Founder of spyware maker pcTattletale pleads guilty to hacking and advertising surveillance software

The founder of a spyware firm known for enabling intrusive surveillance on personal devices has pleaded guilty to serious federal charges related to his long-standing operations. Bryan Fleming, the mastermind behind pcTattletale, entered his guilty plea in a federal court in San Diego on Tuesday, admitting to charges of computer hacking, the unlawful sale and promotion of surveillance software, and conspiracy. This plea marks a significant development following an extensive investigation led by Homeland Security Investigations (HSI), a branch of U.S. Immigration and Customs Enforcement. The scrutiny of pcTattletale began in mid-2021 as part of a broader inquiry into consumer-targeted surveillance software, often referred to as "stalkerware." This case represents the first successful federal prosecution of a stalkerware operator in over a decade, reviving public and legal attention to the issue after the 2014 indictment of the creator of StealthGenie. Fleming’s guilty plea could signal a shift in federal enforcement against spyware operations and those involved in the marketing and distribution of such software. HSI noted that pcTattletale is just one of several stalkerware platforms currently under investigation. A spokesperson for ICE and representatives from the U.S. Attorney’s Office for the Southern District of California could not be reached for immediate comments. Since at least 2016, Fleming had been running pcTattletale, which allowed consumers to purchase software designed to track individuals and their data without consent. This type of surveillance is illegal in the U.S. and many other nations. The app required physical access to a target's device, often exploiting the victim's login credentials to upload sensitive information, including messages, photos, and location data, to pcTattletale's servers. Fleming shuttered pcTattletale in 2024 after a data breach compromised the company’s website and exposed a wealth of sensitive information belonging to both customers and their targets. The breach affected over 138,000 users, with stolen data reported on data breach notification platforms. Fleming later declared the company defunct, stating he had deleted server contents. Despite the closure, federal agents were already well into their investigation. HSI identified pcTattletale in June 2021 while examining a range of stalkerware websites. Unlike many competitors, pcTattletale openly advertised its software for "surreptitiously spying on spouses and partners," raising red flags for investigators. Fleming's operations, based out of Bruce Township, Michigan, were more accessible to U.S. law enforcement than those of many foreign stalkerware developers. Fleming was notably unreserved in promoting pcTattletale, featuring in videos that showcased his role as the company’s founder. HSI secured a warrant in 2022 to access Fleming's emails, uncovering evidence that he actively aided customers in their attempts to spy on non-consenting adults. Undercover operations further corroborated his involvement in promoting the spyware for illicit uses. By November 2022, agents had received judicial approval to search Fleming’s home, seizing various items and financial records reflecting over $600,000 in transactions related to his operations. Fleming has since sold the property for $1.2 million. His conviction is seen as a significant victory for privacy advocates who have long campaigned against the dangers of stalkerware. Eva Galperin, cybersecurity director at the Electronic Frontier Foundation and co-founder of the Coalition Against Stalkerware, remarked on the case's implications, highlighting the alarming prevalence of stalkerware businesses operating without fear of repercussions. Galperin expressed hope that this case would deter other stalkerware creators. Fleming's sentencing is anticipated later this year, marking a pivotal moment in the fight against unlawful surveillance practices.