What is spyware?¶
Spyware is software used to collect information from a device or user without proper authority or informed consent.
Avoid the dangerous assumption¶
The dangerous assumption is that spyware always means covert surveillance by a sophisticated external offender.
It can range from simple monitoring software to malware designed to steal communications, credentials, location data, files or browser activity.
Spyware may collect:
- keystrokes
- screenshots
- messages
- audio
- camera images
- location
- browser history
- stored credentials
- files
- clipboard content.
Some monitoring tools have legitimate uses, such as enterprise management or parental controls. The investigative question is who installed or controlled the software, what authority existed and how it was used.
Relevant evidence may include:
- installation records
- application permissions
- configuration
- account details
- data destinations
- network connections
- captured data
- licensing or payment records
- remote-control accounts
- user and administrator activity.
The presence of spyware does not prove that every available collection function was used.
Likewise, the absence of visible captured data does not prove no collection occurred. Information may have been transmitted elsewhere or deleted.
Do not assume the account holder or device owner installed it. The device may have been shared, remotely managed or physically accessed by another person.
Specialist support may be required where the software uses elevated privileges, hides itself or operates across several devices.
Consider whether collection was continuous, triggered by specific events or manually activated. That distinction may affect the timeline, the likely volume of captured data and the inferences that can safely be drawn.
Operational takeaway¶
Identify who installed and controlled the spyware, what data it could access and what collection or transmission can actually be evidenced.