The I-SPY Act, formally known as the Internet Spyware Prevention Act of 2005 (H.R. 744), is a bill in the U.S. Congress that would criminalize the unauthorized use of spyware, phishing, and other methods of using the Internet to obtain sensitive personal information without someone's knowledge and consent. The bill passed the U.S. House of Representatives on May 23, 2005.
The new law would impose fines and/or prison sentences on corporations or individuals convicted of using malware to obtain protected information. It would also forbid any entity or person from bringing a civil action under the law of any state if such action was premised in whole or in part on the use of illegally obtained protected information. Protected information, as defined in the I-SPY Act, includes first and last names, home or other physical addresses, e-mail addresses, telephone numbers, Social Security numbers, tax identification numbers, driver's license numbers, passport numbers, other government-issued identification numbers, credit card numbers, bank account numbers, and passwords or access codes associated with credit card or bank accounts.
If it becomes law, the I-SPY Act will not apply to government agencies involved in national security operations and investigations.