Bill Budington reports on Patrick Hinchy, a New York resident who made software that made it easy to compromise others' hardware and spy on them. Fined $410,000, Hinchy must also update the software to alert all the victims.
Stalkerware, a type of commercially-available surveillance software, is installed on phones without device users' knowledge or consent to secretly spy on them. The apps track victims' locations and allow abusers to read their text messages, monitor phone calls, see photos, videos, and web browsing, and much more. It's being used all over the world to intimidate, harass, and harm victims, and is a favorite tool for stalkers and abusive spouses or ex-partners.
In a press release announcing the fine, New York's Attorney General Letitia James put it in no unclear terms: "These apps and products put New Yorkers at risk of stalking and domestic abuse, and were aggressively promoted by Patrick Hinchy through 16 different companies. Today's agreement will block these companies from allowing New Yorkers to be monitored without their awareness, and will continue our ongoing fight to protect New Yorkers' rights, safety, and privacy."
Here's what Hinchy's spyware did, according to the ruling (PDF):
Once installed on a Target Device, the Spyware App will copy information from the Target Device and transmit it to Respondents' servers, where the information is made available for viewing by the purchaser of the Spyware App. Information copied and transmitted by Respondents' Spyware Apps includes: call logs (including phone number, date, and call duration); text messages (including message content, date, and recipient); camera images and videos (including the image or video itself and date taken); location (including current latitude and longitude of the device); Gmail data (including an excerpt/snippet of the email message content, email subject, sender and recipient email address, and date); WhatsApp messages (including message text, sender, and date); Skype data (including message content, sender, and date); Facebook, Instagram, and Twitter data (including direct message content, date, and sender); and Google Chrome data (including browser history with URL and dates visited).
