Anita Rao
Hey, it's Anita. Before we get into today's podcast episode, I just want to let you know that this conversation contains stories of domestic violence and abuse. If you're in an abusive relationship and need help, you can call the National Domestic Violence Hotline 1-800-799-7233. Trained advocates are available to talk confidentially 24-hours a day.
Not knowing who may be tracking or watching you is the stuff of nightmares. As a public-facing person, I'll be honest and say it's not always easy to feel fully in control of my environment, and who has access to me at any given time. I'm not talking about Black Mirror level stuff, just every day technology and the ways that things like social media and our smartphones make it pretty simple for our privacy to be violated and our bodies to be put at risk. Harassment and stalking, for me have stayed in the realm of the internet with people I'm not close to, but it's becoming increasingly common for abusive domestic partners to use technology in conjunction with other forms of manipulation and control.
Intimate partner violence affects folks of all genders at alarmingly high rates — and technology has enabled violence against intimate partners in new frightening and often inescapable ways. Figuring out how to combat that is a mind-boggling dilemma.
This is Embodied — our show about sex, relationships and your health. I'm Anita Rao.
Full access to someone's phone is essentially full access to someone's mind. That's a quote from cybersecurity expert, Eva Galperin, who you'll meet later on. And it's really true — intimate partners who share passcodes, app logins, and can access smart home devices can use basic computing skills to turn tools of technology into tools of abuse. That happened for Ashley, who recently left a relationship with her abusive ex. She said it's common for abusers to tell on themselves — and that's how she first found out that something was going on.
Ashley
I was speaking to the person on the phone, and they asked me if I was recording the conversation, and I thought: No, I don't do that. That's kind of weird, you know — It just put enough in my mind to start going through my Gmail settings. And then from there, I could see that you can forward emails to certain addresses or turn what's called IMAP on, so you can see all of your mail from work, and Outlook, and in your Gmail at the same time — and that was turned on.
And then, I just felt something was off, especially with my vehicle. The thing I like to tell people is to always trust your gut. I think a lot of times we try to talk ourselves out of things. So, I took it to the dealership, and they assured me nothing was wrong. They said we've done this before. We never find anything. Well, they found two trackers — that time they found one in the inside of my car, so it had actually been placed inside the walls to go up to the electrical system so the battery did not have to be changed. And then they found another device under my car, so that started even more digging into, you know, what was going on.
I noticed that I would email someone something, and the conversation would be referenced. So, I would just keep this in the back of my mind. I would change my passwords. I would do everything I can and it still kept happening. I found a listening device under my bed and called the police department. And that was a situation within itself. The female police officer told me: Well, there's not a lot we can do with this. Try to get him to hit you, and then we can do more.
I actually had a woman say to me: who cares if they can see what you're doing online? Is there anything bad that you're doing? And it's just, you know, everyone expects a reasonable amount of privacy. And it's still happening. I'm on this device right now, and I've identified what's called a man-in-the middle attack. The person can have a backdoor entrance and basically look at whatever they want to look at. So, tomorrow I'm going to go purchase a new computer and new device for my new home that I'm moving to.
Anita Rao
Ashley lives in North Carolina and runs a TikTok account under the name Merely Ashley. She shares advice on it for other folks experiencing intimate partner abuse. She told us that because digital abuse doesn't leave bruises, it's a method abusers are turning to more and more, especially since the pandemic. And sadly, that's backed up by the data. But, digital domestic abuse is not just a pandemic-era problem. Our smart homes and smartphones were big parts of our lives even before the pandemic — and then, too were also tools abused for power and control.
Kathryn Kosmides
It started with love bombing, which many folks don't realize is a major red flag.
Anita Rao
Kathryn Kosmides is also a survivor of gender based violence. She met her abuser on Tinder in 2016. It started with what seemed like Prince Charming type stuff, but those overwhelming displays of affection and attention to gain trust, were later manipulated.
Kathryn Kosmides
it quickly escalated into emotional abuse and name calling, and things like that — and then it was a lot of digital abuse, you know — having my location turned on my device, having to have all of my passwords, so it wasn't hidden. It was in plain sight that he demanded all of these things from me, and then it turned into sexual and physical violence — and I was very blessed to escape after a year and a half of that relationship.
