.

No one likes invasive spyware. As Spitzer's complaint shows, however, older, more general laws already prohibit these deceptive practices. Rather than rushing to regulate a field that's still changing, with laws whose impact on legitimate software development we can't adequately predict, we should focus on enforcment of these existing laws. Kudos to the New York State AG for doing just that.

Links:

  • AP story, via NYT
  • Verified Petition (complaint)
  • Affirmation with exhibits