FTC Brings First Case Against Developers of “Stalking” Apps

https://www.ftc.gov/news-events/press-releases/2019/10/ftc-brings-first-case-against-developers-stalking-apps

by detaro • 7 years ago

157 125 7 years ago

_bfhp• 7 years ago

I've never heard of these apps and it's really alarming and at the same time not surprising at all. I can only imagine how widespread this is... I'm tempted to print out flyers with that NNEDV graphic to put up in public

techntoke2• 7 years ago

These apps are against the law, but you can still implement the built-in location tracking and activity history of the devices? Seems weird to me. They probably forgot to pay the lobbyists in the industry.

relaunched2• 7 years ago

Think of it this way, chefs knives are legal. Murder is not. If you work in my restaurant, you can use the chefs knives to make food. You can't use them to kill people. If you do, you will be prosecuted.

techntoke2• 7 years ago

I don't see how this analogy is relevant. They aren't accused of killing people. They are accused of having apps that are used to monitor devices (as they said was for work and kids). Google does this as well as many other apps on the Play Store. Just because someone uses the app by to stalk someone by getting access and installing it on a user's device, won't prevent them from using another feature that already exists to do the same thing.

bendbro4• 7 years ago

In your world:

Chef knife :: the app

Chef knife mfg :: the app developer

Murder :: stalking

Cooking :: legal tracking

The law prosecutes app developers and makes illegal apps that allow for stalking. :: The law prosecutes chef knife mfgs and makes illegal chef knifes that can be used for murder.

This is not you have stated. Your example world does not map to the real world, as it is a paradox to think a "murdering chef knife" can be discriminated from a "cooking chef knife" when the manufacturer creates it.

And that is the point of the parent commenter. A tracking app can be used for both legal tracking and stalking, but it is absurd to think the developer will know which it is.

TheSpiceIsLife4• 7 years ago

I don't understand why people insist on making these analogies when it's quite clear and simple what the issues are / can be with the sorts of apps under discussion here today.

relaunched2• 7 years ago

>>The FTC alleges that Retina-X and Johns developed three mobile device apps that allowed purchasers to monitor the mobile devices on which they were installed, without the knowledge or permission of the device’s user.

They are being accused of taking no precautions to make sure their app was being used in a legal way (employees and children), as well as violating child privacy laws and deliquent security practices.

To your other point, selling a legal service that can be used in an illegal way often has legal reprecussions, especially when you ignore compliance w/ applicable laws.

trhway• 7 years ago

I wonder whether these apps are used by police, cool TV FBI agents and the likes, and whether their ability to fight terrorism, drug and human trafficking, etc would get negatively impacted by limiting of those apps.

inetknght• 7 years ago

whether their ability to fight terrorism, drug and human trafficking, etc would get negatively impacted by limiting of those apps.

I seriously doubt it. First that I strongly disagree with the war on drugs. Second because, while human trafficking is certainly a problem, I think the scope of the problem is made out to be far larger than it is in actuality; it's often hand-waived for more security, more laws... but what are the actual yearly numbers of people trafficked?

If the FBI gets a warrant to find you using your phone, they don't need to install an app for that. If they want to see what's on the phone then surreptitiously installing an app isn't going to guarantee that either.

kevingadd• 7 years ago

Even if these apps are used by the police etc, that's typically only allowed if they make sure to only sell to cops. Of course, that's usually not actually enforced, but services like GPS tracking arbitrary phones or cracking iPhone passcode security are usually limited in this fashion.

_underfl0w_• 7 years ago

Law enforcement wouldn't need a 3rd party app on the phone when they have 3rd party products like GrayKey boxes.

mindgam32• 7 years ago

Good. The stalkerware problem is bigger than most people realize. Teens whose parents use Life360 to stalk them are already well aware of the issue.

http://www.wired.com/story/life360-location-tracking-familie...

droithomme2• 7 years ago

Teens whose parents use...

