For years computer viruses have threatened productive use of personal computers, challenging users and support providers to prevent and recover from viral attacks. Now another type of computing malady has begun to enter popular consciousness: spyware. Typically, analyses of spyware focus on technical issues or provide pointers to resources for detecting and removing unwanted software. Equally important are the legal and policy issues colleges and universities need to consider in assessing institutional responses to spyware on campus. In this article, the author contends that institutional policies must address both computer usage and compliance with federal and state laws and offers a number of steps that colleges and universities should consider taking to address this particular situation and spyware in general. (Contains 6 endnotes.)