It's time to start charging people for using stalkerware to harass their partners, watchdog group says

Canadian lawmakers need to crack down on the sale of digital spyware being used to track and harass victims of domestic violence, a leading digital watchdog group says.

In its latest report, The Citizen Lab, a research centre at the University of Toronto, describes how abusers can easily purchase so-called stalkerware apps and download them to their victim's mobile devices without their knowledge.

With the app installed, an abuser can remotely monitor their victim's every move, including phone calls, text messages, emails, online activity, contacts lists, calendar entries and location. In some cases, they can turn on the phone's microphone or take pictures.

The report concludes that anyone who uses stalkerware is potentially breaking a variety of laws — and the same goes for any company that markets an app for the purpose of stalking. But so far, the report says, police and prosecutors have turned a blind eye.

"Abusive partners are targeting and tracking others in a way that's inappropriate and unjust," said Christopher Parsons, a senior research associate at The Citizen Lab and one of the report's lead authors. "We need to do better as a society."

The report is the first comprehensive examination of the use of stalkerware in Canada. Researchers took a deep dive look at the eight most popular spyware apps made for Android devices and available to Canadians.

The apps are promoted primarily as tools for parents to keep track of their children or for employers to keep a close watch on their staff. But the researchers also found that many manufacturers openly market the apps as a good way to keep track of an intimate partner.

The report says one company's website, Highster Mobile, described its application as "the perfect tool to catch a cheating spouse."

"The user will never know the app is installed and collecting data," the site said.

'Spy scenario'

A blog post for another app, FlexiSPY, outlined how its Spoof SMS function could work in a "spy scenario."

"We have reason to believe that Margaret (our target phone) has been hanging out with Bill again — with whom she supposedly broke off an affair two months ago," the blog post said. "We've been tracking call logs, text and IM conversations, so we know they've been in contact again."

CBC asked Highster Mobile and FlexiSPY for comment but did not hear back. The main pages of both websites state their applications are designed for parental control and employee monitoring.

Parsons said an app can be installed "within a couple of minutes" if the user can get their hands on the other person's mobile device and knows the password. The app is concealed so the person targeted may never know it's there.

It's not known how often stalkerware is used in cases of domestic abuse. However, in a 2015 survey of Canadian women's shelters, 93 per cent of front-line workers said they had supported a woman who had been intimidated or threatened by someone using the technology.

Diana Galeano, a transitional housing support worker for Nellie's women's shelter in Toronto, said she has met several clients who were convinced an abusive partner was using their phone to stalk them.

In one case, the abuser turned up at his ex-partner's new home and stabbed her in the chest. The abuser was eventually sent to jail for the assault. Galeano said the woman had kept her new address a secret but continued to use the same cellphone. She thinks her ex-partner installed stalkerware on the phone to track her location.

Galeano said that even women who aren't physically assaulted are deeply traumatized by digital stalking. But when her clients have gone to police, they did not investigate, she said.

The police dismissed the women as "paranoid," she said.

"Unfortunately, they don't get any kind of help or support."

'Now they don't have an excuse'

But the Citizen Lab report concludes that stalkerware users are likely violating a host of criminal and civil laws, including criminal harassment and privacy laws. And manufacturers that knowingly sell the apps for the purpose of facilitating illegal behaviour could also be charged, the report says.

Parsons said he believes police and lawmakers haven't acted because they aren't familiar with how stalkerware is used. But he called on Federal Justice Minister David Lametti and Public Safety Minister Ralph Goodale to "take this issue seriously" and direct prosecutors and police to start pursuing digital stalkers.

"Now they don't have an excuse," he said. "There's a 200-page report."

He also said the manufacturers should be required to redesign their apps so that cellphone users are notified when the app is trying to access their information.

Tips to protect yourself

• A stalker needs physical access to your mobile device and its password to install an app. So change the password regularly.
• Experts say that if you suspect a stalkerware app has been installed on your phone, removing it or trying to shut it down could aggravate your stalker and put you in more danger. Diana Galeano at Nellie's women's shelter in Toronto tells her clients to take the phone to their service provider to check for suspicious applications and to get a new device if necessary.
• The Citizen Lab found that stalkerware cannot be installed on devices that use an up-to-date iOS operating system.