In the last 20 years, domestic abuse has become more and more intertwined with the growth of technology. On top of dealing with real-life abuse, survivors in situations of domestic violence are also at risk of being monitored through spyware apps; their accounts can be hacked by their abusers, and photos and videos can be generated and manipulated both with and without artificial intelligence. Despite this, there is little information on how survivors can protect themselves from technology-facilitated abuse, and there is very limited legislation on this issue.
The numbers are staggering: according to the Stalking Prevention, Awareness, and Resource Center, an estimated 13.5 million Americans are stalked every year, with more than two-thirds stalked through some form of technology, and a 2014 NPR investigation found that 75% of victim service providers report that perpetrators use phone apps to stalk their partners. Experts say the problem is pervasive and that there is a legislative gap in regulating stalkerware apps because most of them market themselves as tools for monitoring children’s internet use—when they are actually spyware.
The lack of awareness—generally and in public policy development—around this kind of app and the harm it causes means developers can sell their spyware designs freely, and abusers can purchase them without consequences. A 2019 report by Malwarebytes revealed that only two stalkerware developers faced legal consequences for their creations and the harm those tools caused in the prior five years. Similarly, a report by ThinkProgress published in 2017 determined that the U.S. Department of Justice only prosecuted 41 cases of cyberstalking between 2012 and 2016. The lack of legislation around stalkerware puts domestic abuse survivors at risk of coercive control, hindering protective measures once they escape the abusive relationship and leaving survivors—and others who might be stalking targets more generally—with limited knowledge on how to protect themselves from this kind of digital warfare.
Operation Safe Escape (OSE) is a volunteer-run nonprofit organization that provides a range of services to survivors of stalking, abuse, and domestic violence, with a special emphasis on digital safety and combating spyware and other kinds of cyber crime. The organization has helped more than 3,000 survivors escape their abusive relationships through a trauma-informed and survivor-centric approach where the survivor decides what they want out of the process of escaping and regaining safety around their digital habits and accounts. Prism spoke to Tony Hunt, OSE’s deputy director, about what resources survivors should know about when confronting and protecting themselves against digital warfare. OSE can help survivors protect their online accounts and their electronic devices from their abuser, help them disappear online, and assist with a safety plan for a secure exit. But it’s important for survivors—and anybody who navigates the internet—to know that their digital lives are possible targets for abusers and that they have free resources at their disposal to protect themselves. The interview below has been edited for clarity and brevity.
Nicole Froio: What makes navigating the digital space harder or more unsafe for survivors?
Tony Hunt: Survivors, albeit by definition, are coming from or are currently in an unsafe state, and while the internet has enabled a lot of good things, it has also enabled some really bad elements. Stalking is far more prevalent now, and investigative techniques and information once used solely by law enforcement are now shared and available to the worst of the worst. Enter stalkerware, applications designed specifically to stalk a target and record/relay all their online activities without the user knowing about it. Tracking down and stopping this kind of thing is difficult because doing so requires multiple organizations to work together and share information in most cases, and this level of cooperation is rare.
Froio: Could you explain what stalkerware is and how it might harm survivors of domestic violence?
Hunt: Stalkerware is an application designed to monitor all activity on a device and provide access to that activity log to another (almost always unauthorized) user. This can include screenshots from the device, messages sent and received, location, and many variants can even turn on the microphone or camera. Once only available to law enforcement and intelligence agencies, these investigative tools (that require a warrant to use) are being sold to the general public under the guise of family and spousal monitoring.
Froio: What advice would you give someone who suspects stalkerware is being used against them?
Hunt: It’s important to remember that removing or disabling stalkerware can alert the person who installed it that it was detected, so the survivor needs to decide what’s best and safest for them. The single easiest method of removing stalkerware on a phone/mobile device is to reset the device. This isn’t the most favorable thing people want to do, but it works. We have instructions and guides on our website, and the Coalition Against Stalkerware, of which we are a founding member, also has a good guide on how to address this. Ultimately, if you’ve gone through all these steps and still find yourself fearing that the device has been reinfected, reach out to Operation Safe Escape, and we can help you through the process of making sure the device is cleaned up and that any evidence is captured.
