WEBVTT 00:02.540 --> 00:05.200 Hello, my name is Cecilia Vian. 00:05.300 --> 00:08.680 Thank you for having me here at the Crypto & Privacy Village. 00:08.680 --> 00:15.680 I'm here to talk about stalkerware and an incident that happened late 2019 and early 2020. 00:20.550 --> 00:23.970 I work as a consultant tester. 00:24.530 --> 00:29.630 I mostly do software testing with UX and security in mind. 00:30.150 --> 00:39.770 And I have what's called an unconventional background for my field of work because I have a bachelor's degree in pedagogics. 00:39.770 --> 00:42.530 That's educational psychology if you're American. 00:42.970 --> 00:46.850 And I have a master's degree in philosophy of technology. 00:48.050 --> 01:03.710 It means that I think a lot about what is technology, what are humans doing with technology, what are they not doing with technology, how is technology affecting us, and so on. 01:04.850 --> 01:08.150 Now, I live and work in Norway. 01:08.150 --> 01:09.670 It's a small country. 01:09.670 --> 01:12.270 You may or may not have heard of us. 01:12.630 --> 01:25.420 There's about 5.5 million Norwegians and it's a country mostly known for its fjords and mountains and very generous parental leave. 01:25.520 --> 01:34.680 But for this context, what's important is it's a country that has pretty advanced technological infrastructure. 01:35.280 --> 01:45.200 Most people in Norway have internet connections, they have smartphones, they have digital ideas, they adopt new technology pretty fast. 01:45.200 --> 01:58.680 We have already implemented GDPR and we have a very digital and highly coordinating banking system. 02:00.500 --> 02:05.900 Banks in Norway mostly don't have any offices, like physical offices. 02:06.980 --> 02:26.200 Banking here is done online and people are paying their bills online, they're receiving their salaries and pensions directly to their bank accounts, and people are using debit card and credit card and what's called digital wallets. 02:26.400 --> 02:28.400 That's commonplace. 02:28.420 --> 02:39.700 We don't really use checks, we don't really use cash a lot, and prepaid cards are not really in use in Norway. 02:40.620 --> 02:48.380 In Norway, not only the young people are online, but also older people are online. 02:49.100 --> 02:59.540 My grandpa is online, my great-grandmother would have been online, she would do all her banking online. 02:59.540 --> 03:02.180 That's now common here. 03:02.180 --> 03:06.880 Everybody is online and doing their banking there. 03:07.700 --> 03:14.680 We are essentially, well, you could say living the dreams of banks other places. 03:15.240 --> 03:21.940 It's very easy, it's efficient, but it also has some drawbacks. 03:24.310 --> 03:28.090 Now, story time. 03:30.640 --> 03:36.220 Late last year, I bought lunch at a grocery store. 03:37.280 --> 03:42.800 It's not as exciting as I try making it sound exciting, but you know. 03:43.320 --> 03:53.260 One of the items that I bought was a pack of tea, and I paid for this, of course, as a Norwegian by card. 03:53.540 --> 04:03.980 When I got home after work, I was cold, and I was tired, and my significant other, he's a nice person, and he wanted to make me a cup of warm tea. 04:05.440 --> 04:13.180 He couldn't find any tea, so he asked me, where did you put the tea I, you know, you bought? 04:16.200 --> 04:30.020 And that, uh, that was odd, because I hadn't told him that I bought tea, because the tea was for my office, it wasn't for our home. 04:30.360 --> 04:34.780 So how come he knew that I bought tea? 04:35.240 --> 04:38.020 Is he stalking me? 04:41.730 --> 04:51.290 Now, I guess you do have some kind of idea what stalking where stalkerware is. 04:51.370 --> 04:57.490 By definition, any software that allows for stalking is called stalkerware. 04:58.390 --> 05:06.250 But with this definition, a lot of very different things will be end up called stalkerware. 05:06.710 --> 05:11.610 So for clarity, I have divided stalkerware into different categories. 05:16.870 --> 05:22.790 First, there's the classic stalkerware. 05:22.910 --> 05:40.810 You can call it creepware, spouseware, theft tracking, child safety is very, it's a very positive spin on stalkerware. 05:40.810 --> 05:51.190 We also have something called prop tech, which is a new type for me. 05:51.530 --> 06:11.550 And you have to install this kind of software on hardware, on the victim's hardware, for instance, on a victim's phone, or victim's computer, watches, house, toys, their car, anything. 