Get ready for 'Son of Can-Spam'

Now politicians are promising to enact new laws against spyware. It might be time to start worrying again.

At a hearing last week, senators pledged prompt action. "According to a recent survey by the National Cyber Security Alliance, 93 percent of people feel that spyware is a serious problem, and 61 percent believe that Congress should be doing more to combat this problem," said Gordon Smith, an Oregon Republican. "Consumers have now downloaded free versions of the two most widely used anti-spyware programs over 45 million times."

Some background: Five spyware-related bills exist in Congress, namely S.1004, H.R.744, H.R.29, S.687, and S.1608.

Three of those--including Rep. Mary Bono's H.R.29, already approved by the House of Representatives--would explicitly override state laws, even if the state laws are more consumer-friendly than the federal law.

Many are. Last year, Utah enacted an anti-spyware law that was so strict that WhenU sued to block it even before the measure took effect. WhenU is one of those companies that treads the line between adware and spyware--its software is surreptitiously installed when unsuspecting Windows users download file-sharing programs like BearShare. Some 87 percent of WhenU "customers" are unaware of where that constant stream of pop-up ads comes from from.

No wonder WhenU CEO Avi Naider says that his company "supports anti-spyware legislation at the federal level." It would eliminate the possibility of state legislators taking a harder line.

Federalism on the Internet
It's true that many legitimate businesses would prefer what they like to call a "uniform federal standard" rather than a "patchwork of dozens of state laws."

But in reality, what's likely to happen is that the state courts will retain authority over common-law torts like invasion of privacy and fraudulent misrepresentation. Plus we'll see five different federal laws, administered by a dozen different federal agencies, each bent on expanding its jurisdiction daily. That's a situation only a lawyer could love.

A better solution might sound like a radical one: for Congress to do nothing.

The Federal Trade Commission has told politicians it already possesses broad authority to punish any fraudulent and deceptive adware or spyware practices with fines, as it demonstrated by suing one bottom-feeding spyware company last week. Department of Justice prosecutors have said the same thing about filing criminal charges.

Congressional forbearance would permit those federal lawsuits and state laws to continue. More importantly, it would support the long-neglected idea of federalism, which Justice Louis Brandeis said let states become "laboratories of democracy." For decades, regulatory power has been increasingly consolidated in the federal government, much to the dismay of critics who have warned that state legislators might know more about what their constituents need than some unelected bureaucrats in a distant Washington. That addiction to centralized power has led to bizarre twists, such as federalized speed limits and a Supreme Court that firmly believes state law can never permit medical marijuana use.

George Mason University professors Bruce Kobayashi and Larry Ribstein have written about how Internet federalism affects Americans' privacy rights. They say that "federal law would perversely lock in a single regulatory framework while Internet technology is still rapidly evolving. State law, by contrast, emerges from 51 laboratories and therefore presents a more decentralized model that fits the evolving nature of the Internet. Moreover, competition among state laws can mute the inefficient tendencies of (special interest group) legislation."

That same argument holds true for spyware regulations. And we've seen how well the Can-Spam law has worked. This time, let's hope that Congress is listening.