Domestic abusers who wish to spy on their partners are no longer limited to stalking them physically; through our research, we have found that modern technology has provided a plethora of cheap hidden cameras, microphones, and GPS trackers that can be easily employed by an abuser. Survivors of this abuse often reach for commercially available spy device detectors, including physical gadgets and smartphone apps. While we find that many detectors are available on online stores and app marketplaces, whether these detectors work is another story altogether.
Millions of people per year in the United States experience intimate partner violence (IPV) [12]. Increasingly, technology has been involved in IPV [5,9,10]. Abusers install spyware apps, send harassing messages, and take control of online accounts to spy on, intimidate, and isolate survivors [4,7,14]. In a particularly worrying trend, abusers are using hidden surveillance devices such as cameras [1,3], audio recorders [8], and location trackers [11] to spy on survivors. In addition to obvious violations of privacy, this intimate partner surveillance (IPS) can escalate to violence, even resulting in homicide [6].
Unfortunately, we find that covert devices are available for purchase on large, online retailers in the US. Several online articles promote the use of hidden surveillance devices for IPS and include links to spy devices for sale online, many for less than $25. Not only do these commercial spy devices provide abusers with a quick, affordable way to purchase surveillance tools, but the manufacturers of these devices also implicitly (and sometimes explicitly) condone IPS using these tools.
With hidden surveillance devices readily available to abusers, survivors urgently need reliable tools to detect hidden devices. Unfortunately, it is unclear whether the available options work. Commercial detection apps [13,15] and hardware detectors [2] claim to detect a wide range of hidden devices including cameras, microphones, and listening bugs. However, there have been no studies assessing their efficacy.
Thus, in this work we study the spy devices and detection tools that are commercially available. We build a taxonomy of available spy devices to understand their capabilities and their underlying technologies. We also perform in-lab tests of a sample of spy devices to understand their effectiveness at enabling IPS. To understand available detection tools, we generate a similar taxonomy and perform in-lab tests to see if they can detect real spy devices. Unfortunately, we find that these detectors fail to live up to their claimed abilities. We hope that this work will provide guidance and motivation for future work in detecting covert spy devices.
To understand what covert devices and detectors are available to the average consumer, we searched online retailers (Amazon, Walmart, eBay, Best Buy, and Home Depot) for both devices and detectors.
We used simple search terms to find these products: terms like “camera to spy on wife” when we wanted to find covert devices, and terms like “best hidden camera detector” when we wanted to find device detectors. Over the course of a week, we collected the listings of the top products returned for each query on each retailer. When we were done, we had a total of 6,403 covert device product listings and 1,313 detector product listings.
Obviously, not all of those listings were covert devices and device detectors. To separate the listings we were interested in from the novels and t-shirts that cropped up, we performed two rounds of classification. In the first round, we classified the products using heuristics based on their product title and description. If a covert device product listing contained words that indicated it was actually technology (and avoided words that indicated it was a book or piece of clothing), the product listing passed the first round. In the second round, we used a logistic regression classifier to determine whether the listing was a covert device and not an irrelevant piece of technology. After classification, we had narrowed the initial set of 6,403 potential covert device listings to 2,248 probable covert devices. The detectors were classified in the same way, but since most of the listings were incredibly similar, we did not need to use the logistic regression classifier, resulting in 700 probable detector listings.
We assembled a sample of 163 product listings from the 2,248 covert device listings we retrieved from the internet. The covert devices were not spread evenly across the five retailers; Amazon, eBay, and Walmart had more devices than Home Depot and Best Buy. As such, we assembled the sample to proportionally represent all five retailers. We examined the product name, description, specifications, and accompanying photos—and occasionally the product reviews, which helped to clarify the actual product capabilities. For spy devices, we gathered (a) the type of information the device claims to collect, (b) communication medium used by the device, (c) advertised use case(s) of the device, (d) how the device can be hidden (which we call covertness), and (e) other metadata, such as the price and the device manufacturer. Two of the researchers working on the project divided the products evenly and inspected them one by one. For spy devices, the researchers occasionally disagreed on how to classify whether a product is able to be hidden; this was resolved by refining our definition of “able to be hidden” to mean 4cm to a side. All researchers met together multiple times to resolve conflicts and confusion. Though most devices are fairly clear about their capabilities and advertised usage, we used our best judgment for some devices. For instance, several cameras in our dataset of spy devices do not explicitly say whether they recorded audio as well as video; for these, we assumed the camera did not record audio unless proven otherwise.
The spy devices in our sample collect three basic types of information: video (74 devices), audio (64), and location (59). These devices are typically cameras with video (and usually audio) capabilities, devices designed for audio recording only, and devices meant for tracking location only. We identified 117 devices built to be hidden and 46 devices not meant to be hidden, but still hideable: they are small and unobtrusive enough to be hidden while not specifically advertised as being a hidden device. The devices utilize four methods of sending information. Several devices—including every location tracker in our sample—share the information they collect using cellular networks (50 devices), WiFi (47), or Bluetooth (5). In contrast, some cameras and recording devices rely on local storage only (such as an SD card) for storing information (58).
A device’s communication method and storage method impact that device’s utility to an abuser. Spy devices that share data remotely allow an abuser to place the device once then continue to view data from that device without being physically near the survivor. Since abusers routinely share children, homes, or assets with survivors, it is not unlikely that an abuser would have one-time physical access to the survivor’s surroundings. On the other hand, devices that use only local storage require an abuser to have routine physical access to the device to look at the data it collects; typically, this would not be possible unless an abuser has periodic access to the survivor’s personal spaces. This is possible in certain situations, but we expect that the devices that communicate wirelessly are more concerning to most survivors. Finally, we note that these devices were available on all five of the online retailers we searched. They were also cheap; over half of the devices we examined cost less than 20 dollars.
We purchased a sample of 11 devices (7 recording devices, 2 traditional GPS trackers, and 2 Bluetooth mesh GPS trackers) to evaluate their effectiveness. Unfortunately, we found that nearly every device in our sample could be used to conduct IPS. Among 7 recording devices we tested, five can gather sensitive data when used in our lab. The picture and audio recorded by the recording devices are clear, and both the cameras and the microphones can record hours of sensitive data when supplied with large-capacity Micro SD cards. All 4 of the GPS trackers we test are able to effectively communicate their location when used in our lab. Moreover, we found these devices did require any advanced technical knowledge to set up.
Advertising and User Reviews
While analyzing these spy devices, we noticed some worrying trends in the product listings and reviews. Some of the listings we analyzed included graphics or text that indicated they were useful for spying on one’s partner. For example, a GPS tracker was titled “Find Spouse Cheating Affair Spy Surveillance GPS Tracking Device,” and a spy camera included an image of a couple in bed as an example use case. All of these listings were sold by third parties on Amazon, Walmart, or eBay; none of these websites prohibit their third party sellers from promoting IPS.
Moreover, some of the devices contained user reviews describing how they can be used for IPS. These reviews were written in glowing terms, praising the device’s efficacy. A common theme of these reviews was the usage of these devices to catch infidelity. A reviewer for a camera wrote “I caught my wife cheating in the act. It worked great but the setup did not accept the special characters like !@#$%& for the WiFi password.” and a review for a microphone was titled “To catch a cheater”. Other reviews, however, simply talk about tracking partners or catching them in generic “lies”. One such review is for a GPS tracker:
“My girl has been giving me “trust issue vibes.” I luckily found this item, and purchased it, and I must say it works EXCEPTIONALLY well! On the first day, I caught her up lying about which Popeyes chicken location she went to LOL, and of course when I confronted her, she says she lied to me to prevent a negative confrontation with me, so yah it’s always the males fault no matter what I guess lol!”
Another review for a GPS tracker tells a similar story:
“Been tracking my husband and now I’m tracking his lies of what he’s doing and where he’s going. . . SMH. I snuck it in the back pocket of his drivers side seat and it works perfectly.”
From the advertising in the listings and the product reviews seen here, we can only conclude that the third parties selling these covert devices are aware that they are being used for IPS. These sellers are not stopping, however, so we must conclude that they either condone IPS, or don’t care whether their products are used for it.
In response to the rising availability of commercial spy devices, many spy device detectors are now on the market as well. These commercially-available detectors take the form of both physical detectors and smartphone apps, and they make claims ranging from highlighting hidden camera lenses to detecting any hidden electronics in a room. We wanted to know whether these detectors work and, importantly, whether they are useful for survivors.
As previously mentioned, we gathered device detector listings using a crawl of five online retailers: Amazon, Walmart, eBay, Best Buy, and Home Depot. We filtered the listings and ended up with 700 listings for device detectors. We also performed a small crawl of the Apple App Store and the Google Play Store for smartphone apps that claim to work as covert device detectors. We collected 43 apps in total, 29 from the Google Play store and 14 from the Apple App Store.
We analyzed the listings for both the physical detectors and the detector apps to determine what they claimed to detect and how they claimed to detect it. Of the 148 physical detectors in our sample, most (117 devices) are advertised with a blanket claim of detecting all potential covert devices. These devices generally claim to use RF detection in combination with a magnetometer and/or an IR lens detector. These detectors are quite homogenous; 40 detectors appear nearly identical to the photo in Figure 1. The remaining 31 physical detectors claim to detect only cameras and include only an IR lens detector. The detection apps have a similar breakdown. Of the 43 detection apps we collected, 23 of them claim to detect hidden cameras using the phone’s camera, and 18 claim to detect all types of hidden bugs using the phone’s built-in magnetometer. The other two apps claim to detect general RF signals and all network attached devices. The apps employ IR lens detectors (17), RF detectors (1), and magnetometers (28), similar to the physical detection devices; additionally, some detection apps claim to find devices using network scanning (11) and AI image recognition (5).
Despite the claims made by these detection tools, we found that they are technologically incapable of detecting any spy devices. To test these detectors, we purchased a sample of them, including one physical detector (depicted in Figure 1) and 11 detector apps. We tested them using the setup pictured in Figure 2. Each detector was tested with each covert device. The covert device was placed in a fixed location and each detector was moved around the covert device at fixed distances and angles. We recorded the measurements of each detector with each spy device in each position and compared them to the recordings in the same positions when there was no device present.
We found that the readings given off by the detectors were practically indistinguishable whether or not there was a device present in the room. This was true for both the physical detector and the detector apps. The physical detector relies on an RF antenna to sense transmissions from the devices, but the antenna was extremely sensitive to other RF signals in the building, and even when testing in an area without stray RF signals, the antenna can only tell when the spy device is transmitting wirelessly, making it extremely difficult to use. The apps claim to use your phone’s built-in magnetometer to detect RF signals, but this was also extremely sensitive to precise position within the room. Additionally, magnetometers cannot detect RF signals at all, and the apps were actually turning the phones into crude metal detectors. All told, these detectors cannot help survivors of IPS. At best, they are a waste of money, and at worst, they provide a false sense of security to survivors.
Spy devices pose a threat to survivors of IPS and, unfortunately, there are few mitigations against this threat. Spy devices are widely available to the average consumer for small amounts of money. These devices effectively enable IPS without the abuser having any specialized technical skill. Meanwhile, commercially-available device detection tools are unusable and often fail to detect anything. To help combat this threat, we encourage the research community to expand upon existing detection techniques while ensuring these techniques are usable for people without technical expertise, and we encourage online retailers and lawmakers to put rules in place that curtail the sale of devices intended to enable IPS. As security researchers, we have a responsibility to ensure the security of vulnerable populations. This work provides us with an opportunity to fulfill that responsibility.
