The Predator in Your Pocket A Multidisciplinary Assessment of the Stalkerware Application Industry

Executive Summary

Persons who engage in technology-facilitated violence, abuse, and harassment sometimes install spyware on a targeted person’s mobile phone. Spyware has a wide range of capabilities, including pervasive monitoring of text and chat messages, recording phone logs, tracking social media posts, logging website visits, activating a GPS system, registering keystrokes, and even activating phones’ microphones and cameras, as well as sometimes blocking incoming phone calls. These capabilities can afford dramatic powers and control over an individual’s everyday life. And when this software is used abusively, it can operate as a predator in a person’s pocket, magnifying the pervasive surveillance of the spyware operator.

Intimate partner violence, abuse, and harassment is routinely linked with efforts to monitor and control a targeted person. As new technologies have seeped into everyday life, aggressors have adopted and repurposed them to terrorize, control, and manipulate their current and former partners. When National Public Radio conducted a survey of 72 domestic violence shelters in the United States, they found that 85% of domestic violence workers assisted victims whose abuser tracked them using GPS. The US-based National Network to End Domestic Violence found that 71% of domestic abusers monitor survivors’ computer activities, while 54% tracked survivors’ cell phones with stalkerware. In Australia, the Domestic Violence Resources Centre Victoria conducted a survey in 2013 that found that 82% of victims reported abuse via smartphones and 74% of practitioners reported tracking via applications as often occurring amongst their client base. In Canada, a national survey of anti-violence support workers from 2012 found that 98% of perpetrators used technology to intimidate or threaten their victims, that 72% of perpetrators had hacked the email and social media accounts of the women and girls that they targeted, and that a further 61% had hacked into computers to monitor online activities and extract information. An additional 31% installed computer monitoring software or hardware on their target’s computer.

Spyware that possesses powerful surveillance capabilities are routinely marketed to consumer audiences to facilitate intimate partner surveillance, parent-child monitoring, or monitoring of employees. When these powerful capabilities are used to facilitate intimate partner violence, abuse, or harassment, we refer to such spyware as stalkerware.

Across a range of use-cases, spyware can easily transform into stalkerware. Perhaps most obviously, spyware that is explicitly sold or licenced to facilitate intimate partner violence, abuse, or harassment, including pernicious intrusions into the targeted person’s life by way of physical or digital actions, constitutes stalkerware by definition. However, spyware can also operate as stalkerware when surveillance software that is sold for ostensibly legitimate purposes (e.g., monitoring young children or employees) is repurposed to facilitate intimate partner violence, abuse, or harassment. To be clear, this means that even application functions which are included in mobile operating systems, such as those which help to find one’s friends and colleagues, can constitute stalkerware under certain circumstances.

“The Predator in Your Pocket: A Multidisciplinary Assessment of the Stalkerware Application Industry” is a report that was collaboratively written by researchers from computer science, political science, criminology, law, and journalism studies. As befits their expertise, the report is divided into several parts, with each focusing on specific aspects of the consumer spyware ecosystem, which includes: technical elements associated stalkerware applications, stalkerware companies’ marketing activities and public policies, and these companies’ compliance with Canadian federal commercial privacy legislation.

Part 1 discusses the harms which are associated with a person being targeted by stalkerware, the full range of marketed capabilities associated with such malicious software, and lays out our justification for conducting research into a small handful of companies: in short, we found that the following companies appeared to be the most popular in the commercial markets in Canada, the United States, and Australia, and so we directed our resources on examining:

1) FlexiSPY;
2) Highster Mobile;
3) Hoverwatch;
4) Mobistealth;
5) mSpy;
6) TeenSafe;
7) TheTruthSpy; and
8) Cerberus.

The rest of Part 1 provides a literature review for the subsequent Parts of the report, and makes clear where our research is meant to fill gaps in the published literature, or otherwise to reconfirm or retest results which have been published by other researchers. We posed a series of research questions based on assessments of relevant disciplinary literatures which are taken up in each of the following Parts of the report.

