• 
• 
• 
• 
• 
• 

 1 of 6

Gallery

The DIY spy

Posted on 11 Feb 2009 at 15:03

Unfortunately, my editor is a little reluctant to fund an espionage expedition to North Korea, so I fix on a target a little closer to home. The production desk. These are the people who rearrange our words so they actually make sense. Needless to say, they're not short of a document or two. I hone in on a stack of proofs in the corner, and pounce the moment they're abandoned for a coffee break. The DocuPen switches on when you begin dragging it across a surface, with a red cross flashing to let you know when you're moving too fast.

Since that's the only hint regarding the image quality, there's no way to know whether you've scanned gems or gibberish until you download the 4GB of internal flash memory to a computer. The manufacturer claims it will happily scan an A4 document at 400dpi in only four seconds, and I managed to scan eight sheets before being rumbled. It turns out four seconds isn't enough, if you plan to get anything comprehensible. Giving myself about eight seconds per page produced perfectly legible scans, but at that pace you're not going to be downloading any dossiers.

Of course, if you can intercept the document while it's being typed, you need never bother with a document scanner, which is where the hardware keylogger comes in handy. If anything, this 2in lump of grey plastic is even less impressive-looking than the DocuPen, but it's a necessary blandness. The keylogger sits between the keyboard and computer, quietly noting every keystroke made on that machine and saving the data to its 64KB internal memory, enough for about 65,000 keystrokes. Unlike software keyloggers, the hardware variety starts recording the moment the machine is switched on, rather than when the operating system boots, meaning it also records BIOS passwords and other login information. A hardware keylogger also has the advantage of not being picked up by antivirus software, making it undetectable, unless somebody happens to glance around the back of the machine.

Wary the production staff might be on to me, I decide to take my operation beyond the office, and target a friend working from home. I ask her permission early one morning, singularly failing to mention I planted the device five minutes beforehand, and return that night to collect the device: a ten-second job to which she's none the wiser. Pulling up the captured data is a simple matter of typing a password into a document editor, which brings up a menu of commands allowing you to search the text or wipe the memory for another day's snooping.

Given how long the technology has been knocking around, it isn't surprising it works. It's how well it works that's alarming. I've collected usernames and passwords, several half-typed essays, dozens of individual corrections, bank card details, emails, Facebook status updates and Google searches. And bear in mind, this is the most basic model. The more advanced versions can wirelessly transmit captured information, or even be installed within the keyboard itself. But while keyloggers are now inextricably linked with malware, according to Julia, the most common purchaser of the hardware version has entirely different motivations: "We get a lot of parents coming in, worried about their children. Especially older children who are locked in their room on the computer by themselves, and the parents have no idea what's going on. They've tried talking, but aren't getting anywhere, they just want to know they're safe, that they're communicating with safe people."