Anita Rao
I mean, as you mentioned, obviously digital domestic abuse doesn't exist in a vacuum. And that's one of the really important things to keep in mind in this conversation, you know — intersects with other forms of abuse. You alluded to that a little bit, but could you tell us a bit more about how that intersection showed up in your own relationship?
Kathryn Kosmides
Yes, so it does not exist in a vacuum, you know, emotional abuse is the sign of future abuse to come. And, you know, demanding my passwords ended with him, you know — or my location, I would not be in the exact location that I told him I would be in, which would then trigger him to call me and scream at me and make me like, cry and embarrass me in front of whoever I was with. And so these are all very, very interconnected, you know — and then he will get angry that I wasn't where I said I would be, and that would escalate to physical violence. So, it's all very, very intertwined.
Anita Rao
So, you mentioned that you were able to leave, but leaving an abuser is not simple, especially when you described, you know, all the access that he had to your accounts in technology. So, what did you do to leave safely, and what was the leaving process like for you?
Kathryn Kosmides
So, leaving is often the most dangerous time for a victim in a relationship, and the statistic is that it takes an average of seven times to leave an abusive relationship. and I had tried to escape many times previously. And it wasn't until some co-workers actually, at the time, helped me safely leave the relationship, opened up their homes to me, and things like that. But, I filed a police report at first. And, as Ashley kind of said, that was a whole ordeal — and I was eventually able to move into another apartment — and, you know, get rid of the devices and try and change passwords and everything that I could do to protect myself - but that only kind of escalated from there.
Anita Rao
So, when you first began to seek support, how were you received when you were describing the ways that these digital tools were being used? Was that something that law enforcement had experience with? How did they react to what you were telling them?
Kathryn Kosmides
Absolutely not. They did not have any experience or really care. They would say things like: well, it's just digital abuse. Just log off or make your accounts private, or why do you really need to be on the internet or have public accounts? And like, my whole life is on the internet. I was a digital marketer at the time. I couldn't just log off. And then they would say things like: You know, we're too busy dealing with murders, and I'm like: Well, don't you want to prevent murder rather than dealing with it after the fact.
Anita Rao
Kathryn left her abusive relationship, but the harassment and digital attacks didn't stop. Her abuser had given himself access to all of her calendars. So, in addition to using every method possible to contact her, her employer and anyone she was meeting up with, he also always knew where she was.
Kathryn Kosmides
So, the typical things like calling, emailing hundreds of times, and constantly, you know, being able to access my phone number — I would change my phone number, and he'd still have access to it. [He'd be] showing up to where I was, things like that, and [it] eventually escalated to him publishing on all of these revenge websites — like liars and cheaters.com, exposed-psychos.com, with my photo and a few paragraphs that exclaimed many, many negative things about me. And it started to rank number one on my Google search results — and that's actually when I felt forced into the justice systems.
So, I've actually been through all three legal justice systems, criminal, family and civil and was first recommended to go to the police to get a police report, to then go to family court to get an order of protection. Finally got an order of protection against him, and then he immediately violated it — and when someone violates an order of protection, at least here in New York, it goes through criminal courts. And so, I would go nearly every week down to the police station and file additional reports of how he was violating the order of protection and how the abuse was continuing.
And eventually, he was arrested for three felonies and two misdemeanors, I believe, of stalking and harassment — and ended up just getting off with a disorderly conduct — and that's when I chose to sue him in civil court because there was no public record of his violence and of this behavior. And it felt like, you know, one: I had the privilege to do that. And two: other people needed to know about this experience and about this abuse.
Audace Garnett
A lot of the tech abuse that's happening can sound like it's unbelievable, but it's important that we believe survivors and take the time to investigate and hear them out because it can cause a lot of harm.
Anita Rao
We're going to zoom out just a little bit now with the help of Audace Garnett. She's with a national network to end domestic violence. Her work focuses on the role that technology plays in domestic abuse situations, and she thinks a lot about how to support survivors and where tech enters into the picture.
Audace Garnett
We oftentimes blame the technology for the all of the awful and messy things that can be done with it, but it's important that we — before I mention the misuse — that I mention that it can be used for good, right. Technology can be used to empower survivors in various ways. They can use it to find employment to network, to attend school — they can also use it to maintain safety by connecting to a domestic violence advocate or to sexual assault services and speaking with people in their community.
