James N. Johns, Jr. was the owner of Retina-X Studios, LLC, a Florida-based company that developed and sold "stalkerware" apps — MobileSpy, PhoneSheriff, and TeenShield — marketed for monitoring children and employees. The Federal Trade Commission (FTC) alleged the apps could be installed covertly, without notice to the device user, and could be configured to hide their icon so the person being monitored would not know the app was present. Installing the apps required bypassing manufacturer security protections (jailbreaking or rooting the device), and once installed the apps collected text messages, emails, phone calls, GPS location, browsing activity, contacts, and photos.
The FTC also alleged that Retina-X failed to secure the data it collected. The company's systems were breached twice, in 2017 and 2018, with hackers obtaining usernames, encrypted passwords, messages, location data, contacts, and photos belonging to both purchasers and the people they were monitoring; in the 2017 breach, the FTC learned of the incident only after a journalist contacted the company following a tip from a hacker. Retina-X had sold more than 15,000 subscriptions before discontinuing the apps in 2018.
On October 22, 2019, the FTC announced a settlement with Retina-X and Johns — the agency's first enforcement action against a stalkerware developer. The Commission voted 5-0 to accept the settlement, which bars the company from selling monitoring products until it can show they will not be used for illegal purposes, requires purchasers to attest their intended use is lawful (monitoring only children, employees, or consenting adults), requires any app icon to be visible on the device screen, prohibits requiring jailbreaking or rooting for installation, requires deletion of previously collected data within 120 days, and requires Retina-X to implement an information security program with biennial third-party assessments and annual compliance certifications. The FTC also alleged violations of the Children's Online Privacy Protection Act (COPPA).
"Although there may be legitimate reasons to track a phone, these apps were designed to run surreptitiously in the background and are uniquely suited to illegal and dangerous uses."
-- Andrew Smith, Director, FTC Bureau of Consumer Protection, October 22, 2019
