Technology, Thoughts & Trinkets

Touring the digital through type

Category: Surveillance (page 1 of 31)

A Predator in Your Pocket : A Multidisciplinary Assessment of the Stalkerware Application Industry

With a series of incredible co-authors at the Citizen Lab, I’ve co-authored a report that extensively investigates the stalkerware ecosystem. Stalkerware refers to spyware which is either deliberately manufactured to, or repurposed to, facilitate intimate partner violence, abuse, or harassment. “A Predator in Your Pocket” is accompanied by a companion legal report, also released by the Citizen Lab. This companion report is entitled “Installing Fear: A Canadian Legal and Policy Analysis of Using, Developing, and Selling Smartphone Spyware and Stalkerware Applications,” and conducts a comprehensive criminal, civil, regulatory, and international law assessment of the legality of developing, selling, and using stalkerware.

A Predator In Your Pocket: Executive Summary

Persons who engage in technology-facilitated violence, abuse, and harassment sometimes install spyware on a targeted person’s mobile phone. Spyware has a wide range of capabilities, including pervasive monitoring of text and chat messages, recording phone logs, tracking social media posts, logging website visits, activating a GPS system, registering keystrokes, and even activating phones’ microphones and cameras, as well as sometimes blocking incoming phone calls. These capabilities can afford dramatic powers and control over an individual’s everyday life. And when this software is used abusively, it can operate as a predator in a person’s pocket, magnifying the pervasive surveillance of the spyware operator.

Intimate partner violence, abuse, and harassment is routinely linked with efforts to monitor and control a targeted person. As new technologies have seeped into everyday life, aggressors have adopted and repurposed them to terrorize, control, and manipulate their current and former partners. When National Public Radio conducted a survey of 72 domestic violence shelters in the United States, they found that 85% of domestic violence workers assisted victims whose abuser tracked them using GPS. The US-based National Network to End Domestic Violence found that 71% of domestic abusers monitor survivors’ computer activities, while 54% tracked survivors’ cell phones with stalkerware. In Australia, the Domestic Violence Resources Centre Victoria conducted a survey in 2013 that found that 82% of victims reported abuse via smartphones and 74% of practitioners reported tracking via applications as often occurring amongst their client base. In Canada, a national survey of anti-violence support workers from 2012 found that 98% of perpetrators used technology to intimidate or threaten their victims, that 72% of perpetrators had hacked the email and social media accounts of the women and girls that they targeted, and that a further 61% had hacked into computers to monitor online activities and extract information. An additional 31% installed computer monitoring software or hardware on their target’s computer.

Spyware that possesses powerful surveillance capabilities are routinely marketed to consumer audiences to facilitate intimate partner surveillance, parent-child monitoring, or monitoring of employees. When these powerful capabilities are used to facilitate intimate partner violence, abuse, or harassment, we refer to such spyware as stalkerware.

Across a range of use-cases, spyware can easily transform into stalkerware. Perhaps most obviously, spyware that is explicitly sold or licenced to facilitate intimate partner violence, abuse, or harassment, including pernicious intrusions into the targeted person’s life by way of physical or digital actions, constitutes stalkerware by definition. However, spyware can also operate as stalkerware when surveillance software that is sold for ostensibly legitimate purposes (e.g., monitoring young children or employees) is repurposed to facilitate intimate partner violence, abuse, or harassment. To be clear, this means that even application functions which are included in mobile operating systems, such as those which help to find one’s friends and colleagues, can constitute stalkerware under certain circumstances.

“The Predator in Your Pocket: A Multidisciplinary Assessment of the Stalkerware Application Industry” is a report that was collaboratively written by researchers from computer science, political science, criminology, law, and journalism studies. As befits their expertise, the report is divided into several parts, with each focusing on specific aspects of the consumer spyware ecosystem, which includes: technical elements associated stalkerware applications, stalkerware companies’ marketing activities and public policies, and these companies’ compliance with Canadian federal commercial privacy legislation.

Part 1 discusses the harms which are associated with a person being targeted by stalkerware, the full range of marketed capabilities associated with such malicious software, and lays out our justification for conducting research into a small handful of companies: in short, we found that the following companies appeared to be the most popular in the commercial markets in Canada, the United States, and Australia, and so we directed our resources on examining:

1) FlexiSPY;
2) Highster Mobile;
3) Hoverwatch;
4) Mobistealth;
5) mSpy;
6) TeenSafe;
7) TheTruthSpy; and
8) Cerberus.

The rest of Part 1 provides a literature review for the subsequent Parts of the report, and makes clear where our research is meant to fill gaps in the published literature, or otherwise to reconfirm or retest results which have been published by other researchers. We posed a series of research questions based on assessments of relevant disciplinary literatures which are taken up in each of the following Parts of the report.