06:12.090 --> 06:14.890 And it can be really hard to find. 06:15.470 --> 06:31.130 And for people who are leaving abusive partners, the best and easiest advice given is move, get new devices, get rid of your old computer, get a dumb phone, start over. 06:36.790 --> 06:50.650 So one of the ways my significant other could have known that I bought tea is if he had installed some kind of stalkerware on my phone, for instance. 06:51.250 --> 06:55.830 But for this occasion, traditional stalkerware didn't really make any sense. 06:56.150 --> 06:57.850 It didn't quite fit. 06:59.710 --> 07:01.490 So what else do we have? 07:01.490 --> 07:02.930 What else could it be? 07:04.910 --> 07:15.690 Well, obviously, having to need to get access to someone's hardware is an obstacle, and it's a bit of a hassle if you want to stalk them. 07:15.690 --> 07:24.090 So naturally, stalkerware evolved, and we got what I called stalking as a service. 07:28.800 --> 07:33.680 Well, stalking as a service, you can't just invite someone to be stalked. 07:33.680 --> 07:37.020 If you tried, please let me how that went. 07:38.000 --> 07:48.440 But typically, the victim is encouraged to register as a service by the abuser because it's something fun or useful. 07:50.860 --> 08:08.200 And this kind of stalkerware could be camouflaged as find my phone, as something social media related type of app, photo apps, a lot, health app and loyalty programs. 08:08.200 --> 08:29.540 They have fun features like sharing by default and geotagging your pictures and tracking your whereabouts and sending copies of whatever you upload or register there, notifications or share the account you register in some way. 08:29.840 --> 08:46.980 Now, there's a lot of gray areas in this because there's so many legit applications and apps and services that do the exact same thing and make it really hard to stay private. 08:47.880 --> 08:57.320 So it's hard to tell sometimes if it's meant to be stalkerware or if it's just bad software. 08:57.560 --> 08:58.760 But okay. 09:01.260 --> 09:10.520 Another thing that sometimes is stalkerware as a service is customer loyalty programs. 09:11.020 --> 09:19.700 A lot of the times, I don't think they're meant to be stalkerware but they are definitely facilitating it. 09:20.160 --> 09:31.340 Now, I don't typically register for loyalty programs so that doesn't explain why did my significant other know about the tea. 09:36.170 --> 09:45.870 Since I didn't think he was trying to hurt me, I asked him, how did you know I bought tea? 09:46.350 --> 09:52.730 And he told me he got a receipt and I said, what receipt? 09:53.030 --> 09:57.190 Well, in the application, in the A application. 09:57.190 --> 09:59.470 A is one of the Scandinavian letters. 10:00.870 --> 10:06.310 And that confused me because I haven't registered in that application. 10:06.310 --> 10:09.590 I know it, but I didn't register. 10:10.890 --> 10:14.370 And I just had to ask him, did you register my card there? 10:14.370 --> 10:17.510 And he said, no, only my card. 10:17.790 --> 10:21.250 And I thought that was odd and creepy. 10:25.120 --> 10:36.280 And it put me on a sort of, gave me a sort of feeling that there's a new kind of stalkerware out there. 10:36.780 --> 10:39.800 That is a new kind of nightmare, really. 10:40.740 --> 10:48.520 Because he had enthusiastically and with no harm intended added his card. 10:48.640 --> 10:52.200 The card is connected to our joint account. 10:53.580 --> 10:56.100 And that's how he got my receipts. 10:56.480 --> 10:57.720 Let me show you. 10:59.740 --> 11:03.720 I, of course, had to figure this out. 11:03.720 --> 11:06.240 Is it really as bad as I think it is? 11:06.680 --> 11:15.100 So I downloaded the app and I added my phone number. 11:15.100 --> 11:18.360 I got a text message with some numbers in it. 11:18.360 --> 11:27.000 I typed numbers into the application again and voila, I was registered. 11:28.140 --> 11:41.980 Now, for this program, if you really want to take, use the benefits, you have to add a card, a payment card. 11:44.070 --> 11:45.670 It's like this. 11:45.670 --> 11:50.210 Now, I know you don't read Norwegian, so I'll explain it. 11:51.050 --> 11:53.850 You type in a credit card number. 11:54.810 --> 11:57.530 Then you add the month and year. 11:58.510 --> 12:01.630 And then you add the bank account number. 12:01.630 --> 12:11.070 As I said previously, Norwegians are all about online banking, so everybody has bank account numbers, probably several. 