Read 8 remaining paragraphs | Comments

The private phone data of hundreds of thousands of people are at risk. Call records, text messages, photos, browsing history, precise geolocations and call recordings can all be pulled from a person’s phone because of a security issue in widely used consumer-grade spyware.

But that’s about as much as we can tell you. TechCrunch repeatedly emailed the developer, whose identity is well hidden, through all known and non-public email addresses, but lines of inquiry to disclose the issue went cold. We sent emails with open trackers to tell if they had been read, but no luck there either.

Efforts were made to contact the spyware developer because the security and privacy of thousands of people are at risk until the issue is fixed. We can’t name the spyware or its developer since it would make it easier for bad actors to access the insecure data.

TechCrunch discovered the security issue as part of a wider investigation into consumer-grade spyware. These apps, often marketed as child tracking or monitoring software, can go by another name — “stalkerware” — for their ability to track and monitor people without their consent. These spyware apps silently and continually siphon the contents of a person’s phone, allowing its operator to track a person’s whereabouts and who they communicate with. Many will have no idea that their phones are compromised, since these apps are designed to disappear from home screens to avoid detection or deletion.

“I am disappointed but not even slightly surprised,” said Eva Galperin, the director of cybersecurity at the Electronic Frontier Foundation who led the effort to launch the Coalition Against Stalkerware, in a call with TechCrunch. “I think that we could reasonably characterize this kind of behavior as negligent. Not only do we have a company, which is making a product which enables abuse, but they’re doing such a poor job of securing the information that’s exfiltrated that they are opening the targets of this abuse to even further abuse.”

TechCrunch also contacted Codero, the web company that provides hosting for the developer’s spyware infrastructure, but Codero did not respond to several requests for comment. Codero is no stranger to hosting stalkerware; the web host “took action” against stalkerware maker Mobiispy in 2019 after it was found spilling thousands of photos and phone recordings.

“I suppose it’s no surprise the web host which hosts one stalkerware company would host other stalkerware companies, and they would if they were previously unresponsive, that they would be unresponsive this time around,” said Galperin.

The proliferation of this easy-to-obtain spyware prompted an industrywide effort to crack down on these apps. Antivirus makers have worked to improve their ability to detect stalkerware, and Google has also banned spyware makers from promoting their products as a way to spy on a spouse’s phone, though some developers are using new tactics to evade Google’s ads ban.

Mobile spyware is no stranger to security issues. In the past few years, over a dozen stalkerware makers are known to have been hacked, left data exposed or otherwise compromised the data of people’s phones — including mSpy, Mobistealth, Flexispy and Family Orbit. Another stalkerware, KidsGuard, had a security lapse that exposed thousands of people’s phone data, and most recently pcTattleTale, which promotes itself as able to spy on a spouse’s device, was leaking screenshots by way of easily guessable web addresses.

Federal regulators are starting to take notice. In September, the Federal Trade Commission banned SpyFone, a stalkerware app that also exposed the phone data of more than 2,000 people, and was ordered to notify victims that their phones had been hacked. It’s the second action taken by the FTC against a spyware maker; the first was Retina-X, after the company was hacked several times and eventually shut down.

If you or someone you know needs help, the National Domestic Violence Hotline (1-800-799-7233) provides 24/7 free, confidential support to victims of domestic abuse and violence. If you are in an emergency situation, call 911. The Coalition Against Stalkerware also has resources if you think your phone has been compromised by spyware. This reporter can be reached on Signal and WhatsApp at +1 646-755-8849 or [email protected] by email.

Buried deep in President Joe Biden’s 2021 tax plan are new amendments to the United States’ Qualified Small Business Stock (QSBS) program, which, if passed, will directly impact early-stage startup employees, founders and investors.

Lawmakers say the proposed changes to QSBS are designed to raise taxes on America’s millionaires and billionaires. But the net they’re casting is so wide that it will undoubtedly catch rank-and-file startup employees, who can easily (and temporarily) find themselves pushed into the country’s top tax bracket if they exercise stock options or sell their shares.

Congress should immediately reconsider these changes.

We fear that these unintended consequences could choke innovation and harm a small group of people while raising what will amount to a rounding error’s worth of new tax revenue for the federal government.

If you’ve exercised stock options in an early-stage startup at any point in the last five years, the proposed QSBS change may affect you when you decide to sell your shares in an exit. You might even be holding QSBS-qualifying stock without even knowing it.

Lawmakers want to reduce the QSBS gain exclusion rates to 50% for people who report more than $400,000 in adjusted gross income in a single year, and trusts and estates holding QSBS shares.

The QSBS exemption was initially enacted in 1993 as a tax incentive for small business owners, their investors and early employees.

Most technology startups begin life as QSBS-qualifying companies, and there can be significant tax benefits to founders, early-stage investors and early employees if they earn or exercise stock options during a startup’s earliest years.

For example, let’s imagine an engineer who joins a seed-stage software startup and is granted 200,000 stock options at $1 per share. The engineer exercises their stock options early, while the company has raised less than $50 million in venture capital.

Six years later, the startup gets acquired, and the engineer’s 200,000 shares are now worth $10 million.

Under current tax law, the engineer would be able to avoid paying an estimated $2.3 million in federal capital gains taxes under the QSBS exemption — $1.96 million in long-term capital gains (20%), and $372,400 in Net Investment Income Tax (3.8%).

Under the proposed changes to the tax code, the engineer would only be able to exclude federal capital gains taxes on half of their profits using the QSBS exemption.

The remaining $5 million would face taxes of nearly $1.6 million — $1.25 million in long-term capital gains (25% under the current proposal), $190,000 in Net Investment Income Tax (3.8%) and $150,000 of a newly proposed high-income surcharge tax.

Congress says they’re targeting America’s wealthiest people by rolling back the QSBS exemption.

In practice, the QSBS exemption has been popular with startup founders, investors and startup employees — people who take significant financial risks to fuel the startup ecosystem. QSBS was originally designed to reward those of us who drive the country’s innovation engine.

Effectively chopping this tax exemption in half will needlessly choke the innovation ecosystem, while raising an estimated average of $570 million per year in new tax revenue over the next decade, according to an analysis of federal data by QSBS Expert. That’s an inconsequential amount compared to the nation’s $3.5 trillion infrastructure plan.

The result will be a slight uptick in new federal revenue, taken from a relatively small group of people working in the innovation economy, and not worth the potential damage to startups. The QSBS exemption must be protected.

(Note: QSBS only applies to a specific set of small businesses and startups and requires people to earn or exercise their stock options while the company is still relatively small, and hold onto their shares for at least five years before selling them. Work with a CPA to find out if your shares qualify.)

Read 17 remaining paragraphs | Comments

Read 9 remaining paragraphs | Comments