Amazon has come under fire for its inaction against three phone surveillance apps, Cocospy, Spyic, and Spyzie, that are storing troves of individuals' private phone data on its cloud servers. Despite being notified by TechCrunch weeks ago, the tech giant has failed to take any meaningful action, sparking concerns over data privacy and security.

The three near-identical Android apps, which share the same source code and a common security bug, have exposed the phone data of approximately 3.1 million people, many of whom are victims with no idea that their devices have been compromised. The data, which includes photos, is being uploaded to storage servers run by Amazon Web Services (AWS), according to a security researcher who discovered the issue.

TechCrunch notified Amazon on February 20 about the issue, providing the names of the specific Amazon-hosted storage "buckets" that contain data taken from victims' phones. However, Amazon spokesperson Ryan Walsh responded by saying that the company was "following [its] process" and provided a link to an abuse reporting form, but would not comment on the status of the Amazon servers used by the apps.

In a follow-up email, TechCrunch again notified Amazon about the issue, but the company's response remained evasive. Amazon spokesperson Casey McGee claimed that it would be "inaccurate" to characterize the substance of the email thread as a report of potential abuse, despite TechCrunch providing specific details about the storage buckets used by the apps.

The inaction by Amazon is particularly concerning given the company's significant resources and technological capabilities to enforce its own policies. Amazon's acceptable use policy broadly spells out what the company allows customers to host on its platform, and it is clear that spyware and stalkerware operations are not permitted. However, Amazon appears to be disputing the procedural aspects of the issue rather than taking concrete action.

The incident highlights the importance of companies taking responsibility for ensuring that their platforms are not used to facilitate illegal activities. Amazon's failure to act in this case raises questions about its commitment to protecting user data and its willingness to hold its customers accountable for violating its terms of service.

TechCrunch's investigation into the stalkerware operations involved analyzing the apps themselves, which revealed that they were uploading victims' data to Amazon's cloud servers. The investigation also identified the real-world identities of the surveillance operators and the platforms used to facilitate the surveillance.

The incident is a stark reminder of the risks associated with stalkerware and the importance of companies taking proactive steps to prevent the misuse of their platforms. It is not uncommon for companies to suspend accounts or remove data that violate their terms of service, and Amazon's inaction in this case is particularly egregious.

If you or someone you know needs help, the National Domestic Violence Hotline (1-800-799-7233) provides 24/7 free, confidential support to victims of domestic abuse and violence. If you are in an emergency situation, call 911. The Coalition Against Stalkerware has resources if you think your phone has been compromised by spyware.

The incident serves as a wake-up call for companies to take responsibility for ensuring that their platforms are not used to facilitate illegal activities. It is imperative that Amazon takes concrete action to address this issue and prevent similar incidents in the future.