12:13.710 --> 12:26.130 And the bank account number, well, it says here in a little text that the account must be registered in your name. 12:27.350 --> 12:31.890 And ethically speaking, it definitely should be registered in your name. 12:31.890 --> 12:35.910 But there's no technical reason why it should be registered to your name. 12:35.910 --> 12:40.030 You can just add whoever you want to stock down there. 12:44.530 --> 12:59.190 I checked out some other programs, some other loyalty programs for the big grocery store chains in Norway, and at least one of the other ones had the exact same solution for this. 13:02.490 --> 13:06.490 And there were some other applications that you can do similar things. 13:06.490 --> 13:13.390 Not as smooth and super easy, but definitely has the potential for stocking. 13:13.750 --> 13:22.650 Now, this type of stalkerware, the third type of stalkerware. 13:23.830 --> 13:33.370 We are used to being tracked when we're online and, you know, Google ads that follow us and Facebook ads and so on. 13:33.370 --> 13:36.510 If you accidentally type baby ever at the internet... 13:38.910 --> 13:43.850 You can just wait for the ads forever to be about babies. 13:47.110 --> 13:54.970 And from a million different kind of trackers, data are being leaked and sold all the time. 13:54.970 --> 13:58.510 And if you take that kind of data, you can find an individual. 13:59.170 --> 14:01.850 But stalkerware is the other way around. 14:02.250 --> 14:06.290 You start out by knowing who you want to know more about. 14:06.290 --> 14:09.470 It's very personal. 14:09.470 --> 14:11.290 It's very invasive. 14:15.680 --> 14:20.700 In addition, this kind of stalking is physical. 14:20.700 --> 14:22.700 You can't turn it off. 14:22.700 --> 14:25.240 You can't just leave. 14:25.900 --> 14:29.800 And you probably don't know it's happening. 14:33.180 --> 14:38.300 So this is the kind of stalkerware my significant other used. 14:38.820 --> 14:40.340 Not by purpose. 14:40.340 --> 14:42.960 He did not know that this would happen. 14:43.060 --> 14:56.060 He didn't know that if I used my card that was connected to our joint account, the receipt would show up because he registered his card with his information. 14:56.520 --> 14:59.900 It just happened to be the same account number. 15:00.240 --> 15:07.880 Remember, you're supposed to give three pieces of information and he gave all three, but they choose to use only one of them. 15:11.470 --> 15:21.890 Other types of programs that do the same, or apps, are parking apps and toll passes because they track license plates. 15:22.310 --> 15:33.990 And some of the applications that I've checked out do realize that license plate numbers are not secret and bank account numbers are not secret. 15:35.130 --> 15:40.890 But quite a few of them treat this information as if it was secret. 15:44.430 --> 15:49.010 Now, I'm sure I haven't seen every kind of version of this. 15:49.010 --> 15:55.510 And if you know of a version of this kind of stalkerware that use other kind of data, please let me know. 15:55.510 --> 15:56.570 I'm interested. 16:01.790 --> 16:13.570 When I talk to people about this kind of software and the application that is giving my significant other my receipt, people tend to not understand the problem. 16:13.570 --> 16:18.850 Let me show you. 16:19.810 --> 16:21.110 This is me. 16:21.730 --> 16:23.710 I go to the grocery store. 16:23.730 --> 16:24.810 I buy tea. 16:24.810 --> 16:26.910 When I'm done, I pay. 16:26.910 --> 16:30.590 I take the paper receipt, I curl it up, I throw it in the trash. 16:31.110 --> 16:36.450 When I leave, as far as I'm concerned, transaction is over. 16:36.450 --> 16:38.450 We don't have a relation anymore. 16:40.150 --> 16:44.290 The app is a key that gives us a relation. 16:45.310 --> 16:50.730 But I don't want to have a relation with the store, so I don't use apps like that. 16:51.590 --> 16:56.250 However, my significant other came along and he made a connection . 16:56.550 --> 16:59.210 And because he made a connection, he knows about the connection. 16:59.210 --> 17:04.830 And because he knows about the connection, he's in control of the connection. 17:07.660 --> 17:15.460 As far as the store knows, he is the rightful owner of this information because he put in the account number. 17:15.840 --> 17:18.980 And they just don't validate this in any other way. 17:19.760 --> 17:22.960 You know the account number, you must be the customer. 