Part 2 undertakes a technical assessment of specific stalkerware applications. We focused on Android applications because Android-based stalkerware involves actually installing malware on a targeted person’s devices. This process stands in contrast to stalkerware for iOS, which routinely depends on obtaining a targeted person’s iCloud password to exfiltrate information for the person’s iCloud backups. In the course of our research, we examined network activity, measured protection from commercial anti-virus products as well as Google’s Play Protect system, and determined the extent to which stalkerware applications’ self-update mechanisms might expose targeted persons to digital security risks in excess of those exclusively associated with the violence, abuse, and harassment from the operator of the stalkerware. Emergent from this research, we found that:

  • Stalkerware we examined depends on intermediaries, principally located in the United States, Netherlands, and Hong Kong;
  • Antivirus products generally identify stalkerware apps as being malicious;
  • Google Play Protect can block stalkerware installation and remove installed stalkerware but it may not protect against the newest versions of stalkerware applications until a period of time after they are released; and
  • Stalkerware developers insecurely implemented software update systems.

In Part 3, we evaluated how companies which sold stalkerware, and software which could be repurposed as stalkerware, marketed their products to prospective customers. We used marketing intelligence methods, as well as content analysis, to conclude that many of the companies studied were actively promoting their software for the purposes of facilitating stalking and, by extension, intimate partner violence, abuse, and harassment. More specifically, we found that:

  • Consumer spyware companies’ blog and search engine optimization content revealed that most companies had extensive references to spousal monitoring;
  • One company, mSpy, encoded concealed HTML text which advertised spousal spying on their website as a way to make their products more easily discoverable by people searching for ways to conduct intimate partner surveillance;
  • Few companies significantly purchased Google Ads as part of their search engine optimization strategies, with the exception of mSpy;
  • The substance of paid Google Ads tended to favour the use of the tools for general spying, hacking, or tracking, and did not include adwords that might help persons targeted by stalkerware to detect or remove the respective companies’ software; and
  • Individual organic searches that related to the spyware companies in our sample overwhelmingly favoured terms that identified the general use of the tools for spying, hacking, or tracking, and explicitly noted the circumvention of security features of products associated with the broader digital ecosystem.

Part 4 of the report undertook a content assessment of companies’ user-facing public policies. We interrogated companies’ respective privacy policies, terms of service documents, and End User Licence Agreements using a structured question set. This methodology let us better understand the policies which the companies adopted concerning the collection, processing, and storage of personal information
associated with stalkerware operators as well as with the persons targeted by these operators. Emergent from this assessment, we concluded that the companies:

  • Failed to make it clear how the victims of stalkerware can have their data deleted when they have not meaningfully consented to the collection;
  • Failed to fully account for the personally identifiable information that can be captured when operating the software, thus circumventing the purpose and rationale of privacy policies to educate those affected by software to understand how it operates and collects such information; and
  • Failed to adopt policies to notify persons targeted by stalkerware in the case of data breaches, or even individuals contracting for the services.

In Part 5, we conducted an assessment of stalkerware companies’ business practices through the lens of Canada’s federal commercial privacy law, the Personal Information Protection and Electronic Documents Act (PIPEDA). Our assessment examined the extent to which companies are accountable to PIPEDA and their corresponding obligations. We ultimately concluded that:

  • Stalkerware companies should be found accountable under PIPEDA for the collection and processing of targeted persons’ personal data on the basis that the companies collect personal information, engage in relevant commercial activities, and collect, use, or disclose targeted persons’ data;
  • Given the potential for stalkerware companies to argue that they are exempt from PIPEDA’s obligations, the OPC should issue an interpretation bulletin or additional accompanying statement to the Guidelines for obtaining meaningful consent or Guidance on inappropriate data practices that specifically address stalkerware, or the use of spyware in abusive contexts. Additionally, Parliament should consider reforming commercial sector data protection legislation to close loopholes that we have identified;
  • Stalkerware companies ought to be obligated under PIPEDA to have extremely stringent data security practices based on the sensitivity of the data that they collect, process, disclose, and store; this pertains when these applications are used for ostensibly “legitimate” purposes and, as such, should apply to the collection of intimate data in the course of products being (re)purposed for stalkerware; and
  • PIPEDA and the European Union’s General Data Protection Regulation (GDPR) identify significant obligations that are imposed upon companies which sell products that have features enabling them to be used as stalkerware. The strength of the GDPR is ultimately found in the significant financial penalties which can be assigned to companies which fail to comply with the law. This is a strength that Parliament should add to PIPEDA by way of enabling the Privacy Commissioner of Canada to impose administrative monetary penalties and directly enforce its recommendations on companies.

