Page 1

ANDROIDMALWARE & STALKERWARE · A GUIDE FOR UK LAWYERS Android Malware, Stalkerware and Compromise The Open Platform's Larger Threat Surface, What Can Be Found, and the Duty of Care That Comes First COMPUTER FORENSICS LAB

§ ABOUT THE AUTHOR PREPARED BY COMPUTER FORENSICS LAB E-DISCOVERY TEAM ESTABLISHED 2007 · LONDON ISO 17025-ALIGNED PROCEDURES ANDROID STALKERWARE & MALWARE DETECTION SAFET Y-LED, VICTIM-CENTRED APPROACH CPR PART 35 EXPERT REPORT S FULL CHAIN-OF-CUSTODY DOCUMENTATION

§ CONTENTS In this guide 01 Executive summary 02 The problem in plain English: openness cuts both ways 03 How Android devices are compromised 04 Detecting compromise: what Android lets you see 05 Safety first: the duty of care 06 Interpretation and honest limits 07 Deployment: protecting the person, then the evidence 08 Source architecture: where else the evidence lives 09 Worked examples 10 Common mistakes and technical limitations 11 Questions to ask · Suggested wording 12 Checklist and red flags · When to involve a digital forensic expert 13 Frequently asked questions 14 Glossary · References · Disclaimer · How a specialist laboratory can assist

§ 01 · ORIENTATION Executive summary The headline point: Android's openness gives it a larger threat surface than iOS, sideloaded stalkerware and malware are easier to install and sweeping permissions let them see a great deal, but the most common surveillance is still consumer stalkerware installed with physical access or the misuse of legitimate features, openness also lets an examiner inspect apps and permissions more fully, and, as on iOS, the person's safety comes before the evidence.

§ 02 · FIRST PRINCIPLES The problem in plain English: openness cuts both ways

§ 03 · HOWDEVICESARECOMPROMISED How Android devices are compromised STALKERWARE PERMISSIONS MISUSED FEATURES CONTROLLED MALWARE (RARE) ACCOUNT