Android Dev Demonstrates CarrierIQ Phone Logging Software On Video

Token_Internet_Girl writes with a followup to last week's news about Android developer Trevor Eckhart, who was researching software from CarrierIQ, installed on millions of cellphones, that secretly logged a variety of user information — from button presses to text message contents to browsing data. CarrierIQ tried to silence Eckhart, but later backtracked. Now, Eckhart has posted a video demonstration of CarrierIQ's logging software. From the article: "The company denies its software logs keystrokes. Eckhart’s 17-minute video clearly undercuts that claim. ... The video shows the software logging Eckhart's online search of 'hello world.' That's despite Eckhart using the HTTPS version of Google, which is supposed to hide searches from those who would want to spy by intercepting the traffic between a user and Google. ...the video shows the software logging each number as Eckhart fingers the dialer. 'Every button you press in the dialer before you call,' he says on the video, 'it already gets sent off to the IQ application.'"

Comments

Can't someone sue the carriers?

[Anonymous Coward]

There is an asymmetry in the system as it works right now. Which private customers have the will, time, and money to sue companies that illegally wiretap their customers? Isn't there anything that can be done against this? (Of, I'm talking about action against CarrierIQ but about action against the carriers that use their software.)

Re:Can't someone sue the carriers?

[fsckmnky]

companies that illegally wiretap their customers

Therein lies the rub. In order to use your cellphone/smartphone, you have to sign the carriers agreement, and in the carriers agreement, there is undoubtedly a clause where you give them permission to collect your data and use it as they see fit. This makes the data collection legal, not illegal, as you agreed to it.

Nothing short of privacy regulation specifically forbidding carriers to use this information, or at the very least, allowing you to specify that you would like your data to remain private, will prevent this practice from being standard, as the monetary incentive is to collect the data. Corporations have an obligation to protect and grow shareholder value, no matter how many advertisements they run claiming "We care about our customers."

Re:Can't someone sue the carriers?

[Theophany]

A contractual agreement to something deemed illegal does not overrule the law.

If a judge found the activity to be unlawful, which I suspect is where the core of the issue rests, then whether or not there was a contractual agreement is irrelevant. I see no reason for a carrier's data collection policy to include keylogging everything a customer does outside of extenuating circumstance (suspected terrorist or something).

Re:Can't someone sue the carriers?

[GPLHost-Thomas]

you have to sign the carriers agreement, and in the carriers agreement, there is undoubtedly a clause where you give them permission to collect your data and use it as they see fit

That would seem right, but only for the time of the contract. What if, as in the video, you have a phone which isn't bound to a contract anymore, and still spying on you?

Re:Can't someone sue the carriers?

[Anonymous Coward]

There is a difference between collecting behavioral data about someone using a cellphone and secretly installing spyware that records everything you do.
The first is something an informed customer can anticipate on when buying a phone and signing a contract. The second goes far beyond what is reasonable to expect when using a phone.

I am pretty sure that a carrier in the EU would open itself up for criminal charges if they tried to pull a stunt like this.

Re:Can't someone sue the carriers?

[Serpents]

The EU finally admitted that nobody reads ToS and it's going to curb such practices.

Re:Can't someone sue the carriers?

[fsckmnky]

A contractual agreement to something deemed illegal does not overrule the law.

It is not illegal, for you to agree, to the carriers collection of the data, which is why regulation specifically making it illegal, or spelling out your rights, is required to stop it.

I see no reason for a carrier's data collection policy to include keylogging everything a customer does outside of extenuating circumstance (suspected terrorist or something).

Yes, you, like myself, see no reason "to allow" carriers to collect this data. That said, a carrier has "every incentive to collect" this data. It has commercial value. They can sell it to the government / police for investigative purposes, they can data mine it in order to find hidden value, and every bit of data sent can be counted towards your monthly usage cap, thereby, increasing the odds that you will run over and incur additional charges.

Please understand I am not arguing on behalf of carriers, merely attempting to point out the reality of the current environment. I don't own a smart phone, as I am aware that the reality of it, is that, I am paying to be spied on.

Re:Can't someone sue the carriers?

[fsckmnky]

Kudos. Lets hope the rest of the world adopts a sane, fair approach.

Re:Can't someone sue the carriers?

[fsckmnky]

Certainly, the army of attorneys at the disposal of the carriers, has been careful to word the agreement such that your scenario also applies.

Re:Can't someone sue the carriers?

[fsckmnky]

I should add, that the moment I heard that Google was releasing a smartphone OS aka Android, my first thought was "Nice. Now google can spy on everyone when they are away from their computer and follow their movements in the physical world."

Beware of free ice cream from pimply faced CEOs of publicly traded corporations who claim to have your best interests in mind.

This situation is only going to get worse. The same data collection practices concerning smartphones are being adopted by car manufacturers, and Google wants to use event data that your spiffy new car collects, in order to "predict" and "suggest" a route for you to travel. Do you really think Google ( and other companies active in this area ) are doing all this work for free because they like you ?

http://media.ford.com/article_display.cfm?article_id=34591

Re:Can't someone sue the carriers?

[CmdrPony]

Yep. This is why I will never get an Android device or use Google+. They want to spy, and they spy everything. On top of that, other companies will start to feel that it's ok to do. If the practice can continue without interruption, we will all lose privacy. It's funny how everyone always fights losing privacy to the government. Google, Carrier IQ and the companies are just middle hands for that!

Re:Can't someone sue the carriers?

[fsckmnky]

Indeed. If the government began a program to spy on everyone domestically, it would undoubtedly cause a huge uproar, and likely be deemed unconstitutional ( at least I hope it would be deemed as such. )

But if companies collect the data, then the government can simply request the records, and pay the company a fee for retrieving them, as part of an "investigation."

Web search ... "what are you interested in ?"
Web analytics ... "what sites are you visiting ?"
Friends lists ... "who do you know / communicate with ?"
Mapping ... "where are you going ?"
GPS / wi-fi detection .... "where are you at right now ?"
SMS ... "what have you said to whom ?"

Welcome to the matrix. Good luck flushing yourself from it.

Re:Can't someone sue the carriers?

[Anonymous Coward]

Carrier IQ DENIES that they are recording keystrokes. They deny this right now, on their website in a PDF, that is linked to right at the top of their home page:
"While we look at many aspects of a device’s performance, we are counting and summarizing performance, not recording keystrokes or providing tracking tools. The metrics and tools we derive are not designed to deliver such information, nor do we have any intention of developing such tools."

So even if our agreement with the carrier permits logging/capturing of this data, it doesn't allow you to LIE about doing it. Their software clearly logs data. We don't know if it keeps that data or transmits it back to anyone. But the data is clearly being captured in some fashion as demonstrated by the video.

Re:Can't someone sue the carriers?

[demonlapin]

Just because you no longer have an early termination fee doesn't mean that you're no longer under contract; you're still operating under the same terms as before except that you can cancel service at any time. Glance at click-through licenses some time; they say things like "use of this device constitutes..." rather than "use of this service constitutes..."

Re:Can't someone sue the carriers?

[fsckmnky]

Carrier IQ DENIES that they are recording keystrokes.

They aren't recording "keystrokes" .... they are recording "event data" of which, keystrokes are merely a sub-class of events. It's not a lie, just like when Bill Clinton told everyone "I did not have sexual relations with [Monica Lewinsky]." He didn't have sexual relations, as in, intercourse, he just played around with a cigar.

So even if our agreement with the carrier permits logging/capturing of this data, it doesn't allow you to LIE about doing it.

As argued above, they are not "lying." They are simply being extremely technically specific in their statements.

We, as private citizens, need to get better at reading between the lines, as that is where the truth is, in order to protect ourselves from the non-lying-liars.

Re:Can't someone sue the carriers?

[sociocapitalist]

IANAL but my understanding is that there can be clauses in contracts that are considered 'enforceable'. Perhaps someone who is a lawyer could opine on whether such a clause can protect a carrier or not?

Re:Can't someone sue the carriers?

[gl4ss]

there's a LOT of things you can't just ask consumers for permission on the TOS and then go "nanananan it's legit you signed the contract!".
same thing applies to that you can't sign away your career through non-competes even if some employer wants you to believe so.
I wonder why so many people nowadays think that such clauses and shenigans are legit? is it because people read donald duck comics where they serve as plot devices? usury is illegal too - even if someone writes a contract for it(fyi uncle scrooge performs usury all the time on donald).

if it were legal to write any fucking kind of contract you want we would all be living in some crazy dystopia where everybodys life was determined by contracts written and signed before the person was even born(that would be pretty much what sucked about the middle ages).

furthermore, corporations don't have obligations to fuck up their value - corporations obligations to it's shareholders are defined by the corporation itself and legalities. starting a fucked up route like installing carrierIQ is actually something they should notify their shareholders of, because it's such a fucked up business decision in the first place and only serves to move money _away_ from the operator. I wouldn't be too surprised if cIQ had gone around offering coke'n'hoes equivalent to operator executives(in the mobile world because people are so lame the equivalent is just offering them a chance to booze off for the weekend).

but even then there's no mention of carrierIQ sw on their TOS and no mention on their data plans that portion of it will be used just for tracking what they do.

so do you really think it would be legal for at&t to start generating traffic using cIQ and place all their customers to 1 million dollar debt by leaving it to transfer data all night long? that's what you're implying the tos would allow them to do and what they _should_ do "to increase shareholder value" . it's just ridiculous. they should be busted for this. this if anything is a good example why the carriers shouldn't be the device providers! make a law against it. it's easy.

