Feds ban Carolina-based firm & CEO from surveillance business
By The Star Staff
The Federal Trade Commission (FTC) has banned Carolina-based business SpyFone and Support King LLC and its CEO Scott Zuckerman from the surveillance business over allegations that the stalkerware app company secretly harvested and shared data on people’s physical movements, phone use, and online activities through a hidden device hack.
In a decision last week, the FTC said the company’s apps sold real-time access to their secret surveillance, “allowing stalkers and domestic abusers to stealthily track the potential targets of their violence.”
SpyFone’s lack of basic security also exposed device owners to hackers, identity thieves, and other cyber threats. In addition to imposing the surveillance-business ban, the FTC’s order requires SpyFone to delete the illegally harvested information and notify device owners that the app had been secretly installed.
“SpyFone is a brazen brand name for a surveillance business that helped stalkers steal private information,” said Samuel Levine, acting director of the FTC’s Bureau of Consumer Protection. “The stalkerware was hidden from device owners, but was fully exposed to hackers who exploited the company’s slipshod security. This case is an important reminder that surveillance-based businesses pose a significant threat to our safety and security. We will be aggressive about seeking surveillance bans when companies and their executives egregiously invade our privacy.”
Support King LLC, also formerly doing business as SpyFone.com, is a Puerto Rico limited liability company with a principal office or principal place of business at Isla Verde Avenue in Carolina. Support King has advertised, marketed, distributed or sold monitoring products and services to consumers throughout the United States. Zuckerman is the president, founder, resident agent and CEO of Support King. He created Support King’s websites, hired service providers for the websites, and signed contracts on behalf of Respondent Support King. His principal office or place of business is also in Isla Verde.
This is the second case the FTC has brought against stalkerware apps, and the first where the FTC is obtaining a ban.
To install its software, according to the complaint, SpyFone required purchasers who used the apps on Android devices to bypass many of the phone’s restrictions. The stalkerware company also provided instructions on how to hide the app so that the device user was unaware the device was being monitored, the FTC alleged. In order to use some functions, such as monitoring email, purchasers had to “root” a phone on which the app is installed, which also could void warranties and expose the device to security risks.
“The illegal secret surveillance provided by the apps made it easy for stalkers and abusers to monitor their potential targets and steal sensitive information about their physical movements, phone use, and online activities,” the FTC said. “For example, some of the products allowed a purchaser to see the device’s live location and view the device user’s emails and video chats,”
The stalkerware app company not only illegally harvested and shared people’s private information, it also failed to keep it secure. The FTC alleges that SpyFone did not put in place basic security measures despite promising that it took “reasonable precautions to safeguard” the information it illegally harvested. The stalkerware apps’ security deficiencies include not encrypting personal information it stored, including photos and text messages; failing to ensure that only authorized users could access personal information; and transmitting purchasers’ passwords in plain text.
Moreover, after a hacker accessed the company’s server and obtained personal data of about 2,200 consumers in August 2018, the company promised purchasers that it would work with an outside data security firm and law enforcement authorities to investigate the incident. The FTC, however, alleges that the company failed to follow through on that promise.
In addition to banning Support King and Zuckerman from offering, promoting, selling or advertising any surveillance app, service or business, the proposed settlement requires them to delete any information illegally collected from their stalkerware apps. It also orders them to notify owners of devices on which SpyFone’s apps were installed that their devices might have been monitored and the devices might not be secure.
The FTC voted 5-0 to issue the proposed administrative complaint and to accept the consent order with the company. Commissioner Rohit Chopra issued a separate statement.