In an obscure case that could have broad implications, a judge in the Eastern District of Virginia sentenced the Danish CEO of two overseas technology companies to time served and a fine of $500,000 for the advertisement and sale of a mobile application capable of surreptitiously monitoring communications and other information on a mobile device. A Department of Justice press release touted the result as “the first-ever criminal conviction concerning the advertisement and sale of a mobile device spyware app.” Nevertheless, the sentence of ten days of time served represents a significant downward departure from the recommended 4-10 month prison term contemplated by the defendant’s plea agreement.
According to a statement of facts filed with the plea agreement, the defendant, Hassam Akbar, advertised and sold “StealthGenie,” a now-defunct mobile app that could be used for real-time monitoring of a mobile device owner’s calls, texts, emails, photographs, calendar appointments, contacts, and other information. The app apparently could also remotely activate the phone’s microphone and record nearby sound. Once installed and activated, the app was undetectable to the average user because it ran in the background whenever the smartphone was powered on with no indication that the app was running. According to the DOJ, “[a]pps like StealthGenie are expressly designed for use by stalkers and domestic abusers who want to know every detail of a victim’s personal life – all without the victim’s knowledge”; indeed, according to the DOJ “SteathGenie ha[d] little use beyond invading a victim’s privacy.” For this reason, as Wired reported, the Akbar indictment was hailed as a step in the right direction by at least one group working to fight domestic violence, which was hopeful the conviction signaled an intent to crack down not only on the users but also on the developers and distributors of tools used to perpetrate domestic violence and stalking.
However, in his sentencing memorandum filed last week with the Court, Akbar, a 31-year old Danish citizen with no prior criminal record, told a different story about his product. Although Akbar conceded that StealthGenie was initially marketed as a tool for catching “cheating spouses,” he asserted that the company quickly pivoted after he became aware of US legislators’ concerns that spyware applications were being used for nefarious purposes. Instead, Akbar asserted, “[t]he company marketed StealthGenie primarily to enterprises seeking to monitor employees’ use of company mobile devices and parents seeking to track children’s smartphone activity.” And, he argued, StealthGenie’s website contained extensive disclaimer language directing that the application must only be used for “ethical monitoring” by parents and employers, in compliance with the laws of the user’s country, and with the “written consent” of the smartphone’s owner.
Perhaps most significantly – and as the statement of facts confirms – Akbar asserted that before his arrest (but after he violated the statute in question), he engaged a “prominent United States law firm,” and was advised that US law “did not absolutely prohibit the sale of the app.” According to the statement of facts, Akbar’s then-counsel “was not aware of any United States statute under which the sale of software such as defendant’s application or mobile phone tracking software was per se illegal” and “[n]otably . . . failed to inform the defendant even of the existence of [18 U.S.C. § 2512, the provision under which the defendant was convicted].” These factors may have impacted the Court’s decision to sentence Akbar to time served and a fine, rather than the 4-10 month recommended prison term under the Sentencing Guidelines.
In actuality, 18 U.S.C. § 2512 criminalizes the sale or advertisement of any device that the seller knows or has reason to know is “primarily useful for the purpose of the surreptitious interception of wire, oral, or electronic communications.” This case should serve as a wakeup call for app and device developers and merchants that the key inquiry is into their product’s “primary use” and not necessarily the intended use. Developers of other surreptitious monitoring tools and devices, such as “nanny cams,” “valet cams,” and other programs to monitor employees and children would be well advised to reconsider all possible uses of their products in light of last week’s sentencing.