Froio: How are BIPOC women, marginalized genders, and young people at higher risk of abuse and coercive control via stalking?
Hunt: This comes down to the same systemic problems faced in most aspects of life for BIPOC: access to active protection and law enforcement is not as effective, and often there is no fear of prosecution, emboldening stalkers and abusers. The perception of both the stalker and their targets is that there is no effective legal recourse. Combine this with cultural biases versus gender diversity, and you have a reinforced scenario whereby those people targeted are at a significant disadvantage. The few options that would be obvious are considered useless or ineffective before even engaging them.
Froio: What tools should survivors be aware of to protect themselves from their abusers or even potential future stalkers?
Hunt: As a precaution versus direct abuse, there is an app called eBodyguard that will send ALL your abuser’s information and description in an expedited emergency call from your phone and record the session. This is different from most apps in that the chain of custody for all recordings through eBodyguard is unbroken and can be used immediately by police. This often is the key to prosecuting abusers. Also, largely thanks to the work of the Coalition Against Stalkerware, all major antivirus products now scan for stalkerware apps, even on the free version.
When we are talking about preventing access to potential stalkers, make sure your phone has a PIN no one else uses. Put a lock on the phone to lock after one minute of inactivity. This way, you can tell if someone used your phone if you left it accessible, it will have locked on its own in a minute. If you suspect your device has been compromised, the easiest way to deal with it is to back up your contacts and content and reset to defaults. Do not restore your apps, though, as the restore process may restore the hidden app as well. If you’re on an iPhone, make sure you’re the only one on the Apple account, as the account owner has ultimate control over the phone. If you need guidance on this, Operation Safe Escape has resources to help you navigate this process.
Froio: What are some legal and law enforcement approaches survivors might be able to take when going through stalking and abuse? What are the risks of going through the legal route?
Hunt: When trying to get a case going against an abuser or stalker, too often, there isn’t actionable evidence provided for the police to follow up on. Keep a journal of all findings, take pictures, and store them in more than one separate secure place. I mentioned eBodyguard earlier, that app has uses in this situation. Even though the police may not provide any assurance, make sure to get a case number. Do NOT be talked out of filing a report. The reports add up and eventually give you enough leverage to petition for protective services. Even if the police are putting resources into your case, it’s important to report all infractions of a protective order.
Froio: What does trauma-informed mean to your organization? What are some trauma-informed approaches everyday people could use when trying to help a survivor?
Hunt: Trauma-informed means we’re operating with specific training to make sure we’re interacting with survivors in a manner that least exacerbates the trauma of abuse. It’s being aware that trauma is a part of the situation, and the need to be respectful of the survivor’s state of mind and situation is paramount. It refers to real training, not just a gauge of experience or time working in this sector. Trauma can have a profound impact on how the brain processes information or how the survivor responds to different scenarios, so we take that into account in all of our interactions with them. There are some best practices people should keep in mind when talking to a survivor. First, listen to them. It can be tempting to try to tell a survivor what to do, to tell them to just leave or call the police, but understand that it’s not always that easy. Offer support, but understand that they might not be ready to leave right away, depending on their circumstances.
Froio: Lately, there have been some concerns about generative AI and deepfake porn in contexts of abuse. Would you say this is a growing concern for the intersection your organization works at?
Hunt: Very much so. Generative AI services have progressed so far that some baseline tools don’t even pick them up when scanned. This presents opportunities for abusers to cause more damage. In many cases, the forensics in discovering the media doesn’t have a 100% success rate, so there is even a gap in knowing the crime has been committed until the media gets on the radar. Since the original media is very rarely used in a manner that matches the generative content, we’re at the mercy of other AI detection tools to find the problems. Don’t get me wrong, there are forensic tools out there that really help, but detection becomes another hurdle in tackling these crimes and helping survivors move on.
Froio: Could you tell me a little bit about how this could affect survivors and if there’s any way of protecting people from this?
