Smartphones are used to stalk, control domestic abuse victims

We've looked a lot at privacy from the Big Brother standpoint: how the National Security Agency or corporate giants like Google track us online, say for political reasons or to make money from ads.

But there's another kind of privacy concern that is a lot more intimate. You could call it Little Brother, though it's really more like husbands and wives, lovers and exes who secretly watch their partners — from a distance. They are cyberstalking — using digital tools that are a lot cheaper than hiring a private detective.

NPR investigated these tools, also known as spyware, and spoke with domestic violence counselors and survivors around the country. We found that cyberstalking is now a standard part of domestic abuse in the U.S.

Digital Detox At The Shelter Before we get into how spyware works, let's visit a place that's been transformed by it: a domestic violence shelter — a safe house for mostly women and children. It's run by a group called Next Door, and it's somewhere in the heart of Silicon Valley. I can't tell you exactly where because its location is a secret. (I had to sign an agreement to be let in.) While the kids are playing with dominoes in the living room, counselor Rosa Navarro takes the newest arrival -- a woman who has a little boy — into a quiet office for intake.

And that intake includes digital detox.

Navarro tells the woman that because most cellphones have a tracking system, "your ex can find you that way." She advises her to shut off her GPS and Wi-Fi, and stay away from Facebook.

The woman nods and says, "I don't have Facebook. I just do texting." She knows to be cautious because, she says, family members who work at the sheriff's office and for the police warned her.

Navarro says most of the people who come here don't already know. They're oozing data — from their phones, their tablets, their social media accounts — data that an abuser can access pretty easily.

Smartphones and GPS have transformed domestic violence shelters across the U.S.

NPR surveyed more than 70 shelters — not just in big coastal cities like New York and San Francisco, but also in smaller towns in the Midwest and the South.

We found a trend: 85 percent of the shelters we surveyed say they're working directly with victims whose abusers tracked them using GPS. Seventy-five percent say they're working with victims whose abusers eavesdropped on their conversation remotely — using hidden mobile apps. And nearly half the shelters we surveyed have a policy against using Facebook on premises, because they are concerned a stalker can pinpoint location.

Counselors in St. Paul, Minn., had to call the police when an abuser banged on the safe house doors; he had tracked down his wife using GPS. In Dallas, a woman inside a group therapy session thought her phone was off, but it turns out it was feeding data to her abuser. In Jamaica Plain, Mass., counselors had to help one victim debug her shoes after finding a GPS tracker embedded in them. A few shelters say abusers gave iPhones to their children as a gift, during the parents' separation, in order to track down the mom.

It's About Power, Not Just Privacy Cindy Southworth, an advocate with the National Network to End Domestic Violence, runs a project focused on technology in domestic abuse.

"The strategy of offenders is to have complete and utter domination and control of their victims," she says. "And so it's not enough that they just monitor the victim. They will then taunt them or challenge them and say, 'Why were you telling your therapist this? Or why did you tell your sister that? Or why did you go to the mall today when I told you couldn't leave the house?' "

Southworth talks about technology and tracking in a distinct way. In the wake of revelations about snooping by the National Security Agency, many people use the word "privacy" to summarize concerns about surveillance. But for her, it's about power.

Surveillance has long been part of domestic violence. Back in the day, abusive partners would have you followed around or wouldn't let you leave the house. Now, from work or from the bar, they can just watch you on a laptop.

"What we're seeing is that technology is now the new tool to perpetuate that surveillance," she says.

How Spyware Works

Spyware is software you can use to track someone else by turning their smartphone, tablet or computer into a spy. Spyware companies offer their software as a service. Like Netflix, it's a pay-as-you-go subscription. But unlike Netflix, it's clearly enabling illegal activity.

Detective Brian Hill with the sheriff's office in Anoka County, Minn., gives me a crash course on one popular brand called mSpy. It costs about $70 for a month or $200 for a year. "Very cheap, considering what it can do," he says.

MSpy is easy to install. The stalker just needs a few minutes alone with the smartphone of the person being stalked. So when they're in the shower, just say: "Hey, honey, I need to use your phone. Tell me the passcode!"

Then, Hill shows me how it works on a smartphone that he's hacked: "It tells you to go to the settings, go to the security and the screen lock, and then tells you to check the box for unknown sources."

MSpy has a step-by-step guide — with screenshots — on how to download the app onto an iPhone or Android device, how to activate it, and then how to delete any visible trace of it. It'll just hang out in a hidden folder, with a nondescript name like "Android.sys." If someone happened to find it, they'd just see the iconic green Android robot and think it's part of the phone's operating system. The app also uses less data than basic text messaging services like WhatsApp, "so mSpy stays under the radar that way," Hill explains.

Now the stalker can monitor the person being stalked, from the website of the spyware company. Hill goes to his laptop and logs into his mSpy account. There's a really nice dashboard to organize all the information you're grabbing — and it's a lot of information, like contacts, call logs, text messages, call recordings (full recordings of entire conversations), photos, video files, and a log of every website visited by the person being stalked.

There's also a keylogger function, to record everything the victim types into his or her smartphone. Say the victim goes to do some online banking at Wells Fargo or Citibank. The stalker can see the website being visited, and the username and password typed in, gaining full online access to the victim's bank account.

And say the victim starts a new relationship. It's going great until suddenly the new person stops calling. Maybe he lost interest. Or maybe the cyberstalker blocked him: "You figured out who the new boyfriend is, or the new girlfriend, whatever it is," Hill explains. "You could type in their phone number, and then it'll restrict that call from ever coming into the phone. It won't allow it."

MSpy also does location tracking. It has a map — kind of like Apple's Find My iPhone — that shows where the victim's smartphone is right now at 1:37 p.m. and the exact route it took to get from Point A to Point B.

And mSpy has one more powerful feature: the eavesdropping function. When the person being stalked gets an incoming call, that very second, their speakerphone gets activated and starts recording. The victim doesn't have to answer the phone. The ringer could even be on mute, so you don't know it's ringing. But whatever conversation is happening in that room — say the victim is talking with her sister or her counselor — the smartphone feeds it back to the stalker.

Marketing: Watch Your Workers And Kids

Ads for spyware companies are all over the Internet. And obviously they don't market their apps as tools for obsessed lovers.

In online videos, they market spyware as a safety product. For example, an ad for PhoneSheriff says: "You can track your child via GPS, and monitor texts for abuse including sexting and bullying."

The companies, which tout hundreds of thousands of subscribers, describe spyware as a legal way to watch your employees or your kids — with their full knowledge — to make sure no one's out of line.

NPR called and emailed mSpy (which is based in London, according to its website), PhoneSheriff (in Jacksonville, Fla.), MobiStealth (in Beverly, Mass.) and StealthGenie (which didn't list a location). We wanted to know: How many subscribers do you have exactly? Have you ever reported a user to law enforcement for suspicious activity? What steps are you taking to prevent abuse?

MSpy responded that every customer signs an agreement acknowledging it's illegal to secretly spy on someone and the company is not liable. None of the other companies responded to NPR's inquiries.

Cindy Southworth, the advocate against domestic violence, says a lot of victims don't realize that it's so easy to be tracked in so many ways. People just think they're going crazy. Southworth says they're not: "What I frequently tell victims is: If you suspect that your ex knows too much, it's entirely possible that all your devices have been compromised."

She says trust your instincts. Trust your gut. Copyright 2019 NPR. To see more, visit https://www.npr.org.