US Senate takes step toward banning stalking software

A loophole that permits software companies to sell cyber-stalking apps that operate secretly on cellphones could soon be closed by Congress. The software is popular among jealous wives or husbands because it can continuously track the whereabouts of a spouse.

The Senate Judiciary Committee approved a bill Thursday that makes it a crime for companies to make and intentionally operate a stalking app. The legislation, sponsored by Sen. Al Franken, D-Minn., also would curb the appeal for such inexpensive and easy-to-use programs by requiring companies to disclose their existence on a target's phone.

Stalking and wiretapping already are illegal, but there are no provisions in federal law that clearly prohibit businesses from making an app whose primary purpose is to help one person stalk another. Franken's proposal would extend the criminal and civil liabilities for the improper use of the apps to include the software companies that sell them.

The proposal would update laws passed years before wireless technology revolutionized communications. Telephone companies currently are barred from disclosing to businesses the locations of people who make traditional phone calls. But there's no such prohibition when communicating over the Internet. If a mobile device sends an email, links to a website or launches an app, the precise location of the phone can be passed to advertisers, marketers and others without the user's permission.

"What's most troubling is this Our law is not protecting location information," said Franken, chairman of the Senate Judiciary subcommittee on privacy, technology and the law.

The ambiguity has created a niche for companies like Retina Software, which makes ePhoneTracker and describes it as "stealth phone spy software." It's available online for about $50.

"Suspect your spouse is cheating?" the company's website says. "Don't break the bank by hiring a private investigator."

An emailed statement from Retina Software said the program is for the lawful monitoring of a cellphone that the purchaser of the software owns and has a right to monitor. If there is evidence the customer doesn't own the phone, the account is closed, the company said. The program is not intended or marketed for malicious purposes and doesn't facilitate stalking, the statement said.

But Franken and supporters of his bill said there is no way to ensure the rules are followed. These programs can be installed in moments, perhaps while the cellphone's actual owner is sleeping or in the shower. The apps operate invisibly to the cellphone's user. They can silently record text messages, call logs, physical locations and visits to websites. All the information is relayed to an email address chosen by the installer.

Even when people discover the software on their phones, they don't know what to do, said Rick Mislan, a Rochester Institute of Technology professor who specializes in mobile security and forensics. "Law enforcement usually won't help them because they've got bigger fish to fry," he said.

Franken's bill is a common-sense step to curb stalking and domestic violence by taking away a tool that gives one person power over another, victims advocacy groups said.

"It's really, really troubling that an industry would see an opportunity to make money off of strengthening someone's opportunity to control and threaten another individual," said Karen Jarmoc, executive director of the Connecticut Coalition Against Domestic Violence.

Franken's bill would make companies subject to civil liability if they fail to secure permission before obtaining location information from a person's cellphone and sharing it with anyone else. They also would be liable if they fail to tell a user no later than seven days after the service begins that the program is running on their phone. Companies would face a criminal penalty if they knowingly operate an app with the intent to facilitate stalking.

The bill includes an exception to the permission requirement for parents who want to place tracking software on the cellphones of minor children without them being aware it is there.

A domestic violence case in St. Louis County, Minn., helped persuade Franken to introduce his bill. A woman had entered a county building to meet with her advocate when she received a text message from her abuser asking her why she was there, according to congressional testimony delivered last year by the National Network to End Domestic Violence. Frightened, she and her advocate went to the local courthouse to file for a protective order. She got another text demanding to know why she was at the courthouse. They later determined her abuser was tracing her movements with an app that had been placed on her cellphone. The woman was not identified by name in the congressional testimony.

Franken said that while doing research for the bill, he heard similar stories from women in Iowa, Wisconsin, Arizona and several other states.

An organization representing software companies opposes Franken's bill because it said the user consent requirement would curb innovation in the private sector without adequately addressing the problem of cyber-stalking. Voluntary but enforceable codes of conduct for the industry are more effective methods for increasing transparency and consumer confidence, said David LeDuc, senior director for public policy at the Software & Information Industry Association.

Those concerns resonated with the Judiciary Committee's top Republican and one of its senior Democrats. The bill could have unintended consequences for an industry that is growing and creating new jobs, said Sens. Charles Grassley, R-Iowa, and Chuck Schumer, D-N.Y. Both senators voted for the bill, however.