When Spies Come Home: Inside the Consumer Spyware Industry

Joseph Cox, Lorenzo Franceschi-Bicchierai This talk covers two areas: the inner workings of the consumer spyware industry, and how that industry has been repeatedly linked to cases of domestic and sexual violence, rape, and murder. The first is based on a slew of internal spreadsheets, financial documents, customer records, and even live intercepts captured by malware which activist hackers stole and provided to us as journalists. This data shows the popularity of consumer spyware, how some companies explicitly market their products to jealous or paranoid lovers to spy on their spouses, and even some connections to the same companies that provide malware for authoritarian regimes. But our talk also offers the behind-the-scenes of an investigation that relied heavily on information provided by criminal hackers: how do journalists verify that data, and how do they handle intensely private information? And we explain why we purchased the malware ourselves to give readers a deeper understanding of how exactly it worked. The second part brings together interviews with sexual violence victims, domestic violence researchers, and concrete evidence of malware being used to facilitate abuse. This malware may require physical access to install, but to ignore this issue would be to miss the point: in an abusive relationship, the attacker often stays in the same building, room, or even bed as the target. This scenario presents a complicated melding of physical and digital security that the infosec community may want to pay more attention to.