Part 2 undertakes a technical assessment of specific stalkerware applications. We focused on Android applications because Android-based stalkerware involves actually installing malware on a targeted person’s devices. This process stands in contrast to stalkerware for iOS, which routinely depends on obtaining a targeted person’s iCloud password to exfiltrate information for the person’s iCloud backups. In the course of our research, we examined network activity, measured protection from commercial anti-virus products as well as Google’s Play Protect system, and determined the extent to which stalkerware applications’ self-update mechanisms might expose targeted persons to digital security risks in excess of those exclusively associated with the violence, abuse, and harassment from the operator of the stalkerware. Emergent from this research, we found that:

• Stalkerware we examined depends on intermediaries, principally located in the United States, Netherlands, and Hong Kong;
• Antivirus products generally identify stalkerware apps as being malicious;
• Google Play Protect can block stalkerware installation and remove installed stalkerware but it may not protect against the newest versions of stalkerware applications until a period of time after they are released; and
• Stalkerware developers insecurely implemented software update systems.

In Part 3, we evaluated how companies which sold stalkerware, and software which could be repurposed as stalkerware, marketed their products to prospective customers. We used marketing intelligence methods, as well as content analysis, to conclude that many of the companies studied were actively promoting their software for the purposes of facilitating stalking and, by extension, intimate partner violence, abuse, and harassment. More specifically, we found that:

• Consumer spyware companies’ blog and search engine optimization content revealed that most companies had extensive references to spousal monitoring;
• One company, mSpy, encoded concealed HTML text which advertised spousal spying on their website as a way to make their products more easily discoverable by people searching for ways to conduct intimate partner surveillance;
• Few companies significantly purchased Google Ads as part of their search engine optimization strategies, with the exception of mSpy;
• The substance of paid Google Ads tended to favour the use of the tools for general spying, hacking, or tracking, and did not include adwords that might help persons targeted by stalkerware to detect or remove the respective companies’ software; and
• Individual organic searches that related to the spyware companies in our sample overwhelmingly favoured terms that identified the general use of the tools for spying, hacking, or tracking, and explicitly noted the circumvention of security features of products associated with the broader digital ecosystem.

Part 4 of the report undertook a content assessment of companies’ user-facing public policies. We interrogated companies’ respective privacy policies, terms of service documents, and End User Licence Agreements using a structured question set. This methodology let us better understand the policies which the companies adopted concerning the collection, processing, and storage of personal information
associated with stalkerware operators as well as with the persons targeted by these operators. Emergent from this assessment, we concluded that the companies:

• Failed to make it clear how the victims of stalkerware can have their data deleted when they have not meaningfully consented to the collection;
• Failed to fully account for the personally identifiable information that can be captured when operating the software, thus circumventing the purpose and rationale of privacy policies to educate those affected by software to understand how it operates and collects such information; and
• Failed to adopt policies to notify persons targeted by stalkerware in the case of data breaches, or even individuals contracting for the services.

In Part 5, we conducted an assessment of stalkerware companies’ business practices through the lens of Canada’s federal commercial privacy law, the Personal Information Protection and Electronic Documents Act (PIPEDA). Our assessment examined the extent to which companies are accountable to PIPEDA and their corresponding obligations. We ultimately concluded that:

• Stalkerware companies should be found accountable under PIPEDA for the collection and processing of targeted persons’ personal data on the basis that the companies collect personal information, engage in relevant commercial activities, and collect, use, or disclose targeted persons’ data;
• Given the potential for stalkerware companies to argue that they are exempt from PIPEDA’s obligations, the OPC should issue an interpretation bulletin or additional accompanying statement to the Guidelines for obtaining meaningful consent or Guidance on inappropriate data practices that specifically address stalkerware, or the use of spyware in abusive contexts. Additionally, Parliament should consider reforming commercial sector data protection legislation to close loopholes that we have identified;
• Stalkerware companies ought to be obligated under PIPEDA to have extremely stringent data security practices based on the sensitivity of the data that they collect, process, disclose, and store; this pertains when these applications are used for ostensibly “legitimate” purposes and, as such, should apply to the collection of intimate data in the course of products being (re)purposed for stalkerware; and
• PIPEDA and the European Union’s General Data Protection Regulation (GDPR) identify significant obligations that are imposed upon companies which sell products that have features enabling them to be used as stalkerware. The strength of the GDPR is ultimately found in the significant financial penalties which can be assigned to companies which fail to comply with the law. This is a strength that Parliament should add to PIPEDA by way of enabling the Privacy Commissioner of Canada to impose administrative monetary penalties and directly enforce its recommendations on companies.

Notably, PIPEDA only applies to the activities undertaken by business and organizations; as such, our assessment does not attend to the broader Canadian criminal law, tort law, privacy law, product liability, consumer protection, intellectual property, and intermediary liability law that are attached to the legality of using, creating and developing, selling, or facilitating the distribution of stalkerware applications. A broader legal assessment of stalkerware, as well as a set of recommendations for legal and policy reform to address some of the harms that stalkerware engenders, can be found in a companion report entitled “Installing Fear: A Canadian Legal and Policy Analysis of Using, Developing, and Selling Smartphone Spyware and Stalkerware Applications.”

In Part 6, we collect our major findings from our multidisciplinary research and propose a range of recommendations that would mitigate some of the harms associated with stalkerware companies’ practices and products. We focused on issues associated with consent, accountability and redress by jurisdiction, as well as data security and data protection. Specifically, our major findings included:

• There were significant and disturbing failures by the companies in this study to obtain meaningful and ongoing consent, which seriously increased the risks and threats faced by those who operators target with stalkerware. This omission was further marked by failures to ensure that targeted persons could exercise their data access and deletion rights under Canadian privacy law;
• While these companies were accountable under Canadian consumer privacy law, the limited ‘bite’ of that law may impede its ability—and, by extension, that of the Office of the Privacy Commissioner of Canada—to establish preemptive deterrence or ex post remedy and enforcement;
• Not all of the companies in this study indicated that data security was a meaningful element in their privacy policies, despite Canadian law imposing data security obligations; and
• Google’s Play Protect service in tandem with antivirus applications appeared, in initial testing, to relatively reliably identify stalkerware. However, more long-term testing is required to further confirm these results.

Ultimately, the availability of stalkerware applications is the result of broader social conditions that either lead developers to believe it is appropriate to create software designed for stalking or, alternately, to create applications for ostensibly legitimate purposes that can be repurposed to facilitate surreptitious intimate partner surveillance. The recommendations that we propose in this report might, if adopted, rebalance stark information asymmetries between the operator and target(s) of stalkerware. This rebalancing would address a core aspect of how stalkerware works as a tool to facilitate intimate partner violence, abuse, and harassment: by mitigating the potential for operators to engage in pervasive and surreptitious surveillance. Adopting these recommendations would also ensure meaningful and ongoing consent to any individuals that might use these tools for ostensibly legitimate purposes.

These recommendations are, however, only part of a much broader series of technical and social transformations which are required to remedy the wider, and pervasive, issues that give rise to forms of gender-related violence, abuse, and harassment. While the technical and legal remedies outlined in this report might provide important relief in the context of consumer spyware, the ongoing struggle to transcend patriarchal gender inequalities, misogyny, and corrosive societal norms around controlling, abusive, and violent behaviour directed at women, girls, non-binary persons, and children is an undertaking that requires critical and supportive communities at its core. We hope that this report provides insight into some of the deleterious manifestations of these norms, and that the structural recommendations which we provide help to alleviate some of these long-standing social harms.

Read the full report here