Language selection

Search

Real Results Vol. 3

December 2021

Protecting Privacy Rights
through Innovative Research

Digital Stalking on the Rise in Canada

Suffering intimate partner abuse is harrowing enough, but what happens when abuse and control occurs through an application on someone’s device – otherwise known as “stalkerware” – while they are still in the abusive relationship or even long after the abused individual has managed to leave?

 

Sad female victim of online stalking.

We think of our cell phones as our private domain. But what if your phone conversations, your call history, your text messages, your private social media activity, and your daily movements were all secretly under surveillance? Now imagine it’s your abusive partner or ex-partner who seems to know the content of your communication and everywhere you’ve been – all because they have easily installed a widely accessible, available, and affordable app on your phone to continue their violence, abuse, and harassment.

Not to be underestimated

“Stalkerware” is a type of mobile “spyware” app that someone can install on another person's device to secretly track their location, monitor their private social media messages, and spy on their phone calls, text messages, and call history, among other invasive functions. Many such apps are either designed to be – or marketed as – "child safety" or "employee monitoring" apps, but have been repurposed as abusive stalkerware.

The significance of this issue cannot be understated. Intimate partner violence, abuse, and harassment are routinely linked with efforts to monitor and control a targeted person. And as new technologies have seeped into everyday life, aggressors have adopted and repurposed them to terrorize, control, and manipulate their current and former partners.

In Canada, a national survey of anti-violence support workers found that 98% of perpetrators used technology to intimidate or threaten their victims. Stalkerware has a wide range of capabilities, including pervasive monitoring of text and chat messages, recording phone logs, tracking social media posts, logging website visits, activating a GPS system, registering keystrokes, and even activating phones’ microphones and cameras, as well as sometimes blocking incoming phone calls. These capabilities can afford dramatic power and control over an individual’s everyday life.

Decorative elementDecorative element

“In Canada, a national survey of anti-violence support workers found that 98% of perpetrators used technology to intimidate or threaten their victims.”

A Canadian-focussed assessment

To spearhead an assessment of stalkerware under Canadian law, the Office of the Privacy Commissioner of Canada (OPC) funded “Understanding and Responding to the Privacy and Safety Risks of Stalkerware,” an independent research project that culminated in the publication of two educational comics and two reports: “The Predator in Your Pocket: A Multidisciplinary Assessment of the Stalkerware Application Industry,” an assessment of the stalkerware ecosystem, and “Installing Fear: A Canadian Legal and Policy Analysis of Using, Developing, and Selling Smartphone Spyware and Stalkerware Applications,” an in-depth legal and policy analysis of the act of creating, selling, and distributing stalkerware apps, and also of using these apps to engage in intimate partner surveillance.

Cynthia Khoo, a technology and human rights lawyer and Research Fellow with the Citizen Lab, co-led the “Installing Fear” research project, and also contributed to “Predator in Your Pocket.”

“The impetus for the ‘Installing Fear’ project was observing that mobile stalkerware apps and similar technologies have been in common use for many years, particularly in the context of intimate partner violence, and yet there seemed to be a lack of legal response or legal remedies available to individuals targeted by such technology,” explained Khoo. “The use of stalkerware to monitor and track the intimate daily activities and communications of the targeted individual, without their knowledge or consent, is also a gendered phenomenon that predominantly impacts women, girls, and those who hold intersecting marginalized identities – thus impacting their fundamental rights to equality, privacy, and freedom of expression.”

The researchers’ goal was to provide a resource that examined which laws in Canada are currently available to address this issue – specifically to prevent or deter perpetrators and vendors from using and selling stalkerware – and recommend what legal reforms might be required to provide greater protection and legal remedy to individuals subjected to this type of abuse.

The research involved a component to understand the scope of the problem, including how stalkerware apps work, including what functionalities they offer; the broader context of technology-facilitated gender-based and intimate partner violence, abuse, and harassment; and the prevalence of such abuse in Canada and elsewhere. For this part of the project, the team partly drew on the technical research of Citizen Lab colleagues researching and writing “The Predator in Your Pocket”.

The researchers also engaged in a comprehensive legal analysis that involved researching legislation and case law – using desk research and legal databases – to evaluate how they apply to stalkerware use, development, sales, and distribution.

Likely violating numerous laws

The team found that both using and selling stalkerware apps likely violate numerous laws in Canada, notably consumer privacy laws, such as the consent and appropriate purpose provisions of the Personal Information Protection and Electronic Documents Act. Using and selling stalkerware may also result in liability for civil wrongdoing such as invasion of privacy, intentional infliction of mental suffering, and product liability. Finally, the team found that use of such apps likely constitutes criminal offences such as criminal harassment, intimidation, and interception of, or purchasing or selling devices primarily useful for covert interception of, private communications.