Re:Can't someone sue the carriers?

[Grave]

I am pretty sure that a carrier in the EU would open itself up for criminal charges if they tried to pull a stunt like this.

Welcome to America, where corporations are protected like deities, and the average citizen is expected to forfeit any and all rights.

Re:Can't someone sue the carriers?

[alostpacket]

While I agree with the spirit of your rant, AT&T did just show us this past spring that we might already be in such a dystopia. They challenged a customer's right to partake in a class-action lawsuit (when a customer had signed an binding arbitration contract. AT&T took it to the supreme court and won.

Re:Can't someone sue the carriers?

[sirdude]

So, what device do you use?

I'm curious to know why Apple is never implicated in such privacy and tracking discussions considering how they lock you down to their own software and services. IIRC, they were involved in a GPS tracking furore a few months ago which came to naught. CarrierIQ doesn't develop for the iOS. But if carriers want all phones to return "diagnostic" information, presumably the iPhone is also doing so.

Re:Can't someone sue the carriers?

[Goaway]

So, a third party had to make this spy app for the carriers because Google was not spying enough on users for their taste. And your conclusion is that Google is evil.

Re:Can't someone sue the carriers?

[Ash Vince]

Yep. This is why I will never get an Android device or use Google+. They want to spy, and they spy everything. On top of that, other companies will start to feel that it's ok to do. If the practice can continue without interruption, we will all lose privacy. It's funny how everyone always fights losing privacy to the government. Google, Carrier IQ and the companies are just middle hands for that!

But why single out Google? All smart phones are going to do crap like this so the only way to escape it is to only use products that are completely open and unlocked.

Bear in mind that this thread is not actually about anything Google can change, it is about some extra software that carriers (ie - AT&T, etc) are adding to android after google are done with it. There is very little you can do to avoid this as all the carriers are just as bad but you can at least not just blame google because they created an open phone platform that some other company wrote bad software for. Do you blame Apple for Mac IE5 being shit or Microsoft?

Re:Can't someone sue the carriers?

[fsckmnky]

there's a LOT of things you can't just ask consumers for permission on the TOS and then go "nanananan it's legit you signed the contract!". same thing applies to that you can't sign away your career through non-competes even if some employer wants you to believe so.

There is no law that I am aware of, that prevents private parties ( carrier and customer ) from agreeing to share information with each other. As for non-compete agreements, that is an entirely different issue ( legally ) than information sharing. It is voluntary for you to share, or not share, information with another party, while it is decidedly not voluntary for you to work and earn a living, unless someone else is working and earning a living to support you.

if it were legal to write any fucking kind of contract you want we would all be living in some crazy dystopia where everybodys life was determined by contracts written and signed before the person was even born(that would be pretty much what sucked about the middle ages).

I hate to break the news to you, but this is the world you live in now. Contracts are binding unless found all or in part ( under specific circumstances ) to be invalid by prior legislation or precedent.

because it's such a fucked up business decision in the first place and only serves to move money _away_ from the operator.

No. It increases shareholder value, up until the point where the public 1) becomes aware of it and 2) refuses to accept it and 3) finds the will to boycott the service. Unless all 3 of those things happen, the data collection is valuable, and enhances the bottom line.

so do you really think it would be legal for at&t to start generating traffic using cIQ and place all their customers to 1 million dollar debt by leaving it to transfer data all night long? that's what you're implying the tos would allow them to do and what they _should_ do "to increase shareholder value" . it's just ridiculous.

It is legal for AT&T to define "data usage" and "data caps" as "including data required to operate the service." As for whether they do this or not, cheCk your specific TOS. As an example of another industry that successfully did this, look at hard drive manufacturers. They have been claiming "300 Megabytes" when only "270 Megabytes" were in fact usable for over a decade now with much success.

As to your example of 1 million dollars in debt from carrier generated data streams, yes, that would cause the public to boycott the service and create lawsuits and bad debt. It is your extreme hypothetical abusive interpretation of the definitions that is ridiculous. In practice, this would optimally, from a revenue generation standpoint, be an amount that customers do not notice, whatever that amount may be.

I have not suggested carriers do anything, in any of my comments. I have merely attempted to explain the current ecosystem. No need to kill the messenger if you don't like the message.

Re:Can't someone sue the carriers?

[andydread]

Unfortunately for you it looks like you wont be owning Cell phone of any type. And I suppose you don't own one now. Almost every cellphone from certain carriers has CarrierIQ installed. THis has nothing to do with Google or the underlying operating system. Carrier IQ is crapware that is installed on phones by the CARRIER. And its on Nokia phones and blackberry's along with many many many feature phones. Apple has been tight lipped but don't be surprised if it is found on iphones either. They already have a client available for Iphones. So if the carrier choses to install it you are SOL.

Re:Can't someone sue the carriers?

[CmdrPony]

Currently, I use my old HTC Touch HD, which comes with Windows Mobile 6.2. The OS that was made before Microsoft also went the Apple and Google route because it was more profitable way. Before that I used Symbian phones, which either didn't come with none of this bullshit. Frankly, Asia and Europe (made by Asians) still has many manufacturers who understand this thing and I can get phone that suits me. Americans, not so much. But they managed to ruin the phone industry for all of us. Did you know in Europe and Asia, you buy the phone you want and then get the contract from telephone company you want, who are only competing with service prices, not with devices they offer? (at least were, until all this iPhone and Android bullshit)

Re:Can't someone sue the carriers?

[CmdrPony]

Because it's a practice Google started, by offering services and software free of charge in return of spying and data collection.

Re:Can't someone sue the carriers?

[andydread]

Oh how nice of you to lump Google into this. I wonder if you are just pro trolling, or some fanboy of some type. . THis event has nothing to do with Google. It is installed by the cell carrier and there are clients available to carries for ALL mobile operating systems and it has been found on other non Android phones. Nice attempt to smear Google with this one.

Re:Can't someone sue the carriers?

[CharlyFoxtrot]

Apple has been tight lipped but don't be surprised if it is found on iphones either. They already have a client available for Iphones. So if the carrier choses to install it you are SOL.

The carrier would have to convince Apple to make a special version of iOS for them because carriers cannot by themselves install unremovable crapware on iPhones. I'd like to see the carriers try this, I could use a good laugh.

Re:Can't someone sue the carriers?

[fsckmnky]

There are a few methods, that I am aware of, that might, although the legality of such methods I am unsure of, still allow for cell phone use while preventing this sort of spying from occurring.

One method, is to get a GNU Radio ( http://gnuradio.org/redmine/projects/gnuradio/wiki ) device and operate it as a cellphone carrier firewall. This would accept connections from your cell phone, log and allow you to filter what is being sent, and then communicate with your carrier.

The other method, would be to use a cellphone data device / mobile hotspot, and then operate your cell phone using encrypted VOIP to an Asterisk server in your home / office.

If there are other methods, by all means let everyone know about them.

Re:Can't someone sue the carriers?

[Maow]

doesn't mean that you're no longer under contract; you're still operating under the same terms as before except that you can cancel service at any time.

In the video, he explains he has a separate phone for development, without any mobile provider / SIM, which he also plays games on.

It was connected via Wifi. Every keystroke, HTTPS search, etc. was recorded and presumably uploaded to CarrierIQ or to ATT (or whomever).

His device is not of concern to any mobile operator.

That's a significant issue, and I doubt he'd be hard pressed to convince a lawyer to take it on.

(IANAL, etc.)

Re:Can't someone sue the carriers?

[InsaneMosquito]

What happens when you aren't under a service contract any more? I never turn my old phone over to the carrier when I upgrade. The previous one makes a good toy for the little kids in the family. It has no cell service. I do still connect it to the family wireless.

Re:Can't someone sue the carriers?

[Anonymous Coward]

Here's my idea: File a complaint with your state's attorney general.

Re:Can't someone sue the carriers?

[Gr8Apes]

I believe that should there be confidential transactions of any sort, such as client attorney privs, done over the phone that CIQ would log would be illegal regardless of whatever "contractual" terms you sign. After all, the phone is presented as a communications device, not a device to eavesdrop on everything you do.

Re:Can't someone sue the carriers?

[Anonymous Coward]

Yes that's the norm here, so far anyway. You mean it's not possible in the USA to get a mobile without a piggybacked connection sale as well?!? Oh well, we're getting there too... its just a matter of few more years.

Re:Can't someone sue the carriers?

[opposabledumbs]

Added to the fact that you can't have a contract for something that breaks the law is the legal principle that both parties have to be agreeing to the same contract - i.e. there has to be a meeting of minds on the terms of the contract.

Just saying that the carriers are going to collect data is not enough in my opinion, as the way in which this data is collected and the depth of of the data that is going to be collected was not spelled out. And that is for obvious reasons: not many people would willingly agree to this kind of gross invasion of privacy.

Let's hope that the judge that hears this case has a daughter with a phone that can be affected by this. Hell, and a mistress, too, that would really drive the point home and make it personal.

Re:Can't someone sue the carriers?

[chromas]

Other method

Re:Can't someone sue the carriers?

[CowTipperGore]

They aren't recording "keystrokes" .... they are recording "event data" of which, keystrokes are merely a sub-class of events. It's not a lie...

"While we look at many aspects of a device’s performance, we are counting and summarizing performance, not recording keystrokes or providing tracking tools."

While I appreciate your efforts at devil's advocate throughout this thread, you seem to have missed the mark on this one. It is immaterial that keystrokes are a sub-class of the event data they are collecting; it is a lie to say categorically that you are not collecting keystrokes when you are.

Re:Can't someone sue the carriers?

[Anonymous Coward]

This is insanity!
This is SPARTAAA!

Re:Can't someone sue the carriers?

[Anonymous Coward]

Google may have nothing to do with this particular issue, but don't tell me they're not watching everything we do with GMail or Google Search, because I won't believe it.

Power corrupts, and people who have information at their fingertips will use it, plain as day. Google said they're not evil, they never said anything about being nosy.

Re:Can't someone sue the carriers?

[delinear]

I hate to break the news to you, but this is the world you live in now. Contracts are binding unless found all or in part ( under specific circumstances ) to be invalid by prior legislation or precedent.

They might want you to believe that, but any contract still has to be able to withstand a test of reasonableness in court. Some might say a weasel worded contract by a multi-national company enabling them to spy on what you as a customer believed were encrypted transmissions potentially beyond the life of the contract is a tad one sided and might just possibly be deemed not worth the paper it's written on. Companies rely on most people not knowing their rights to be able to continually get away with this garbage.

Re:Can't someone sue the carriers?

[Anonymous Coward]

You can buy the iPhone unlocked, which means that the CarrierIQ can't be put on it since the simcard only has like 32KB of space.

Seriously, the entire thing is overblown, but it doesn't dismiss the issue as to why these keylogging tools are installed in the first place. It's overblown in a "Echelon" way, sure everything might be listened to, but we don't know if this data is being actively gathered and reported, or passively collected and datamined instead.

The former is the kind of problem Apple and Google already get into trouble with on Location services, because this data is being used sometimes without permission. The latter is less of a problem when you're google or facebook, since it's aggregate anonymous service datamining, not "oh joe blow is on, let's see what he does." But if you've been flagged for FBI investigations, maybe all your data is being sent directly to the FBI to datamine and see what you've been doing.

I rather question the purpose of this. It seems that it's only going to result in 1984 malicious use. China and Iran, nuff said.

Re:Can't someone sue the carriers?

[tomboalogo]

use a fuckin' payphone (stupid kids, get off my lawn!!!)

Re:Can't someone sue the carriers?

[CapnStank]

Depends on where you're from. In parts Canada we have privacy laws that state that if a company is going to receive private information from you they have to explicitly disclose how/where it will be used. Failure to notify the customer when you are about to use the data for an unintended purpose can weigh a hefty fine on the company.

Where the ambiguity comes in is where we draw the line as "private information". Is your conversation or web history considered private? You'd have to convince the courts should you take it that far.
Source: Ex-programmer for telecom provider within Canada from the billing and revenue software department. We had privacy laws rammed down our throat due to our access to production databases.

Re:Can't someone sue the carriers?

[gl4ss]

in general, in the west - that doesn't seem to include USA anymore - there's certain consumer rights and privacy expectations, you can't force consumers to waive warranty with shrink wraps.

having to have a telecoms operator isn't voluntary either, in the west it is regarded as a basic service that you can't just attach any clause you want to. you have to have a phone and it can't come with bigger privacy invasions than necessary. it's an utility.

I don't think shareholder value had anything to do with the decision to add cIQ. it was merely something that got sold to them and serves as purpose for some managers to exist within the operators as they now have something to manage, it decreases shareholder value and provides them with very little information they can actually use for anything. the relevant network performance information etc they already have - from the network itself. you did suggest that corporations just have to do this kind of crap, while they don't need to.

where does the shareholder value come from? conveniently in this case while cIQ provides lots of metrics the one metric it can't provide is value. if they(operator) in the business of selling information on which cells are busy during which time of day, traffic congestion information and such - this doesn't help them in that at all - and if they get caught selling your https connection statistics then they can only lose value from this. they already know who you're calling too.

cIQ exists because it's an easy product to make and was a seemingly easy sale to some bozos over at the operators without common sense or even understanding about how their networks operate.

by the intentionally generated billing coup at&t could, in a dystopia, take over the small building real estate of the nation they operate in. of course, in reality they wouldn't get away with it, consumer rights would stop them even in USA. forcing arbitration on consumers is something at&t should have been smacked for as that is a dangerous route as that just leads to donald duck contracts and courts.

(I suspect the real reason to include it on american operators is to spy if the user is tethering without a tethering plan, though)

Re:Can't someone sue the carriers?

[Anonymous Coward]

That practice started well before Google. They were just the first to do it really well.

Re:Can't someone sue the carriers?

[fsckmnky]

Have you tried to find a payphone in the US recently ? You practically need a smartphone with google maps to find one. ;)

Re:Can't someone sue the carriers?

[samkass]

I'm curious to know why Apple is never implicated in such privacy and tracking discussions considering how they lock you down to their own software and services.

It's pretty simple: because Apple doesn't do this. They had something that tracked recent position so a phone could home in on its current position on request faster, but when it was brought to light how long that cache was retained Apple fixed that bug. iOS now only keeps that information briefly.

Android is only "free" because it gets Google (an advertising company) information and opportunities to sell to advertisers. If you actually want to just buy the phone and use it as your own device, perhaps ironically Apple's controlled "walled garden" is a better choice. Apple's profit motive is not in the collecting of user information like Google's is, it's in the selling of devices. Anything that interferes with that, such as privacy concerns, is addressed.

Re:Can't someone sue the carriers?

[arkenian]

Because it's a practice Google started, by offering services and software free of charge in return of spying and data collection.

So ... one doesn't have to be THAT old to know that Google did NOT start this practice. Yahoo was doing it before Google, and there was geocities, which IIRC was before Google (or around the same time) and, heck, in the 90s there were dozens of fly-by-night dial-up ISPs who gave you free access in return for a marketing survey and permission to send you promotions. What was Google the first to do? Google was the first to do this DISCRETELY enough that it wasn't obnoxious to the user, and WELL enough that their 'targeted advertising' was sometimes even useful.

Re:Can't someone sue the carriers?

[fsckmnky]

where does the shareholder value come from?

Googles entire business plan and damn near 100% of its revenue comes from selling the data you enter while using a Google service.

Their current market cap is $188 billion dollars. That is how valuable usage data is.

Re:Can't someone sue the carriers?

[Hentes]

If they recorded only events that weren't keystrokes, then it wouldn't be a lie. But that is not the case.

Re:Can't someone sue the carriers?

[sunderland56]

I'm curious to know why Apple is never implicated in such privacy and tracking discussions.

CarrierIQ was discovered because it is a third party program - and so it shows up in the Android debugger. Much of Android is open source, so even if it did not, people could write their own debuggers to expose it.

Apple develops the hardware, the OS, and the debugger - and it is all closed source. If they wanted to build complete tracking into the kernel, and not have it show up in the debugger at all, they could. So - how do you know that they didn't? Just because nobody has exposed it yet, does not mean that it does not exist.

Re:Can't someone sue the carriers?

[TheGratefulNet]

google ALLOWED it. they allowed this crap.

like apple, they could have owned the phone companies. they had the hot product and they could have dictated 'do not be evil to our customers!' to the phone companies.

they did not.

they sat, smiled and PLANNED all the privacy invasion they will 'enjoy' over the next 5 years.

do no evil is like 2 wolves and a sheep arguing over what (who) is for dinner.

'do no evil' is the most pathetic lie that so many of us have (in the past) fallen for.

we now know that neither 'smart phone' (apple or android) is really trustable. yeah, you can root them but you lose a LOT of the benefit of the 'magic apps' (maps and so on) if you do root it. there's much less point of carrying a rooted phone around since the value of the phone IS the apps. most worthwhile apps don't work in a rooted environment (the google goodies, mostly). isn't that true?

so, you have to root your phone to make it safe again, and then you lose a lot of its value. great. might as well not carry one, then, I guess.

Re:Can't someone sue the carriers?

[fsckmnky]

Oh how nice of you to lump Google into this. I wonder if you are just pro trolling, or some fanboy of some type. . THis event has nothing to do with Google.

"How Google–and everyone else–gets Wi-Fi location data" http://www.zdnet.com/blog/networking/how-google-8211and-everyone-else-8211gets-wi-fi-location-data/1664

Check the mirror. There you will find your fan boy.

Re:Can't someone sue the carriers?

[mattcsn]

Is it possible to simply edit the hosts file on a rooted android phone to block carrier iq, or does it use ip addresses directly? Just rooting android is easier than doing the entire root/custom recovery/custom ROM dance for most people.

Re:Can't someone sue the carriers?

[fsckmnky]

What you and me consider to be a lie, or at least, deceitful, is entirely different, in what is required for a court to rule a statement as being a lie or fraud.

If the company issues the statement, claiming, keystrokes were not being collected, and the app was designed to not collect keystrokes, they can claim, that statement, was made, with the technical understanding, that event data was being collected, and not just keystrokes, and this would undoubtedly come out in any lawsuit or inquiry based upon the publics interpretation of the statement.

You and I can call it a lie, believe its a lie, feel strongly that we have been lied to, etc., but the odds of a court to rule they are lying are astronomical.

