WASHINGTON -- Congress' good intentions may also be good business for the $2.8 billion shady world of the spyware industry. Pending anti-spyware legislation may, in fact, end up legitimizing bad actors.

That's the take of Richard Stiennon, vice president of threat research at anti-spyware firm Webroot. Stiennon, who spoke at the Gartner IT Security Summit here today, thinks Congress should do less, rather than more, when it comes to federal anti-spyware bills.

Last month, the U.S. House of Representatives passed two anti-spyware measures. One bill (I-SPY Act) imposes tougher criminal penalties for spyware-related activities.

The other bill (SPY Act) also increases penalties but includes an opt-in, notice and consent regime for legal software -- adware -- that collects personally identifiable information from consumers.

Both bills contain a long list of exemptions, including pre-purchase installations, cookies and software and network security upgrades.

"I'm leaning toward preferring the increase in penalties for bad acting," Stiennon told internetnews.com. "By setting a lot of definitions, you're going to have some of the perpetrators just modifying their behavior to comply with this new law and then start legal activities to get index spyware vendors to stop listing them."

In particular, Stiennon said, adware companies might be able to say, "Hey, we comply with this new law, the Federal Trade Commission doesn't have a problem with what we're doing and you shouldn't identify us this way."

Prominent adware firms such as Claria have in recent months mounted public relations campaigns to distinguish themselves from spyware companies. The purpose of adware is to drive visitors to advertisers' Web sites. Adware writers and distributors redirect browsers and generate pop-up adds.

Adware vendors contend they obtain consent before installing their software. Spyware, on the other hand, distributes pop-up advertising without consent and often in malicious ways.

With or without a new law, Stiennon vowed to continue to list adware vendors in Webroot's quarterly rankings of top threats to network security.

"I certainly agree they are adware companies, that's how we identify them," Stiennon said. "The one thing we won't stop doing is to identify them as adware companies as long as they serve ads and support free software with ads."

He also scoffed at adware firms' claims of notice and consent, saying, "If they truly gave end users full disclosure, they wouldn't have any customers."

Adware consent, he said, should read: "This product is going to pop up a million ads in your face and it's going to significantly reduce the performance of your computer and increase boot times by 30 seconds."

Stiennon also shrugged off the idea of adware lawsuits against Webroot seeking to be de-listed as a threat.

"Sadly, in this country anybody can sue anyone for anything," he said. "I don't think anybody could win one of those cases because you will not find 12 U.S. citizens who feel sorry for adware vendors."

Ultimately, Stiennon said, federal anti-spyware legislation will be as effective as the CAN-SPAM Act, Congress' effort to curb unwanted and unsolicited e-mail.

"Legislation isn't going to make it go away. Maybe it will push it offshore," he said. "The CAN-SPAM Act has done some good, but there's more spam now than when CAN-SPAM passed. It's made it more expensive for legitimate companies to engage in spam, and this will be the exact same with spyware."