New York attorney general fines developer of stalking apps

The New York attorney general has ordered a spyware maker whose apps are marketed as tools for surveilling one’s partner to pay a $410,000 fine and amend their business practices.

Under Thursday’s agreement with Patrick Hinchy, a Florida-based man whose 16 companies operate a constellation of spyware apps and services, the entities must alter practices around marketing of their products and inform owners of targeted devices that the app was active on their phones.

“Snooping on a partner and tracking their cell phone without their knowledge isn’t just a sign of an unhealthy relationship, it is against the law,” said New York Attorney General Letitia James, citing the risk of domestic abuse. “Today’s agreement will block these companies from allowing New Yorkers to be monitored without their awareness, and will continue our ongoing fight to protect New Yorkers’ rights, safety, and privacy.”

Hinchy’s companies are behind the apps PhoneSpector, Highster Mobile, Surepoing, Auto Forwards and TurboSpy, among others. According to the attorney general filing, the apps copy information from a device and transmit it to company servers, where it is available to the customer. The information includes call logs, text messages, images and videos, location data and messaging app records. It is also possible for customers to access, and turn on, the device’s cameras and audio recorders.

Another offered service allows customers to exfiltrate data on the target’s iCloud server if the customer has access to login details.

One of the investigation’s main areas of focus was on the companies’ deceptive marketing, which the attorney general said misled customers into thinking they were not violating the law. They set up purportedly independent product review websites, which published glowing reviews of the benefits of using spyware.

One blog post claimed the app PhoneSpector “allows you to monitor all their phone activity, without the risk to be caught spying.” What it and other marketing materials didn’t mention is that it is illegal in the United States, and in most countries around the world, to access and monitor someone’s device without their consent. 

“Despite promoting the Respondents’ Spyware Products as tools for covertly monitoring the device of another adult, the terms and conditions page on most of the… Spyware Products websites acknowledged that such use violates state and federal criminal statutes… and several included relevant portions of the Computer Fraud and Abuse Act, which prohibits intentionally accessing a computer, including a smartphone, without authorization,” prosecutors wrote in a court filing. 

Despite the illegality of non-consensual spying, the products themselves remain available, including for use without consent when monitoring a minor’s device. 

In September 2021, the Federal Trade Commission banned the app SpyFone, claiming it “illegally harvested and shared people’s private information,” while failing to implement security measures. In 2019, the FTC brought its first case against “stalking” app developers, ordering the makers of three such apps to modify their practices in accordance with the law.