“Catch cheating spouses” the website for California-based HelloSpy, a smartphone app, says. There is a photo of a woman with a bruised face and a man grabbing her arm. Infidelity is easier these days because of online social networks and mobile phones, the page claims. But the “good news” is that technology can reveal infidelity too, it says.
On the site for another app, FlexiSpy, I seek help from a customer support agent. During a web chat, I say, “I think my wife is cheating.” The agent, whether human or bot, immediately asks whether I have physical access to her phone so I can install the app.
Neither HelloSpy nor FlexiSpy responded to a request for comment on these marketing practices. The sale of such apps is permitted in both the US and UK, but these disturbing examples demonstrate how the software easily slips into a legal grey area.
Advertisement
“Accessing the contents of someone’s phone now is accessing their life. We are very concerned about this”
The software itself is perfectly legal. For example, an employer might tell an employee that their work phone will be loaded with software that records everything they do. The employee’s consent may be explicitly granted in that case.
However, software can also be installed surreptitiously on someone’s device to snoop on their messages and phone calls. The use of such “stalkerware” seems to be on the rise. “Accessing the contents of someone’s phone now is accessing their life,” says Lucy Purdon at campaign group Privacy International. “We are very concerned about this.”
Once installed, stalkerware can be set up so as to be practically invisible to the phone’s owner. It might be used, for example, to monitor their location and movements using GPS. It can provide access to any text messages or pictures they send, or record everything they type. In some cases, stalkerware can even switch on the device’s microphone to eavesdrop on private conversations.
Purdon and her colleagues have examined apps that market themselves as helpful tools that allow parents to keep an eye on their kids. In reality, they offer unbridled access to children’s phones. “These tools go way beyond checking your child’s location,” she says.
Employers, parents and snooping partners have emerged as the three main target audiences for spy apps.
An found that, in the first eight months of 2019, more than 37,500 of its customers encountered spyware or stalkerware at least once – a 35 per cent rise on the same period in 2018. “We’re seeing a marked increase,” says David Emm, .
Another security firm, Avast, in July. All have since been removed as Google prohibits such apps.
Spy in your pocket
Many notorious stalkerware apps are built for Android, but there are variants that can be installed on iPhones running iOS as well. , Google software engineer Ivan Rodriguez described how stalkers can get around some of the security protections built into iOS and spy on the phone’s owner anyway.
But a crackdown is afoot. The US Federal Trade Commission (FTC) has just taken legal action against a Florida-based firm called Retina-X, which developed spyware apps called MobileSpy, PhoneSheriff and TeenShield. Among other things, the FTC said the company was , a practice it said was “unfair” since it put people at risk of being monitored illegally.
Despite this, stalkerware can still slip through legal loopholes. Neither the UK nor the US explicitly outlaw this software. Rather it is how it is used – for example to harass people or access their data without consent – that may fall foul of legislation.
There is a lack of international coordination over how to deal with the misuse of spy apps, says Christopher Parsons at the University of Toronto. He and his colleagues published an on the rise of stalkerware earlier this year.
Parsons says law enforcement agencies in different countries could collaborate to shut down firms that market their products for purposes that are abusive.
One issue is that this marketing can be covert. Parsons and his colleagues found that one London-based firm, mSpy, didn’t explicitly refer to spousal snooping on its website. Instead, web code concealed references to such spying as a means of attracting search traffic on the subject. mSpy didn’t respond to a request for comment.
Tactics like this can mean that some stalkerware apps only come to the attention of law enforcement when their targets report them – something Parsons says shouldn’t be necessary.
“Women are suffering incredibly serious harms because of this and they don’t have to,” he says. “Governments could solve this if they chose to.”
People who install stalkerware on their partners’ devices aren’t just invading their privacy. Emm says that because such apps often ask the installer to deactivate security protections, the target is left open to other cyberthreats such as malware.
“Some victims fear that their partners will use the information to blackmail or shame them”
Stalkerware providers themselves can also be targeted. In 2017, Retina-X was who was allegedly able to retrieve photos and data from the company’s servers of people being stalked. That such data was left vulnerable in this way was another reason the FTC decided to take action against the firm.
But it is perhaps the psychological impact of having your phone completely compromised by a romantic partner that is most insidious. Christina Dardis at Towson University in Maryland , including cases where stalkers turn to technology to spy on or harass their target, broadly known as cyberstalking.
Stressful situation
Such behaviour can cause post-traumatic stress disorder or depression, she says, as well as prompting worries of further abuses. “Some victims fear that their partners will use the information they obtain from their surveillance to blackmail or shame them,” says Dardis. Cyberstalking is also correlated with other forms of harassment, including physical stalking and sexual violence, she says.
Stalkerware is really a symptom of a deeper problem. “There’s kind of an assumption with technology misuse that if you remove the technology you stop the abuse,” says Erica Olsen at the US National Network to End Domestic Violence.
In reality, these apps clearly fulfil a disturbing demand. One review on FlexiSpy’s website, apparently left by a customer, says they purchased the software to keep tabs on their wife. Seeing her calls, photos and locations was “very helpful” the reviewer says, before adding: “I’ll be recommending this to anyone that needs to know.”
How to protect yourself
You might think that scanning your phone to detect stalkerware is a good idea. But be careful. Besides the fact that antivirus programs don’t always catch spy apps, a stalker could be alerted to your attempts to take protective actions and confront you.
“Some of these applications have the ability to see every web page that you go to,” says Christopher Parsons, co-author of a report looking at stalkerware. He recommends instead that people seek out advice directly from a domestic abuse charity or similar organisation if they think they are being targeted.
If you are confident that your device hasn’t already been compromised, David Emm of security firm Kaspersky suggests the best thing to do is lock down your phone. Not allowing your partner to know the passcode for your phone, which is ideally at least six digits long, is a good start. Then make sure that you have antivirus software installed and that your online accounts are protected with strong passwords.
Yet taking precautions against loved ones doesn’t come naturally, says Emm: “By definition, none of us is as unguarded as we are with a partner.”
- Affected by domestic violence? UK : 0808 2000 247; US : 1-800-799-7233; In Australia, : 1800 737 732. Search online for local alternatives.
