Spy Tools Raise Child Development, Illegal Use Concerns

SnoopStick recently had civil liberties groups muttering. The product, by Solid Oak Software, allows real- time remote tracking of computer activity. Users plug the USB flash drive into a target computer, installing monitoring files that hide on the hard drive. Plugged into a parent’s PC, SnoopStick allows surveillance of website access, instant messenger chats and e-mail “to” and “from” data. The software logs up to 12 months of activity. Targets aren’t notified of their computer being accessed unless the SnoopStick user sends an alert, Solid Oak developer Chris Kuske said.

SnoopStick also lets users remotely control some of the target computer’s processes, and it works with firewall settings, the company’s website said. SnoopStick users can send message alerts, restrict Internet access, block access to specified ports, log off the original user and turn off the target PC. But the software doesn’t show e-mail message content because viewing of medical, financial, and personal details “could be extremely damaging to the user,” the site said -- showing sensitivity to federal privacy laws on health and financial records. Neither does SnoopStick provide remote access to the target computer’s files.

Software like SnoopStick creates barriers between parents and children, IMSafer CEO Brandon Watson said. It appeals to parents who didn’t grow up with computers and don’t understand the program’s potential harm to child development, he said. The software may be a useful tool with kids 5-7 but could harm older children, said Stephen Balkam, Family Online Safety Institute founder. Parents should talk with kids about plans to use monitoring software, not keep it secret, particularly with older children, he said.

Surveillance software has made spying on spouses much easier, said National Network to End Domestic Violence founder Cindy Southworth. She hears every week about episodes of monitoring software being abused, she said. Developers of private surveillance software may market to parents and employers but ultimately also get business from those who commit domestic violence, she added.

Developers of such software aren’t responsible for users’ illegal actions under most state laws, said Wash. Assistant Attorney Gen. Katherine Tassi. A developer could be held liable for illegal data transmission if the developer is deemed complicit in the crime, she said, but there haven’t been any major enforcement actions of that sort in the U.S.

SnoopStick monitoring data are encrypted and sent through Solid Oak’s servers. No data are stored locally at Solid Oak, the site said. State law could hold liable a company whose servers illegally transmit data, Tassi said, but it would depend on the mechanism involved. Technology laws likely will strengthen as the federal and state govts. learn more about technology crimes, she said.

Marketing materials may land surveillance tool makers in legal trouble “if they promote illegal uses or fail to warn their customers of the legal consequences” of misuse, said Guilherme Roschke of the Electronic Privacy Information Center. Intercepting another’s communications can be a Wiretap Act violation, he said: “Legitimate monitoring is done with the consent and awareness of those involved.”

In Aug. 2005, the developer of LoverSpy, a computer monitoring program, was indicted for violating federal computer privacy laws, charges triggered when the developer advertised it as a means of surreptitiously installing spyware on computers they don’t own without consent, said Roschke. SnoopStick is advertised as a tool for parents and employers who would use it legitimately on computers they own. SnoopStick’s end user license agreement declares that the software may be installed only on computers that a user owns. “Any other use may be a violation of State and/or Federal laws,” it warns.

Users of targeted computers can’t see who is linked remotely to their computers, but a connection with the Solid Oak servers is visible, Kuske said. The monitoring software appears as a service in the Windows Task Manager “processes” tab, but not identified as SnoopStick, he said. The software has a “hard-coded filename” consisting of letters, but this may change, he said.

To uninstall SnoopStick, users of targeted PCs need the particular SnoopStick flash drive used for installation, but also can contact Solid Oak to request manual uninstallation instructions, Kuske said. Solid Oak can disable specific SnoopSticks if victims of abuse send the company diagnostic information. The company will offer more uninstallation options if cases of SnoopStick abuse arise, he said. Since it went on sale 6 months ago, the only SnoopSticks Solid Oak has had to disable are those someone has lost, Kuske said.

Consumers must have control of the software installed on their computers, said Tara Flynn, assistant dir.-FTC Bureau of Consumer Protection. In the Sony BMG “rootkit” debacle, the FTC said in its Jan. 30 complaint that Sony made it “unreasonably difficult” to uninstall its content-protection software (WID Jan 31 p1). Before Dec. 2005, users had to visit the Sony BMG or software vendor’s website, fill out a request form, wait for an e-mail, and then download and install a program to remove the files.

Software developers should strive to balance parents’ desire to protect children with kids’ right to privacy, Watson said. IMSafer offers free monitoring software that alerts parents when it observes potentially dangerous instant message conversations. Parents don’t need real-time monitoring of their kids any more than they need to follow them around at school every day, he said: “The principal will call if there’s a problem.”