The FTC order allows them to do so. The problem was the apps are marketed to monitor employees and minors of which the installer is the legal guardian, both which are completely legal. But it was being used in some cases by customers to monitor other adults, which is not legal without consent. The company agreed to get the users to check a box saying it was being used for minors or employees, both which remain legal uses of the apps.

mindgam32• 7 years ago

My point is: using these apps to monitor people without legal consent is super not cool, obviously, but there’s an even bigger problem which is parents relying on legal-but-shady stalking apps. Parents and kids need to be able to trust each other. Surveilling your kids is not the answer. Full stop.

jdnenej• 7 years ago

A better system would be to require that it is very clear the user is being monitored. Some kind of persistent notification and popup on every boot notifying the user of the software. This way it still works fine for corporate setups but is useless for stalkers

C1sc0cat3• 7 years ago

Never knew my employer was my legal guardian :-)

raxxorrax• 7 years ago

So I could legally stalk employees? That is a ridiculous back door.

singingboyo2• 7 years ago

There's nothing forcing someone to install the app, at least in a stalker situation. Secretly install... maybe, but check your damn phone permissions, people! As with many things, there are good and bad use cases.

For teens, it's a bit more complicated due to family dynamics, but frankly this seems like a parenting issue that has not changed significantly from how things worked before. Instead, it's just changed form slightly because parents can passively track rather than actively pestering their kids about where they were/are/will be. Bad parenting is not a technological creation.

Also, maybe Life360 is just a questionable example, but as far as I know everything there can be toggled in app. Permissions can be denied too. Unless parental controls can stop those options?

azernik2• 7 years ago

These apps were designed to be installed when the phone owner left their phone unguarded, and to be unnoticed by the phone owner. Poor man's Evil Maid attack.

TFA:

"To install the apps, the purchasers were required to bypass mobile device manufacturer restrictions, which the FTC alleges exposed the devices to security vulnerabilities and likely invalidated manufacturer warranties. In addition, while Retina-X claimed in its legal policies that the apps were intended for monitoring employees and children, Retina-X did not take any steps to ensure that its apps were being used for these purposes.

Each of the apps provided purchasers with instructions on how to remove the app’s icon from appearing on the mobile device’s screen so that the device’s user would not know the app was installed on the device, according to the complaint."

3wolf• 7 years ago

This is small potatoes compared to the number of apps out there periodically harvesting a users' locations to be aggregated and sold to some quant fund.

vkou2• 7 years ago

Really?

I don't give a damn that my data is anonymized, aggregated, and sold to some asshole on Wall Street, who uses it to make a stock trade. Even if it's not anonymized well, this is not a physical threat to my safety, because the people buying the data don't care about me. I'm not special. And they don't care about hurting me - they just want to make stock trades.

I mean, I care about this sort of thing - but I care only a little.

I sure as hell care that someone might be using the information on my phone to physically stalk me, in particular. The latter is an active threat to my life and limb.

jakemal2• 7 years ago

This is a common argument against privacy measures and a very slippery slope. If it's fine to sell to Wall Street, should it be fine to sell to insurance companies? Who can use that information to label your habits as "high risk" and adjust your premiums as such?

It's much more difficult to take back your privacy than it is to maintain it in the first place.

TheSpiceIsLife4• 7 years ago

Yours is a legitimate concern, but a separate issue.

Stalking can present real, immediate, and severe consequences to the target(s).

everlastingfan2• 7 years ago

Right, don't talk about advanced persistent threats here.

theNJR• 7 years ago

Can you talk more about that? What do the quant funds do with this data?

oh_sigh• 7 years ago

You can predict earnings movement from knowing how many people visit a retail location.

geoffreyhale• 7 years ago

What's the problem here? I don't see it. I see family opt-in location sharing.

LeonB• 7 years ago

For example, abusive partners can use it to track their partner and continue to track them when they (hopefully) become ex partners.

