The Federal Trade Commission (FTC) announced an enforcement action against Support King, LLC, which did business as SpyFone.com, and its CEO Scott Zuckerman from the surveillance business on Tuesday, claiming that the “stalkerware” app company not only illegally harvested and shared people’s private information, but also failed to keep it secure.
According to the administrative complaint, the FTC found that the Puerto Rico-based company marketed its product as one to monitor children or employees. SpyFone reportedly sold four versions of the software at different price points, with the most expensive and detailed iteration providing information about users’ emails, video chats, and activity on apps, a key logger, and live screen viewing. It also included the ability to remotely take pictures, record audio by turning on the device’s microphone, record calls, and send the mobile device commands through SMS.
“Despite stating in a disclaimer that its monitoring products and services are designed for monitoring children or employees, Respondents do not take any steps to ensure that purchasers use Respondents’ monitoring products and services for such purposes,” the complaint said. Specifically, the FTC accused SpyFone of inadequate data security practices for consumers’ personal information.
For example, the respondents failed to encrypt personal information stored on its server, including photos, messages, web histories, and GPS locations and failed to ensure access to its server so that only authorized users could access consumers’ personal information, the complaint said. As a result of its “slipshod” security, a hacker accessed SpyFone’s server in August 2018, thereby gaining access to the data of approximately 2,200 consumers including records collected from their mobile devices and their photos, the FTC explained.
This week’s final order prevents the respondents from offering, selling, or advertising any surveillance app, service, or business. It also requires SpyFone and Zuckerman to delete any information illegally collected from the stalkerware apps and orders them to notify impacted device owners that their phones might have been monitored and the devices might not be secure.
The FTC voted 4-0 to finalize the settlement after receiving and responding to seven substantive comments.r