17:26.220 --> 17:32.760 So, in case you're not sure there is a problem, I want to spell it out for you. 17:33.680 --> 17:52.040 First of all, I'm sure you already thought about that, okay, people that are hiding from violent partners or still living in abusive relationships would probably need to be protected from this kind of stalking and leakage of data. 17:52.460 --> 18:09.860 But also politicians, activists, journalists, union representatives and religious people do need to be or may need to be particular about their privacy. 18:14.940 --> 18:24.300 In addition to these groups, as I said before, I think a lot about humans and what they are and what they do and what they do with technology. 18:24.960 --> 18:27.960 I have three other groups. 18:27.960 --> 18:30.940 First of all, the elderly. 18:32.260 --> 18:35.180 Elder abuse is a thing. 18:35.280 --> 18:48.740 Elder abuse is when typically relatives, but also perhaps friends and neighbors of the elderly, when they start to be abusive to the elder person. 18:49.500 --> 18:59.860 In this context, perhaps they started having opinions about what should the person spend money on? 18:59.860 --> 19:02.560 What should grandma be allowed to buy? 19:02.560 --> 19:05.540 Should grandpa be allowed to buy so many beers? 19:06.800 --> 19:09.960 Should grandma be allowed to buy so much candy? 19:09.980 --> 19:12.120 You know, because she has diabetes. 19:14.640 --> 19:21.700 They are grown and adult and their own person with their own money. 19:22.560 --> 19:32.260 But they do get unwanted attention from people around them or may get that. 19:32.260 --> 19:36.140 Now, there's children. 19:37.040 --> 20:03.340 And children, while the smallest children will typically not have a credit or debit card to pay with, when children start to grow up, parents, at least in Norway, start giving their children debit cards with a little bit of money so they can start practice and understand what are money and how expensive are things and, 20:03.340 --> 20:07.000 you know, what are things, how does this work? 20:07.000 --> 20:10.080 Is it real or is it, you know, imaginary money? 20:12.100 --> 20:28.160 And children do need to be protected and have their own privacy, not only from strangers, but also from their parents and relatives and friends. 20:28.160 --> 20:35.040 Of course, if everybody was nice, children wouldn't need this, but everybody's not nice. 20:35.060 --> 20:43.900 Not every parent is nice, so they deserve their privacy. 20:44.560 --> 20:49.820 And then there's teenagers or young adults. 20:49.820 --> 20:59.040 And teenagers, they need to have their privacy protected from everyone. 20:59.220 --> 21:06.040 Parents, friends, strangers, relatives, employers. 21:06.040 --> 21:08.580 There's so many groups of people. 21:08.580 --> 21:18.660 They may have opinions and negatively affect teenagers' lives if they knew what teenagers were buying. 21:18.660 --> 21:22.420 Just imagine you as a 13-year-old. 21:23.260 --> 21:27.880 What if your mom got an instant notification every time you went to the store? 21:27.880 --> 21:29.640 Would that affect you? 21:31.280 --> 21:37.700 What if you were 16 or 19? 21:37.860 --> 21:53.080 In Norway, you are technically an adult when you're 18, but just because you got older, your parents may not be ready to let you be an independent person. 21:57.810 --> 22:00.370 Now, groceries. 22:00.370 --> 22:02.730 How bad can it be? 22:03.950 --> 22:08.630 I guess you already thought about the candy and the alcohol that I mentioned. 22:09.930 --> 22:16.290 But in Norway, you can buy the following items in every grocery store. 22:18.390 --> 22:24.510 Candy, alcohol, lottery tickets. 22:25.630 --> 22:33.870 How many lottery tickets should your significant other allow me or allow you to buy, for instance? 22:34.410 --> 22:36.330 Is that a thing? 22:36.330 --> 22:37.990 Shouldn't be. 22:38.290 --> 22:40.950 Anyways, magazines. 22:40.950 --> 22:47.370 You know, not everybody prefer things online. 22:48.890 --> 22:50.450 Tobacco. 22:50.990 --> 22:55.510 You can get over-the-counter pharmaceuticals such as painkillers. 22:56.720 --> 23:01.090 You can get intimate products such as tampons and pads. 23:03.010 --> 23:10.090 Not every girl want to share with her dad instantly when this is a needed product. 23:11.270 --> 23:15.870 And you can get condoms and pregnancy tests. 23:16.730 --> 23:19.810 That will be a fun conversation to have, right? 