“There did not appear to be effective legal restraints on creating and developing stalkerware apps in the first place,” noted Khoo. “While third-party intermediary distributors – such as Google and Apple app stores – have engaged in proactive efforts to stem the availability and sales of stalkerware on their platforms, such efforts have seen limited results, and their app developer policies could be better enforced to better protect individuals who could be or are being targeted by stalkerware abuse.”

The team’s research and analysis resulted in 16 law reform recommendations divided into several categories aimed at Canada's criminal and family justice systems, federal and provincial lawmakers and government, the Office of the Privacy Commissioner of Canada, along with app developers, technology companies, and app stores.

“We had several target audiences in mind,” said Khoo. “They included regulators, lawyers, law enforcement, policymakers, and other stakeholders who are part of the justice system or in a position to bring about legal reforms to address stalkerware abuse; community-based organizations and frontline support workers who work directly with victims and survivors of gender-based and intimate partner violence, abuse, and harassment, including technology-facilitated forms such as stalkerware; and the general public to raise awareness about this issue.”

Positive results arising from the research

While most members of the team have since moved on to other areas since the report was released, it has sparked further engagement with frontline support workers and community-based organizations focussed on preventing gender-based and intimate partner violence and abuse – including technology-facilitated abuse like stalkerware. The team facilitated an interdisciplinary and cross-sectorial workshop shortly after the report launch, bringing together academic researchers, lawyers, frontline support workers, digital rights activists, and information security professionals to exchange ideas, build capacity among community-based organizations, and advance a more coordinated and intersectional response to stalkerware abuse. 

Another positive, yet perhaps unanticipated, result that arose from the research, according to Khoo: Victim and survivor validation.

“We were told after the report was released that it was validating for those who have been directly impacted by stalkerware abuse, as victims and survivors, and who had not been believed about their experiences or were uncertain if such technology-facilitated abuse was even possible.”

Decorative element

What Is “Stalkerware”?

Unrecognisable person working on a laptop in the dark.

Stalkerware is a kind of intrusive surveillance software that a person installs on another person’s device, and uses it to facilitate intimate partner violence, abuse, and harassment. Stalkerware may be repurposed legitimate software or specifically designed for technology-facilitated stalking.

 

 

 

 

 

Decorative element

Protecting Yourself Against Stalkerware

A laptop with a padlock on the keyboard.

The consumer-level stalkerware apps studied in this report generally require physical access to a targeted person's device so they can be installed, which means the device must be unlocked. Basic prevention methods include always keeping your phone with you, never letting it out of your sight, and locking it with a password that no one else knows. There are also certain signs that may suggest stalkerware has been installed, such as the phone losing battery inordinately quickly, the phone heating up, or an unusual app you don't recognize or didn't install.

However, according to Khoo, “I would hasten to note that it can be harmful to over-emphasize what people can do to ‘protect themselves’, as at the end of the day, it should not be victims or potential victims who bear the burden of not being abused. This shades into telling women to shut down their social media accounts or stay offline, for example, to avoid being abused or harassed. Such a response implicitly blames the victim and implicates their rights to equality and freedom of expression in addition to privacy, given the importance of online participation in both private and public life. The law and other institutional responses should focus on the behaviour and actions of those who create, sell, and use stalkerware, rather than those subjected to the abuse.”

Think you’ve been the victim of stalkerware? Khoo advises having a safety plan in place before searching for evidence on your device.

“If stalkerware has been installed on a person's phone, then searching for it or finding evidence  may be visible to the abuser. That may escalate the danger of the targeted person's situation, and so it is important to have a safety plan in place ahead of time, if possible, formed with the support of a frontline organization or trusted individuals in their social network.”

According to Khoo, while some prevention and detection resources are available (see “Installing Fear” – Appendix A: Digital Security Guides and Resources, pages 179–80), there is a dearth of frontline aid for those who find themselves being subjected to stalkerware abuse.

“Frontline support organizations were already understaffed even before adding the element of technological literacy and awareness, and there is currently no specific ‘hotline’ or ‘legal aid clinic’ in Canada for technology-facilitated gender-based violence, abuse, and harassment.”

Other articles from Real Results


Disclaimer: The OPC’s Contributions Program funds independent privacy research and knowledge translation projects. The opinions expressed by the experts featured in this publication, as well as the projects they discuss, do not necessarily reflect those of the Office of the Privacy Commissioner of Canada.

Report a problem or mistake on this page
Error 1: No selection was made. You must choose at least 1 answer.
Please select all that apply (required):

Note

Date modified: