Slashdot Mirror


Palm Pre Reports Your Location and Usage To Palm

AceJohnny writes "Joey Hess found that his Palm Pre was ratting on him. It turns out the Pre periodically uploads detailed information about the user to Palm, including the names of installed apps, application usage (and crashes), as well as GPS coordinates. This, of course, is without user consent or control. The only way he found to disable the uploads was to modify system files."

11 of 314 comments (clear)

  1. User Consent ... by neonprimetime · · Score: 5, Informative

    Story says...

    This, of course, is without user consent or control.

    But From Palm Infocenter, they say

    Palm's own "Terms and Conditions" statement, along with their Privacy policy, detail that Palm basically maintains it has the right to indefinitely collect, process, store and share this information. Users must accept this multipage collection of fine-print waivers and disclaimers in full during the initial device setup process before being able to utilize the device.

  2. Re:Oh no! Automated Dr. Watson by Nazlfrag · · Score: 5, Informative

    It's not just crash data. It sends that too, but it also uploads your GPS coordinates daily along with the app use data (what you've used and for how long) according to TFA. It's customer profiling, not bug testing.

  3. Re:Boycott by keithjr · · Score: 5, Informative

    Seems like the only phone you'd be able to buy with this requirement would be an OpenMoko device. Maybe an Android phone if it's mostly open source.

    Closed source and closed hardware devices mean these little surprises will continue to happen.

  4. Re:Oh no! Automated Dr. Watson by digsbo · · Score: 5, Informative

    Wrong. The cell id (tower identifier) is available from the GSM module without knowing the GPS coordinates. In fact, with multiple local towers, you might incorrectly guess which tower is being used based on lat/lon, since they may handover (pass your call from one tower to another) for a variety of reasons, including capacity.

  5. Re:Did it not occur to PALM that this is BAD? by John+Hasler · · Score: 5, Informative

    > Likely there will be no repercussions whatever.

    Right. You'll whine and whine, but you'll keep right on buying the stuff.

    --
    Warning: this article may contain humor, sarcasm, parody, and perhaps even irony. Read at your own risk.
  6. Re:Yea, and.... by rm999 · · Score: 5, Informative

    "Hell, I thought all phones did this anyway"

    Running the GPS on a phone eats up the battery, I wouldn't assume any phone company would be purposefully sabotaging the battery life of its own products to piss off its customers.

    And tracking of cell phones has come up in the past, and is generally quite controversial: http://www.insidetech.com/news/articles/2299-controversial-study-tracks-movement-via-cellphones

    I honestly don't know why Palm thought it could get away with it without some outrage. Especially when it has such a steep hill ahead of it already.

  7. TFA Text by AceJohnny · · Score: 5, Informative

    Woops, looks like /. is hammering the server. Here's a copy of the text (as of now):

    I've been taking a closer look at the WebOS side of my Palm Pre tonight, and I noticed that it periodically uploads information to Palm, Inc.

    The first thing sent is intended to be my GPS location. It's the same location I get if I open the map app on the Pre. Not very accurate in this case, but I've seen it be accurate enough to find my house before.

    { "errorCode": 0, "timestamp": 1249855555954.000000, "latitude": 36.594108, "longitude": -82.183260, "horizAccuracy": 2523, "heading": 0, "velocity": 0, "altitude": 0, "vertAccuracy": 0 }

    Here they can tell every WebOS app I use, and for how long.

    { "appid": "com.palm.app.phone", "event": "close", "timestamp": 1250006362 }
    { "appid": "com.palm.app.messaging", "event": "launch", "timestamp": 1250006422 }
    { "appid": "com.palm.app.messaging", "event": "close", "timestamp": 1250006446 }

    It sends the above info on a daily basis.

    2009-08-10t09:15:10z upload /var/context/pending/1249895710-contextfile.gz.contextlog ok rdx-30681971
    2009-08-11t09:15:10z upload /var/context/pending/1249982110-contextfile.gz.contextlog ok rdx-31306808

    There is also some info that is recorded when a WebOS app crashes. Now, I've seen WebOS crash hard a time or two, but it turns out apps are crashing fairly frequently behind the scenes, and each such crash is logged and a system state snapshot taken. At least some of these are uploaded, though if things are crashing a whole lot it will be throttled.

    2009-08-09T17:01:22Z upload /var/log/rdxd/pending/rdxd_log_59.tgz OK RDX-30246857
    2009-08-09T17:05:36Z upload /var/log/rdxd/pending/rdxd_log_26.tgz OK RDX-30249465
    2009-08-09T17:09:11Z upload /var/log/rdxd/pending/rdxd_log_56.tgz OK RDX-30252374
    2009-08-09T17:11:46Z upload /var/log/rdxd/pending/rdxd_log_70.tgz OK RDX-30253958
    2009-08-09T17:16:29Z upload /var/log/rdxd/pending/rdxd_log_67.tgz ERR_UPLOAD_THROTTLED_DAILY
    2009-08-09T17:17:28Z upload /var/log/rdxd/pending/rdxd_log_51.tgz ERR_UPLOAD_THROTTLED_DAILY
    2009-08-09T17:20:40Z upload /var/log/rdxd/pending/rdxd_log_21.tgz ERR_UPLOAD_THROTTLED_DAILY

    Each tarball contains a kernel dmesg, syslog, a manifest.txt listing all installed ipkg packages (including third-party apps), a backtrace of the crash, a df (from which they can tell I'm using Debian on the phone), and ps -f output listing all processes owned by root (but not by joey).

    The uploading is handled by uploadd, which reads /etc/uploadd.conf:

    [SERVER=rdx]
    RepositoryURL=https:///palmcsext/prefRequest?prefkey=APPLICATIONS,RDX_SRV
    UploadURL=https:///palmcsext/RDFileReceiver

    [SERVER=context]
    RepositoryURL=https:///palmcsext/prefRequest?prefkey=APPLICATIONS,RDX_SRV
    UploadURL=https:////palmcsext/RDFileReceiver

    The "HOST" this is sent to via https is ps.palmws.com.

    My approach to disable this, which may not stick across WebOS upgrades, was to comment out the 'exec' line in /etc/event.d/uploadd and reboot. However, then I noticed a contextupload process running. This is started by dbus, so the best way to disable it seems to be: rm /usr/bin/contextupload

    BTW, since Palm has lawyers, they have a privacy policy, which covers their ass fairly well regarding all this, without going into details or making clear that the above data is being uploaded.

    --
    Misleading titles? Inflammatory blurbs? Keep in mind that Slashdot is a tabloid.
  8. article on precentral.net (soon to be slashdotted) by tony.damato · · Score: 4, Informative

    http://www.precentral.net/fyi-pre-reports-your-location-palm

    When PreCentral's people asked Palm about this, their official statement to them in part was:

            Our goal has been to follow industry best practices on data collection, use, and encryption. Like most EULAs and privacy policies, though, the terms tend to get pretty detailed about potential scenarios. And because the terms are meant to notify users about all possible variations, we wanted to err on the side of over notifying rather than under notifying users through the terms of use. So there's really nothing here "beyond the norm" for a EULA or privacy policy.

            The provision you've quoted explains why Palm might collect user information. For example, we collect and transmit users' email addresses, email content, contact lists, etc. to provide WebOS services such as back-up and restore for the purpose of backing up that data and helping users restore the data if needed (in that case, it would not be limited to just the email address collected at registration). If users someday make purchases on their device through the Apps Catalog, then we would also collect payment information to process the transaction.

            At all times, we'd be strictly bound by our privacy policy. Our privacy policy, like virtually all others in the industry, contemplate our using data to provide services users have requested, improve our products and services (hence the reference to Palm's own "sales and marketing" in the privacy policy), troubleshoot, etc. We also refer to affiliates because Palm is a global company, and we may need to transmit data from our European subsidiary to the parent company. We're obviously not a conglomerate with many different subs and affiliates, but the terms specifically mention subs and affiliates so that we can comply with European data protection laws that require us to spell out that data collected by a European sub can be transmitted to another part of the company.

  9. Re:Apps installed OK, crashes OK, location - HELL by Otto · · Score: 4, Informative

    Actually, it's the cellular companies that want that data more. By having the phones report back on position and cell tower ID strengths, they can more easily map "dead zones" in their coverage areas, telling them where to put new towers to hit the most people.

    --
    - Give a man a fire and he's warm for a day, but set him on fire and he's warm for the rest of his life.
  10. Re:Did it not occur to PALM that this is BAD? by Sandbags · · Score: 5, Informative

    hey, AT&T may have complied with illegal orders to provide wire taps, and even played some questionable moves to avoid prosecution, but lets place the blame where it really lies; the Bush Administration... AT&T was not the only company to comply with these orders, and was told quite explicitly, by judges, that the orders were in fact valid...

    AT&T may have broken the law, and violated the privacy of many (suspected crimainals/terorists) Americans, but they did so under a supposed legal authority and under orders to do so, and these wire taps (most of them) were actually for people accused or associated with active federal investigations. Palm is collecting personal information, it has NO association with any criminal activity and no basis in law, and they're doing it without informed concent, and without a way to disable the tracking, and wihtout support or order by the government, and I bet they're doing it without the Phone Company's knowledge too. (and if the phone company IS aware of it, they're FAR more guilty than AT&T is...

    --
    There is no contest in life for which the unprepared have the advantage.
  11. Re:Settings to disable by joey · · Score: 4, Informative

    So FWIW, I have "Background Data Collection" set to off, that did not stop the Pre sending those logs to Palm. I'm sure that that switch does prevent sending your location info to the Google, which makes it doubly unsettling that it's still sent to Palm, no?

    --
    see shy jo