It can also be used to decrease isolation, which is a tactic that abusers commonly use. Survivors can use it to connect with friends, join virtual groups, find a support system, so when we talk about misuse, it can be used to harass or threaten from monitoring or surveillance — you talk about the smart home systems, it can be used to stalk the survivor through GPS, and tracking devices and location features within devices. Abusers are using technology to impersonate them online and create fake accounts to commit fraud and privacy violations, hacking into bank accounts and emails.
But the point I want to make clear here is that technology is just one aspect of the violence a survivor may experience. Stalking, harassment, threats, shaming, monitoring, surveillance, and impersonation are all behaviors of power and control, and those behaviors have been happening before technology evolved to what it is today. So, even without the technology — power and control would still exist in that abusive relationship, so I just wanted to make that point.
Anita Rao
Such an important point, and I want to put that to you, Kathryn. I mean, hyper-focusing on tech solutions can take us away from some of the acknowledgement that: yeah, there is a lot of preventative work to be done. There's a lot of re-education about relationships that needs to be done, so I'd love to hear from you about kind of how where you are now in your thinking about how you navigate relationships and intimacy, and where technology plays a part in that, given the experience that you've had?
Kathryn Kosmides
Yeah, so I agree that technology can be used for a lot of good. And it's often, you know, not the technology's fault. It's the person weaponizing it, but often technology is built on a bell curve. They're building for the average user, instead of building for the margins. Then when you build for the most vulnerable people who could be using your platform, you build safety for everyone — and I think it's really important. That shift is slowly happening like — trust and safety teams are a brand new thing. Within technology, within the last five years, these teams didn't exist when I was a teenager on the internet, or when I first, you know, started using technology, and so there is this big shift about building for the most vulnerable — and that's what we've taken into our own platform as well.
Anita Rao
Kathryn's own platform? It's called Garbo. It's a forthcoming background check service that aims to make it easier to figure out if a potential romantic partner has a history of violence. With a first name, phone number and a few dollars, you'll be able to search their database of over 1 billion arrest, conviction and sex offender records.
Kathryn Kosmides
So, it really was developed after my own experience and realizing that, you know, I went through all of this to not only protect myself, but to protect the next person, but there was no protecting the next person because no one could easily find these records of violence. You had existing state databases —that like in New York, you have to have first name, last name, full birthday, and $95 to run a background check on someone that's not a public record — and then you had these traditional online background checks, which we call stalking as a service because we found that most of them don't have any criminal records, but they do provide access to invasive information like home addresses and email addresses. Like, the information that your stalker wants to find about you — you can still find a lot of my information on these websites, even though I tried to delete myself from them constantly. So, I saw the need for a new kind of online background check that really focused only on the reporting of violence, while not providing access to that invasive information.
Anita Rao
Garbo got a lot of press earlier this year when Tinder's parent company announced its plan to partner with Garbo. Some criminal justice and Information science experts raised concerns, saying that the tool may further stigmatize folks with criminal histories, or not properly reflect the nuance of dropped charges or an accurate records. Kathryn has been listening and responding to the critiques.
Kathryn Kosmides
I think we're in the middle of this battle, holistically, of privacy and protection. And we're seeing those two things butt heads, constantly — and so when we developed the platform of Garbo — one: we said we're not going to provide access to home addresses and phone numbers and emails and things like that, but we're also going to go one step further, to not perpetuate the bias you've seen, especially within the criminal justice system around minor offenses, especially things like drug possession — like over 50% of arrests today are for drug possession, which is absolutely insane, and we know that these offenses are disproportionately targeted at communities of color, and LGBTQIA+ individuals and different, marginalized and vulnerable groups.
And so we actually chose to filter out, with advice from advocates and experts across gender, racial and social justice, certain offenses that are not correlated to gender-based violence, and have disproportionate impacts to different communities — and so it's a balance of not having that record follow you forever, especially if it is a non-violent offense, but also protecting communities, from individuals who do have violent histories because we know that a past history of violence is the biggest indicator of future violence.
Anita Rao
So, acknowledging that fact that a past history of violence is an indicator — I'm curious, I mean, what are some early signs that folks can look out for in relationships, and maybe if tech based abuse is showing up earlier than some of the other signs?
Audace Garnett
Some warning signs are that person asking you for your password, questioning where you are, wanting to know your location, wanting to check your phone, right — things like that are warning signs, and they may vary, but those are some things that you should definitely look into and consider as a red flag.
