BILL ANALYSIS
Committee Report (Substituted)
BACKGROUND AND PURPOSE
Spyware is a class of software that is installed on a computer without consent and that monitors or controls computer use. The software is installed for a myriad of reasons, some of which include tracking a user's online behavior, browsing for market research, sending pop-up ads, redirecting computer users to websites, or recording keystrokes, which in turn could lead to identity theft and fraud. Spyware can be transferred via spam or be bundled in with freeware, shareware, or games downloadable on the internet. Oftentimes, the installation of software results in the drastic slowing of infected computers, in the corrupting of the hard drive, or in the disabling of hardware and software computer settings.
According to the National Cyber Security Alliance, 9 out of 10 computers connected to the Internet are infected with spyware, and a recent audit by Earthlink found that the average computer had more than 26 spyware programs installed. The net impact of this problem will be our citizens' loss of confidence in the internet and their reluctance to engage in online business transactions.
Currently, there exists no statute that expressly prohibits the actions of spyware. C.S.S.B. 327 seeks to remedy this problem by prohibiting the installation, copying, or use of computer software for fraudulent and unauthorized purposes. C.S.S.B. 327 establishes a cause of action for providers of computer software, for the owner of a webpage or trademark, and for a telecommunications carrier or Internet service provider who are adversely affected. C.S.S.B. 327 allows the Attorney General to collect civil penalties.
RULEMAKING AUTHORITY
SECTION-BY-SECTION ANALYSIS
SECTION 1. Amends Title 4, Business & Commerce Code, by adding Chapter 48, as follows:
CHAPTER 48. CONSUMER PROTECTION AGAINST COMPUTER SPYWARE ACT
SUBCHAPTER A. GENERAL PROVISIONS
Sec. 48.001. SHORT TITLE. Authorizes this chapter to be cited as the Consumer Protection Against Computer Spyware Act.
Sec. 48.002. DEFINITIONS. Defines "advertisement," "computer software," "damage," "execute," "keystroke-logging function," "owner or operator of a computer," "person," and "personally identifiable information."
Sec. 48.003. APPLICABILITY OF CHAPTER. Provides specific exceptions to this chapter for the transmission of computer software to the computer of another by a person providing certain services. Provides that Section 48.052, other than Subdivision (1) of that section, and Sections 48.053(4) and 48.055 of this chapter do not apply to certain providers of service.
[Reserves Sections 48.004-48.050 for expansion.]
SUBCHAPTER B. PROHIBITED CONDUCT OR ACTIVITIES
Sec. 48.051. UNAUTHORIZED COLLECTION OR TRANSMISSION OF PERSONALLY IDENTIFIABLE INFORMATION. Prohibits a person, other than the owner or operator of a computer, from knowingly transmitting computer software to a computer in this state and using the software to collect or cull, through intentionally deceptive means, certain personally identifiable information.
Sec. 48.052. UNAUTHORIZED TRANSMISSIONS OR MODIFICATIONS OF COMPUTER SETTINGS; COMPUTER DAMAGE. Prohibits a person, other than the owner or operator of the computer, from knowingly transmitting computer software to a computer in this state and using the software to modify, through intentionally deceptive means, certain settings, including certain security settings, or take control of the computer by accessing or using the computer for certain purposes or opening, without the consent of the owner, certain advertisements.
Sec. 48.053. UNAUTHORIZED INTERFERENCE WITH INSTALLATION OR DISABLING OF COMPUTER SOFTWARE. Prohibits a person, other than the owner or operator of the computer, from knowingly transmitting computer software to a computer in this state and using the software to prevent, through intentionally deceptive means, reasonable efforts of the owner or operator to block the installation or execution of or to disable certain software, to intentionally misrepresent to another that computer software will be uninstalled or disabled by the actions of the owner or operator of the computer, or to remove, disable, or render inoperative, through intentionally deceptive means, security, antispyware, or antivirus software installed on the computer.
Sec. 48.054. KNOWING VIOLATION. Provides that a person knowingly violates Sections 48.051, 48.052, or 48.053, if the person acts with actual knowledge of the facts that constitute the violation or consciously avoids information that would establish actual knowledge of those facts.
Sec. 48.055. OTHER PROHIBITED CONDUCT. Prohibits a person, other than the owner or operator of the computer, from inducing the owner or operator of a computer in this state to install a computer software component by intentionally misrepresenting certain facts or copying and executing or providing for the copying and execution of a computer software component to a computer in this state in a deceptive manner with the intent of causing the owner or operator of the computer to use the component in a manner that violates this chapter.
Sec. 48.056. DECEPTIVE ACT OR OMISSION. Provides that, for purposes of this chapter, a person is considered to have acted through intentionally deceptive means if the person, with the intent to deceive an owner or operator of a computer, intentionally makes certain statements or intentionally and materially fails to provide certain notice to the owner or operator of a computer.
Sec. 48.057. TRANSMISSION OF COMPUTER SOFTWARE. Provides that, for purposes of this chapter, a person is considered to have transmitted computer software to a computer if the person transfers, sends, or makes available computer software, or a component of the software, through certain mediums.
[Reserves Sections 48.058-48.100 for expansion.]
SUBCHAPTER C. CIVIL REMEDIES
Sec. 48.101. CIVIL RELIEF. (a) Authorizes certain persons to bring a civil action against a person who violates this chapter.
(b) Authorizes a person bringing an action under this section, in addition to any other remedy provided by law and except as provided by Subsection (g), to seek injunctive relief to restrain the violator from continuing the violation, recover damages in a specified amount, or both.
(c) Authorizes the court to increase an award of actual damages in an action brought under this section to an amount not to exceed three times the actual damages sustained if the court finds that the violations have occurred with a frequency as to constitute a pattern or practice.
(d) Provides that a plaintiff who prevails in an action filed under this section is entitled to recover reasonable attorney's fees and court costs.
(e) Provides that each separate violation of this chapter is an actionable violation.
(f) Provides that, for purposes of this section, violations are of the same nature if the violations consist of the same course of conduct or action, regardless of the number of times the conduct or act occurred.
(g) Provides that in the case of a violation of Section 48.052 that causes a telecommunications carrier to incur costs for the origination, transport, or termination of a call triggered using a modem of the carrier as a result of this violation, a telecommunications carrier has certain remedies.
Section 48.102. CIVIL PENALTY; INJUNCTION. (a) Authorizes the attorney general to bring a suit to recover a civil penalty from a person found in violation of this chapter.
(b) Provides that the attorney general may bring an action against a person to restrain the violation by a temporary restraining order or a permanent or temporary injunction.
(c) Providers that the attorney general is entitled to recover reasonable expenses, including reasonable attorney's fees, and court costs.
SECTION 2. Effective date: September 1, 2005.
EFFECTIVE DATE
September 1, 2005.
COMPARISON OF SUBSTITUTE TO SENATE ENGROSSED VERSION
The substitute differs from the Senate engrossed version in that the substitute makes minor alterations to the definition of "advertisement."
The substitute inserts "(iii) cause a third party affected by the conduct to incur financial charges for a service not previously authorized by the third party" on page 6, line 7.
The substitute inserts "(3) a telecommunications carrier or Internet service provider who is adversely affected by the violation," on page 9, line 16.
The substitute differs from the Senate engrossed version in that the substitute inserts a new subsection (g) in Sec. 48.101 Civil Relief, prohibiting "modem hijacking" and allows a telecommunications carrier to bring a cause of action in such an event.
The substitute differs from the Senate engrossed version in that the substitute separates out the Attorney General's right to seek a civil penalty and to seek an injunction.