1
00:00:02,540 --> 00:00:05,200
Hello, my name is Cecilia Vian.

2
00:00:05,300 --> 00:00:08,680
Thank you for having me here at the Crypto & Privacy Village.

3
00:00:08,680 --> 00:00:15,680
I'm here to talk about stalkerware and an incident that happened late 2019 and early 2020.

4
00:00:20,550 --> 00:00:23,970
I work as a consultant tester.

5
00:00:24,530 --> 00:00:29,630
I mostly do software testing with UX and security in mind.

6
00:00:30,150 --> 00:00:39,770
And I have what's called an unconventional background for my field of work because I have a bachelor's degree in pedagogics.

7
00:00:39,770 --> 00:00:42,530
That's educational psychology if you're American.

8
00:00:42,970 --> 00:00:46,850
And I have a master's degree in philosophy of technology.

9
00:00:48,050 --> 00:01:03,710
It means that I think a lot about what is technology, what are humans doing with technology, what are they not doing with technology, how is technology affecting us, and so on.

10
00:01:04,850 --> 00:01:08,150
Now, I live and work in Norway.

11
00:01:08,150 --> 00:01:09,670
It's a small country.

12
00:01:09,670 --> 00:01:12,270
You may or may not have heard of us.

13
00:01:12,630 --> 00:01:25,420
There's about 5.5 million Norwegians and it's a country mostly known for its fjords and mountains and very generous parental leave.

14
00:01:25,520 --> 00:01:34,680
But for this context, what's important is it's a country that has pretty advanced technological infrastructure.

15
00:01:35,280 --> 00:01:45,200
Most people in Norway have internet connections, they have smartphones, they have digital ideas, they adopt new technology pretty fast.

16
00:01:45,200 --> 00:01:58,680
We have already implemented GDPR and we have a very digital and highly coordinating banking system.

17
00:02:00,500 --> 00:02:05,900
Banks in Norway mostly don't have any offices, like physical offices.

18
00:02:06,980 --> 00:02:26,200
Banking here is done online and people are paying their bills online, they're receiving their salaries and pensions directly to their bank accounts, and people are using debit card and credit card and what's called digital wallets.

19
00:02:26,400 --> 00:02:28,400
That's commonplace.

20
00:02:28,420 --> 00:02:39,700
We don't really use checks, we don't really use cash a lot, and prepaid cards are not really in use in Norway.

21
00:02:40,620 --> 00:02:48,380
In Norway, not only the young people are online, but also older people are online.

22
00:02:49,100 --> 00:02:59,540
My grandpa is online, my great-grandmother would have been online, she would do all her banking online.

23
00:02:59,540 --> 00:03:02,180
That's now common here.

24
00:03:02,180 --> 00:03:06,880
Everybody is online and doing their banking there.

25
00:03:07,700 --> 00:03:14,680
We are essentially, well, you could say living the dreams of banks other places.

26
00:03:15,240 --> 00:03:21,940
It's very easy, it's efficient, but it also has some drawbacks.

27
00:03:24,310 --> 00:03:28,090
Now, story time.

28
00:03:30,640 --> 00:03:36,220
Late last year, I bought lunch at a grocery store.

29
00:03:37,280 --> 00:03:42,800
It's not as exciting as I try making it sound exciting, but you know.

30
00:03:43,320 --> 00:03:53,260
One of the items that I bought was a pack of tea, and I paid for this, of course, as a Norwegian by card.

31
00:03:53,540 --> 00:04:03,980
When I got home after work, I was cold, and I was tired, and my significant other, he's a nice person, and he wanted to make me a cup of warm tea.

32
00:04:05,440 --> 00:04:13,180
He couldn't find any tea, so he asked me, where did you put the tea I, you know, you bought?

33
00:04:16,200 --> 00:04:30,020
And that, uh, that was odd, because I hadn't told him that I bought tea, because the tea was for my office, it wasn't for our home.

34
00:04:30,360 --> 00:04:34,780
So how come he knew that I bought tea?

35
00:04:35,240 --> 00:04:38,020
Is he stalking me?

36
00:04:41,730 --> 00:04:51,290
Now, I guess you do have some kind of idea what stalking where stalkerware is.

37
00:04:51,370 --> 00:04:57,490
By definition, any software that allows for stalking is called stalkerware.

38
00:04:58,390 --> 00:05:06,250
But with this definition, a lot of very different things will be end up called stalkerware.

39
00:05:06,710 --> 00:05:11,610
So for clarity, I have divided stalkerware into different categories.

40
00:05:16,870 --> 00:05:22,790
First, there's the classic stalkerware.

41
00:05:22,910 --> 00:05:40,810
You can call it creepware, spouseware, theft tracking, child safety is very, it's a very positive spin on stalkerware.

42
00:05:40,810 --> 00:05:51,190
We also have something called prop tech, which is a new type for me.

43
00:05:51,530 --> 00:06:11,550
And you have to install this kind of software on hardware, on the victim's hardware, for instance, on a victim's phone, or victim's computer, watches, house, toys, their car, anything.

44
00:06:12,090 --> 00:06:14,890
And it can be really hard to find.