Re:Can't someone sue the carriers?

[Anonymous Coward]

Actually both the iOS kernel and the debugger are open source.

Re:Can't someone sue the carriers?

[kuhnto]

I am looking at this from the point of view of a large corporation that uses Carrier IQ infected hardware (Blackberry's) as part of doing buisness. There is a lot of proprietary, confidential information that falls outside of the scope of personal text messages. Insider trading comes to mind. In addition, as a employee of a large defense contractor that uses a LOT of blackberry's, I am sure there must be some rule of law that would prevent Carrier IQ from gathering ALL that information, from CEO down to engineer, and handing it over to another defense contractor.

Re:Can't someone sue the carriers?

[Hatta]

Correct. I do not and will not own a cell phone until it is Stallman approved. Which will be never.

Re:Can't someone sue the carriers?

[metalgamer84]

Rooting the phone is the biggest part of the battle. If you can root your phone, a custom ROM is mere seconds away. It was ridiculously easy to install Cyanogenmod on my Evo Shift and I will never go back to Sprint's factory ROM.

Re:Can't someone sue the carriers?

[blackraven14250]

Carrier IQ is simple to remove when flashing a new build of Android to your device. It's on every device forum on XDA.

Re:Can't someone sue the carriers?

[blackraven14250]

Carriers insist that manufacturers preload this on devices. How does that leave Google as the bad guy again?

Re:Can't someone sue the carriers?

[amicusNYCL]

It is not illegal, for you to agree, to the carriers collection of the data, which is why regulation specifically making it illegal, or spelling out your rights, is required to stop it.

Shatner, is, that, you?

Re:Can't someone sue the carriers?

[Dishevel]

That is kind of funny.
With all of the source code releases by Google so far and and all the guys out there customizing the OS not one that I have seen has found a key logger in Android.
Or are you just spreading FUD?

Re:Can't someone sue the carriers?

[Andy Dodd]

"like apple, they could have owned the phone companies. they had the hot product and they could have dictated 'do not be evil to our customers!' to the phone companies."
No, they were a newcomer in the market. In the portable device industry, they didn't have the clout that Apple had thanks to iTunes + iPod. As a result, Apple is still the only company that can successfully tell a North American carrier to fuck themselves.

And anyway - yes Google allowed it. The whole point of Android is its openness - unfortunately, on some devices, the carrier abuses that openness. Don't like it, go buy a Nexus.

Re:Can't someone sue the carriers?

[Anonymous Coward]

Yeah, Google collects anonymous location data. Just like Apple. And you're not singling Google out at all and it has everything to do with the topic of this article.

You should check your mirror for haters in there.

Seeing your inanities rise to +5 Insightful makes me wonder who're your alts/shill friends with mod points.

Re:Can't someone sue the carriers?

[Anonymous Coward]

law does indeed overrule contracts. If you where to say, contract with someone to kill you and that contract specifies that the contractor will not be held liable for your death, for example, which do you think holds precedence? Do you think law wouldn't apply? I know it's an extreme example, but it's still appropriate as an example. As far as law is concerned, it's about the same thing.

Re:Can't someone sue the carriers?

[Anonymous Coward]

Not only that, contracts have to be equitable. You agree to give me X service, I agree to pay you this much.

A judge could also find that the agreement is invalid because it leans too much (and by that I mean _WAY_ too much to one party).

Re:Can't someone sue the carriers?

[perryizgr8]

But they managed to ruin the phone industry for all of us.

this. there was healthy competition an actual product differentiation before apple's ishit. nokia, sony ericsson, samsung made stellar hardware, competed on the basis of features and had strong software and hardware research divisions. now google designs a reference phone, and everyone else just removes features from it and sells it at appropriate prices. nokia is going down, had to go from a strong hardware innovator to microsoft's bitch. and apple continues to add random insignificant features to newer iterations and makes all the money. while doing no research whatsoever. the end result? stagnation of actual features (which samsung is trying hard to avoid, and succeeding at least in display tech).
have a look:
n900 vs galaxy nexus
3g vs 4g
267ppi vs 316ppi
querty keyboard vs fuckall
32gb+16gb microsd vs 32gb
10mbps vs 21mbps max dl rate
bt 2.1 vs bt3.0
ir port vs lol!
5mp carl zeiss optics vs shitty 5mp
480p video vs 1080p
600mhz cortex a8 vs 1.2ghz cortex a9
fm receiver+transmitter vs no radio
both have all sorts of sensors that few people actually use.
so, most features have undergone slow evolution, and many have actually regressed.

Re:Can't someone sue the carriers?

[chrb]

Can you point out exactly what you think Google does that Apple does not? From Apple's Q&A on Location Data.

1) Apple gathers "crowd-sourced Wi-Fi hotspot and cell tower data". To do this, your iPhone sends your location along with your Wi-Fi hotspot and cell tower data (SSIDs, signal strength) to Apple. They do say that the request is anonymised so they have no way of figuring out who you are based on the request, but clearly they could just correlate the geo-tagged request with non-geo requests coming from your phone and figure out who you are.

2) Apple has an advertising system (iAds) that uses your location to send you targetted ads. Obviously this involves Apple knowing what your location is.

3) Apple provides application crash logs to third party developers. They say the logs are anonymous, but an app developer could easily include enough information to identify you (a username, IP address etc.).

4) Apple tracks you when you travel. They say it is anonymous, but again they could clearly figure out who you if they wanted to. ("Apple is now collecting anonymous traffic data to build a crowd-sourced traffic database.")

Apple's profit motive is not in the collecting of user information like Google's is, it's in the selling of devices.

iAds: "The iAd mobile advertising network is a significant revenue stream for developers and a powerful way for brands to reach millions of iOS users." This is different to Google how?

Re:Can't someone sue the carriers?

[fast turtle]

I also don't turn in my old phones when I upgrade/replace under contract as here in the states, you get nothing for doing so. Another thing is, if the new phone dies, I still have all of my numbers and information that's in the old phone and can simply contact the carrier and reactivate it. Finally, 911 is a universal service in the states and any phone is able to access it, even those w/o service contracts. That's by Federal Law, meaning that even an older cell can still be used in an emergency to contact 911 if/when needed.

Re:Can't someone sue the carriers?

[fsckmnky]

See recent article on slashdot titled "Google Throws /. Under Bus To Snag Patent"

Re:Can't someone sue the carriers?

[Sporkinum]

I get around that by having a work phone. Since it is theirs and not mine, I really don't care. My wife has a refurb prepaid phone, so it is only tangentially connected to her. If you do a search on either phone number, nothing comes up tying us to them. (actually my wife's phone comes up as belonging to someone in Florida)

Re:Can't someone sue the carriers?

[shoehornjob]

IANAL but if you needed to have a confidential conversation with a lawyer he's most likely going to tell you to come in to the office. That's just common sense.

Re:Can't someone sue the carriers?

[Anonymous Coward]

You do realize that you're going in circles here.

If we're going by your assumption that CarrierIQ is *technically* correct in stating that only event data is being collected, then I'll raise your event data and throw in the fact that a Java event in encapsulated in a Listener which is bound to a *gasp* Button/Checkbox/etc.

Crack open the JDK once in a blue moon and you'd realize that this argument will fall to pieces in a court of law.

Re:Can't someone sue the carriers?

[Reverand Dave]

Ok so yesterday you were vehemently defending FB and before that you were ranting about how windows phone 7 was the new messiah. I'm not sure if you have any credibility left on the issue of phones or privacy.

Re:Can't someone sue the carriers?

[TheCRAIGGERS]

You make an interesting point, but you forget a major category: the weight & size of the hardware.

Yes, the n900 had a physical keyboard, FM radio chips, large ports like IR (although you fail to mention NFC, which I would call superior and in the same category). However, the n900 was a fucking tank. The nexus is a thin, slim piece of hardware. And when you're putting them in your pocket, that is important.

Re:Can't someone sue the carriers?

[alexo]

If they recorded only events that weren't keystrokes, then it wouldn't be a lie. But that is not the case.

So, according to your logic, if the Nazis were to claim that they did not try to exterminate the Romani, that would be a truthful statement?

Re:Can't someone sue the carriers?

[Anonymous Coward]

If you've posted it as answer on my last question, yes, you demonstrate that

However, because there is no restriction on the users that may participate, the reliability of the ratings is correspondingly diminished.

If you're just trying to show "Google is eeeeeeeevil" with a random headline - no, mister hater, you should have read what's under the headline as well, that's just grasping at straws.

Re:Can't someone sue the carriers?

[Anonymous Coward]

Carrier IQ is simple to remove when flashing a new build of Android to your device. It's on every device forum on XDA.

I guess that makes it okay, then.

Re:Can't someone sue the carriers?

[kqs]

Citation needed. Please show a single case where Google has sold user info or actions.

Google collects info and actions, and uses them to target ads. They sell ads, not info.

CarrierIQ collects user actions and sends to the cell providers. I don't trust them at all, but that distrust is based on years of Baby Bells mistreating users and their data, not on random fantasies of an evil Google coming to steal my soul.

Re:Can't someone sue the carriers?

[D'Sphitz]

I haven't seen any indication anywhere that Google has anything at all to do with Carrier IQ. It is your service provider who put it there, and it is your service provider who is collecting the data. TFA even clearly states that this is not unique to Android devices.

Re:Can't someone sue the carriers?

[Archangel Michael]

If it uses IP addresses directly, that would make it fairly easy to DOS. Not that I'm saying we should doing it.

Thanks

Re:Can't someone sue the carriers?

[Anonymous Coward]

Google isn't doing this; carriers are. In fact, Google phones (like the nexus series) are the models explicitly without carrieriq

Re:Can't someone sue the carriers?

[Archangel Michael]

He didn't have sexual relations

A blowjob is not sexual relations?

Re:Can't someone sue the carriers?

[Anonymous Coward]

You're retarded. The research you linked to is obviously to help build self-driving cars, which Google has dedicated a lot of research to and would help 1) save lives from people crashing and 2) help disabled people become more mobile. Yes, Google would inevitable profit from releasing a system of self-driving cars -- so what? All of this is opt-in and it's no surprise that a self-driving service would need to know where your car is to give it further direction. CarrierIQ is not opt-in and is thus fundamentally different. Also, OnStar and the FBI already track your car without your consent, so you have more important things to worry about.
 
With regards to the Android issue, this is software sold to the OEMs, not Google. I'm betting vanilla Android has no CarrierIQ software. In fact, phones released with the Google logo allow you to root them while other OEM phones with their proprietary software do not.
 
If you really wanted to support transparency in technology, I suggest you actually look at the situation instead of demonizing corporations. The type of brand-tarnishing seen in this /. post and others disavowing the future purchase of any Android device cedes ground to what's basically the only smartphone alternative: iPhone and iOS. I would claim those are more insidious since Apple is closed-source, doesn't allow rooting (although it happens), and only allows a single marketplace for apps.

Re:Can't someone sue the carriers?

[macshome]

On iOS 5 you can individually toggle each application and each system service's location settings.

You can globally just shut it off if you want.

You can tell iOS 5 to put a location icon in the status bar whenever something uses location services.

For example you could tell iOS to not use location for iAds, or traffic, but to go ahead and use it to set your time zone.

Re:Can't someone sue the carriers?

[Anonymous Coward]

You might want to look into the details more closely. They were not covered by what the lawyers asked him and at the time I looked up in a dictionary what sex was. And that dictionary said sex was short for sexual intercourse. And that definition did not include a blowjob.

A virgin is someone who's never had sex. Do you consider a blowjob to be count as sex?

I'm not really defending the guy. What he did was wrong in many ways, but the stories people are telling after the fact (like "is is") are myths and not based on truth. Feel free to go back to the transcripts some day. I know most people have no idea what the context for *any* of these quote are.

Re:Can't someone sue the carriers?

[Anonymous Coward]

assuming the EU lasts the year. They're in deep deep economic shit.

Re:Can't someone sue the carriers?

[AdamJS]

In the United States, as was somewhat recently decided by the Supreme Court, a TOS, EULA or contractual agreement for services/products provided can and does override any consumer protections or laws it desires so long as it's stated in the agreement;
That is, if you sign it, and it says that they never have to actually provide a service, then they don't have to provide the service, EOD.

Re:Can't someone sue the carriers?

[erroneus]

This is reportedly available on Nokia phones too. I have not read where it is limited to Nokia's smart phones only.... or smart phones at all actually.

CarrierIQ offers a range of services to carriers and clients for their service are on lots of different devices.

Re:Can't someone sue the carriers?

[Anonymous Coward]

Nope.

I have a rooted android and all Google Apps work perfectly. I rooted the day I got it and Cyanogen doesn't have this Carrier IQ. It was very easy to do.

Not sure where you go this information that "magic" apps don't work when rooted. EVERYTHING works rooted.

Re:Can't someone sue the carriers?

[Anonymous Coward]

In the United States, as was somewhat recently decided by the Supreme Court, a TOS, EULA or contractual agreement for services/products provided can and does override any consumer protections or laws it desires so long as it's stated in the agreement;

{{Citation needed}}

Re:Can't someone sue the carriers?

[tlhIngan]

I'm curious to know why Apple is never implicated in such privacy and tracking discussions considering how they lock you down to their own software and services. IIRC, they were involved in a GPS tracking furore a few months ago which came to naught. CarrierIQ doesn't develop for the iOS. But if carriers want all phones to return "diagnostic" information, presumably the iPhone is also doing so.

Well, the location tracking database furor was because iOS used it as a cache. What it does is it notes the towers it sees, the WiFi APs it sees, and asks Apple "I'm seeing towers X, Y and Z, and see these WiFi MACs. Where am I?". Apple responds with "Here's a list of WiFI APs and Towers and locations near you".

Since the database can be big and changes often, it's not transferred in entirety to an iOS device, but only bits and pieces of it - where it is now and nearby places. As it goes out of the cached area, it'll just request more data.

In dense urban areas, this can be quite fine grained (street level) due to sheer amount of data. In rural parts, it'll cover larger areas (10+mile radius), hence hte variability in the recorded data regions.

Unfortunately, the real problem is it's difficult to tell if it's a cache or really tracking you.

As for CarrierIQ - they'd have to get at some lowlevel access to iOS. Jailbreaking can do it, but as an app in the App Store, there's not enough priviledges for it. Unless apps bundle it in like they do with AdMob ads and such.

Re:Can't someone sue the carriers?

[tqk]

Where the ambiguity comes in is where we draw the line as "private information". Is your conversation or web history considered private? You'd have to convince the courts should you take it that far.

No, I would not need to convince a court of anything. I would, however, talk to my cellphone provider to see if they did anything like this. If so, I'll find another provider that doesn't. If I can't find one, then I'll do without.

This is close to the most despicable business practice I've heard of in a long time. My provider runs a hidden keylogger/spyware app on my phone, for which I'm paying the bills?!?

I've read the CarrierIQ "Privacy and Security" disclaimer. I don't believe them. I've also read their "Mobile Service Intelligence" page:

What's more, the combination of the MSIP and IQ Insight lets you move seamlessly from broad trend data across many users, through comparative groups down to diagnostic data from individual devices. Now, not only can you identify trends, you have the power to drill down to specific instances, giving you the insight your specialists need to make a difference. [emphasis mine.]

Utterly unacceptable. I can absolutely guarantee that I will never in the future own a cellphone (or any other device) that won't submit to jailbreaking, specifically so I can avoid crapware like CarrierIQ.

Ho. Ly. !@#$ :-O

Re:Can't someone sue the carriers?

[Anonymous Coward]

That was a bug that Apple fixed and rolled-out an update within days. CarrierIQ would never make it to the App Store.

Re:Can't someone sue the carriers?

[mrchaotica]

Does the implosion of the Euro necessarily also mean the destruction of the EU itself?

Re:Can't someone sue the carriers?

[Anonymous Coward]

CarrierIQ isn't in Android Market either. Just sayin'.

Re:Can't someone sue the carriers?

[Anonymous Coward]

is your , key broken or are you trying to frame your sentences like Capt. Kirk?

Re:Can't someone sue the carriers?

[dupup]

Indeed. If the government began a program to spy on everyone domestically, it would undoubtedly cause a huge uproar, and likely be deemed unconstitutional ( at least I hope it would be deemed as such. )

The Patriot Act essentially allowed the government to do exactly this and without too much uproar. Specifically:

• Title II Section 225 - Immunity for compliance with FISA wiretap
• Title V as it pertains to National Security Letters (NSLs)

I guess I could go on but I threw up a little in my mouth and had to stop.

Re:Can't someone sue the carriers?

[Anonymous Coward]

How is it different? To start, Apple doesn't allow carriers to include software that logs every single keystroke you input into one of their devices, including the contents of SMS messages and https strings.

So, maybe a little different.

Re:Can't someone sue the carriers?

[fsckmnky]

Google Sells User Data To U.S. Government
http://breakingnewsworld.net/2011/06/google-sells-user-data-to-u-s-government/

Re:Can't someone sue the carriers?

[lgw]

No, the Euro, the EU, the EC, and several other bodies are distinct, and will have to collapse separately. In general, there seems to be some discontent with the not-very-democratic federal government in Europe, with its approach towards uncooperative citizens of member states of "we'll just make you vote over and over until you get it right". Will that collapse? Do people really want democracy? We'll find out.

Re:Can't someone sue the carriers?

[nahdude812]

I should add, that the moment I heard that Google was releasing a smartphone OS aka Android, my first thought was "Nice. Now google can spy on everyone when they are away from their computer and follow their movements in the physical world."

It should be noted that CarrierIQ is not Google and is not related to Google. This is a third party which makes a rootkit/spyware app that carriers have installed on handsets that they sell (it is not part of a vanilla Android install).

Re:Can't someone sue the carriers?

[Archangel Michael]

"I did not have sexual relations ... with that woman .. Ms Lewinsky"

Indeed, a blowjob is sexual relations, just not sexual intercourse. One is broader in definition than the other, don't you think?

And yes, he was Disbarred because of factually inaccurate answers in a legal proceeding (ie LYING under oath). Just because the Democrats always stick up for Democrats (and Rs for Rs) doesn't mean he didn't lie to the American People when he was wagging his finger at us.

Re:Can't someone sue the carriers?

[kqs]

Interesting. The headline says "sells", but the article sounds like this is just the usual judicial warrants and subpoenas. Any evidence that this is something else?

A counter-example: http://www.nytimes.com/2006/01/20/technology/20google.html?pagewanted=all

The justice department requested millions of requests; AOL, MSN and Yahoo said "here it is!", and Google said "nope, we don't think this subpoena is valid so we'll fight it."

I'm not claiming they're perfect, but this seems like a promising sign.

Re:Can't someone sue the carriers?

[Bucky24]

You can't say "simple" and "flashing a new build of Android" in the same sentence.

Re:Can't someone sue the carriers?

[anonymov]

The only place word "sells" is mentioned in that article is that sensationalist headline. It speaks about law enforcement related requests - surely only Google complies to those. Please do try harder next time.

Re:Can't someone sue the carriers?

[anonymov]

Depending on the device, it can be as simple as plugging in the USB and double-clicking the batch file.

Re:Can't someone sue the carriers?

[Bucky24]

If every single Android phone is already communicating with this IP then I would imagine it's a pretty robust server.

Re:Can't someone sue the carriers?

[Bucky24]

Whooosh!

Re:Can't someone sue the carriers?

[Bucky24]

Depends on the judge you get, I think. And from the looks of things, most of the higher level judges tend to favor corporations over people.

Re:Can't someone sue the carriers?

[aesiamun]

I do not see where I can shut off location for iAds, please tell me where I can deny Apple more marketing revenue.

Re:Can't someone sue the carriers?

[anonymov]

"Satisfies"? Responded to law enforcement requests != sold. Your trolling lacks quality, couldn't you google for some more matching headlines, at least?

Re:Can't someone sue the carriers?

[Anonymous Coward]

http://socialtimes.com/files/2011/04/AndroidLocationConsent-r41.png

First time you start up the phone (the setup wizard) and every time you enable the Wireless Networks GPS function, this warning box pops up. It's not buried in a ToS somewhere. I have mine turned off 99% of the time due to this warning. Don't think you can blame Google on this one; most people are capable of reading "LOCATION CONSENT" (don't even have to read the rest of the warning really).

Google has no reason to have your wifi/cell GPS information if you do not wish to use the wifi/cell GPS feature. If you turn it off, nothing gets reported but you lose access to the online database of wifi APs (which makes sense; the server will know where you are if you ask where you are based on a set of wifi APs.)

Re:Can't someone sue the carriers?

[Anonymous Coward]

No, it proves you love someone ;)

Re:Can't someone sue the carriers?

[Anonymous Coward]

Actually it has been. There has been two GPS privacy issues, not just one.

The first is what most are familiar with: the on-device logging of GPS that: a) survived device transfers, and b) was available to any application that accessed it. You say it "came to naught", but how do you know applications weren't already using or downloading that log?

The second issue: your i device is effectively selling your location data to advertisers. The OPT OUT configuration option is not actually on the phone. I challenge you to go find how to turn it off. I'll give you a hint, it starts with "oo". Every single i-device owner I have ever asked about this has never known that their location data has been effectively sold to advertisers.

Re:Can't someone sue the carriers?

[fsckmnky]

"One might think that an application need to ask for a location permission (either ACCESS_COARSE_LOCATION or ACCESS_FINE_LOCATION) in order to do that, but that’s not true. If an application asks for permissions for the WiFi state (ACCESS_WIFI_STATE ) and has internet access, it can use the skyhook service (which is available for the Android) in order to retrieve the phone’s location." http://useroriented.wordpress.com/2009/02/22/a-security-flaw-in-google-android/

Re:Can't someone sue the carriers?

[macshome]

Settings > Location Services > System Services

It looks like this. http://snapplr.com/snap/kqck

Re:Can't someone sue the carriers?

[dalias]

It's very easy to avoid if you don't use carrier-branded phones. I always buy phones from overseas (usually Nokia in the past, but now...) with no crapware, no carrier lock-in, etc.

Re:Can't someone sue the carriers?

[Gr8Apes]

Even the call telling you to come to his office is "confidential"

Re:Can't someone sue the carriers?

[byuu]

It has little to do with reading the contracts. The problem is that if you want a good white collar job, you need a cell phone. And if you want a cell phone, every last service provider has the same clauses. Reading the clause won't help, as unfortunately most people don't care about their privacy. The providers won't care even if they did lose 0.1% of their customer base if the spyware gained them +10% profits.

Re:Can't someone sue the carriers?

[thegarbz]

You've just proven to the world you have no idea how the telecoms industry or even Android works.

Apple was a single developer creating a new device with their own OS and releasing it to the market with the promise that thousands of Apple devotees will line up to buy the thing. This gave them the power to decide what happens.

Android on the other hand was developed by the Open Handset Alliance. A group of 84 companies. Yes EIGHTY FOUR COMPANIES. Many already entrenched in the telecoms industry and many already with various deals with carriers around the world. It is they who decided how Android will look. Google only provided the coding knowhow. It is they who requested features and abilities to change the system. It is they who ultimately customise the OS and ship it to carriers to sell.

If Google wanted to stamp its foot the Open Handset Alliance would likely have been disbanded and we'd have no Android phone at all.
Also the only phone Google actually sells happens to also be the only Android phone sold here in Australia which doesn't come with crapware installed.

Also magic apps? What have you been smoking? There is not a single app that suddenly stops working on a rooted phone. Even if you install a completely custom ROM like Cyanogenmod all that you need to do is install the Google Framework which gives you access to the market and from there you can download and install any Google app including your somehow magical "Google Maps".

The only thing you lose by rooting is your warranty, and depending on how a specific model of phone is actually rooted you can make it so you don't even lose that.

Re:Can't someone sue the carriers?

[Anonymous Coward]

Google doesn't install Carrier IQ, and that wasn't OP's point. The point was that every Android phone does some similar things, like reporting its location, visible networks, contacts list and search history to Google's servers. It does this about once an hour.

Carrier IQ and Google both want lots of information to data mine or sell. You can throw Facebook into this list as well. The type of information collected is unique and personal. Anything you like about Google's services or Android is paid for by mining data. Same goes for Facebook.

The differences between Carrier IQ and other data ming companies is the amount and scope of collected data, and the very obvious conclusion that we get nothing of benefit from it. Google gives us email/search/voicemail and facebook gives a free webpage/message board. Carrier IQ gives you....?

Re:Can't someone sue the carriers?

[exomondo]

ir port vs lol!

It's more 'lol' that you even want an IR port, just another useless thing that makes the phone bigger and bulkier. If you want data transfer there's NFC, BT and WiFi, if you want remote control most devices these days support BT or WiFi. IR is old technology used for old technology, it can stay in the past.
The N900 was the phone with all the features, the phone that very few people actually wanted. I don't use mine anymore, it was good in terms of functionality but it was too big, bulky and heavy as well as suffering quite badly from this.

You also missed that the N900 has a resistive touchscreen as opposed to a capacitive one, and that the Nexus has NFC where the N900 does not.
On the 'sensors' comment you've just put that few people actually use them, obviously because that goes a long way to disproving your point but of course you left in IR because that is a win for your point even though few people actually use IR, so clearly not an unbiased opinion there.

Re:Can't someone sue the carriers?

[Khyber]

That contract doesn't exempt them from following the law.

Getting around HTTPS by essentially being a MITM data-gathering tool is very likely against the law; I believe there are criminal penalties for circumventing security measures and violating someone's privacy.

Re:Can't someone sue the carriers?

[Goaway]

Nothing you just said really makes any sense. Also, you are kind of insane.

Re:Can't someone sue the carriers?

[BasilBrush]

Sure you can avoid it. Carriers can't add software to the iPhone.

Re:Can't someone sue the carriers?

[BasilBrush]

Carriers can't install software on iPhones. So your argument isn't valid.

Re:Can't someone sue the carriers?

[BasilBrush]

I guess you didn't RTFA. This very story is about software built into Android phones that does key logging as well as lots of other logging.

Re:Can't someone sue the carriers?

[HiThere]

Wrong. Google specifically chose to release Android under a license that allowed the carriers to close it. If they had chosen GPL they probably wouldn't be in court against Oracle right now. And Oracle had made representations to Google before Android was released.

So Google chose this route with considerable in the way of reasons not to do so. The safe way would have been for them to use GPL licensing. They didn't. So there is some reason. One may speculate as to what that reason is, but that such a reason exists if obvious.

Re:Can't someone sue the carriers?

[BasilBrush]

They're not doing it on iPhones.

Re:Can't someone sue the carriers?

[anonymov]

Because it's not in source code releases by Google, it's a third party app installed by carriers.

Re:Can't someone sue the carriers?

[demonlapin]

I guess I wasn't clear enough with the second half of my statement. I didn't watch the video, but unless that was a Nexus phone it wasn't a developer phone; it was a phone that he used for development. His original contract of sale / use with AT&T for the phone may very well have included terms that allowed them to run CIQ whenever he used the device, not just while using their service.

Re:Can't someone sue the carriers?

[Anonymous Coward]

Will Germany want to fund everything? probably not (I dont blame them)

Re:Can't someone sue the carriers?

[mattcsn]

I'm thinking about being able to do this for non-geek friends. I love cyanogenmod and would never go back a non-cyanogenmod-able phone, but a quick root and edit of the hosts file is invisible as far as non-geeks are concerned. Also, not all phones have cyanogenmod builds available.

Re:Can't someone sue the carriers?

[mjwx]

It should be noted that CarrierIQ is not Google and is not related to Google. This is a third party which makes a rootkit/spyware app that carriers have installed on handsets that they sell (it is not part of a vanilla Android install).