Hunt: Being able to produce false content and media without using or including original media used to be very easily detectable. There are a ton of factors to accommodate for in detection. The problem is that if that content piece isn’t on anyone’s radar, the damage is done, the content is in circulation longer, sometimes substantially longer, than if this were some scenario where an abuser is using real content. Real content is trackable from the beginning; the question is, where is the media and content we never knew about? The end effect simply makes it harder to discover and remove the content, extending the amount of time survivors have to deal with this.
Froio: A huge part of the problem seems to be that there’s a lack of attention on the part of authorities when it comes to technology-assisted abuse, both when these apps are being used by abusers and when developers are making these tools. What does OSE advocate for when it comes to legislating and prosecuting these apps and their users?
Hunt: While our organization focuses on the survivor as part of our mission, when we encounter anyone—person, organization, or application—we look VERY closely at them. Uncomfortably close. Where we collect enough evidence of crime, we make sure it is clear to relevant authorities, which is required by law. But we don’t just make a small report. OSE is comprised not only of some of the best security pros around—we’re law enforcement, and we have real investigators, social workers, and true advocates who go to bat for survivors. We don’t provide legal assistance, and we’re not prosecutors, but we are pretty good at evidence gathering. We have to be. A vast majority of cases aren’t viable because of lack of evidence or, more appropriately, lack of viable evidence. We’re pros. We follow the chain of evidence guidelines wherever possible. Note also, we advocate legislation when it is appropriate as well. While we do not as a rule discuss case details, we are very vocal and promote awareness every day as part of our mission.
Froio: Given how prevalent domestic abuse within police families is and how police rarely hold their own accountable, how does OSE navigate protecting and working with victims of abusers when the abusers/stalkers are someone within law enforcement?
Hunt: We have a name for dangerous adversaries. They are called ATPs—Advanced Persistent Threats. They represent one of the most difficult and dangerous scenarios that can happen. OSE specializes in this scenario, and cases along this line are the ones that make us extra careful.
The term ATP is usually associated with threat actors (aka Very Bad People) who have advanced training, access, means, and resources that allow them to stay a threat despite more common efforts to mitigate them.
It is important to note that our approach focuses on the survivor, not the abuser. This allows us to operate—often undetected—and plan a rescue or escape. Our focus is security and safety for the survivor first. Our methodology in actualizing a good outcome is something we do not publish.
As far as our interaction with abusers who are in law enforcement or other similar positions of power, we perform a very in-depth threat assessment, not unlike a federal investigation. The difference with us is that we are comprised of law enforcement, security experts, intelligence people, hackers, and social workers, and we don’t advertise. Ever. We don’t pick fights, we don’t doxx. (Doxxing is the worst thing you can ever do to a survivor’s situation because abusers always escalate.) We investigate. We gather information and evidence where possible, and when there is enough to prosecute, we research the best oversight path that the department can’t interfere with, like state oversight and even the FBI where necessary or opportune.
The navigation in this is not easy. It’s straight-up dangerous—for the survivor, their family, and often for us as well. But it is navigable. I can say we’ve done this scenario, and it’s different every time. But we’ve been successful every time, too.
Now for the healthy dose of reality. ATPs are really dangerous. They are not only abusers, they have means to deter investigations, erase evidence, etc. While we are very successful in setting up an escape and empowering survivors even in these situations, most of the time putting the abusers in jail in a desirable time frame doesn’t happen. This is one of the reasons we focus on the survivors: we can help them get away, teach them how to maintain distance, and make it difficult to be found or approached without the abuser incriminating themselves. I wish we could say we topple all of the most dangerous abusers, but the reality is, it’s safer that they never see us, never know of us. It allows us to plan, educate, and effect an escape or rescue without being seen.
The goal is the survivor and their kids first.
Froio: Is there anything you’d like to add?
Hunt: Although our primary work is with survivors, we also work with their support systems, other advocacy organizations, and public safety to confront abuse holistically. Operation Safe Escape exists to aid and assist survivors of domestic violence, abuse, stalking, and trafficking. We only ask that you seek assistance if you find yourself in these situations, and remember that you are not alone.