45
00:06:15,470 --> 00:06:31,130
And for people who are leaving abusive partners, the best and easiest advice given is move, get new devices, get rid of your old computer, get a dumb phone, start over.

46
00:06:36,790 --> 00:06:50,650
So one of the ways my significant other could have known that I bought tea is if he had installed some kind of stalkerware on my phone, for instance.

47
00:06:51,250 --> 00:06:55,830
But for this occasion, traditional stalkerware didn't really make any sense.

48
00:06:56,150 --> 00:06:57,850
It didn't quite fit.

49
00:06:59,710 --> 00:07:01,490
So what else do we have?

50
00:07:01,490 --> 00:07:02,930
What else could it be?

51
00:07:04,910 --> 00:07:15,690
Well, obviously, having to need to get access to someone's hardware is an obstacle, and it's a bit of a hassle if you want to stalk them.

52
00:07:15,690 --> 00:07:24,090
So naturally, stalkerware evolved, and we got what I called stalking as a service.

53
00:07:28,800 --> 00:07:33,680
Well, stalking as a service, you can't just invite someone to be stalked.

54
00:07:33,680 --> 00:07:37,020
If you tried, please let me how that went.

55
00:07:38,000 --> 00:07:48,440
But typically, the victim is encouraged to register as a service by the abuser because it's something fun or useful.

56
00:07:50,860 --> 00:08:08,200
And this kind of stalkerware could be camouflaged as find my phone, as something social media related type of app, photo apps, a lot, health app and loyalty programs.

57
00:08:08,200 --> 00:08:29,540
They have fun features like sharing by default and geotagging your pictures and tracking your whereabouts and sending copies of whatever you upload or register there, notifications or share the account you register in some way.

58
00:08:29,840 --> 00:08:46,980
Now, there's a lot of gray areas in this because there's so many legit applications and apps and services that do the exact same thing and make it really hard to stay private.

59
00:08:47,880 --> 00:08:57,320
So it's hard to tell sometimes if it's meant to be stalkerware or if it's just bad software.

60
00:08:57,560 --> 00:08:58,760
But okay.

61
00:09:01,260 --> 00:09:10,520
Another thing that sometimes is stalkerware as a service is customer loyalty programs.

62
00:09:11,020 --> 00:09:19,700
A lot of the times, I don't think they're meant to be stalkerware but they are definitely facilitating it.

63
00:09:20,160 --> 00:09:31,340
Now, I don't typically register for loyalty programs so that doesn't explain why did my significant other know about the tea.

64
00:09:36,170 --> 00:09:45,870
Since I didn't think he was trying to hurt me, I asked him, how did you know I bought tea?

65
00:09:46,350 --> 00:09:52,730
And he told me he got a receipt and I said, what receipt?

66
00:09:53,030 --> 00:09:57,190
Well, in the application, in the A application.

67
00:09:57,190 --> 00:09:59,470
A is one of the Scandinavian letters.

68
00:10:00,870 --> 00:10:06,310
And that confused me because I haven't registered in that application.

69
00:10:06,310 --> 00:10:09,590
I know it, but I didn't register.

70
00:10:10,890 --> 00:10:14,370
And I just had to ask him, did you register my card there?

71
00:10:14,370 --> 00:10:17,510
And he said, no, only my card.

72
00:10:17,790 --> 00:10:21,250
And I thought that was odd and creepy.

73
00:10:25,120 --> 00:10:36,280
And it put me on a sort of, gave me a sort of feeling that there's a new kind of stalkerware out there.

74
00:10:36,780 --> 00:10:39,800
That is a new kind of nightmare, really.

75
00:10:40,740 --> 00:10:48,520
Because he had enthusiastically and with no harm intended added his card.

76
00:10:48,640 --> 00:10:52,200
The card is connected to our joint account.

77
00:10:53,580 --> 00:10:56,100
And that's how he got my receipts.

78
00:10:56,480 --> 00:10:57,720
Let me show you.

79
00:10:59,740 --> 00:11:03,720
I, of course, had to figure this out.

80
00:11:03,720 --> 00:11:06,240
Is it really as bad as I think it is?

81
00:11:06,680 --> 00:11:15,100
So I downloaded the app and I added my phone number.

82
00:11:15,100 --> 00:11:18,360
I got a text message with some numbers in it.

83
00:11:18,360 --> 00:11:27,000
I typed numbers into the application again and voila, I was registered.

84
00:11:28,140 --> 00:11:41,980
Now, for this program, if you really want to take, use the benefits, you have to add a card, a payment card.

85
00:11:44,070 --> 00:11:45,670
It's like this.

86
00:11:45,670 --> 00:11:50,210
Now, I know you don't read Norwegian, so I'll explain it.

87
00:11:51,050 --> 00:11:53,850
You type in a credit card number.

88
00:11:54,810 --> 00:11:57,530
Then you add the month and year.

89
00:11:58,510 --> 00:12:01,630
And then you add the bank account number.

90
00:12:01,630 --> 00:12:11,070
As I said previously, Norwegians are all about online banking, so everybody has bank account numbers, probably several.

91
00:12:13,710 --> 00:12:26,130
And the bank account number, well, it says here in a little text that the account must be registered in your name.

92
00:12:27,350 --> 00:12:31,890
And ethically speaking, it definitely should be registered in your name.

93
00:12:31,890 --> 00:12:35,910
But there's no technical reason why it should be registered to your name.

94
00:12:35,910 --> 00:12:40,030
You can just add whoever you want to stock down there.

95
00:12:44,530 --> 00:12:59,190
I checked out some other programs, some other loyalty programs for the big grocery store chains in Norway, and at least one of the other ones had the exact same solution for this.

96
00:13:02,490 --> 00:13:06,490
And there were some other applications that you can do similar things.

97
00:13:06,490 --> 00:13:13,390
Not as smooth and super easy, but definitely has the potential for stocking.

98
00:13:13,750 --> 00:13:22,650
Now, this type of stalkerware, the third type of stalkerware.

99
00:13:23,830 --> 00:13:33,370
We are used to being tracked when we're online and, you know, Google ads that follow us and Facebook ads and so on.

100
00:13:33,370 --> 00:13:36,510
If you accidentally type baby ever at the internet...

101
00:13:38,910 --> 00:13:43,850
You can just wait for the ads forever to be about babies.

102
00:13:47,110 --> 00:13:54,970
And from a million different kind of trackers, data are being leaked and sold all the time.

103
00:13:54,970 --> 00:13:58,510
And if you take that kind of data, you can find an individual.

104
00:13:59,170 --> 00:14:01,850
But stalkerware is the other way around.

105
00:14:02,250 --> 00:14:06,290
You start out by knowing who you want to know more about.

106
00:14:06,290 --> 00:14:09,470
It's very personal.

107
00:14:09,470 --> 00:14:11,290
It's very invasive.

108
00:14:15,680 --> 00:14:20,700
In addition, this kind of stalking is physical.

109
00:14:20,700 --> 00:14:22,700
You can't turn it off.

110
00:14:22,700 --> 00:14:25,240
You can't just leave.

111
00:14:25,900 --> 00:14:29,800
And you probably don't know it's happening.

112
00:14:33,180 --> 00:14:38,300
So this is the kind of stalkerware my significant other used.

113
00:14:38,820 --> 00:14:40,340
Not by purpose.

114
00:14:40,340 --> 00:14:42,960
He did not know that this would happen.

115
00:14:43,060 --> 00:14:56,060
He didn't know that if I used my card that was connected to our joint account, the receipt would show up because he registered his card with his information.

116
00:14:56,520 --> 00:14:59,900
It just happened to be the same account number.

117
00:15:00,240 --> 00:15:07,880
Remember, you're supposed to give three pieces of information and he gave all three, but they choose to use only one of them.

118
00:15:11,470 --> 00:15:21,890
Other types of programs that do the same, or apps, are parking apps and toll passes because they track license plates.

119
00:15:22,310 --> 00:15:33,990
And some of the applications that I've checked out do realize that license plate numbers are not secret and bank account numbers are not secret.

120
00:15:35,130 --> 00:15:40,890
But quite a few of them treat this information as if it was secret.

121
00:15:44,430 --> 00:15:49,010
Now, I'm sure I haven't seen every kind of version of this.

122
00:15:49,010 --> 00:15:55,510
And if you know of a version of this kind of stalkerware that use other kind of data, please let me know.

123
00:15:55,510 --> 00:15:56,570
I'm interested.

124
00:16:01,790 --> 00:16:13,570
When I talk to people about this kind of software and the application that is giving my significant other my receipt, people tend to not understand the problem.

125
00:16:13,570 --> 00:16:18,850
Let me show you.

126
00:16:19,810 --> 00:16:21,110
This is me.

127
00:16:21,730 --> 00:16:23,710
I go to the grocery store.

128
00:16:23,730 --> 00:16:24,810
I buy tea.

129
00:16:24,810 --> 00:16:26,910
When I'm done, I pay.

130
00:16:26,910 --> 00:16:30,590
I take the paper receipt, I curl it up, I throw it in the trash.

131
00:16:31,110 --> 00:16:36,450
When I leave, as far as I'm concerned, transaction is over.

132
00:16:36,450 --> 00:16:38,450
We don't have a relation anymore.

133
00:16:40,150 --> 00:16:44,290
The app is a key that gives us a relation.

134
00:16:45,310 --> 00:16:50,730
But I don't want to have a relation with the store, so I don't use apps like that.

135
00:16:51,590 --> 00:16:56,250
However, my significant other came along and he made a connection .

136
00:16:56,550 --> 00:16:59,210
And because he made a connection, he knows about the connection.

137
00:16:59,210 --> 00:17:04,830
And because he knows about the connection, he's in control of the connection.

138
00:17:07,660 --> 00:17:15,460
As far as the store knows, he is the rightful owner of this information because he put in the account number.

139
00:17:15,840 --> 00:17:18,980
And they just don't validate this in any other way.

140
00:17:19,760 --> 00:17:22,960
You know the account number, you must be the customer.

141
00:17:26,220 --> 00:17:32,760
So, in case you're not sure there is a problem, I want to spell it out for you.

142
00:17:33,680 --> 00:17:52,040
First of all, I'm sure you already thought about that, okay, people that are hiding from violent partners or still living in abusive relationships would probably need to be protected from this kind of stalking and leakage of data.

143
00:17:52,460 --> 00:18:09,860
But also politicians, activists, journalists, union representatives and religious people do need to be or may need to be particular about their privacy.

144
00:18:14,940 --> 00:18:24,300
In addition to these groups, as I said before, I think a lot about humans and what they are and what they do and what they do with technology.

145
00:18:24,960 --> 00:18:27,960
I have three other groups.

146
00:18:27,960 --> 00:18:30,940
First of all, the elderly.

147
00:18:32,260 --> 00:18:35,180
Elder abuse is a thing.

148
00:18:35,280 --> 00:18:48,740
Elder abuse is when typically relatives, but also perhaps friends and neighbors of the elderly, when they start to be abusive to the elder person.

149
00:18:49,500 --> 00:18:59,860
In this context, perhaps they started having opinions about what should the person spend money on?

150
00:18:59,860 --> 00:19:02,560
What should grandma be allowed to buy?

151
00:19:02,560 --> 00:19:05,540
Should grandpa be allowed to buy so many beers?

152
00:19:06,800 --> 00:19:09,960
Should grandma be allowed to buy so much candy?

153
00:19:09,980 --> 00:19:12,120
You know, because she has diabetes.

154
00:19:14,640 --> 00:19:21,700
They are grown and adult and their own person with their own money.

155
00:19:22,560 --> 00:19:32,260
But they do get unwanted attention from people around them or may get that.

156
00:19:32,260 --> 00:19:36,140
Now, there's children.

157
00:19:37,040 --> 00:20:03,340
And children, while the smallest children will typically not have a credit or debit card to pay with, when children start to grow up, parents, at least in Norway, start giving their children debit cards with a little bit of money so they can start practice and understand what are money and how expensive are things and,

158
00:20:03,340 --> 00:20:07,000
you know, what are things, how does this work?

159
00:20:07,000 --> 00:20:10,080
Is it real or is it, you know, imaginary money?

160
00:20:12,100 --> 00:20:28,160
And children do need to be protected and have their own privacy, not only from strangers, but also from their parents and relatives and friends.

161
00:20:28,160 --> 00:20:35,040
Of course, if everybody was nice, children wouldn't need this, but everybody's not nice.

162
00:20:35,060 --> 00:20:43,900
Not every parent is nice, so they deserve their privacy.

163
00:20:44,560 --> 00:20:49,820
And then there's teenagers or young adults.

164
00:20:49,820 --> 00:20:59,040
And teenagers, they need to have their privacy protected from everyone.

165
00:20:59,220 --> 00:21:06,040
Parents, friends, strangers, relatives, employers.

166
00:21:06,040 --> 00:21:08,580
There's so many groups of people.

167
00:21:08,580 --> 00:21:18,660
They may have opinions and negatively affect teenagers' lives if they knew what teenagers were buying.

168
00:21:18,660 --> 00:21:22,420
Just imagine you as a 13-year-old.

169
00:21:23,260 --> 00:21:27,880
What if your mom got an instant notification every time you went to the store?

170
00:21:27,880 --> 00:21:29,640
Would that affect you?

171
00:21:31,280 --> 00:21:37,700
What if you were 16 or 19?

172
00:21:37,860 --> 00:21:53,080
In Norway, you are technically an adult when you're 18, but just because you got older, your parents may not be ready to let you be an independent person.

173
00:21:57,810 --> 00:22:00,370
Now, groceries.

174
00:22:00,370 --> 00:22:02,730
How bad can it be?

175
00:22:03,950 --> 00:22:08,630
I guess you already thought about the candy and the alcohol that I mentioned.

176
00:22:09,930 --> 00:22:16,290
But in Norway, you can buy the following items in every grocery store.

177
00:22:18,390 --> 00:22:24,510
Candy, alcohol, lottery tickets.

178
00:22:25,630 --> 00:22:33,870
How many lottery tickets should your significant other allow me or allow you to buy, for instance?

179
00:22:34,410 --> 00:22:36,330
Is that a thing?

180
00:22:36,330 --> 00:22:37,990
Shouldn't be.

181
00:22:38,290 --> 00:22:40,950
Anyways, magazines.

182
00:22:40,950 --> 00:22:47,370
You know, not everybody prefer things online.

183
00:22:48,890 --> 00:22:50,450
Tobacco.

184
00:22:50,990 --> 00:22:55,510
You can get over-the-counter pharmaceuticals such as painkillers.

185
00:22:56,720 --> 00:23:01,090
You can get intimate products such as tampons and pads.

186
00:23:03,010 --> 00:23:10,090
Not every girl want to share with her dad instantly when this is a needed product.

187
00:23:11,270 --> 00:23:15,870
And you can get condoms and pregnancy tests.

188
00:23:16,730 --> 00:23:19,810
That will be a fun conversation to have, right?

189
00:23:21,750 --> 00:23:30,410
Not in every store, but in a lot of stores, they sell what's called a morning after pill or an emergency contraception.

190
00:23:35,210 --> 00:23:46,730
I guess most teenagers, if they were caught buying this, it would be embarrassing.

191
00:23:46,870 --> 00:23:51,490
Perhaps they'll get grounded or they will have a fight with their parents.

192
00:23:53,310 --> 00:23:58,130
But some will not survive that their parents know this.

193
00:23:59,450 --> 00:24:12,910
And that is why teenagers is such a vulnerable group, because they are growing up and supposed to make independent choices, but are still very close and dependent on their families.

194
00:24:15,510 --> 00:24:24,210
So, even though I only bought tea, there's nothing very radical about that.

195
00:24:24,350 --> 00:24:36,770
I did go through the motion and thought about, was there something I could have done differently so that I wasn't unintentionally, but still stalked?

196
00:24:39,550 --> 00:24:43,910
And I came up with these points.

197
00:24:43,910 --> 00:24:52,490
First of all, if I never shared my account number with anyone, then I would have been safe.

198
00:24:52,490 --> 00:24:55,800
Unfortunately, account numbers are not secret.

199
00:24:56,790 --> 00:25:08,710
And if you want money from your employer, you definitely will have to give your employer an account number to transfer the money to.

200
00:25:08,910 --> 00:25:20,650
And your family and friends, if they want to give you perhaps a little attention when you have a birthday, you need to give them an account number to transfer the money to.

201
00:25:24,790 --> 00:25:26,810
So, it's not very realistic.

202
00:25:27,710 --> 00:25:34,890
So, I thought, what if I had a dedicated account for receiving money?

203
00:25:35,490 --> 00:25:39,270
That could work for me specifically.

204
00:25:39,790 --> 00:26:04,810
But for people who have a shared economy with someone else, married people or living with someone, or again teenagers, it would be completely normal and expected that other people, their parents or their spouse, know the account number.

205
00:26:05,310 --> 00:26:13,010
I could have paid with cash instead of with my card.

206
00:26:15,730 --> 00:26:20,390
That would have worked until March 2020.

207
00:26:20,390 --> 00:26:42,530
Because March 2020, the COVID-19 virus hit Norway and a lot or actually most stores stopped accepting physical payment money because they were afraid that the COVID-19 virus would be transferred via the money.

208
00:26:42,870 --> 00:26:45,690
So, it's card only.

209
00:26:47,630 --> 00:26:56,770
I could have chosen not to shop at that particular grocery store chain.

210
00:26:59,130 --> 00:27:06,430
But unfortunately, that particular one together with the other one that I mentioned also have the same app.

211
00:27:06,930 --> 00:27:10,650
Together they have a 76% market share.

212
00:27:11,830 --> 00:27:24,270
And in Norway, well, I live in, let's call it a large town where not a lot of people, but we are enough people that I have a choice.

213
00:27:24,410 --> 00:27:29,090
I could have bought my lunch somewhere else.

214
00:27:29,330 --> 00:27:43,270
But in a lot of towns spread around Norway, you only have one or two shops and probably one or two of those specific stores.

215
00:27:44,770 --> 00:27:58,290
Now, I did discover that when I started to register my own card in the application, I got an error message that says that this card is already registered.

216
00:27:58,290 --> 00:28:10,950
It meant that they had some kind of control mechanism so that only one person would register the account number and my significant other already had registered the account number.

217
00:28:10,950 --> 00:28:12,410
So, I couldn't.

218
00:28:13,250 --> 00:28:15,890
I did, of course, verify this.

219
00:28:15,890 --> 00:28:25,110
I verified by asking some friends if they would allow me to stalk them for a while.

220
00:28:25,350 --> 00:28:31,190
And because my friends are my friends and know what I do, they said yes.

221
00:28:31,270 --> 00:28:36,350
So, I stalked my friends to verify that the application actually worked the way I suspected.

222
00:28:39,700 --> 00:28:40,900
Yes.

223
00:28:41,960 --> 00:28:49,340
But to sum it up, I can't really protect myself from this kind of stalkerware.

224
00:28:49,340 --> 00:28:58,740
I can protect myself from the classical type by changing all my devices, by having dumb phones, you know.

225
00:28:58,740 --> 00:29:08,820
I can protect myself from the other type, the stalkerware as a service, by not registering anywhere.

226
00:29:08,820 --> 00:29:12,140
But this type I cannot protect myself against.

227
00:29:12,940 --> 00:29:14,660
Not even in theory.

228
00:29:16,260 --> 00:29:18,220
It's not practical.

229
00:29:18,220 --> 00:29:20,220
It's not possible.

230
00:29:20,220 --> 00:29:30,560
And because, unfortunately, I do think there are other applications that rely on different kind of not really secrets.

231
00:29:32,120 --> 00:29:35,220
And I can't keep up with that.

232
00:29:36,120 --> 00:29:45,680
In reality, I wouldn't know if someone tried stalking me this way, unless they did something to make me aware of it.

233
00:29:45,680 --> 00:29:49,540
Like asking me, where is the tea?

234
00:29:51,890 --> 00:29:53,990
But I'm not giving up.

235
00:29:54,470 --> 00:29:56,150
So, what do I do?

236
00:29:56,510 --> 00:30:12,170
Well, I realized that that grocery store chain, making stalkerware was probably not their primary business.

237
00:30:12,170 --> 00:30:14,210
They're not, not their intention.

238
00:30:14,490 --> 00:30:27,430
It's just something that happened as a side effect, because they were doing this side gig that was collecting data and trying to be cool and new and digital and so on.

239
00:30:27,990 --> 00:30:35,250
So, I contacted them and told them about this.

240
00:30:40,090 --> 00:30:43,830
So, I believe in responsible disclosure.

241
00:30:44,070 --> 00:30:51,570
Give companies a chance to fix their mess, and so it stops hurting people.

242
00:30:54,210 --> 00:30:57,570
In this case, I told them.

243
00:30:58,350 --> 00:31:01,530
We talked, I explained, it was nice.

244
00:31:01,770 --> 00:31:07,530
I gave them a limited time for them to fix the problem.

245
00:31:08,110 --> 00:31:11,190
I do work in software, with software development.

246
00:31:11,190 --> 00:31:19,210
So, I do have a rough idea of how much time would be reasonable, because I didn't want to give them forever, because you know what happens then.

247
00:31:20,170 --> 00:31:35,010
So, halfway through my deadline, I follow up and ask how are things going, how's the progress, just in case they for some reason needed extra time.

248
00:31:36,290 --> 00:31:43,180
Well, they thanked me.

249
00:31:44,060 --> 00:31:51,420
And then they gave me a bounty, which is nice and super rare, that never happens in Norway.

250
00:31:51,440 --> 00:31:56,060
And then they did nothing.

251
00:31:56,540 --> 00:31:57,880
Nothing.

252
00:31:58,200 --> 00:32:04,780
They decided it was more convenient to keep things the way it was.

253
00:32:07,060 --> 00:32:13,340
When they decided not to fix things, I had to decide if I wanted to warn the victims.

254
00:32:14,300 --> 00:32:17,720
Now, warning victims meant going public.

255
00:32:21,430 --> 00:32:30,890
Going public is not all cool and fun, because if I didn't reach out enough, I wouldn't be warning victims.

256
00:32:30,890 --> 00:32:35,870
I would be giving harmful people another tool to be cruel.

257
00:32:38,310 --> 00:32:41,510
So, I had to think about it.

258
00:32:41,590 --> 00:32:48,030
In addition, it has a personal cost, because as I mentioned, I'm a consulted tester.

259
00:32:48,330 --> 00:32:50,980
Companies hire me to test their software.

260
00:32:51,880 --> 00:32:58,080
If I made waves, they may see me as a troublemaker and not hire me in the future.

261
00:32:58,400 --> 00:33:02,280
So, that is also something I had to think about.

262
00:33:02,280 --> 00:33:04,020
Was it worth the risk?

263
00:33:08,270 --> 00:33:11,230
I decided it would be worth the risk.

264
00:33:11,810 --> 00:33:16,290
I contacted a journalist that I know understands technology.

265
00:33:16,970 --> 00:33:20,950
He worked at the Norwegian Broadcasting Corporation.

266
00:33:21,470 --> 00:33:28,840
It's a national news channel in Norway, it reaches around 80 to 89 percent of the adult population on a daily basis.

267
00:33:30,650 --> 00:33:40,310
And for a few hours in the morning, the case got the front page.

268
00:33:40,550 --> 00:33:45,690
And it was on heavy rotation in the news and on the radio.

269
00:33:45,910 --> 00:33:53,770
And that felt so good, because it meant that I got the outreach that I needed.

270
00:33:57,050 --> 00:34:10,530
The journalist was a good journalist, so he also called the company responsible for the app, and they had made a statement.

271
00:34:11,210 --> 00:34:25,370
But around 24 hours after this got published, they decided to close the feature that was facilitating stalking.

272
00:34:25,830 --> 00:34:27,650
And that was even better.

273
00:34:27,650 --> 00:34:33,570
That was a real win, because it meant that this software was no longer harming people.

274
00:34:34,910 --> 00:34:43,610
Unfortunately, this was only one out of two that was using the same software.

275
00:34:43,810 --> 00:34:52,970
And the other people, they were also asked for a statement, and they decided they didn't want to do something.

276
00:34:53,170 --> 00:35:00,550
They decided it was worth the risk, which is pretty unfair, because they're not really risking anything.

277
00:35:00,550 --> 00:35:04,150
They're taking a risk on other people's behalf.

278
00:35:05,370 --> 00:35:16,050
But anyway, they decided they wanted to wait and see what happened, and whether or not the first company would get a GDPR fine.

279
00:35:16,890 --> 00:35:22,050
Like, they had to pay to the authorities.

280
00:35:26,030 --> 00:35:26,890
Yeah.

281
00:35:29,190 --> 00:35:38,430
So, the Trumf app in Logiskruppen still has the issue, as far as I know.

282
00:35:39,050 --> 00:35:42,210
In addition, there was a lot of parking apps.