23:21.750 --> 23:30.410 Not in every store, but in a lot of stores, they sell what's called a morning after pill or an emergency contraception. 23:35.210 --> 23:46.730 I guess most teenagers, if they were caught buying this, it would be embarrassing. 23:46.870 --> 23:51.490 Perhaps they'll get grounded or they will have a fight with their parents. 23:53.310 --> 23:58.130 But some will not survive that their parents know this. 23:59.450 --> 24:12.910 And that is why teenagers is such a vulnerable group, because they are growing up and supposed to make independent choices, but are still very close and dependent on their families. 24:15.510 --> 24:24.210 So, even though I only bought tea, there's nothing very radical about that. 24:24.350 --> 24:36.770 I did go through the motion and thought about, was there something I could have done differently so that I wasn't unintentionally, but still stalked? 24:39.550 --> 24:43.910 And I came up with these points. 24:43.910 --> 24:52.490 First of all, if I never shared my account number with anyone, then I would have been safe. 24:52.490 --> 24:55.800 Unfortunately, account numbers are not secret. 24:56.790 --> 25:08.710 And if you want money from your employer, you definitely will have to give your employer an account number to transfer the money to. 25:08.910 --> 25:20.650 And your family and friends, if they want to give you perhaps a little attention when you have a birthday, you need to give them an account number to transfer the money to. 25:24.790 --> 25:26.810 So, it's not very realistic. 25:27.710 --> 25:34.890 So, I thought, what if I had a dedicated account for receiving money? 25:35.490 --> 25:39.270 That could work for me specifically. 25:39.790 --> 26:04.810 But for people who have a shared economy with someone else, married people or living with someone, or again teenagers, it would be completely normal and expected that other people, their parents or their spouse, know the account number. 26:05.310 --> 26:13.010 I could have paid with cash instead of with my card. 26:15.730 --> 26:20.390 That would have worked until March 2020. 26:20.390 --> 26:42.530 Because March 2020, the COVID-19 virus hit Norway and a lot or actually most stores stopped accepting physical payment money because they were afraid that the COVID-19 virus would be transferred via the money. 26:42.870 --> 26:45.690 So, it's card only. 26:47.630 --> 26:56.770 I could have chosen not to shop at that particular grocery store chain. 26:59.130 --> 27:06.430 But unfortunately, that particular one together with the other one that I mentioned also have the same app. 27:06.930 --> 27:10.650 Together they have a 76% market share. 27:11.830 --> 27:24.270 And in Norway, well, I live in, let's call it a large town where not a lot of people, but we are enough people that I have a choice. 27:24.410 --> 27:29.090 I could have bought my lunch somewhere else. 27:29.330 --> 27:43.270 But in a lot of towns spread around Norway, you only have one or two shops and probably one or two of those specific stores. 27:44.770 --> 27:58.290 Now, I did discover that when I started to register my own card in the application, I got an error message that says that this card is already registered. 27:58.290 --> 28:10.950 It meant that they had some kind of control mechanism so that only one person would register the account number and my significant other already had registered the account number. 28:10.950 --> 28:12.410 So, I couldn't. 28:13.250 --> 28:15.890 I did, of course, verify this. 28:15.890 --> 28:25.110 I verified by asking some friends if they would allow me to stalk them for a while. 28:25.350 --> 28:31.190 And because my friends are my friends and know what I do, they said yes. 28:31.270 --> 28:36.350 So, I stalked my friends to verify that the application actually worked the way I suspected. 28:39.700 --> 28:40.900 Yes. 28:41.960 --> 28:49.340 But to sum it up, I can't really protect myself from this kind of stalkerware. 28:49.340 --> 28:58.740 I can protect myself from the classical type by changing all my devices, by having dumb phones, you know. 28:58.740 --> 29:08.820 I can protect myself from the other type, the stalkerware as a service, by not registering anywhere. 29:08.820 --> 29:12.140 But this type I cannot protect myself against. 29:12.940 --> 29:14.660 Not even in theory. 29:16.260 --> 29:18.220 It's not practical. 29:18.220 --> 29:20.220 It's not possible. 