Real Results Vol. 3

Digital Stalking on the Rise in Canada

Suffering intimate partner abuse is harrowing enough, but what happens when abuse and control occurs through an application on someone’s device – otherwise known as “stalkerware” – while they are still in the abusive relationship or even long after the abused individual has managed to leave?

We think of our cell phones as our private domain. But what if your phone conversations, your call history, your text messages, your private social media activity, and your daily movements were all secretly under surveillance? Now imagine it’s your abusive partner or ex-partner who seems to know the content of your communication and everywhere you’ve been – all because they have easily installed a widely accessible, available, and affordable app on your phone to continue their violence, abuse, and harassment.

Not to be underestimated

“Stalkerware” is a type of mobile “spyware” app that someone can install on another person's device to secretly track their location, monitor their private social media messages, and spy on their phone calls, text messages, and call history, among other invasive functions. Many such apps are either designed to be – or marketed as – "child safety" or "employee monitoring" apps, but have been repurposed as abusive stalkerware.

The significance of this issue cannot be understated. Intimate partner violence, abuse, and harassment are routinely linked with efforts to monitor and control a targeted person. And as new technologies have seeped into everyday life, aggressors have adopted and repurposed them to terrorize, control, and manipulate their current and former partners.

In Canada, a national survey of anti-violence support workers found that 98% of perpetrators used technology to intimidate or threaten their victims. Stalkerware has a wide range of capabilities, including pervasive monitoring of text and chat messages, recording phone logs, tracking social media posts, logging website visits, activating a GPS system, registering keystrokes, and even activating phones’ microphones and cameras, as well as sometimes blocking incoming phone calls. These capabilities can afford dramatic power and control over an individual’s everyday life.

“In Canada, a national survey of anti-violence support workers found that 98% of perpetrators used technology to intimidate or threaten their victims.”

A Canadian-focused assessment

To spearhead an assessment of stalkerware under Canadian law, the Office of the Privacy Commissioner of Canada (OPC) funded “Understanding and Responding to the Privacy and Safety Risks of Stalkerware,” an independent research project that culminated in the publication of two educational comics and two reports: “The Predator in Your Pocket: A Multidisciplinary Assessment of the Stalkerware Application Industry,” an assessment of the stalkerware ecosystem, and “Installing Fear: A Canadian Legal and Policy Analysis of Using, Developing, and Selling Smartphone Spyware and Stalkerware Applications,” an in-depth legal and policy analysis of the act of creating, selling, and distributing stalkerware apps, and also of using these apps to engage in intimate partner surveillance.

Cynthia Khoo, a technology and human rights lawyer and Research Fellow with the Citizen Lab, co-led the “Installing Fear” research project, and also contributed to “Predator in Your Pocket.”

“The impetus for the ‘Installing Fear’ project was observing that mobile stalkerware apps and similar technologies have been in common use for many years, particularly in the context of intimate partner violence, and yet there seemed to be a lack of legal response or legal remedies available to individuals targeted by such technology,” explained Khoo. “The use of stalkerware to monitor and track the intimate daily activities and communications of the targeted individual, without their knowledge or consent, is also a gendered phenomenon that predominantly impacts women, girls, and those who hold intersecting marginalized identities – thus impacting their fundamental rights to equality, privacy, and freedom of expression.”

The researchers’ goal was to provide a resource that examined which laws in Canada are currently available to address this issue – specifically to prevent or deter perpetrators and vendors from using and selling stalkerware – and recommend what legal reforms might be required to provide greater protection and legal remedy to individuals subjected to this type of abuse.

The research involved a component to understand the scope of the problem, including how stalkerware apps work, including what functionalities they offer; the broader context of technology-facilitated gender-based and intimate partner violence, abuse, and harassment; and the prevalence of such abuse in Canada and elsewhere. For this part of the project, the team partly drew on the technical research of Citizen Lab colleagues researching and writing “The Predator in Your Pocket”.

The researchers also engaged in a comprehensive legal analysis that involved researching legislation and case law – using desk research and legal databases – to evaluate how they apply to stalkerware use, development, sales, and distribution.

Likely violating numerous laws

The team found that both using and selling stalkerware apps likely violate numerous laws in Canada, notably consumer privacy laws, such as the consent and appropriate purpose provisions of the Personal Information Protection and Electronic Documents Act. Using and selling stalkerware may also result in liability for civil wrongdoing such as invasion of privacy, intentional infliction of mental suffering, and product liability. Finally, the team found that use of such apps likely constitutes criminal offences such as criminal harassment, intimidation, and interception of, or purchasing or selling devices primarily useful for covert interception of, private communications.

“There did not appear to be effective legal restraints on creating and developing stalkerware apps in the first place,” noted Khoo. “While third-party intermediary distributors – such as Google and Apple app stores – have engaged in proactive efforts to stem the availability and sales of stalkerware on their platforms, such efforts have seen limited results, and their app developer policies could be better enforced to better protect individuals who could be or are being targeted by stalkerware abuse.”

The team’s research and analysis resulted in 16 law reform recommendations divided into several categories aimed at Canada's criminal and family justice systems, federal and provincial lawmakers and government, the Office of the Privacy Commissioner of Canada, along with app developers, technology companies, and app stores.

“We had several target audiences in mind,” said Khoo. “They included regulators, lawyers, law enforcement, policymakers, and other stakeholders who are part of the justice system or in a position to bring about legal reforms to address stalkerware abuse; community-based organizations and frontline support workers who work directly with victims and survivors of gender-based and intimate partner violence, abuse, and harassment, including technology-facilitated forms such as stalkerware; and the general public to raise awareness about this issue.”

Positive results arising from the research

While most members of the team have since moved on to other areas since the report was released, it has sparked further engagement with frontline support workers and community-based organizations focussed on preventing gender-based and intimate partner violence and abuse – including technology-facilitated abuse like stalkerware. The team facilitated an interdisciplinary and cross-sectorial workshop shortly after the report launch, bringing together academic researchers, lawyers, frontline support workers, digital rights activists, and information security professionals to exchange ideas, build capacity among community-based organizations, and advance a more coordinated and intersectional response to stalkerware abuse. 

Another positive, yet perhaps unanticipated, result that arose from the research, according to Khoo: Victim and survivor validation.

“We were told after the report was released that it was validating for those who have been directly impacted by stalkerware abuse, as victims and survivors, and who had not been believed about their experiences or were uncertain if such technology-facilitated abuse was even possible.”