283
00:35:42,210 --> 00:35:55,570
It came up as a part of the discussion that followed going public with the app feature, because people started telling me and others that, you know what, but my parking app is doing the same thing.

284
00:35:55,570 --> 00:35:58,050
I can add cars that I don't own.

285
00:35:58,050 --> 00:35:59,450
There's no verification.

286
00:36:00,170 --> 00:36:10,270
And I checked up on it, and several companies have been told and warned, and they as well just decided it was worth the risk.

287
00:36:10,270 --> 00:36:14,990
In other words, it wasn't worth the effort.

288
00:36:21,160 --> 00:36:23,600
Now, I'm not done.

289
00:36:25,100 --> 00:36:26,820
And neither are you.

290
00:36:26,820 --> 00:36:31,500
So, if you find this stuff out in the wild, please do something about it.

291
00:36:32,020 --> 00:36:36,600
I suggest, first, tell the owners or makers.

292
00:36:36,600 --> 00:36:39,680
They're not always the same people.

293
00:36:39,680 --> 00:36:45,560
So, give them a proper, clear explanation.

294
00:36:46,140 --> 00:36:48,080
Include some abuse scenarios.

295
00:36:48,080 --> 00:36:55,800
You can use some of the ones that I mentioned, because they don't always get the problem.

296
00:36:56,160 --> 00:37:02,980
They just see somebody contacting us, wanting us to do and spend money and time on something.

297
00:37:02,980 --> 00:37:05,720
So, you really need to be clear about it.

298
00:37:05,960 --> 00:37:09,240
If there's an authority you should be notified, notify them.

299
00:37:10,040 --> 00:37:13,380
In Norway, we do have an authority.

300
00:37:13,700 --> 00:37:15,300
It's called the Datatilsina.

301
00:37:15,300 --> 00:37:17,760
I'm sorry, I don't know the English translation.

302
00:37:19,760 --> 00:37:32,760
And I did tell the creators and owners of the app that they had to notify Datatilsina themselves, because that's how it should work.

303
00:37:32,760 --> 00:37:36,060
And they did.

304
00:37:36,860 --> 00:37:48,940
But most importantly, educate yourself and others around you, so that you don't unintentionally make stock aware.

305
00:37:49,840 --> 00:37:55,600
And if it's worth it, go public.

306
00:37:56,810 --> 00:37:59,910
After you've done a responsible disclosure.

307
00:38:00,890 --> 00:38:06,070
And after going public, if that didn't work, you know what?

308
00:38:06,870 --> 00:38:08,190
Shame them.

309
00:38:08,930 --> 00:38:12,310
Shame the companies that refuse to be decent.

310
00:38:12,970 --> 00:38:16,490
Tell people about it for a long time.

311
00:38:17,490 --> 00:38:27,240
Now, first step in educating yourself is to look up these two eras.

312
00:38:27,280 --> 00:38:29,040
They're both badass.

313
00:38:29,300 --> 00:38:31,980
Read the article that is mentioned here.

314
00:38:32,080 --> 00:38:34,640
And please watch the video.

315
00:38:34,640 --> 00:38:35,740
It's good.

316
00:38:36,080 --> 00:38:40,780
I'll make sure that the links are published somewhere related to this talk.

317
00:38:41,340 --> 00:38:55,160
And if you're still ready for more, after reading the article and watching the video, I recommend the collection that the Vice Media Group made.

318
00:38:55,800 --> 00:38:59,360
It's called When Spies Come Home.

319
00:38:59,540 --> 00:39:06,360
And it's a good collection of articles around that shows the problem with stock aware, really.

320
00:39:06,860 --> 00:39:08,140
Yeah.

321
00:39:09,580 --> 00:39:13,020
And if you have questions, let me know.

322
00:39:16,360 --> 00:39:19,400
Thank you for your time and for your patience.

323
00:39:19,400 --> 00:39:24,260
I hope you're as pissed off as I am.

324
00:39:37,300 --> 00:39:39,380
That was Next Level Stock Aware.

325
00:39:39,380 --> 00:39:41,460
Thank you again to Cecilia and Vianne.

326
00:39:41,460 --> 00:39:43,680
We are very thankful to have you here.

327
00:39:43,680 --> 00:39:46,420
So, our speaker is now here for a live Q&A.

328
00:39:46,420 --> 00:39:50,520
So, please put any of your questions in the Discord CPV Q&A channel.

329
00:39:50,900 --> 00:39:53,660
Currently, we have one question so far.

330
00:39:54,220 --> 00:39:59,480
Speaking of child protection from the commenter, I am in Utah.

331
00:39:59,480 --> 00:40:00,900
A bit of a bubble over here.

332
00:40:00,900 --> 00:40:06,900
What is right about deploying stock aware against a child and wrong about deploying it against an adult?

333
00:40:08,500 --> 00:40:08,960
Okay.

334
00:40:08,960 --> 00:40:16,400
So, one of the difference between being an adult and a child is that children learn to make good decisions.

335
00:40:17,040 --> 00:40:23,540
And if you want to teach your children to make good decisions, you need to give them the space to actually do it.

