Court Orders Halt to Sale of Spyware

At the request of the Federal Trade Commission, a U.S. District Court has issued a temporary restraining order halting the sale of keylogger spyware. According to the FTC’s complaint, the Florida-based CyberSpy Software, LLC marketed and sold RemoteSpy keylogger spyware to clients who would then secretly monitor unsuspecting consumers’ computers. The FTC seeks to permanently bar the unfair and deceptive practices and require the defendants to give up their ill-gotten gains.

According to papers filed with the court, the defendants provided RemoteSpy clients with detailed instructions explaining how to disguise the spyware as an innocuous file, such as a photo, attached to an email. When consumer victims clicked on the disguised file, the keylogger spyware silently installed in the background without the victims’ knowledge. This spyware recorded every keystroke typed on the victim’s computer (including passwords); captured images of the computer screen; and recorded Web sites visited. To access the information gathered and organized by the spyware, RemoteSpy clients would log into a Web site maintained by the defendants.

Defendants touted RemoteSpy as a “100% undetectable” way to “Spy on Anyone. From Anywhere.” According to the FTC complaint, the defendants violated the FTC Act by engaging in the unfair advertising and selling of software that could be: (1) deployed remotely by someone other than the owner or authorized user of a computer; (2) installed without the knowledge and consent of the owner or authorized user; and (3) used to surreptitiously collect and disclose personal information. The FTC complaint also alleges that the defendants unfairly collected and stored the personal information gathered by their spyware on their own servers and disclosed it to their clients. The complaint further alleges that the defendants provided their clients with the means and instrumentalities to unfairly deploy and install keylogger spyware and to deceive consumer victims into downloading the spyware.

On November 5, 2008, the FTC filed its complaint and requested a temporary restraining order against the defendants from the U.S. District Court for the Middle District of Florida, Orlando Division. Under the terms of the order approved by the court, in addition to halting the sale of their RemoteSpy software, the defendants must disconnect from the Internet any of their servers that collect, store, or provide access to information that this software has gathered.

The complaint also names Tracer R. Spence – the registered agent and manager of the
Orlando, Florida-based CyberSpy Software – as liable and culpable for the charges made in this case. The Commission vote authorizing the staff to file the complaint and request a temporary restraining order was 4-0.

A complaint filed by the Electronic Privacy Information Center (“EPIC”) brought the RemoteSpy software to the FTC’s attention.

An update on this litigation can be found at http://www.ftc.gov/opa/2008/11/cyberspynr.shtm

NOTE: The Commission authorizes the filing of a complaint when it has “reason to believe” that the law has been or is being violated, and it appears to the Commission that a proceeding is in the public interest. A complaint is not a finding or ruling that the defendants have actually violated the law.

The Federal Trade Commission works for consumers to prevent fraudulent, deceptive, and unfair business practices and to provide information to help spot, stop, and avoid them. To file a complaint in English or Spanish, visit the FTC’s online Complaint Assistant or call 1-877-FTC-HELP (1-877-382-4357). The FTC enters complaints into Consumer Sentinel, a secure, online database available to more than 1,500 civil and criminal law enforcement agencies in the U.S. and abroad. The FTC’s Web site provides free information on a variety of consumer topics.

(FTC File No. 0823160)