Spyware and Stalkerware: Computer Surveillance and Safety

Spyware and stalkerware refer to tools – apps, software programs, and devices – that let an unauthorized person (such as a perpetrator) secretly monitor and record information about your computer. The term “stalkerware” is a more recent term that draws attention to the invasive, intrusive, and dangerous misuse of these tools.

Spyware can keep track of almost everything you do on your computer, including every keystroke typed, website visited, online chat or instant message sent or received, and documents opened. Some spyware can also allow the person who installed it to turn on the webcam or microphone, take screenshots, make the computer talk or make other noises, or shut down or restart the computer. The abusive person can view your computer activities or control your computer remotely, generally via a website dashboard or accompanying app.

Most computer spyware can be installed remotely, usually by sending an email or message with an attached file or link. The spyware automatically installs when you click on the link or open the attachment. Some spyware products can be sent through an instant message, computer game, or other ploys to entice you or your children to open the attachment or click on a link. Once installed, it runs in stealth mode without any notification or identifying activity and is difficult to detect or remove.

While most spyware is installed as software, there are also hardware-based spyware devices called keystroke loggers. These keylogging devices may appear to be normal computer parts; for example, it can be a special keyboard with keystroke logging capabilities or a small device that connects the keyboard to the computer. Once the keylogger is plugged into the computer, it records every key typed, which can include passwords, personal identification numbers (pins), and websites visited. Some hardware devices allow for remote spying while others require the abuser to have access to the hardware to access information about the computer activity.

Detecting spyware on your computer can be very difficult. In most cases, a computer with spyware installed will not have noticeable changes in the way it operates (e.g. your computer won't necessarily slow down or freeze up). Even without these things happening, however, you might suspect that your activity is being monitored because of the abuser’s suspicious behaviour. Trust your instincts and look for patterns. If the abusive person knows too much about your computer activity or knows things that you’ve only done on your computer or phone, spyware may be on your device.

If a hardware device has been installed, you might see an additional component between the computer and the keyboard cord, or you might suddenly have a new keyboard or mouse. On laptops, a hardware device may not be as noticeable since it would be installed inside the laptop, through the access panel.

Safety first. Before acting to find or remove spyware, it is important to consider safety and the possibility of collecting evidence. Since many perpetrators use spyware as a way to monitor and control women, they may escalate their harassing and abusive behaviour if they suspect that she is removing the spyware and cutting off their access. Before removing the spyware, think through your safety as you consider ways to protect yourself, and talk with an advocate about safety planning. If you need an anti-violence worker, please go to www.sheltersafe.ca.

Gather Evidence

Law enforcement or a computer forensics expert may be able to assist you if you want to preserve evidence needed for a criminal investigation or civil legal action. Forensic tools may be the only way to determine for sure if spyware is on a computer. Read more about spyware evidence in WSC’s Preserving Digital Evidence Toolkit.

Use devices that aren’t being monitored. If you suspect that spyware is on your device, remember that all activity including online chat, emails, and web searches, can be revealed to the perpetrator. If you can, use a safer computer or device – one the person does not have physical or remote access to – when you look for help or information. This may be a computer at a public library or community center or a friend’s device.

Remove Spyware

Spyware on a computer can be very difficult to remove once it’s installed. You can consider wiping the computer and rebuilding the computer starting with reinstalling the operating system, although this will not guarantee complete removal. Another option is to replace the hard drive of the computer or get a new computer. Be careful not to copy files or documents from the infected computer onto the new computer, which could reinstall spyware hidden in the files. Use online cloud services to store documents from the infected computer.

Update Accounts

Since spyware would have given the perpetrator access to your login information, consider resetting your passwords on a different device and no longer accessing certain accounts from the computer you are concerned is being monitored. Also consider changing passwords to sensitive accounts such as online banking and social media accounts. Read more about password safety.

Consider access. Be suspicious if someone abusive wants to install a new keyboard, cord, or software, or updates or “fixes” the computer or phone – particularly if this coincides with increased monitoring or stalking. Beware of gifts from the perpetrator to you or your children, such as new phones, computers, keyboards, or games.

Create separate user or guest accounts. You can create guest accounts or a user account that has settings that do not allow software or apps to be installed without the administrator’s login. This can prevent accidentally installing spyware or other malware if you or someone else using your computer clicks a link or opens a file.

Use anti-virus and anti-spyware protection. Install anti-virus and anti-spyware programs, make sure they are up-to-date, and set them to scan your computer regularly. These programs can help prevent spyware from being installed, and they work best before your computer has been compromised. In addition, before browsing online or clicking on links, run your anti-virus/anti-spyware software for further protection. Note that these programs will only protect you from spyware software or programs, not hardware devices such as a keystroke logging keyboard or device.

There are many other methods for someone to access information on your computer without installing spyware. If the perpetrator has physical access to the computer, they may not need to install spyware, which is mostly for remote monitoring.

Perpetrators may also be logging into accounts such as email or social media to learn about what you are doing. These accounts can be accessed from another device if the abusive person knows the username or email and password.

Sometimes, the explanation for the perpetrator knowing too much about what you’re doing could be as simple as friends or family members sharing information about you. Looking for patterns of what the person knows and where that information might have come from can help you to narrow down the possibilities. An anti-violence worker can help you figure out what may be happening and plan next steps.

Technology-Facilitated Gender-Based Violence (TFGBV) is part of a continuum of violence that can be both online and in-person. If you or someone you know is experiencing TFGBV, you are not alone. You can use sheltersafe.ca to find a shelter/transition house near you to discuss options and create a safety plan. You don’t need to stay in a shelter to access free, confidential services and support.

Adapted for Canada with permission from NNEDV’s Safety Net project, based on their resource Spyware and Stalkerware: Computer Surveillance & Safety for Survivors.