336
00:40:23,540 --> 00:40:25,660
And privacy is a part of that.

337
00:40:25,660 --> 00:40:37,220
And as they are growing and become more and more independent and have more and more independent opinion and experiences, they also need more privacy.

338
00:40:37,220 --> 00:40:40,900
Because as I mentioned, not every parent is nice.

339
00:40:40,900 --> 00:40:49,840
And if we make sure that every child gets some kind of privacy, there is room to tell others that they're not fine.

340
00:40:50,340 --> 00:40:57,100
So, it's just like we really need to make sure that every child gets this and not just the children who have it nice at home.

341
00:40:57,100 --> 00:40:59,100
Because you can't really tell.

342
00:40:59,900 --> 00:41:08,960
And I'm aware there's some cultural differences when it comes to how independent and how much privacy a child can have.

343
00:41:10,120 --> 00:41:21,860
But in essence, from like from a pedagogic perspective, if you want your children to make good decisions, you have to give them the space for it.

344
00:41:26,520 --> 00:41:29,190
That is really, really lovely.

345
00:41:29,250 --> 00:41:36,470
And hopefully any future parents or current parents in here are listening to this and hear that thoughtful advice.

346
00:41:36,550 --> 00:41:42,630
We have another question also saying, I know Norway is already GDPR compliant.

347
00:41:42,630 --> 00:41:47,090
Is there anything policy related that you could push forward to combat stalkerware?

348
00:41:47,770 --> 00:41:49,550
Yes, there is.

349
00:41:49,550 --> 00:41:57,570
I did tell there's the hang on, let me remember what they're called.

350
00:41:57,570 --> 00:42:01,550
It's like authorities for computer and digital.

351
00:42:02,090 --> 00:42:03,850
They have a very complicated name.

352
00:42:03,850 --> 00:42:11,010
But anyway, and they are the ones who are handling all GDPR complaints and issues.

353
00:42:11,010 --> 00:42:15,250
And they also have a mandate to give out fines, for instance.

354
00:42:16,830 --> 00:42:24,870
And Norway, you're supposed to tell, you know, confess if you have an incident that is related to privacy.

355
00:42:25,410 --> 00:42:30,350
And I did tell the company that I was in contact with and told them, you know what, you really have to do this yourself.

356
00:42:30,350 --> 00:42:33,510
Because if I tell them, it's going to be very bad.

357
00:42:33,770 --> 00:42:35,350
And they told them.

358
00:42:35,550 --> 00:42:43,850
And when I went public, they said that, well, we have to look into it again, because they were essentially just putting the case in the bottom.

359
00:42:43,850 --> 00:42:52,090
And just like, yeah, because of the way that the company had displayed the situation, because they said like, it's not really a big issue at all.

360
00:42:52,090 --> 00:42:54,210
It's like one person and so on.

361
00:42:54,350 --> 00:43:01,910
And when I went public and issue was like revealed, they were like, oh, we have to pick this up again.

362
00:43:02,230 --> 00:43:16,990
So I expect in, but it will probably take like six months to a year before they actually will make a proper legal statement and, you know, serve a fine related to this.

363
00:43:17,210 --> 00:43:21,030
And that is the thing that the other company is waiting for.

364
00:43:21,250 --> 00:43:24,270
The one that's not changed their app.

365
00:43:25,190 --> 00:43:27,630
And but the authorities are great.

366
00:43:27,630 --> 00:43:29,670
It's just that they have a lot to do.

367
00:43:30,010 --> 00:43:32,130
So everything is super.

368
00:43:32,510 --> 00:43:38,210
We can definitely tell them just takes forever.

369
00:43:38,470 --> 00:43:41,170
And while we're waiting, more people are being hurt.

370
00:43:41,170 --> 00:43:44,450
So I just, yeah, it's frustrating.

371
00:43:45,170 --> 00:43:49,070
Oh, gosh, that is quite a lot of time for things happen.

372
00:43:49,090 --> 00:43:55,830
Yes, we have another comment with some context behind it for US context.

373
00:43:55,830 --> 00:44:01,930
Here in the US, some cities are requiring all stores to accept cash, because many people don't have credit cards.

374
00:44:01,930 --> 00:44:05,370
Would you recommend using cash whenever buying sensitive items?

375
00:44:05,730 --> 00:44:07,250
Yes, I would.

376
00:44:08,410 --> 00:44:10,290
I definitely would.

377
00:44:10,790 --> 00:44:21,150
And if you don't have cash, or like the situation is now where some stores will not accept cash, ask a friend you trust to pay for you.

378
00:44:21,530 --> 00:44:27,390
If you have reason to suspect, or if you are sensitive about whether you're buying.

379
00:44:31,080 --> 00:44:32,980
That's a really interesting point.

380
00:44:36,120 --> 00:44:40,840
At the moment, I don't think we have any more further questions from the discord.

381
00:44:40,980 --> 00:44:44,260
Thank you so much again, Cecilia, for joining us today.

382
00:44:44,260 --> 00:44:46,780
And for your really lovely talk.

383
00:44:46,780 --> 00:44:47,960
Please take care and...