Anita Rao
One of the things that I have read about is this idea of a digital inventory for folks leaving or ending an abusive relationship, so can you talk about what that is and how people can do it safely? Because it's not necessarily safe to automatically change all of your passwords and lock someone out of your account, who will then be flagged that you might be thinking about leaving or something like that.
Kathryn Kosmides
Creating a digital inventory of your passwords and things that you should change, right, because your device could be compromised, and you might not be able to physically write it down, because if you're in the house with them, you can't have a notebook that they could find.
And so there is actually one platform that I would like to shout out, it's called Victims Voice. It is a web-based app that anyone can upload history, evidence of their abuse, and things happening in the moment — screenshots and they get saved to this database that you can't even access. You can't edit them until until you escape the relationship, and, you know, choose to go to the police or whatever you choose to do with them. And so that's a very valuable tool to survivors.
But it's also interesting, you know — reporting is not just reporting to the police. You can report to a friend, you can report to a co-worker, your boss. You can tell them what's happening, and they can help you create this digital inventory of passwords, that you need to change account settings that you should look at and help facilitate this kind of experience to help you escape the relationship safely.
Anita Rao
A lot of the digitally enabled tech abuse is not done by abusers who are particularly tech-savvy. They're just able to interact with devices as authenticated users, knowing or guessing passwords, owning accounts, having access because of proximity. But, there are some other tools that are a little more technically complicated, like stalkerware. It's something that cybersecurity expert Eva Galperin has studied closely.
Eva Galperin
Stalkerware is the class of commercially available software, which is readily available, which is designed to be covertly installed on another person's device, and to exfiltrate data from that device without the user of the device knowing.
Anita Rao
Unfortunately, this is just as creepy and invasive as it sounds, and one of the most common ways it's found: a simple Google search.
Eva Galperin
Someone goes to their search engine, looks up: how do I spy on my partner's iPhone or how do I spy on my partner's Android? [Then] gets led to a website. The website has a link, and then what they do is they pay a certain amount of money. The whole idea is that then you either trick the person that you are spying on into downloading a file onto their device — or if you are an abuser who has physical access to your survivors device, you grab it yourself for a period of seconds in order to install the file — and it exfiltrates data from your phone to a command and control server, which is controlled by the software company that has sold the stalkerware to your abuser. The abuser then pays money to the stalkerware company for monthly access to that portal in order to see the information that is being sent from the device hearing you.
Anita Rao
The thing going through my mind is: How on earth is this legal? So, you've got to help me understand the legal intricacies of this: how can these things exist?
Eva Galperin
Well, it's complicated, but this is sort of how every legal answer begins with a lawyer looking off into the distance. So many of the aspects of what I just described are in fact illegal. While it is legal to write the software, and depending on how you advertise it, it may even be legal to sell this software, the software that I am describing is expressly against the terms of use of the app stores run by both Google and Apple.
So, you should not be finding these directly in app stores — and usually you have to have to sideload the product, then actually installing this on somebody else's device without their consent, and exfiltrating the data is also often illegal. And it depends on exactly what data you're exfiltrating and what jurisdiction you're in, and what jurisdiction the person that you are spying on is in because the laws around your location data and the contents of your emails, or the contents of your phone calls, are all different. But, yes, this breaks many, many laws - many, many times along the long line here.
Anita Rao
Stalkerware can monitor everything you are doing on your phone — from the photos and videos you take, to the texts you send and receive, to maybe even turning on your microphone or camera. But some of the features of it — like knowing where you are or sending an alert when you arrive at a specific location are also found in some apps parents used to keep tabs on their kids, things like Family Safe or Find My, which used to be Find My Friends.
Eva Galperin
What differentiates a dual use app from just blatant stalkerware is that stalkerware hides on the device. So, the whole idea is that the person who is being watched does not know that they are being watched. There are classes of apps that will report your location, or even your keystrokes and your searches and your internet behavior to someone else — which act overtly. So, you know, the app is on your phone, you know what it does, you know how it does it, you know who it's talking to the majority of the time —and those apps can absolutely be used as tools of abuse, but at least they're not being used as covert tools of abuse.
