The FTC denied a request to cancel that ban made by Scott Zuckerman, the founder of consumer spyware company Support King and its subsidiaries SpyFone and OneClickMonitor. Zuckerman was banned from the surveillance industry following a data breach that exposed the personal information of its customers, as well as the people they were spying on.
According to its press release, FTC said that in an order denying Zuckerman’s petition, the Commission found he failed to show changed conditions of fact or law sufficient to justify reopening and setting aside the Consent Order.
In a 2021 order, the FTC alleged that Zuckerman and Support King, LLC, which did business as SpyFone.com, sold apps that allowed purchasers to secretly monitor devices without device-owner knowledge, put users at risk by requiring them to disable security protections on those devices, and secretly collected and shared data on photos, text messages, web histories, location, and physical movements.
READ: Amazon faces trial in FTC suit alleging Prime was hard to cancel (
The order, which was finalized in late 2021, bans Support King and Zuckerman from offering, promoting, selling, or advertising any surveillance app, service, or business. It also requires them to develop an information-security program for any business they operate and obtain biennial assessments of that program by a third party and comply with other reporting obligations. After receiving 27 comments on Zuckerman’s petition, the Commission voted 2-0 to deny the petition and respond to the commenters.
“SpyFone is a brazen brand name for a surveillance business that helped stalkers steal private information,” said Samuel Levine, then acting director of the FTC’s Bureau of Consumer Protection. “The stalkerware was hidden from device owners, but was fully exposed to hackers who exploited the company’s slipshod security.”
In his petition, Zuckerman claimed that the FTC order’s security requirements have made it harder for him to run his other businesses due to financial costs. Support King is no longer in operation, and Zuckerman only runs a restaurant and plans other “tourism ventures” in Puerto Rico, according to the petition.
In 2018, a security researcher discovered an Amazon S3 bucket belonging to SpyFone that left extremely sensitive data, including selfies, text messages, chat app messages, audio recordings, contacts, location, hashed passwords and logins, and more exposed online.
According to the researcher, the exposed data included 44,109 unique email addresses and, according to the researcher who found the breach, “at least 2,208 current ‘customers’ and hundreds or thousands of photos and audio in each folder” from 3,666 phones that had the SpyFone stalkerware installed on them.
TechCrunch reported in 2022 that Zuckerman appeared to be running another stalkerware company. TechCrunch received a trove of breached data from stalkerware app SpyTrac, which revealed it was run by freelance developers with direct ties to Support King in an attempt to circumvent the ban.
Eva Galperin, a prominent expert on stalkerware, celebrated the news. “Mr. Zuckerman was clearly hoping that if he laid low for a few years, everyone would forget about the reasons why the FTC issued a ban not only against the company, but against him specifically,” Galperin told TechCrunch.