Notably, PIPEDA only applies to the activities undertaken by business and organizations; as such, our assessment does not attend to the broader Canadian criminal law, tort law, privacy law, product liability, consumer protection, intellectual property, and intermediary liability law that are attached to the legality of using, creating and developing, selling, or facilitating the distribution of stalkerware applications. A broader legal assessment of stalkerware, as well as a set of recommendations for legal and policy reform to address some of the harms that stalkerware engenders, can be found in a companion report entitled “Installing Fear: A Canadian Legal and Policy Analysis of Using, Developing, and Selling Smartphone Spyware and Stalkerware Applications.”

In Part 6, we collect our major findings from our multidisciplinary research and propose a range of recommendations that would mitigate some of the harms associated with stalkerware companies’ practices and products. We focused on issues associated with consent, accountability and redress by jurisdiction, as well as data security and data protection. Specifically, our major findings included:

  • There were significant and disturbing failures by the companies in this study to obtain meaningful and ongoing consent, which seriously increased the risks and threats faced by those who operators target with stalkerware. This omission was further marked by failures to ensure that targeted persons could exercise their data access and deletion rights under Canadian privacy law;
  • While these companies were accountable under Canadian consumer privacy law, the limited ‘bite’ of that law may impede its ability—and, by extension, that of the Office of the Privacy Commissioner of Canada—to establish preemptive deterrence or ex post remedy and enforcement;
  • Not all of the companies in this study indicated that data security was a meaningful element in their privacy policies, despite Canadian law imposing data security obligations; and
  • Google’s Play Protect service in tandem with antivirus applications appeared, in initial testing, to relatively reliably identify stalkerware. However, more long-term testing is required to further confirm these results.

Ultimately, the availability of stalkerware applications is the result of broader social conditions that either lead developers to believe it is appropriate to create software designed for stalking or, alternately, to create applications for ostensibly legitimate purposes that can be repurposed to facilitate surreptitious intimate partner surveillance. The recommendations that we propose in this report might, if adopted, rebalance stark information asymmetries between the operator and target(s) of stalkerware. This rebalancing would address a core aspect of how stalkerware works as a tool to facilitate intimate partner violence, abuse, and harassment: by mitigating the potential for operators to engage in pervasive and surreptitious surveillance. Adopting these recommendations would also ensure meaningful and ongoing consent to any individuals that might use these tools for ostensibly legitimate purposes.

These recommendations are, however, only part of a much broader series of technical and social transformations which are required to remedy the wider, and pervasive, issues that give rise to forms of gender-related violence, abuse, and harassment. While the technical and legal remedies outlined in this report might provide important relief in the context of consumer spyware, the ongoing struggle to transcend patriarchal gender inequalities, misogyny, and corrosive societal norms around controlling, abusive, and violent behaviour directed at women, girls, non-binary persons, and children is an undertaking that requires critical and supportive communities at its core. We hope that this report provides insight into some of the deleterious manifestations of these norms, and that the structural recommendations which we provide help to alleviate some of these long-standing social harms.

Download “The Predator in Your Pocket: A Multidisciplinary Assessment of the Stalkerware Application Industry”

Accountability and the Canadian Government’s Reporting of Computer Vulnerabilities and Exploits

Photo by Taskin Ashiq on Unsplash

I have a new draft paper that outlines why the Canadian government should develop, and publish, the guidelines it uses when determining whether to acquire, use, or disclose computer- and computer-system vulnerabilities. At its crux, the paper argues that an accountability system was developed in the 1970s based on the intrusiveness of government wiretaps and that state-used malware is just as, if not more so, intrusive. Government agencies should be held to at least as high a standard, today, as they were forty years ago (and, arguably, an even higher one today than in the past). It’s important to recognize that while the paper argues for a focus on defensive cybersecurity — disclosing vulnerabilities as a default in order to enhance the general security of all Canadians and residents of Canada, as well as to improve the security of all government of Canada institutions — it recognizes that some vulnerabilities may be retained to achieve a limited subset of investigative and intelligence operations. As such, the paper does not rule out the use of malware by state actors but, instead, seeks to restrict the use of such malware while also drawing its use into a publicly visible accountability regime.

I’m very receptive to comments on this paper and will seek to incorporate feedback before sending the paper to an appropriate journal around mid-December.

Abstract:

Computer security vulnerabilities can be exploited by unauthorized parties to affect targeted systems contrary to the preferences their owner or controller. Companies routinely issue patches to remediate the vulnerabilities after learning that the vulnerabilities exist. However, these flaws are sometimes obtained, used, and kept secret by government actors, who assert that revealing vulnerabilities would undermine intelligence, security, or law enforcement operations. This paper argues that a publicly visible accountability regime is needed to control the discovery, purchase, use, and reporting of computer exploits by Canadian government actors for two reasons. First, because when utilized by Canadian state actors the vulnerabilities could be leveraged to deeply intrude into the private lives of citizens, and legislative precedent indicates that such intrusions should be carefully regulated so that the legislature can hold the government to account. Second, because the vulnerabilities underlying any exploits could be discovered or used by a range of hostile operators to subsequently threaten Canadian citizens’ and residents’ of Canada personal security or the integrity of democratic institutions. On these bases, it is of high importance that the government of Canada formally develop, publish, and act according to an accountability regime that would regulate its agencies’ exploitation of computer vulnerabilities.

Download .pdf // SSRN Link

Government Surveillance Accountability: The Failures of Contemporary Interception Reports

Photo by Gilles Lambert on Unsplash

Over the past several years I’ve undertaken research exploring how, how often, and for what reasons governments in Canada access telecommunications data. As one facet of this line of research I worked with Dr. Adam Molnar to understand the regularity at which policing agencies across Canada have sought, and obtained, warrants to lawfully engage in real-time electronic surveillance. Such data is particularly important given the regularity at which Canadian law enforcement agencies call for new powers; how effective are historical methods of capturing communications data? How useful are the statistics which are tabled by governments? We answer these questions in a paper published with the Canadian Journal of Law and Technology, entitled ‘Government Surveillance Accountability: The Failures of Contemporary Canadian Interception Reports.” The abstract, follows, as do links to the Canadian interception reports upon which we based our findings.

Abstract:

Real time electronic government surveillance is recognized as amongst the most intrusive types of government activity upon private citizens’ lives. There are usually stringent warranting practices that must be met prior to law enforcement or security agencies engaging in such domestic surveillance. In Canada, federal and provincial governments must report annually on these practices when they are conducted by law enforcement or the Canadian Security Intelligence Service, disclosing how often such warrants are sought and granted, the types of crimes such surveillance is directed towards, and the efficacy of such surveillance in being used as evidence and securing convictions.

This article draws on an empirical examination of federal and provincial electronic surveillance reports in Canada to examine the usefulness of Canadian governments’ annual electronic surveillance reports for legislators and external stakeholders alike to hold the government to account. It explores whether there are primary gaps in accountability, such as where there are no legislative requirements to produce records to legislators or external stakeholders. It also examines the extent to which secondary gaps exist, such as where there is a failure of legislative compliance or ambiguity related to that compliance.

We find that extensive secondary gaps undermine legislators’ abilities to hold government to account and weaken capacities for external stakeholders to understand and demand justification for government surveillance activities. In particular, these gaps arise from the failure to annually table reports, in divergent formatting of reports between jurisdictions, and in the deficient narrative explanations accompanying the tabled electronic surveillance reports. The chronic nature of these gaps leads us to argue that there are policy failures emergent from the discretion granted to government Ministers and failures to deliberately establish conditions that would ensure governmental accountability. Unless these deficiencies are corrected, accountability reporting as a public policy instrument threatens to advance a veneer of political legitimacy at the expense of maintaining fulsome democratic safeguards to secure the freedoms associated with liberal democratic political systems. We ultimately propose a series of policy proposals which, if adopted, should ensure that government accountability reporting is both substantial and effective as a policy instrument to monitor and review the efficacy of real-time electronic surveillance in Canada.

Canadian Electronic Surveillance Reports

Alberta

British Columbia

Government of Canada

Manitoba

New Brunswick

Newfoundland

Nova Scotia

Ontario

Quebec

Saskatchewan

Citizen Lab and CIPPIC Release Analysis of the Communications Security Establishment Act

The Fifth Eye by Dustin Ginetz (CC BY-NC-SA 2.0) https://flic.kr/p/id9KHn

It’s with real pleasure that I can announce that the Citizen Lab and the Canadian Internet Policy & Public Interest Clinic (CIPPIC) have collaborated to produce a report which provides timely legal analysis, political context, and historical background on the Communications Security Establishment Act and related provisions in Bill C-59 (An Act respecting national security matters), First Reading (December 18, 2017).  We hope that this resource will help members of parliament, journalists, researchers, lawyers, and civil society advocates engage more effectively on the issues at stake. Our report represents an analysis of the legislation as it enters political debate in Canada, and should be understood in the context of a rapidly evolving legal and political landscape.

