Spouse cyberspying dangerous, possibly illegal

Network World - Increasing use of stealthy surveillance software for computers and phones is raising legal concerns and alarm among those who help victims of domestic violence.

"These commercial surveillance packages, such as Spector from SpectorSoft, are turning up in domestic violence cases," says Cindy Southworth, director of technology at the Washington-based organization National Network to End Domestic Violence (NNEDV). The group gets many calls from women who say their abusers "know too much. We advise women, if you're researching an escape plan or trying to find a new job, don't do it on your home PC."

Southworth advises those contacting NNEDV not to delete the surveillance software. Some antivirus packages, such as those from McAfee, F-Secure and Trend Micro, scan to detect stealth-surveillance programs and ask the user if they want to eradicate them.

"If the victim wants to get police involved, you don't want the spyware eliminated," says Southworth. In addition, the spyware can report every few minutes to the individual who installed and controls it, and the act of deleting or attempting to delete it has been known to trigger violence against the one being spied on.

One of the first criminal cases linking spyware and domestic abuse occurred six years ago and involved an estranged husband and wife in Belleview, Mich. The husband had secretly installed surveillance software from SpectorSoft to monitor her computer use. After the wife became suspicious, she complained to local law enforcement.

The Michigan attorney general's high-tech unit came in to investigate, and after getting a search warrant for the husband's computer, it discovered reports of his wife's computer activities stored there and identified SpectorSoft's eBlaster as the spyware. SpectorSoft cooperated with Michigan law enforcement in confirming the husband as the registered software purchaser.

"I remember that one; he got slapped on the wrist with a few years probation," says SpectorSoft President Doug Fowler. The eight-year-old privately held Vero Beach, Fla., firm still "does occasionally get subpoenas from court jurisdictions asking us for information on did this person buy this software."

But Fowler says SpectorSoft, which makes consumer and business versions of its surveillance software, three years ago stopped marketing its products as spouse-spying tools.

"It was a strain on our employees to support this environment that can get kind of nasty," says Fowler, who notes the company has seen plenty of wives trying to spy on husbands, too. "Sometimes we get a wife who's purchased the software and wants to monitor him at work. We tell them, this isn't for monitoring computers you don't own."

There have even been bizarre instances where the husband and wife each purchased SpectorSoft software to try and do surveillance of each other on the same computer -- a technically impossible feat, he says.

Sometimes, says Fowler, SpectorSoft simply ends up disabling the software and refunding the cost, typically under $100, for the software. SpectorSoft claims its surveillance software today runs on 400,000 desktops -- about 60% consumer and 40% in business.

But in marketing to the home, the emphasis today from SpectorSoft is on giving parents a tool to monitor their children.

Fowler adds that the company's surveillance tools can also help law enforcement as they are gaining acceptance by courts and probation officers requiring it on the PCs of some ex-cons if they're allowed access to a computer.

Though they appear to share the perspective that using surveillance software in business is acceptable with the proper legal notification to those being monitored, Southworth of NNEDV and Fowler are at odds on another point: Is one spouse spying on another legal?

"It's a violation of the Electronic Communications Privacy Act [ECPA]," says Southworth, alluding to the federal law. "It's eavesdropping."

"I wouldn't agree with a blanket statement like that," says Fowler. He adds no legal advice he's received indicates it's out-and-out illegal for a spouse to monitor a spouse without consent.

Mark Rasch, an expert in cyberlaw who's managing director of technology at Washington-based FTI Consulting, notes that the ECPA in general does make it illegal to intercept someone else's communications and transmissions. However, he adds a broader look into the law reveals ambiguity and contradiction in the question of interspousal monitoring without knowledge or consent.

"If a husband does a forensic examination of a shared computer, and the computer automatically recorded this stuff, it's definitely a gray area. It's not clear," says Rasch. Adding a surveillance package like that from SpectorSoft to a PC to boost recording capability does clearly heighten the privacy concerns.

But "the spousal relationship" as a legal concept in common law suggests "that man and wife were a single entity," says Rasch, which complicates the picture, though that view appears to be declining in the nation's courts. The idea of a "marital home exception" held sway in a New Jersey case called Simpson vs. Simpson in 1991, which denied the wife the ability to keep taped telephone conversations out of a divorce suit. "But that's the minority view today," Rasch adds.

In the hodgepodge of communications-intercept law, Rasch notes, the federal ECPA law is not the only law that has to be considered. Every state has its own laws, with 12 considered to be so-called "all-party consent" states where it's necessary to obtain consent from all parties to monitor communications.

That means getting the consent of anyone communicating with the monitored spouse -- not something easy to accomplish in real life.

The all-party consent states are California, Connecticut, Delaware, Florida, Illinois, Maryland, Massachusetts, Nevada, New Hampshire, Pennsylvania, Vermont and Washington.

"If you're spying on your spouse, you need the consent of all the parties concerned in these states," he says, adding wryly, "The best place to spy on your spouse is New York."

The all-party consent laws raise the question of whether even parents can legally use surveillance software to monitor their own children.

In most states, children could be monitored by parents until 17 or 18, Rasch points out, but what about gaining the consent of all the individuals with whom the child communicates online? Most of these state laws, he emphasizes, sit quietly on the books and haven't been tested yet in court in real-world disputes.

The privacy question came up in a high-profile case brought by the U.S. attorney general of the Southern District of California in 2005 against the maker of a spyware program called Loverspy.

Loverspy allowed subscribers to send electronic greeting cards to up to five different victims. When the electronic card was opened, Loverspy installed itself on the desktop and gave the purchaser the ability to remotely control the victim's computer.

In that case, Loverspy's creator, Carlos-Enrique Perez-Melara, was indicted with others for "advertising" an interception device, "unlawfully intercepting electronic communications," and "unauthorized access to protected computers for financial gain." But in that case, the accused fled the country before the trial concluded.

Several other commercial spyware packages target detection and eradication. They include Iambigbrother for the desktop PC, and cell phone/smart phone packages like Neo-Call and Flexispy.

"Some of these mobile spyware tools steal information and send it out of the phone," said F-Secure's CTO Mikko Hypponen, who spoke about detecting and eradicating them with F-Secure's security software during a presentation at the recent Black Hat Conference. "Some market the tool saying, 'Install this and monitor your spouse.' We think many of these programs are in big use and are just espionage."

"Flexispy gives no indication of running, so we'll detect it and give the user the option to delete it," says Todd Thiemann, director of device security marketing at Trend Micro.

"Most of these use stealth, so we consider it a 'potentially unwanted program,' and it's always unsafe,'" says Hiep Dang, McAfee's director of anti-malware research, who says McAfee's software can detect SpectorSoft applications.

That antimalware vendors are targeting SpectorSoft products bothers Fowler, who says his company continually works to come up with improved evasion tactics for its software. "Too many of the antivirus vendors will just take it off your computer, but the vast majority of our customers are legitimate," Fowler concludes.