29:20.220 --> 29:30.560 And because, unfortunately, I do think there are other applications that rely on different kind of not really secrets. 29:32.120 --> 29:35.220 And I can't keep up with that. 29:36.120 --> 29:45.680 In reality, I wouldn't know if someone tried stalking me this way, unless they did something to make me aware of it. 29:45.680 --> 29:49.540 Like asking me, where is the tea? 29:51.890 --> 29:53.990 But I'm not giving up. 29:54.470 --> 29:56.150 So, what do I do? 29:56.510 --> 30:12.170 Well, I realized that that grocery store chain, making stalkerware was probably not their primary business. 30:12.170 --> 30:14.210 They're not, not their intention. 30:14.490 --> 30:27.430 It's just something that happened as a side effect, because they were doing this side gig that was collecting data and trying to be cool and new and digital and so on. 30:27.990 --> 30:35.250 So, I contacted them and told them about this. 30:40.090 --> 30:43.830 So, I believe in responsible disclosure. 30:44.070 --> 30:51.570 Give companies a chance to fix their mess, and so it stops hurting people. 30:54.210 --> 30:57.570 In this case, I told them. 30:58.350 --> 31:01.530 We talked, I explained, it was nice. 31:01.770 --> 31:07.530 I gave them a limited time for them to fix the problem. 31:08.110 --> 31:11.190 I do work in software, with software development. 31:11.190 --> 31:19.210 So, I do have a rough idea of how much time would be reasonable, because I didn't want to give them forever, because you know what happens then. 31:20.170 --> 31:35.010 So, halfway through my deadline, I follow up and ask how are things going, how's the progress, just in case they for some reason needed extra time. 31:36.290 --> 31:43.180 Well, they thanked me. 31:44.060 --> 31:51.420 And then they gave me a bounty, which is nice and super rare, that never happens in Norway. 31:51.440 --> 31:56.060 And then they did nothing. 31:56.540 --> 31:57.880 Nothing. 31:58.200 --> 32:04.780 They decided it was more convenient to keep things the way it was. 32:07.060 --> 32:13.340 When they decided not to fix things, I had to decide if I wanted to warn the victims. 32:14.300 --> 32:17.720 Now, warning victims meant going public. 32:21.430 --> 32:30.890 Going public is not all cool and fun, because if I didn't reach out enough, I wouldn't be warning victims. 32:30.890 --> 32:35.870 I would be giving harmful people another tool to be cruel. 32:38.310 --> 32:41.510 So, I had to think about it. 32:41.590 --> 32:48.030 In addition, it has a personal cost, because as I mentioned, I'm a consulted tester. 32:48.330 --> 32:50.980 Companies hire me to test their software. 32:51.880 --> 32:58.080 If I made waves, they may see me as a troublemaker and not hire me in the future. 32:58.400 --> 33:02.280 So, that is also something I had to think about. 33:02.280 --> 33:04.020 Was it worth the risk? 33:08.270 --> 33:11.230 I decided it would be worth the risk. 33:11.810 --> 33:16.290 I contacted a journalist that I know understands technology. 33:16.970 --> 33:20.950 He worked at the Norwegian Broadcasting Corporation. 33:21.470 --> 33:28.840 It's a national news channel in Norway, it reaches around 80 to 89 percent of the adult population on a daily basis. 33:30.650 --> 33:40.310 And for a few hours in the morning, the case got the front page. 33:40.550 --> 33:45.690 And it was on heavy rotation in the news and on the radio. 33:45.910 --> 33:53.770 And that felt so good, because it meant that I got the outreach that I needed. 33:57.050 --> 34:10.530 The journalist was a good journalist, so he also called the company responsible for the app, and they had made a statement. 34:11.210 --> 34:25.370 But around 24 hours after this got published, they decided to close the feature that was facilitating stalking. 34:25.830 --> 34:27.650 And that was even better. 34:27.650 --> 34:33.570 That was a real win, because it meant that this software was no longer harming people. 34:34.910 --> 34:43.610 Unfortunately, this was only one out of two that was using the same software. 34:43.810 --> 34:52.970 And the other people, they were also asked for a statement, and they decided they didn't want to do something. 34:53.170 --> 35:00.550 They decided it was worth the risk, which is pretty unfair, because they're not really risking anything. 35:00.550 --> 35:04.150 They're taking a risk on other people's behalf. 35:05.370 --> 35:16.050 But anyway, they decided they wanted to wait and see what happened, and whether or not the first company would get a GDPR fine. 35:16.890 --> 35:22.050 Like, they had to pay to the authorities. 