It should also be noted, Google has no deals with CarrierIQ, this software is installed by the carriers, not by Google.

Re:Can't someone sue the carriers?

[Anonymous Coward]

Holy, comma, overuse, Batman!

Re:Can't someone sue the carriers?

[perryizgr8]

my mistake that i forgot about nfc, but keep in mind that nfc is primarily the result of nokia's and samsung's research, apple will just steal the tech one day. nexus is thin and slim only because it doesn't have a keyboard. remove the keyboard from n900 and you'd have something very thin indeed. my point is that cellphones today are competing on 'shiny', not features. and that is the result of apple's shit, and it is harming actual tech research (because nokia and samsung can either pump up the shiny or build new tech, and apple doesn't have to).

Re:Can't someone sue the carriers?

[perryizgr8]

i never said i wanted an ir port. the 'lol!' was there becuase i thought having an ir port in this day and age is lol-worthy. also, i forgot about nfc, did not deliberately leave it out.
nfc, btw is the result of nokia research. nokia initiated development of nfc, later joined by samsung. almost all new nokia phones have nfc, even the mid-level ones.
you're right about the screen, resistivecapacitive.
the point i was trying to make is that newer phones are better, but not 'OMG-that's AMAZING' sort of better. they're all clones now, with only minor differences in capability/features across manufacturers and price ranges.

Re:Can't someone sue the carriers?

[exomondo]

the point i was trying to make is that newer phones are better, but not 'OMG-that's AMAZING' sort of better. they're all clones now, with only minor differences in capability/features across manufacturers and price ranges.

That was pretty much always the case though, from the early analog handsets with monochrome screens and no applications the connectivity evolved, the screens evolved and as a result of the power evolving the applications got better. The differences across Nokia phones (well just about all phones) in the late 90s was little more than form factor.

Re:Can't someone sue the carriers?

[Anonymous Coward]

fsckmnky writes:
They aren't recording "keystrokes" .... they are recording "event data" of which, keystrokes are merely a sub-class of events. It's not a lie, just like when Bill Clinton told everyone "I did not have sexual relations with [Monica Lewinsky]." He didn't have sexual relations, as in, intercourse, he just played around with a cigar.

Shirley you can't be serious !!! (honestly for a while I thought you were joking, but looking at some of your other posts makes me think otherwise).

"Keystroke logging (often called keylogging) is the action of tracking (or logging) the keys struck on a keyboard, typically in a covert manner so that the person using the keyboard is unaware that their actions are being monitored." - Wikipedia

Of course that's just one definition, but there are others that support this as well.

Your citing of the Clinton/Lewinsky scandal does not apply. It was not a lie when he denied it in court, because the lawyers argued back and forth over the precise meaning of those words prior to him uttering them, and the judge made specific rulings about it. It was, IMO, a lie to the American people who were (largely) not part of that court proceeding and regardless, the ruling by the Judge does not necessarily apply to utterances he makes outside the court.

In this case of Carrier IQ, there is no Judge who has made a ruling (yet), to describe whether what Carrier IQ is doing qualifies as key logging. But to deny it in the face of this video is just completely absurd.

Also I invite you to read the post by "Riskable" which details out a number of laws that Carrier IQ (and or HTC) are likely breaking.

Re:Can't someone sue the carriers?

[fsckmnky]

Also I invite you to read the post by "Riskable" which details out a number of laws that Carrier IQ (and or HTC) are likely breaking.

I read it, and replied to it. Almost the entire post by Riskable was invalid and inaccurate, as much as you would like it to be otherwise.

My original comment stands that privacy legislation specifically addressing this issue is required to resolve it, because right now what the carriers are doing by installing CarrierIQ and monitoring you, and having you agree to the monitoring via the TOS, appears to be perfectly legal ( at least in the US ).

If you don't like it, don't get a cell phone. The industry and government will respond rapidly when sales plummet to $0. The odds of people being willing to go without a cell phone of course, I would place so close to zero it might as well be zero. As long as people are unaware or willing to accept this sort of monitoring, it will continue.

Re:Can't someone sue the carriers?

[andydread]

Sorry CarrierIQ i on your Iphone. Before you trip over yourself to defend Apple here maybe you should get informed? no? http://blog.chpwn.com/post/13572216737?fe250de0

Re:Can't someone sue the carriers?

[BasilBrush]

Note the differences. On iPhone you elect to use it or not during setup of a new device. And at any point after that you can switch it off in preferences. It's also not a key-logger.

On Android, you don't elect to use it. You can't switch it off. And it logs keystrokes.

The major criticism of wrong doing is the key-logging. There doesn't seem to be any reasonable criticism of what's happening on iPhone here. Only Android.

Re:Can't someone sue the carriers?

[andydread]

Its only comes installed by AT&T on Android phones distributed by AT&T. There are Android phones that you can purchase that does not even have it installed. So at least on Android you have a choice of not having it installed in the first place based on the phone you chose.

Re:Can't someone sue the carriers?

[BasilBrush]

Its hard to see how not having it installed is in any practical way better than just having it switched off.

However there is a bigger flaw in your category of argument:

Whenever there is a positive feature, the Android fans say "Ah, but you can get it in Model X." or "It''s higher spec in Model X".

Whenever there is a negative, the Android fans say "Ah, but you can get Model Y which doesn't have that".

The flaw is that that people buy on multiple criteria, and there will inevitably not be a single Android model that fulfils all these good attributes.

As always one buys a compromise. And iPhone is a particularly good compromise for many people.

Re:Can't someone sue the carriers?

[Anonymous Coward]

search "droidwall" your answer will be there.

Re:Can't someone sue the carriers?

[lgw]

My personal prediction from a year or so ago is that Germany will in fact fund everything under such terms that they effectively conquer Europe (and effectively replace their democratic national government with a much-less-democratic EU-federal government).

Re:Can't someone sue the carriers?

[andydread]

Does not remove the fact that the iPhone is inflicted by CarrierIQ also. So the argument that Apple wouldn't allow this on the iPhone is a farce. Apple allowed it and probably facilitated in the installation of it. Any pure carrier-free phone whether its Android, WinMo or plain old feature phone does not have this spyware period.

Re:Can't someone sue the carriers?

[sjames]

It's not legal to agree, but it may be illegal to actually do it. It could be that the whole thing would be found unconscionable since it's a contract of adhesion. Particularly since all of the carriers have such a clause, it can't be argued that there is any real choice in accepting the terms.

Re:Can't someone sue the carriers?

[BasilBrush]

PROBABLY facilitated? You don't know what you re talking about. All the software that is on a new iPhone is there because Apple put it there.

Apple is open about the data sent back home and asks the user at setup time whether he wants to do that. Apple have done nothing wrong. But whoever put that software on the Andorid certainly did do wrong. They neither informed the users, nor give them the option to disable it. These are not equivalents.

Any pure carrier-free phone whether its Android, WinMo or plain old feature phone does not have this spyware period.

You don't know that. And even if it were the case it doesn't change matter for the majority of Android phones that are in fact carrier subsidised.

Re:Can't someone sue the carriers?

[niftymitch]

companies that illegally wiretap their customers

Therein lies the rub. In order to use your cellphone/smartphone, you have to sign the carriers agreement, and in the carriers agreement, there is undoubtedly a clause where you give them permission to collect your data and use it as they see fit. This makes the data collection legal, not illegal, as you agreed to it. ...snip....

But if they collect information, the courts (and TLAs) can go after it.
I suspect the clear and obvious pre-warrant search and
inventory is illegal. It is worrisome to all because all of
us can be assaulted via the court. Personal lives,
divorce, employer litigation, legal political actions, library
book inventory, health, religion and medical issues .... things
well beyond national security.

Re:Can't someone sue the carriers?

[andydread]

Well in the USA its easy..just avoid AT&T. Verizon issued a statement saying the do not issue phones with CarrierIQ.

Re:Can't someone sue the carriers?

[niftymitch]

ir port vs lol!

It's more 'lol' that you even want an IR port, just another useless thing that makes the phone bigger and bulkier. ....snip.......

But a smart phone with a good IR chip could replace all seventeen
of my home TV, whatnot remotes even the POS from Comcast.

Re:Can't someone sue the carriers?

[BasilBrush]

But that ca't be true, because we already know that iPhone has a Carrier IQ client on it, and Verizon issues that.

Somebody spoke too soon.

Re:Can't someone sue the carriers?

[exomondo]

So could a multifunction remote, which would be better because it means people don't have to borrow your phone everytime they want to change the channel, or the AC, etc...

Re:Can't someone sue the carriers?

[andydread]

That would be the AT&T version of the iPhone not the Verizon version apparently according to Verizon.

Re:Can't someone sue the carriers?

[BasilBrush]

That would be the AT&T version of the iPhone not the Verizon version apparently according to Verizon.

To the best of my knowledge there is a single OS image per device. So all iPhone 4 units have Carrier IQ and all iPhone 4S units don't have it. Regardless of which carrier. Though perhaps it's coded to it only actually runs when on some carriers and not on others.

Re:Can't someone sue the carriers?

[niftymitch]

...snip....

I don't think shareholder value had anything to do with the decision to add cIQ. it was merely something that got sold to them and serves as purpose ...snip....

This may be correct.. Now that the service is more public
it seems to me that the sold service can be subjected to
abuses that were not the intention or design.