And in that way, the survivor can actually understand what the limits of their abusers knowledge and power is —a nd that helps them create a space in which they can escape when the time comes, when they are ready — and I think that's really important.
Anita Rao
Eva is the director of cyber security for the Electronic Frontier Foundation, but she's paid extra close attention to the ways things like stalkerware can be used as tools of abuse. So much so, that our own personal research uncovered some major gaps in anti-virus products, and inspired her to start the coalition against stalkerware.
Eva Galperin
I helped found an organization which includes a bunch of anti-virus companies, and those anti-virus companies have committed to doing a good job of staying on top of stalkerware detection, and also to sharing samples of stalkerware with the other AV companies in the coalition, so that we don't have every security company reinventing the wheel. As a result, if you are using an Android, and it's the Android ecosystem that releases the majority of the stalkerware that we look at, you can download an anti-virus program — and you can be safe in the knowledge that no matter which program you download, it is fairly likely to detect stalkerware if it is present on your device — and then you can have the option of deleting it or not.
Most of the stalkerware in the iPhone ecosystem no longer works in the way that I described, where you grab somebody's phone and you covertly install an app. A lot of it is done through mis-configuration of your settings, and Apple actually has a specific manual out there that will walk you through the settings in question, and also allow you to see whether or not something has been configured in such a way as to leak data to an abuser.
Anita Rao
When we say that putting together this episode finally made us turn on two-factor authorization and sign up for password managers — we mean it. But, jumping to immediately changing your tech habits if you're in the middle of a potentially violent situation is not a good idea. Audace says proceed with informed caution.
Audace Garnett
Everyone situation is different, so there's not one way of dealing with the situation, so we often say trust your instincts, put safety first. People always put out their knee jerk reactions and may say if the survivor detects that there's tech abuse, why don't they just remove the stock away from the device or get rid of the device or change their phone number and email? That may not be the safest thing for survivors to do. Before doing any of that it's important to consider the safety because the violence may escalate as a result of the survivor cutting off the abuser. So, working with a local advocate is really important, so that they can guide you and support you, and provide you with whatever resources are available to help you get to safety with your family.
Anita Rao
We'll share a bunch of the resources we've gathered on our website. Advocates, with the support of folks like Audace are working hard to stay on top of new technology and have the latest tools available to help survivors get to safety.
Audace Garnett
Because technology is constantly emerging it can be difficult to keep up for advocates to always be on top of things, so however, I must say that advocates are really creative and committed to supporting survivors. So, they figure things out. They're downloading those apps, they're testing on those apps, they're attending webinars and trainings, and as much as the technology is continually changing, the root behaviors of the abuser remains the same. So, the power and control are always there. I want to just say it's the new tools and old behavior, so advocates are doing all that they can to keep up.
Anita Rao
If any of what you've heard today sounds familiar to you, or you know someone in the thick of an abusive situation, please know there are so many ways for you to get support right now and 24-7 - you can call the National Domestic Violence Hotline at 1-800-799-7233, and Merely Ashley from TikTok also wants to leave you with some of her own advice.
Ashley
It does get better, and you are stronger and more resilient than you will ever realize. There were days that I didn't think I could push on, and I've had friends that have listened to me for two hours, and I'm forever grateful to them, but, you will get through this, and sometimes there's reasons where you have to go through hard experiences, and just going one step at a time will get you there. And there are people out there who believe you. If others aren't believing you, I believe you. You can always reach out to me. You can reach out to others in the cybersecurity community and we are there to help.
Anita Rao
Embodied is a production of North Carolina Public Radio WUNC - a listener supported station. If you want to lend your support to this podcast and WUNC's other shows on demand, consider a contribution at wunc.org. Now, incredible storytelling like you hear on Embodied is only possible because of listeners like you.
Josie Taris produced this show with editorial support from Kaia Finley and Amanda Magnus. Jenni Lawson is our sound engineer and Quilla wrote our theme music.
This show is supported by Weaver Street Market, a worker and consumer owned cooperative selling organic and local food at Fort Triangle locations in North Carolina. Now featuring online shopping with next day picked up: weaverstreetmarket.coop.
And we always want to hear from you and include your voices in future shows. We're working on a show right now about facial feminization surgery. If you've undergone this procedure, what was the experience like for you? What advice would you pass on to others? Email us embodied@wunc.org.
I'm Anita Rao — taking on the taboo with you.