35:26.030 --> 35:26.890 Yeah. 35:29.190 --> 35:38.430 So, the Trumf app in Logiskruppen still has the issue, as far as I know. 35:39.050 --> 35:42.210 In addition, there was a lot of parking apps. 35:42.210 --> 35:55.570 It came up as a part of the discussion that followed going public with the app feature, because people started telling me and others that, you know what, but my parking app is doing the same thing. 35:55.570 --> 35:58.050 I can add cars that I don't own. 35:58.050 --> 35:59.450 There's no verification. 36:00.170 --> 36:10.270 And I checked up on it, and several companies have been told and warned, and they as well just decided it was worth the risk. 36:10.270 --> 36:14.990 In other words, it wasn't worth the effort. 36:21.160 --> 36:23.600 Now, I'm not done. 36:25.100 --> 36:26.820 And neither are you. 36:26.820 --> 36:31.500 So, if you find this stuff out in the wild, please do something about it. 36:32.020 --> 36:36.600 I suggest, first, tell the owners or makers. 36:36.600 --> 36:39.680 They're not always the same people. 36:39.680 --> 36:45.560 So, give them a proper, clear explanation. 36:46.140 --> 36:48.080 Include some abuse scenarios. 36:48.080 --> 36:55.800 You can use some of the ones that I mentioned, because they don't always get the problem. 36:56.160 --> 37:02.980 They just see somebody contacting us, wanting us to do and spend money and time on something. 37:02.980 --> 37:05.720 So, you really need to be clear about it. 37:05.960 --> 37:09.240 If there's an authority you should be notified, notify them. 37:10.040 --> 37:13.380 In Norway, we do have an authority. 37:13.700 --> 37:15.300 It's called the Datatilsina. 37:15.300 --> 37:17.760 I'm sorry, I don't know the English translation. 37:19.760 --> 37:32.760 And I did tell the creators and owners of the app that they had to notify Datatilsina themselves, because that's how it should work. 37:32.760 --> 37:36.060 And they did. 37:36.860 --> 37:48.940 But most importantly, educate yourself and others around you, so that you don't unintentionally make stock aware. 37:49.840 --> 37:55.600 And if it's worth it, go public. 37:56.810 --> 37:59.910 After you've done a responsible disclosure. 38:00.890 --> 38:06.070 And after going public, if that didn't work, you know what? 38:06.870 --> 38:08.190 Shame them. 38:08.930 --> 38:12.310 Shame the companies that refuse to be decent. 38:12.970 --> 38:16.490 Tell people about it for a long time. 38:17.490 --> 38:27.240 Now, first step in educating yourself is to look up these two eras. 38:27.280 --> 38:29.040 They're both badass. 38:29.300 --> 38:31.980 Read the article that is mentioned here. 38:32.080 --> 38:34.640 And please watch the video. 38:34.640 --> 38:35.740 It's good. 38:36.080 --> 38:40.780 I'll make sure that the links are published somewhere related to this talk. 38:41.340 --> 38:55.160 And if you're still ready for more, after reading the article and watching the video, I recommend the collection that the Vice Media Group made. 38:55.800 --> 38:59.360 It's called When Spies Come Home. 38:59.540 --> 39:06.360 And it's a good collection of articles around that shows the problem with stock aware, really. 39:06.860 --> 39:08.140 Yeah. 39:09.580 --> 39:13.020 And if you have questions, let me know. 39:16.360 --> 39:19.400 Thank you for your time and for your patience. 39:19.400 --> 39:24.260 I hope you're as pissed off as I am. 39:37.300 --> 39:39.380 That was Next Level Stock Aware. 39:39.380 --> 39:41.460 Thank you again to Cecilia and Vianne. 39:41.460 --> 39:43.680 We are very thankful to have you here. 39:43.680 --> 39:46.420 So, our speaker is now here for a live Q&A. 39:46.420 --> 39:50.520 So, please put any of your questions in the Discord CPV Q&A channel. 39:50.900 --> 39:53.660 Currently, we have one question so far. 39:54.220 --> 39:59.480 Speaking of child protection from the commenter, I am in Utah. 39:59.480 --> 40:00.900 A bit of a bubble over here. 40:00.900 --> 40:06.900 What is right about deploying stock aware against a child and wrong about deploying it against an adult? 40:08.500 --> 40:08.960 Okay. 40:08.960 --> 40:16.400 So, one of the difference between being an adult and a child is that children learn to make good decisions. 40:17.040 --> 40:23.540 And if you want to teach your children to make good decisions, you need to give them the space to actually do it. 40:23.540 --> 40:25.660 And privacy is a part of that. 40:25.660 --> 40:37.220 And as they are growing and become more and more independent and have more and more independent opinion and experiences, they also need more privacy. 40:37.220 --> 40:40.900 Because as I mentioned, not every parent is nice. 40:40.900 --> 40:49.840 And if we make sure that every child gets some kind of privacy, there is room to tell others that they're not fine. 40:50.340 --> 40:57.100 So, it's just like we really need to make sure that every child gets this and not just the children who have it nice at home. 40:57.100 --> 40:59.100 Because you can't really tell. 40:59.900 --> 41:08.960 And I'm aware there's some cultural differences when it comes to how independent and how much privacy a child can have. 41:10.120 --> 41:21.860 But in essence, from like from a pedagogic perspective, if you want your children to make good decisions, you have to give them the space for it. 41:26.520 --> 41:29.190 That is really, really lovely. 41:29.250 --> 41:36.470 And hopefully any future parents or current parents in here are listening to this and hear that thoughtful advice. 41:36.550 --> 41:42.630 We have another question also saying, I know Norway is already GDPR compliant. 41:42.630 --> 41:47.090 Is there anything policy related that you could push forward to combat stalkerware? 41:47.770 --> 41:49.550 Yes, there is. 41:49.550 --> 41:57.570 I did tell there's the hang on, let me remember what they're called. 41:57.570 --> 42:01.550 It's like authorities for computer and digital. 42:02.090 --> 42:03.850 They have a very complicated name. 42:03.850 --> 42:11.010 But anyway, and they are the ones who are handling all GDPR complaints and issues. 42:11.010 --> 42:15.250 And they also have a mandate to give out fines, for instance. 42:16.830 --> 42:24.870 And Norway, you're supposed to tell, you know, confess if you have an incident that is related to privacy. 42:25.410 --> 42:30.350 And I did tell the company that I was in contact with and told them, you know what, you really have to do this yourself. 42:30.350 --> 42:33.510 Because if I tell them, it's going to be very bad. 42:33.770 --> 42:35.350 And they told them. 42:35.550 --> 42:43.850 And when I went public, they said that, well, we have to look into it again, because they were essentially just putting the case in the bottom. 42:43.850 --> 42:52.090 And just like, yeah, because of the way that the company had displayed the situation, because they said like, it's not really a big issue at all. 42:52.090 --> 42:54.210 It's like one person and so on. 42:54.350 --> 43:01.910 And when I went public and issue was like revealed, they were like, oh, we have to pick this up again. 43:02.230 --> 43:16.990 So I expect in, but it will probably take like six months to a year before they actually will make a proper legal statement and, you know, serve a fine related to this. 43:17.210 --> 43:21.030 And that is the thing that the other company is waiting for. 43:21.250 --> 43:24.270 The one that's not changed their app. 43:25.190 --> 43:27.630 And but the authorities are great. 43:27.630 --> 43:29.670 It's just that they have a lot to do. 43:30.010 --> 43:32.130 So everything is super. 43:32.510 --> 43:38.210 We can definitely tell them just takes forever. 43:38.470 --> 43:41.170 And while we're waiting, more people are being hurt. 43:41.170 --> 43:44.450 So I just, yeah, it's frustrating. 43:45.170 --> 43:49.070 Oh, gosh, that is quite a lot of time for things happen. 43:49.090 --> 43:55.830 Yes, we have another comment with some context behind it for US context. 43:55.830 --> 44:01.930 Here in the US, some cities are requiring all stores to accept cash, because many people don't have credit cards. 44:01.930 --> 44:05.370 Would you recommend using cash whenever buying sensitive items? 44:05.730 --> 44:07.250 Yes, I would. 44:08.410 --> 44:10.290 I definitely would. 44:10.790 --> 44:21.150 And if you don't have cash, or like the situation is now where some stores will not accept cash, ask a friend you trust to pay for you. 44:21.530 --> 44:27.390 If you have reason to suspect, or if you are sensitive about whether you're buying. 44:31.080 --> 44:32.980 That's a really interesting point. 44:36.120 --> 44:40.840 At the moment, I don't think we have any more further questions from the discord. 44:40.980 --> 44:44.260 Thank you so much again, Cecilia, for joining us today. 44:44.260 --> 44:46.780 And for your really lovely talk. 44:46.780 --> 44:47.960 Please take care and...