Spyware firm must halt illegal activity

A company that produced and sold software intended for illegal cyber-spying has been forced to change its ways after a two-year civil court action launched by the U.S. Federal Trade Commission.

CyberSpy Software and its owner Tracer Spence can no longer sell or advertise a computer program that is secretly installed on a third-party computer and records keystrokes, screen images and website visits.

RemoteSpy was advertised as a 100 per cent undetectable way to "spy on anyone from anywhere." The software came with instructions on how to disguise the program, download and install it without the knowledge of the person whose computer was targeted.

No fines for CyberSpy

Tracy Shapiro, the FTC attorney who led the action, says while CyberSpy won't have to pay any fines or financial compensation, the legal agreement prevents it from marketing the program as spyware.

"It's a settlement agreement but it has the force of the court because the judge enters the agreement so it comes out as a stipulated order for permanent injunction from the federal court," she said in an interview with CBC News.

The company also had to make changes in the software to prevent it from being used on computers without the owner knowing that it's there.

'They use this technology to gather passwords or to gather sensitive information that they then report back to the person who initiated the virus ...' —Anthony Nelson, computer security specialist

"There's two levels of transparency, a pop up screen that tells you what's being installed, that it's RemoteSpy and a description of what the program is," Shapiro said, "and then it will also cause an icon to be on the desktop which it didn't have in the past so that somebody who goes to use the computer can see the icon is there."

While Shapiro says consumers are now safe from this particular program, a computer security expert says there are many others like it that haven't yet been targeted by authorities.

"If you look at a lot of the viruses and worms and stuff that are out on the net, they use this technology to gather passwords or to gather sensitive information that they then report back to the person who initiated the virus or the worm," Anthony Nelson of Edmonton-based Estec systems told CBC News.

Programs in legal 'grey zone'

Keylogging programs, as they're called, aren't necessarily illegal. Nelson says it depends on what they're being used for.

"An illegal application is where you're using it to capture somebody's keystrokes without their knowledge and recording that information to use for whatever purpose."

He says consumers shouldn't feel any safer simply because one business has been forced to make its spyware more visible.

'We certainly hope this order would send a message to industry.' —Tracy Shapiro, FTC lawyer

But Shapiro told CBC News the legal action against one company should serve as a lesson to others.

"We certainly hope this order would send a message to industry about what we see is how companies need to change their programs to be in compliance of Section 5 of the FTC act."

That section prohibits any company engaging in a deceptive or unfair business practice.