Who is causing the harm or doing the surveillance?¶
Who is behind the harm? The answer is not always obvious. It is not just “bad people doing bad things online.” It is a cast of characters, from central figures to silent enablers. Some act deliberately; others simply leave doors open. All contribute to the harm.
Abusive partners (past or present)¶
The central figure in this story. Not a mysterious figure in a basement, but someone who knows your voice, your habits, your weak spots, and probably your PIN.
They may have had full access to your devices and accounts, often with your knowledge and trust. That access may have never been revoked. In many cases, the phone was a gift, the router was installed by them, or the login to your email is in a shared notes app “just in case.”
Their advantage is not primarily technical. It is relational. They know what you will click on. They know how to talk you round. They may justify surveillance as concern, control as care, or financial interference as protecting you.
Importantly: this applies to both current and former partners. In fact, some of the most serious abuse begins after someone has left.
What they realistically have¶
The capabilities available to an abusive partner are worth stating plainly, because they are different from most adversary models.
Knowledge: they may know your passwords (old and possibly current), the answers to your security questions, and which accounts you use for which purposes. They may know your recovery email address and your phone number. They may have watched you enter PINs.
Access: they may have active logged-in sessions on devices you no longer control. They may share accounts (streaming services, cloud storage, family plans) that were never properly separated. They may have had brief physical access to a device recently, even if you did not know it.
Tools: stalkerware or repurposed “parental control” applications; social engineering and impersonation; AI tools for voice cloning and image generation; access to data brokers and people-search sites.
Influence: the ability to contact your employer, your friends, your family, or official services. The ability to shape a narrative in which they appear as the concerned party, and you appear unstable, unreliable, or dishonest.
Third-party enablers¶
Abusers rarely act alone. They are aided, sometimes knowingly, sometimes not, by others who provide tools, access, or legitimacy.
Stalkerware vendors market apps under the banner of parental control or employee monitoring. Their real market is often intimate partner surveillance, and their product design reflects it.
Private investigators are sometimes hired to track someone or dig up data. There is a grey market of operators who specialise in monitoring former partners.
Friends, family members, or mutual contacts may be drawn in: some willingly, others manipulated. They may pass on information, share posts, or help with access without realising what they are contributing to.
The abuser controls the narrative. Everyone else plays a supporting role, often without knowing it.
Malicious actors (opportunists)¶
Not connected to the abuser, but still dangerous. If your accounts were set up with weak security during the relationship (no two-factor authentication, shared or reused passwords), they become accessible to anyone. A breach of one platform can cascade to others.
The opportunist does not care about your relationship. They care about leverage: credit card details, compromising content, account access they can sell or exploit. But the effect on you is the same.
Platforms and services¶
Not people, but powerful actors. Technology companies build systems that assume everyone in a household is on good terms, and those assumptions become vulnerabilities in abuse contexts.
Platforms routinely:
Enable family sharing or location sharing without meaningful consent mechanisms
Hide security settings behind confusing menus
Default to convenience over privacy
Make removing someone else’s access look like deleting your own account
Provide little or no useful information about who has accessed what, and when
This is not malice. It is neglect. They have designed for the easy case. When abuse enters the picture, those same design choices quietly support it.
A word on this section¶
Understanding who is involved is not about fear. It is about clarity. Who has access? Who benefits from that access? And who is propping it up, even without knowing it?
Once you can see who is in the room, digitally or otherwise, you can start making decisions about how to change that. One account. One setting. One step at a time.