14.1. Introduction

Computer users increasingly confront software that collects information about them or asserts control over their computers without their knowledge or consent [116]. Whether labeled spyware, adware, ransomware, stealware, keyloggers, trojans, or rootkits, they have in common the fact that they are installed and operate without explicit user knowledge or consent [138]. Unlike earlier forms of code-based attacks that operated without any human intervention, these programs frequently exploit human credulity, cupidity, or naiveté to persuade or trick the computer user into downloading, installing, or executing them.

We often describe these programs collectively as “malicious code” or “malware,” but these labels may not be accurate. For example, adware can improve the relevance of advertisements that users see and contribute to making certain programs or information available at no or low cost. Cookies can offer the same benefits as well as enhance consumer convenience and recognition when visiting familiar web sites. Spyware may include programs that allow parents to track their children’s computer use or facilitate remote diagnostic testing of computers. These uses are far from malicious, but the code may nevertheless operate without the knowledge of the computer user. Moreover, our current labels are not particularly helpful, because they often reflect judgments that are subjective and usually reflect a conclusion rather than aid in reaching one.