Phone Spyware Check Kit for Domestic Abuse Support Workers, in English and Urdu

The problem: "I think my phone is being watched"

Survivors of domestic abuse often suspect that an abusive partner or family member is tracking them through their phone: knowing where they went, reading their messages, quoting things they only said on calls. Some of this is spyware installed while the abuser had the phone. Much of it is ordinary apps and accounts used against them: a family locator app, a WhatsApp session still linked to another device, a Google account whose password the abuser knows.

Support organisations, women's helplines and university counselling services hear this constantly. Few of them have a technologist, and generic antivirus apps miss dual-use apps entirely. Worse, an app that alerts the abuser when it is removed can escalate danger. Survivors need a careful check by a trained person who explains the findings and the risks before anything is changed.

What already exists and the gap

• TinyCheck, an open source tool from a Kaspersky researcher, runs on a Raspberry Pi and watches a phone's network traffic for connections to known stalkerware servers, without touching the phone.
• The Coalition Against Stalkerware shares indicators and supports antivirus vendors in detecting stalkerware.
• ISDi, from the Clinic to End Tech Abuse research team, scans phones over USB for apps that could be used for intimate partner surveillance, as part of a structured consultation.
• Mobile antivirus apps detect known spyware but run on the phone itself, which an abuser may check.

The gap is a kit adapted for South Asian support settings: Urdu explanations, local apps and family dynamics (shared phones, joint family members as abusers), checks for the accounts and apps common here, and a workflow that a non-specialist worker can follow with short training.

Inspiration

"The Spyware Used in Intimate Partner Violence" by Rahul Chatterjee and colleagues (IEEE S&P 2018) found that most tools used for partner surveillance are dual-use apps with legitimate purposes. "Clinical Computer Security for Victims of Intimate Partner Violence" by Sam Havron and colleagues (USENIX Security 2019) designed and deployed in-person consultations with survivors, along with tools such as ISDi, and found account compromise, exploitable misconfigurations and potential spyware. This project adapts that method for organisations in Pakistan and similar settings.

What you build

• Support workers connect the phone with a cable, follow a guided check, and walk through the results with the survivor.
• Survivors see each finding explained in their language, with the choice of what to do and a warning where removing something might alert the abuser.
• Organisations get a short training guide and a process that stores nothing by default.

The technically interesting part

• Checking without installing. Use ADB over USB to read the app list, permissions, device admins, accessibility services and notification listeners, which are the powers stalkerware needs. Nothing is installed on the phone and no trace is left.
• Dual-use apps. A family locator or parental control app is not malware. Score apps by the powers they hold and whether they are hidden, recently installed or unknown to the survivor, and present them as questions ("did you install this?") rather than verdicts.
• Hidden apps. Stalkerware often hides its icon or uses a harmless name such as "System Service". Compare launcher-visible apps with installed packages and flag mismatches.
• Accounts. Many compromises are account-level. Build a guided checklist with screenshots for the linked device lists in Google, WhatsApp and other common apps.
• Safety-aware design. Default to no storage, a quick exit button and wording reviewed with people who work in this field.

How to evaluate it

• Detection: on test phones with known stalkerware samples (handled safely and legally on lab devices) and dual-use apps installed, measure what the kit finds.
• Time: minutes for a full check by a trained volunteer.
• Understanding: in a usability study with role-play scenarios, check whether participants correctly explain each finding and its risk afterwards.
• Language: review of the Urdu text by native speakers who are not engineers.

Suggested plan

• Weeks 1 to 3: read both papers; ADB basics; list apps and permissions on test phones.
• Weeks 4 to 7: indicator database and the scanning logic for hidden and high-power apps.
• Weeks 8 to 11: results screen, Urdu content and account checklist.
• Weeks 12 to 15: usability study, refinements, training guide and report.

Path to a product

This is best run as an open source public-interest tool, offered to helplines, NGOs, university counselling centres and digital rights groups, with training. Grants and partnerships with digital rights organisations are the realistic funding route, not sales.

Scope warning

Never test on real survivors' phones during the project; use test devices and role play. Work with a supervisor and, if possible, an organisation in the field, and get ethics approval for the usability study. Android only.

Learn what you need on Sefism

• Cybersecurity roadmap: mobile threats and how investigations work.
• OWASP Mobile Application Security (MASVS and MASTG): Android internals and permissions.
• Mobile development roadmap: how Android apps, services and permissions fit together.
• Linux, terminal and Git roadmap: the command-line skills ADB work needs.
• Where do I start if I want a career in cybersecurity or IT operations?: where this kind of work can lead.

Get help with this idea

This project needs as much care in design and ethics as in code. Tauseef can help you scope the checks, plan a safe usability study and find the right people to review the Urdu content. If you are new here, create a free account first.

• Discuss this idea with a mentor
• Send a query to Tauseef
• Book a 1:1 session