Google is taking the step of prohibiting “stalkerware” in Google Play, along with apps that could be used in political-influence campaigns.
Effective October 1, apps that would allow someone to surreptitiously track the location or online activity of another person will be removed from the internet giant’s official online store.
According to Google, stalkerware is defined as “code that transmits personal information off the device without adequate notice or consent and doesn’t display a persistent notification that this is happening.” This includes apps that can be used to monitor texts, phone calls or browsing history; or GPS trackers specifically marketed to spy or track someone without their consent.
Abusers can use such apps for the purposes of harassment, surveillance, stalking and they can even lead to domestic violence, critics say.
Google also specified that any consent-based tracking-related apps distributed on the Play Store (telemetry apps used by enterprises to keep tabs on employee activity) must comply with certain parameters. For instance, they can’t market themselves as spying or secret-surveillance solutions (such as apps that go with surveillance cameras, stealth audio recorders, dash cams, nanny cams and the like).
Apps also can’t hide or cloak tracking behavior or attempt to mislead users about such functionality, and they have to present users with a “persistent notification and unique icon that clearly identifies the app,” according to a Wednesday website notice.
The new rules also include a clause meant to close down developer loopholes: “Apps and app listings on Google Play must not provide any means to activate or access functionality that violate these terms, such as linking to a non-compliant APK hosted outside Google Play.”
There is, however, a significant exemption from these rules: Services designed for parents to track or monitor their underage children.
“Acceptable forms of these apps can be used by parents to track their children,” according to Google. “However, these apps cannot be used to track a person (a spouse, for example) without their knowledge or permission unless a persistent notification is displayed while the data is being transmitted.”
Stalkerware companies in the past have sold apps that purport to help parents track their young children – even though their capabilities could be used for other purposes. That was the case with three Retina-X apps, which last October were barred by the Federal Trade Commission (FTC): MobileSpy, PhoneSheriff and TeenShield. While these three apps were marketed for monitoring mobile devices used by children, or for monitoring employees, the FTC determined that “these apps were designed to run surreptitiously in the background and are uniquely suited to illegal and dangerous uses.”
Another example is an app called “Monitor Minor,” which researchers flagged as problematic in March. The Android version of the app gives stalkers near absolute control of targeted devices, going so far as allowing them to capture the unlock pattern or unlock code of phones; and, it gives users the ability to creep on a target’s missives swapped via Instagram, Skype and Snapchat, researchers said.
Loophole aside, Google has been addressing stalkerware since the summer, when it prohibited “the promotion of products or services that are marketed or targeted with the express purpose of tracking or monitoring another person or their activities without their authorization” as part of updated advertising policies.
Earlier this year, Kaspersky stats showed that the number of stalkerware attacks on mobile devices increased 50 percent in 2019, showing an upward and continued trend in the emerging threat.
Influence Campaign Apps
Besides stalkerware, Google also addressed what it terms “misrepresentation,” in an effort to put a crimp in influence campaigns and coordinated political activity.
Specifically, Google will prohibit apps or developer accounts that “impersonate any person or organization, or that misrepresent or conceal their ownership or primary purpose,” starting Oct. 21.
“This includes, but isn’t limited to, apps or developer accounts that misrepresent or conceal their country of origin and that direct content at users in another country,” according to its announcement, “[or those that] coordinate with other apps, sites, developers or other accounts to conceal or misrepresent developer or app identity or other material details, where app content relates to politics, social issues or matters of public concern.”
Coordinated activity (i.e. the use of ads in cooperation with other sites or accounts to create viral content and an artificial echo chamber) has been seen as a hallmark of disinformation and fake-news influence campaigns. Social media platforms have cracked down periodically on fake accounts ever since such operations were discovered to be widespread during the 2016 presidential election. Leading up to the 2020 election, researchers have flagged these kinds of campaigns as one of the biggest cyber-threats to the democratic process.
This Google Play move follows, like with stalkerware, previous changes to Google’s advertising policies.
In August, it updated its Google Ads Misrepresentation Policy to prevent coordinated activity around politics, social issues or “matters of public concern,” by requiring advertisers to provide transparency about who they are. As of Sept. 1, this means big penalties for “concealing or misrepresenting your identity or other material details about yourself,” and violations will be considered “egregious.”
“If we find violations of this policy, we will suspend your Google Ads accounts upon detection and without prior warning, and you will not be allowed to advertise with us again,” according to Google.