C1sc0cat3• 7 years ago

And some times kill the ex partner sadly in some cases.

Back when I worked for a large telco we had a training film about why you should never look up data on our systems for a "friend" and there was a real case of this happening.

somejerk1232• 7 years ago

Once upon a time, I found this company's software on an employee's work laptop, installed by a jealous ex-boyfriend.

I called the company, and they refused to remove our data or even help with uninstalling the software without a court order.

The software helpfully logged the URL when it saved screenshots to S3, which it did every few seconds.

The S3 bucket was fully public, listable, readable, writable. It also contained keylogging and other data.

Not just from our employee. From everyone.

nkrisc• 7 years ago

Did the data spontaneously delete itself?

matheusmoreira• 7 years ago

Did you get a court order?

koolba• 7 years ago

Could you overwrite the existing data?

derefr• 7 years ago

Perhaps you should have just sent the link to the S3 bucket to a news organization. Things would have handled themselves from there.

somejerk1232• 7 years ago

Between the red text on all their sites and this settlement, I'd say things did handle themselves.

The employee and jealous ex even made up, got married, and have children now.

Everybody lived happily ever after.

nitwit005• 7 years ago

You could report them to AWS for violating the acceptable use policy. They have a line in there about interception: https://aws.amazon.com/aup/

meowface3• 7 years ago

People need to stop calling it (just) stalkerware and call it what it obviously is: malware. It's no different from any other form of malware. Just the criminals are probably people you know rather than online opportunists.

Dylan16807• 7 years ago

I think 'stalkerware' sounds much worse, so I'm not sure how that helps.

peteretep2• 7 years ago

You seem to think that "malware" sounds worse and somehow more specific than "stalkerware". Stalkerware sounds like a more nefarious subset of malware, and I'm not sure what conflating a more specific term into a less specific one achieves

DoreenMichele8• 7 years ago

Stalkerware specifies the malicious intent. It helps clarify what the problem space is.

pjc50• 7 years ago

These days I would hope the GDPR big hammer could be brought to bear on such cases.

(Also, you could make the argument that installing such software on someone else's work laptop constitutes IP theft and/or breach of local computer security laws...)

Jerry2• 7 years ago

From the article:

Retina-X and Johns marketed one of the apps, called MobileSpy, to monitor employees and children. Retina-X promoted two other apps, called PhoneSheriff and TeenShield, to monitor mobile devices used by children. Retina-X sold more than 15,000 subscriptions to all three stalking apps before the company stopped selling them in 2018.

MobileSpy's website [1] is still up but they now have an "apology" for getting hacked from 2018:

Regrettably Retina-X Studios, which offers cutting edge technology that helps parents and employers gather important information on devices they own, has been the victim of sophisticated and repeated illegal hackings. Over the past year, Retina-X Studios has begun to implement steps designed to enhance our security measures which had the positive outcome of restricting data obtained by the hackers in the most recent intrusion. No personal data was accessed, but some photographic material of TeenShield and PhoneSheriff customers has been exposed.

These apps also appear to be Android only. I don't see how they could run something like this without a jailbreak.

[1] https://www.mobile-spy.com/

kizer• 7 years ago

Holy shit... what?! People have been stalking their partners using hidden apps? Is jealousy this powerful? WTF - that legitimately sounds crazy to me.

SmallDeadGuy• 7 years ago

Each of the apps provided purchasers with instructions on how to remove the app’s icon from appearing on the mobile device’s screen so that the device’s user would not know the app was installed on the device, according to the complaint.

For the legitimate uses of this app, there should be absolutely no need to remove the app icon from the home screen and there should be a regular/persistent notification of when monitoring is in effect. I can't believe that the company would even think this is a good idea for their intended use, let alone ignoring how it enables malicious behaviour.

FTC Brings First Case Against Developers of “Stalking” Apps

Related Stories