The Communications Security Establishment (“the CSE” or “the Establishment”) is Canada’s national signals intelligence and cybersecurity agency. In the course of our analysis, we summarize the CSE’s mandate, activities, operations, and powers, with an emphasis on their potential implications for human rights and global security. We also offer a series of recommendations which, if adopted, would ensure a more legally sound framework for the CSE, better protect global security interests in a rapidly changing technological environment, and more effectively account for Canada’s domestic and international human rights obligations.

In Section I, we provide a brief overview of the CSE’s current mandate and certain controversial activities undertaken as part of that mandate. We also provide a high-level overview of Bill C-59 and its primary implications for the CSE.

In Section II, we undertake a detailed analysis of key issues arising from Bill C-59 related to the CSE, focusing on aspects with the most critical implications for human rights, political transparency, and global security. In particular, some of the issues we highlight in the legislation relate to:

  • Longstanding problems with the CSE’s foreign intelligence operations, which are predicated on ambiguous and secretive legal interpretations that legitimize bulk collection and mass surveillance activities. These activities both attract Charter protections and engage Canada’s human rights obligations.
  • The complete lack of meaningful oversight and control of the CSE’s activities under the proposed active and defensive cyber operations aspects of its mandate.
  • The absence of meaningful safeguards or restrictions on the CSE’s active and defensive cyber operations activities, which have the potential to seriously threaten secure communications tools, public safety, and global security.
  • The absence of meaningful safeguards or restrictions on the CSE’s activities more generally. As drafted, the CSE Act appears to include a loophole which would allow the Establishment to cause death or bodily harm, and to interfere with the “course of justice or democracy,” if acting under its foreign intelligence or cybersecurity powers while prohibiting these outcomes under its new cyber operation powers.
  • The risk that the CSE’s cybersecurity and assurance operations for the federal government could threaten independence of the courts or the separation of powers.
  • Concerns regarding the framework for the CSE’s acquisition of malware, spyware and hacking tools, which may legitimize a market predicated on undermining and subverting, rather than strengthening, the security of the global information infrastructure.
  • Serious issues related to the CSE’s provision of technical and operational assistance to other entities—including Canadian law enforcement—which may lead the CSE to proffer capabilities that would otherwise be illegal or unconstitutional for domestic partners to develop, use or possess, or which would be inherently disproportionate if deployed in those contexts (e.g., in policing operations).
  • Potential issues with the National Security Intelligence Review Agency’s ability to access foreign-provided information, and the risk of regulatory capture through its hiring policies.
  • Serious shortcomings—both legal and practical—in the role of the Intelligence Commissioner, which does not resolve the constitutional challenges surrounding the current CSE Commissioner or the constitutionality of the CSE’s activities more generally.
  • The Intelligence Commissioner’s inability to exercise meaningful and comprehensive oversight and control over the CSE’s activities (including its most problematic activities) due to an under-inclusive mandate, issues of independence, and insufficient powers of a quasi-judicial nature.
  • Weak and vague protections for the privacy of Canadians and persons in Canada, alongside an abject disregard for privacy rights as an international human rights norm.
  • Extraordinary exceptions to the CSE’s general rule against “directing” activities at Canadians and persons in Canada significantly expand the CSE’s ability to use its expansive powers domestically.
  • A general failure to recognize that the highly interconnected and interdependent nature of the global information infrastructure means that protections or limits on the CSE’s powers that begin and end at national boundaries are insufficient to protect Canada’s security interests.
  • Deep tensions at the core of the CSE mandate, which requires the Establishment to both protect and defend against security threats while simultaneously exploiting, maintaining, and creating new vulnerabilities in order to further its foreign intelligence agenda. These tensions are exacerbated by the introduction of new offensive powers and the two new aspects of its mandate.
  • A lack of legal clarity regarding how, when, and whether vulnerabilities discovered by the CSE are disclosed to vendors or the public, and how the CSE accounts for the public interest in the process.
  • The lack of oversight or reporting requirements for “arrangements” with equivalent agencies to the CSE in foreign jurisdictions. There is a risk that these partnerships could involve receipt of information derived from torture or other activities that would be unlawful or unconstitutional if conducted by a Canadian agency.

In Section III, we summarize recommendations emerging from our analysis for committee members and other members of Parliament studying the proposed CSE Act. In particular, we make recommendations to improve systems of review, oversight, and control of the CSE and to constrain the CSE’s ability to engage in activities that are problematic, abusive, unconstitutional, or in violation of international human rights norms.

Download a copy of “Analysis of the Communications Security Establishment Act and Related Provisions in Bill C-59 ( An Act respecting national security matters ), First Reading (December 18, 2017)

« Older posts