I don't agree that bad actors will move offshore. Some will, of course. But legislation could readily speak to the installation practices used by big US companies -- the kind of companies who have received hundreds of millions of dollars of VC funding (listings). Legislation could also speak to the kinds of advertising practices that may permissibly be used by big US companies. Since advertising expenditures by big US firms are what's fueling the spyware business, spyware is actually quite a bit easier to stop than, say, general hacking, viruses, worms, and other malware.