Although for our purposes, keyloggers operate in the context of malware, they are not always illegal to install and use. Keyloggers are a common tool for corporations, which IT departments use to troubleshoot technical problems on their systems and networks—or to keep an eye on employees surreptitiously. The same goes for, say, parents, who want to monitor their children’s activities. Suspicious spouses are another market for keyloggers.
In all such cases, if the organization or person downloading and installing the keylogger actually owns the device, then it’s perfectly legal. And there are thousands of commercially available keyloggers on the Internet, which advertise themselves for just such a use.
However, the concern about keyloggers is when malicious actors are behind them. And they definitely do not own the device they infect. You don’t know they’ve breached your computer; and depending on what kind of keylogger it is, it can steal any passwords you’ve entered, periodically take screen shots, record the web pages you view, grab on to your sent emails and any instant messaging sessions, as well as sensitive financial information (such as credit card numbers, PIN codes, and bank accounts), and then send all that data over the network to a remote computer or web server. There, the person operating the logging program can retrieve it all, potentially sending it to third parties for criminal purposes.
In all such cases, if the organization or person downloading and installing the keylogger actually owns the device, then it’s perfectly legal. And there are thousands of commercially available keyloggers on the Internet, which advertise themselves for just such a use.
However, the concern about keyloggers is when malicious actors are behind them. And they definitely do not own the device they infect. You don’t know they’ve breached your computer; and depending on what kind of keylogger it is, it can steal any passwords you’ve entered, periodically take screen shots, record the web pages you view, grab on to your sent emails and any instant messaging sessions, as well as sensitive financial information (such as credit card numbers, PIN codes, and bank accounts), and then send all that data over the network to a remote computer or web server. There, the person operating the logging program can retrieve it all, potentially sending it to third parties for criminal purposes.