Hello, my name is Cecilia Vian. Thank you for having me here at the Crypto & Privacy Village.
I'm here to talk about stalkerware and an incident that happened late 2019 and early 2020.
I work as a consultant tester. I mostly do software testing with UX and security in mind.
And I have what's called an unconventional background for my field of work
because I have a bachelor's degree in pedagogics. That's educational psychology if you're American.
And I have a master's degree in philosophy of technology.
It means that I think a lot about what is technology, what are humans doing with technology,
what are they not doing with technology, how is technology affecting us, and so on.
Now, I live and work in Norway. It's a small country. You may or may not have heard of us.
There's about 5.5 million Norwegians and it's a country mostly known for its
fjords and mountains and very generous parental leave.
But for this context, what's important is it's a country that has pretty advanced
technological infrastructure. Most people in Norway have internet connections,
they have smartphones, they have digital ideas, they adopt new technology pretty fast.
We have already implemented GDPR and we have a very digital and highly coordinating banking system.
Banks in Norway mostly don't have any offices, like physical offices.
Banking here is done online and
people are paying their bills online, they're receiving their salaries and pensions directly
to their bank accounts, and people are using debit card and credit card and
what's called digital wallets. That's commonplace. We don't really use checks,
we don't really use cash a lot, and prepaid cards are not really in use in Norway.
In Norway, not only the young people are online, but also older people are online.
My grandpa is online, my great-grandmother would have been online,
she would do all her banking online. That's now common here. Everybody is online and doing their
banking there. We are essentially, well, you could say living the dreams of banks other places.
It's very easy, it's efficient, but it also has some drawbacks. Now, story time.
Late last year, I bought lunch at a grocery store.
It's not as exciting as I try making it sound exciting, but you know.
One of the items that I bought was a pack of tea, and I paid for this, of course, as a Norwegian by
card. When I got home after work, I was cold, and I was tired, and my significant other,
he's a nice person, and he wanted to make me a cup of warm tea.
He couldn't find any tea, so he asked me, where did you put the tea I, you know, you bought? And that,
uh, that was odd, because I hadn't told him that I bought tea, because the tea was for my office,
it wasn't for our home. So how come he knew that I bought tea? Is he stalking me? Now,
I guess you do have some kind of idea what stalking where stalkerware is.
By definition, any software that allows for stalking is called stalkerware.
But with this definition, a lot of very different things will be end up called stalkerware.
So for clarity, I have divided stalkerware into different categories.
First, there's the classic stalkerware. You can call it creepware, spouseware,
theft tracking, child safety is very, it's a very positive spin on stalkerware.
We also have something called prop tech, which is a new type for me.
And you have to install this kind of software on hardware,
on the victim's hardware, for instance, on a victim's phone, or victim's computer, watches,
house, toys, their car, anything. And it can be really hard to find.
And for people who are leaving abusive partners, the best and easiest advice given is move,
get new devices, get rid of your old computer, get a dumb phone, start over.
So one of the ways my significant other could have known that I bought tea
is if he had installed some kind of stalkerware on my phone, for instance.
But for this occasion, traditional stalkerware didn't really make any sense. It didn't quite fit.
So what else do we have? What else could it be?
Well, obviously, having to need to get access to someone's hardware is an obstacle,
and it's a bit of a hassle if you want to stalk them. So naturally, stalkerware evolved,
and we got what I called stalking as a service. Well, stalking as a service,
you can't just invite someone to be stalked. If you tried, please let me how that went.
But typically, the victim is encouraged to register as a service by the abuser
because it's something fun or useful.
And this kind of stalkerware could be camouflaged as find my phone, as something social media
related type of app, photo apps, a lot, health app and loyalty programs. They have fun features
like sharing by default and geotagging your pictures and tracking your whereabouts and
sending copies of whatever you upload or register there, notifications or share the account you
register in some way. Now, there's a lot of gray areas in this because there's so many legit
applications and apps and services that do the exact same thing and make it really hard
to stay private. So it's hard to tell sometimes if it's meant to be stalkerware or if it's just
bad software. But okay. Another thing that sometimes is stalkerware as a service is
customer loyalty programs. A lot of the times, I don't think they're meant to be stalkerware
but they are definitely facilitating it. Now, I don't typically register for loyalty programs so
that doesn't explain why did my significant other know about the tea. Since I didn't think
he was trying to hurt me, I asked him, how did you know I bought tea? And he told me he got a receipt
and I said, what receipt? Well, in the application, in the A application. A is one of the Scandinavian
letters. And that confused me because I haven't registered in that application. I know it, but
I didn't register. And I just had to ask him, did you register my card there? And he said, no,
only my card. And I thought that was odd and creepy. And it put me on a sort of,
gave me a sort of feeling that there's a new kind of stalkerware out there.
That is a new kind of nightmare, really. Because he had enthusiastically and with no harm intended
added his card. The card is connected to our joint account.
And that's how he got my receipts. Let me show you.
I, of course, had to figure this out. Is it really as bad as I think it is? So I downloaded the app
and I added my phone number. I got a text message with some numbers in it. I typed numbers into the
application again and voila, I was registered. Now, for this program, if you really want to take,
use the benefits, you have to add a card, a payment card.
It's like this. Now, I know you don't read Norwegian, so I'll explain it.
You type in a credit card number. Then you add the month and year.
And then you add the bank account number. As I said previously, Norwegians are all about
online banking, so everybody has bank account numbers, probably several.
And the bank account number, well, it says here in a little text that the account must be registered
in your name. And ethically speaking, it definitely should be registered in your name.
But there's no technical reason why it should be registered to your name.
You can just add whoever you want to stock down there.
I checked out some other programs, some other loyalty programs for the big grocery
store chains in Norway, and at least one of the other ones had the exact same solution for this.
And there were some other applications that you can do similar things.
Not as smooth and super easy, but definitely has the potential for stocking.
Now, this type of stalkerware, the third type of stalkerware.
We are used to being tracked when we're online and, you know, Google ads that follow us
and Facebook ads and so on. If you accidentally type baby ever at the internet...
You can just wait for the ads forever to be about babies.
And from a million different kind of trackers, data are being leaked and sold all the time.
And if you take that kind of data, you can find an individual.
But stalkerware is the other way around. You start out by knowing who you want to know more about.
It's very personal. It's very invasive.
In addition, this kind of stalking is physical. You can't turn it off. You can't just leave.
And you probably don't know it's happening.
So this is the kind of stalkerware my significant other used.
Not by purpose. He did not know that this would happen.
He didn't know that if I used my card that was connected to our joint account,
the receipt would show up because he registered his card with his information.
It just happened to be the same account number.
Remember, you're supposed to give three pieces of information
and he gave all three, but they choose to use only one of them.
Other types of programs that do the same, or apps, are parking apps and toll passes
because they track license plates. And some of the applications that I've checked out
do realize that license plate numbers are not secret and bank account numbers are not secret.
But quite a few of them treat this information as if it was secret.
Now, I'm sure I haven't seen every kind of version of this.
And if you know of a version of this kind of stalkerware that use other kind of data,
please let me know. I'm interested.
When I talk to people about this kind of software and the application that is
giving my significant other my receipt, people tend to not understand the problem.
Let me show you.
This is me. I go to the grocery store. I buy tea. When I'm done, I pay. I take the paper receipt,
I curl it up, I throw it in the trash. When I leave, as far as I'm concerned,
transaction is over. We don't have a relation anymore.
The app is a key that gives us a relation. But I don't want to have a relation with the store,
so I don't use apps like that. However, my significant other came along and he made a
connection. And because he made a connection, he knows about the connection. And because he
knows about the connection, he's in control of the connection.
As far as the store knows, he is the rightful owner of this information because he put in the
account number. And they just don't validate this in any other way. You know the account number,
you must be the customer. So, in case you're not sure there is a problem, I want to spell it out
for you. First of all, I'm sure you already thought about that, okay, people that are
hiding from violent partners or still living in abusive relationships would probably need
to be protected from this kind of stalking and leakage of data. But also politicians, activists,
journalists, union representatives and religious people do need to be or may need to be particular
about their privacy. In addition to these groups, as I said before, I think a lot about humans and
what they are and what they do and what they do with technology. I have three other groups. First
of all, the elderly. Elder abuse is a thing. Elder abuse is when typically relatives, but also
perhaps friends and neighbors of the elderly, when they start to be abusive to the elder person.
In this context, perhaps they started having opinions about what should the person spend money
on? What should grandma be allowed to buy? Should grandpa be allowed to buy so many beers?
Should grandma be allowed to buy so much candy? You know, because she has diabetes.
They are grown and adult and their own person with their own money.
But they do get unwanted attention from people around them or may get that. Now, there's children.
And children, while the smallest children will typically not have a credit or debit card to pay
with, when children start to grow up, parents, at least in Norway, start giving their children
debit cards with a little bit of money so they can start practice and understand
what are money and how expensive are things and, you know, what are things,
how does this work? Is it real or is it, you know, imaginary money?
And children do need to be protected and have their own privacy, not only from strangers,
but also from their parents and relatives and friends. Of course, if everybody was nice,
children wouldn't need this, but everybody's not nice. Not every parent is nice,
so they deserve their privacy. And then there's teenagers or young adults.
And teenagers, they need to have their privacy protected from everyone. Parents, friends,
strangers, relatives, employers. There's so many groups of people. They may have opinions
and negatively affect teenagers' lives if they knew what teenagers were buying.
Just imagine you as a 13-year-old. What if your mom got an instant notification every
time you went to the store? Would that affect you? What if you were 16 or 19?
In Norway, you are technically an adult when you're 18,
but just because you got older, your parents may not be ready to let you be an independent person.
Now, groceries. How bad can it be? I guess you already thought about the candy and the alcohol
that I mentioned. But in Norway, you can buy the following items in every grocery store.
Candy, alcohol, lottery tickets. How many lottery tickets should your significant other allow me
or allow you to buy, for instance? Is that a thing? Shouldn't be. Anyways, magazines.
You know, not everybody prefer things online.
Tobacco. You can get over-the-counter pharmaceuticals such as painkillers.
You can get intimate products such as tampons and pads.
Not every girl want to share with her dad instantly when this is a needed product.
And you can get condoms and pregnancy tests. That will be a fun conversation to have, right?
Not in every store, but in a lot of stores, they sell what's called a morning after pill
or an emergency contraception. I guess most teenagers, if they were caught buying this,
it would be embarrassing. Perhaps they'll get grounded or they will have a fight with their
parents. But some will not survive that their parents know this. And that is why teenagers
is such a vulnerable group, because they are growing up and supposed to make independent
choices, but are still very close and dependent on their families. So, even though I only bought
tea, there's nothing very radical about that. I did go through the motion and thought about,
was there something I could have done differently so that I wasn't unintentionally, but still stalked?
And I came up with these points. First of all, if I never shared my account number with anyone,
then I would have been safe. Unfortunately, account numbers are not secret.
And if you want money from your employer, you definitely will have to give your employer
an account number to transfer the money to. And your family and friends, if they want to give you
perhaps a little attention when you have a birthday,
you need to give them an account number to transfer the money to.
So, it's not very realistic. So, I thought, what if I had a dedicated account for receiving money?
That could work for me specifically. But for people who have a shared economy
with someone else, married people or living with someone, or again teenagers,
it would be completely normal and expected that other people, their parents or their spouse,
know the account number. I could have paid with cash instead of with my card.
That would have worked until March 2020. Because March 2020, the COVID-19 virus hit Norway
and a lot or actually most stores stopped accepting physical payment money
because they were afraid that the COVID-19 virus would be transferred via the money.
So, it's card only. I could have chosen not to shop at that particular grocery store chain.
But unfortunately, that particular one together with the other one that I mentioned also have
the same app. Together they have a 76% market share. And in Norway, well, I live in, let's call
it a large town where not a lot of people, but we are enough people that I have a choice. I could
have bought my lunch somewhere else. But in a lot of towns spread around Norway, you only have one
or two shops and probably one or two of those specific stores. Now, I did discover that when
I started to register my own card in the application, I got an error message that says
that this card is already registered. It meant that they had some kind of control mechanism
so that only one person would register the account number and my significant other already
had registered the account number. So, I couldn't. I did, of course, verify this.
I verified by asking some friends if they would allow me to stalk them for a while.
And because my friends are my friends and know what I do, they said yes. So, I stalked my friends
to verify that the application actually worked the way I suspected. Yes. But to sum it up,
I can't really protect myself from this kind of stalkerware. I can protect myself from the
classical type by changing all my devices, by having dumb phones, you know. I can protect
myself from the other type, the stalkerware as a service, by not registering anywhere.
But this type I cannot protect myself against. Not even in theory.
It's not practical. It's not possible. And because, unfortunately, I do think there are
other applications that rely on different kind of not really secrets. And I can't keep up with that.
In reality, I wouldn't know if someone tried stalking me this way,
unless they did something to make me aware of it. Like asking me, where is the tea?
But I'm not giving up. So, what do I do? Well,
I realized that that grocery store chain, making stalkerware was probably not their primary
business. They're not, not their intention. It's just something that happened as a side effect,
because they were doing this side gig that was collecting data and trying to be cool and
new and digital and so on. So, I contacted them and told them about this.
So, I believe in responsible disclosure. Give companies a chance to fix their mess,
and so it stops hurting people. In this case, I told them.
We talked, I explained, it was nice. I gave them a limited time for them to fix the problem.
I do work in software, with software development. So, I do have a rough idea of how much time would
be reasonable, because I didn't want to give them forever, because you know what happens then.
So, halfway through my deadline, I follow up and ask how are things going,
how's the progress, just in case they for some reason needed extra time.
Well, they thanked me.
And then they gave me a bounty, which is nice and super rare, that never happens in Norway.
And then they did nothing. Nothing. They decided it was more convenient to keep things the way
it was. When they decided not to fix things, I had to decide if I wanted to warn the victims.
Now, warning victims meant going public. Going public is not all cool and fun,
because if I didn't reach out enough, I wouldn't be warning victims.
I would be giving harmful people another tool to be cruel.
So, I had to think about it. In addition, it has a personal cost, because as I mentioned,
I'm a consulted tester. Companies hire me to test their software.
If I made waves, they may see me as a troublemaker and not hire me in the future. So,
that is also something I had to think about. Was it worth the risk?
I decided it would be worth the risk. I contacted a journalist that I know understands technology.
He worked at the Norwegian Broadcasting Corporation. It's a national news channel in Norway,
it reaches around 80 to 89 percent of the adult population on a daily basis.
And for a few hours in the morning, the case got the front page.
And it was on heavy rotation in the news and on the radio. And that felt so good,
because it meant that I got the outreach that I needed.
The journalist was a good journalist, so he also called the company responsible for the app,
and they had made a statement. But around 24 hours after this got published,
they decided to close the feature that was facilitating stalking.
And that was even better. That was a real win, because it meant that this software
was no longer harming people. Unfortunately, this was only one out of two that was using the same
software. And the other people, they were also asked for a statement, and they decided
they didn't want to do something. They decided it was worth the risk, which is pretty unfair,
because they're not really risking anything. They're taking a risk on other people's behalf.
But anyway, they decided they wanted to wait and see what happened, and whether or not
the first company would get a GDPR fine. Like, they had to pay to the authorities.
Yeah. So,
the Trumf app in Logiskruppen still has the issue, as far as I know.
In addition, there was a lot of parking apps.
It came up as a part of the discussion that followed going public with the app feature,
because people started telling me and others that, you know what, but my parking app is doing the
same thing. I can add cars that I don't own. There's no verification. And I checked up on it,
and several companies have been told and warned, and they as well just decided it was worth the
risk. In other words, it wasn't worth the effort. Now, I'm not done.
And neither are you. So, if you find this stuff out in the wild, please do something about it.
I suggest, first, tell the owners or makers. They're not always the same people.
So, give them a proper, clear explanation. Include some abuse scenarios. You can use some
of the ones that I mentioned, because they don't always get the problem. They just see
somebody contacting us, wanting us to do and spend money and time on something. So,
you really need to be clear about it. If there's an authority you should be notified, notify them.
In Norway, we do have an authority. It's called the Datatilsina. I'm sorry,
I don't know the English translation. And I did tell the creators and owners of the app
that they had to notify Datatilsina themselves, because that's how it should work.
And they did. But most importantly, educate yourself and others around you,
so that you don't unintentionally make stock aware. And if it's worth it, go public.
After you've done a responsible disclosure.
And after going public, if that didn't work, you know what? Shame them. Shame the companies
that refuse to be decent. Tell people about it for a long time. Now, first step in educating
yourself is to look up these two eras. They're both badass. Read the article that is mentioned
here. And please watch the video. It's good. I'll make sure that the links are published
somewhere related to this talk. And if you're still ready for more, after reading the article
and watching the video, I recommend the collection that the Vice Media Group made.
It's called When Spies Come Home. And it's a good collection of articles
around that shows the problem with stock aware, really. Yeah.
And if you have questions, let me know.
Thank you for your time and for your patience. I hope you're as pissed off as I am.
That was Next Level Stock Aware. Thank you again to Cecilia and Vianne.
We are very thankful to have you here. So, our speaker is now here for a live Q&A. So,
please put any of your questions in the Discord CPV Q&A channel. Currently, we have one question
so far. Speaking of child protection from the commenter, I am in Utah. A bit of a bubble over
here. What is right about deploying stock aware against a child and wrong about deploying it
against an adult? Okay. So, one of the difference between being an adult and a child is that
children learn to make good decisions. And if you want to teach your children to make good decisions,
you need to give them the space to actually do it. And privacy is a part of that. And as they
are growing and become more and more independent and have more and more independent opinion
and experiences, they also need more privacy. Because as I mentioned, not every parent is nice.
And if we make sure that every child gets some kind of privacy, there is room to tell others
that they're not fine. So, it's just like we really need to make sure that every child gets
this and not just the children who have it nice at home. Because you can't really tell.
And I'm aware there's some cultural differences when it comes to how independent and how much
privacy a child can have. But in essence, from like from a pedagogic perspective,
if you want your children to make good decisions, you have to give them the space for it.
That is really, really lovely. And hopefully any future parents or current parents in here
are listening to this and hear that thoughtful advice. We have another question also saying,
I know Norway is already GDPR compliant. Is there anything policy related that you could
push forward to combat stalkerware? Yes, there is. I did tell there's the
hang on, let me remember what they're called. It's like authorities for computer and digital.
They have a very complicated name. But anyway, and they are the ones who are handling all GDPR
complaints and issues. And they also have a mandate to give out fines, for instance.
And Norway, you're supposed to tell, you know, confess if you have an incident that is related
to privacy. And I did tell the company that I was in contact with and told them, you know what,
you really have to do this yourself. Because if I tell them, it's going to be very bad.
And they told them. And when I went public, they said that, well, we have to look into it again,
because they were essentially just putting the case in the bottom. And just like,
yeah, because of the way that the company had displayed the situation, because they said like,
it's not really a big issue at all. It's like one person and so on. And when I went public and
issue was like revealed, they were like, oh, we have to pick this up again. So I expect
in, but it will probably take like six months to a year before they actually will make a proper
legal statement and, you know, serve a fine related to this. And that is the thing that
the other company is waiting for. The one that's not changed their app. And but the authorities
are great. It's just that they have a lot to do. So everything is super. We can definitely tell
them just takes forever. And while we're waiting, more people are being hurt. So I just, yeah,
it's frustrating. Oh, gosh, that is quite a lot of time for things happen.
Yes, we have another comment with some context behind it for US context. Here in the US,
some cities are requiring all stores to accept cash, because many people don't have credit cards.
Would you recommend using cash whenever buying sensitive items? Yes, I would.
I definitely would. And if you don't have cash, or like the situation is now where some stores
will not accept cash, ask a friend you trust to pay for you. If you have reason to suspect,
or if you are sensitive about whether you're buying. That's a really interesting point.
At the moment, I don't think we have any more further questions from the discord.
Thank you so much again, Cecilia, for joining us today. And for your really lovely talk.
Please take care and...