Spyware: What you don’t know can hurt you

Mon, 02/23/2015 - 3:15pm

    I love you.

    This powerful phrase was emailed to 1,000 computer owners in 2003. Unbeknownst to them, once they opened the email, the spyware program “Loverspy” was installed on their computers. And love had nothing to do with it.

    Carlos Enrique Perez-Melara of El Salvador, the creator of “Loverboy,” began marketing his product in 2003. Two years later he was indicted on 35 counts. Perez-Melara fled the country and remains on the FBI's cyber most wanted list.

    Nine years later, on Sept. 27, 2014, Hammad Akbar, chief executive officer of InvoCode, the company that sold StealthGenie spyware, was arrested in Los Angeles.

    Akbar was charged with “conspiring to advertise and sell the spyware application that could monitor calls, texts, videos and other communications on mobile phones — including Apple's iPhone, Google's Android, and Blackberry Limited's Blackberry — without detection,” according to a U.S. Department of Justice press release dated Sept. 29, 2014.

    “Spyware is an electronic eavesdropping tool that secretly and illegally invades individual privacy,” Assistant Attorney General Leslie R. Caldwell of the Justice Department’s Criminal Division in a press release from the Dept. of Justice Office of Public Affairs. “Make no mistake: selling spyware is a federal crime, and the criminal division will make a federal case out if it.”

    Akbar pleaded guilty to the charges against him on Nov. 25, 2014. He was fined $500,000 and ordered to give the product's source code to the government.

    The StealthGenie case made history; it was the first criminal case against a company for advertising and selling a spyware app for mobile devices. The case was also the first case of its kind in the U.S. to end in a criminal conviction for advertising and selling a mobile device spyware app.

    Use of spyware applications for the purpose of spying and control comes as no surprise to domestic violence advocates and activists.

    One such person is Cindy Southworth, vice president of development and innovation at the National Network to End Domestic Violence (NNEDV).

    “We're extraordinarily happy anytime a creator of spyware is held accountable,” Southworth said of the StealthGenie case. “It sends an important message, not only to manufacturers of spyware, but to users of spy software, to beware.

    “If you're spying on your spouse, you're committing a crime. And if you're developing spy software, you’re committing a crime.”

    Southworth started out at one of Maine's eight domestic violence advocacy agencies, serving Lewiston-Auburn. She began working at NNEDV in 2002, the same year she founded the organization's Safety Net Project, which addresses the use of technology in violence against women.

    Now an advocate on the national level, Southworth gave testimony to the Senate Judiciary Committee and Subcommittee on Privacy, Technology and the Law regarding the Location Privacy Protection Act in Washington, D.C. on June 4, 2014.

    During that testimony, Southworth told the committee that location technology with stealth mode was not required for legitimate use by parents and employers.

    Stealth mode, she said, “is designed to facilitate stalking and spying.”

    Southworth noted several website companies were marketing their product (StealthGenie being one of them) to be used for spying on/monitoring girlfriends or wives.

    Her recommendations: apps should have a visible reminder (icon) to forewarn the victim of the spyware; and to make the sale, operation and marketing of spyware/surreptitious applications, with a primary purpose of tracking an individual without their knowledge or consent, a criminal offense; and bring users of apps/programs for spying and stalking up on criminal charges.

    She asked the federal government to gather more information about the use of GPS for stalking, to facilitate the reporting of its use for this purpose; and to provide grants for training law enforcement.

    Southworth was not the first to make such recommendations regarding spyware.

    In October 2011, Sens. Al Franken and Chuck Grassley asked the Department of Justice and the Federal Trade Commission (FTC) to “use their full force to crack down on and prosecute the makers of these apps.” The following month, the Feds flagged StealthGenie for its website advertising.

    “My common sense bill will help a whole range of people — including victims of domestic violence,” Franken wrote in a press release dated Sept. 30, just after the Akbar/StealthGenie arrest. “My bill would finally put an end to GPS stalking apps that allow abusers to secretly track their victims, and it would also give consumers more control over their very sensitive location data.”

    Southworth's Safety Net Project conducts surveys every couple of years regarding domestic violence survivors abused through the use of technology. The results of the 2012 survey are online at http://nnedv.org/projects/safetynet.html.

    The 2014 survey will be released in the coming weeks, however, Southworth shared some of those statistics — pertaining to cell phone spyware and monitoring — in advance. The results are based on information received from 346 advocacy agencies in 46 states, excluding Delaware, Iowa and Louisiana.

    “We specifically asked about monitoring via text messaging and apps,” Safety Net Project Deputy Director Kaofeng Lee said. “This question also included an open-ended section that asked for examples. Here is one example: ‘A couple of abusers had victims’ phones set to some kind of “family plan.” They had access to everything on the phone, to all accounts used on the phone, basically turning “parental guidance”features into “stalk your partner.”’

    “I worked with a survivor this year whose abuser used a GPS tracking device; he put it on the victim's truck.”

    In the survey results, for the percentage of cases involving the use of apps on cell phones, the results were: monitoring: 187 (54 percent); and tracking/stalking: 181 (52 percent).  

    Cases involving the use of other cell phone features (call logs, monitoring activity on the phone, GPS tracking, turning on features through the carrier), monitoring: 136 (39 percent); tracking/stalking: 119 (34 percent).

    Some of the states represented by the agencies in the survey have prosecuted and convicted users of spyware. The earliest case occurred in Michigan in 2001 and involved an estranged husband installing eBlaster spyware on his estranged wife's computer.

    But the husband was prosecuted and convicted for eavesdropping and installing an eavesdropping device, unauthorized access and using a computer to commit a crime.

    Southworth said she gets a little impatient when she hears some members of law enforcement say the law isn't keeping up with technology.

    “The eavesdropping statutes [Wire Tap Act, now Electronic Communications Privacy Act] have been on the books forever. Just because a law doesn't specify 'spyware' it doesn't mean it wouldn't be covered,” Southworth said. “Intercepting communications is intercepting communications, and it is illegal. If we change the law every time a new device comes out we'll end up with statutes that are too narrow.”

    Southworth said that victims of domestic violence or teen dating abuse need to understand that these behaviors are crimes.

    “Trust your instincts,” Southworth said. “Look for patterns. If a boyfriend or husband knows more about phone calls or computer use than he should, contact your local advocacy group — but not from your phone or computer — for help and advice.”

    For more information or help, visit the following websites: www.newhopeforwomen.org; http://techsafety.org/resources-survivors; www.loveisrespect.org (recommended by Southworth, for teenagers).