Most interestingly I do not believe such tools.
My Android phone locked up yesterday and required a battery pull.

Now that I know that such software exists I WANT to know if
this negative customer experience was logged and noted
to my service. I want to know if my service provider is
a mushroom.... sitting in the dark living on the poo that some
service generates.

Re:Can't someone sue the carriers?

[Ash Vince]

Sure you can avoid it. Carriers can't add software to the iPhone.

But since Apple may have added it for them that doesn't seem to matter much:

http://yro.slashdot.org/story/11/12/01/1418245/carrier-iq-software-may-be-in-ios-too

Caught in a lie then.

[Nursie]

That's just nasty. First try to silence the researcher, then try to deny what's going on when you've already been caught.

The question is, will this have any effect? Will carriers stop shipping this stuff ? Will consumers care?

My guess is no, they'll just try to hide it better in future.

Re:Caught in a lie then.

[gstoddart]

The question is, will this have any effect? Will carriers stop shipping this stuff ? Will consumers care?

Will the FCC decide this is a violation of what they're allowed to do?

This to me sounds like it could be bordering on illegal ... and, of course, how likely is it that law enforcement is requesting this data and forcing the carriers to keep it secret?

Re:Caught in a lie then.

[Culture20]

This to me sounds like it could be bordering on illegal

Bordering? It might be legal federally, but if I recall correctly (not a lawyer), there are States where recording such data is a violation of wiretap unless both parties are aware of the recording. And such some people here on /. are pointing to contract clauses where "data necessary to the functioning of the network" or similar are spelled out and saying that people consented (and are thus aware, which is suspect in itself). But let's take this a step further. CarrierIQ says in plain English that they're not logging keystrokes. Any customer who knows about carrierIQ and has seen carrierIQ's statement has a reasonable expectation that "logging keystrokes" is not part of the data logging they're agreeing to. "Aha!" says the weasel lawyer "the ordinary people didn't know about carrierIQ! Only our execs knew it was installed on our phones." To which I say, "did carrierIQ misrepresent its logging nature to those execs?" if it did, then carrierIQ might be logging keystrokes between a user and the phone company when the phone company execs have a reasonable expectation that carrierIQ isn't doing that. Then carrierIQ is in trouble in two-party states.

I have

[Anonymous Coward]

Always been suspicious of the countless android apps that REQUIRE device permissions such as "full internet access", "read phone state and identity" etc...

Re:I have

[Chrisq]

Always been suspicious of the countless android apps that REQUIRE device permissions such as "full internet access", "read phone state and identity" etc...

As far as I can gather this is worse. It comes pre-installed by your carrier, you never grant it access to everything and there is no sign that it is installed.

Re:I have

[Fri13]

Then install Permission Denied application (you need root) what gives you possibility to rip those permissions off from application https://market.android.com/details?id=com.stericson.permissions.

After selecting what permissions the app can have, you need to reboot to take it affect.
And the other great application is Droidwall what is firewall (needs root as well) where you choose per application does it have access to WLAN or 3G internet connection. Great to limit some apps only to use WLAN instead 3G or vice versa.

Re:I have

[Anonymous Coward]

Unfortunately the "read phone state and identity" permission is necessary if the application wants to check for a valid license.

Technically it is not absolutely necessary - but the generated key necessary to call the Google license API is crap if the phone ID is not hashed into it.

Re:I have

[rhizome]

What application's permissions would be modified to protect a persons phone from CarrierIQ with your app?

Re:I have

[Catnaps]

If you need root for these things, you may as well just grab a custom ROM to go along with it which has CIQ removed (well, most devs remove it anyway). I know my Sensation third-party ROM (ARHD 4.1.x) doesn't have CIQ anywhere in it, I've checked.
After all, flashing a ROM after rooting is a really small step in terms of difficulty and then you're totally free of CIQ.

Re:I have

[daid303]

One of the latest (7.2 or something) CyanogenMOD versions allows you to revoke permissions on installed apps. Which is the main reason why I installed Cyanogen.

Re:I have

[Anonymous Coward]

Except for those with a locked bootloader

Re:I have

[Catnaps]

My Legend had a locked bootloader, so did my Sensation. Emphasis on past tense, because you can unlock them quite easily with some help from XDA Devs. My Sensation was literally; "run batch file, wait 3 minutes and watch it reboot a few times, check bootloader: S-OFF. Done."

Re:I have

[blackraven14250]

You need root to remove Carrier IQ, it's not as simple as changing its permissions. It's completely invisible to the user, much like Cerberus.

Re:I have

[Fri13]

That application was not as fix for CarrierIQ but fix for every application what you ever install your phone.

You see, that works for EVERY application what you install. Not to one single pre-installed one.

Re:I have

[Fri13]

CarrierIQ is more like rootkit or very well hided program in ROM.

My suggested application is answer for this:

Always been suspicious of the countless android apps that REQUIRE device permissions such as "full internet access", "read phone state and identity" etc...

As you see, it was not about CarrierIQ but countless android apps that require device permissions

Re:I have

[DMUTPeregrine]

LBE Privacy guard is similar to PermissionDenied, but no reboot necessary. https://market.android.com/details?id=com.lbe.security.lite

Re:I have

[Anonymous Coward]

Besides having more control over permissions, it's also a nice feeling to NOT have shitware like CarrierIQ installed...

Needs to be labeled as spyware

[assemblerex]

Clearly that's what it is, it spies to enrich the company at your expense.

Re:Needs to be labeled as spyware

[PolygamousRanchKid]

. . . at your expense.

So guess who pays for the transmission of all those logged clicks . . . ?

. . . and you thought some other app was draining you battery and carrier account limit . . . ?

Re:Needs to be labeled as spyware

[Anonymous Coward]

I know this is unimaginable to a "money over everything" Neo-American (Note: Unrelated to real Americans, even though they call themselves the "real Americans"), but there are other valuable things besides money. Like freedom, privacy, life, love, knowledge, etc. It's weird how the USA today is quite the opposite of your own founders' ideals.

Conspiracy theories aside...

[ruemere]

What software is actually affected? What phone models? What platforms? What applications?
If it's just AT&T and its victims, well, it's their own private little hell. Otherwise, some facts would be nice.

For now, (quoting from the article), phrase of "millions of Android, BlackBerry and Nokia phones" smacks of cheap propaganda and scaremongering.

Regards,
Ruemere

Re:Conspiracy theories aside...

[Anonymous Coward]

That's the point

Its hidden pre installed rootkit spyware

No one but carrieriq knows how many devices are infected

Re:Conspiracy theories aside...

[Fri13]

Seems like none of phones sold in EU comes with this preinstalled.

Think about it. EU would rip every carrier, phone manufacturer and software company in pieces if such privacy abusing would rise.
Not even any end user license would protect those companies at all.

Re:Conspiracy theories aside...

[Anonymous Coward]

Do you have a source for that statement? CarrierIQ does have office in Europe, so I guess they are not just targeting the US.

Re:Conspiracy theories aside...

[Anonymous Coward]

Prudence, indeed, will dictate that [Cellphone providers] long established should not be changed for light and transient causes; and accordingly all experience hath shewn, that mankind are more disposed to suffer, while evils are sufferable, than to right themselves by abolishing the forms to which they are accustomed. But when a long train of abuses and usurpations, pursuing invariably the same Object evinces a design to reduce them under absolute Despotism, it is their right, it is their duty, to throw off such Government, and to provide new Guards for their future security.--Such has been the patient sufferance of these [Customers]; and such is now the necessity which constrains them to alter their former Systems of [Cellphone coverage].

Re:Conspiracy theories aside...

[Anonymous Coward]

See the following article:
http://www.carrieriq.com/company/news.htm

Are you saying that Portugal isn't a part of the EU? I think it shouldn't be but that's besides the point. Portugal networks have been pimping this as a feature since 2009.

Re:Conspiracy theories aside...

[Andy Dodd]

Primarily Sprint - I think ALL of Sprint's Android devices are infected with it and have been for quite some time.

It's new for AT&T - The Shitrocket is the first device I know of to have it in the originally sold factory firmware. The current Infuse firmware doesn't have it (but the Gingerbread update will, and it was in the Rogers Gingerbread release in July, although CIQ for the Rogers Infuse was one of the easier implementations to remove), and the Galaxy S II does not have it (and it doesn't appear to be in the update leaks, however I need to check again.) I think some of AT&T's newer HTCs have it but I haven't paid attention.

So far it's primarily a North American thing. I'm fairly certain CIQ in the form implemented by most North American carriers is illegal per European privacy laws. Supposedly more benign forms of CIQ exist, but they have never actually been seen in a released device.

Re:Conspiracy theories aside...

[Fri13]

Seems like

Re:Conspiracy theories aside...

[Fri13]

No, I am not saying. But EU will rip that company into pieces if someone just makes lawsuite against that company, in this case that operator. As you are not allowed to be tracked without your permission. And as video already shows, it is done without permission. Do believe that carrieriq has gone and asked permission from EU to do a citizen spying legal? No....

Re:Conspiracy theories aside...

[gstoddart]

So far it's primarily a North American thing. I'm fairly certain CIQ in the form implemented by most North American carriers is illegal per European privacy laws.

It's quite likely also illegal under Canadian privacy laws.

This could get Rogers in trouble with the Federal Privacy Commissioner.

Re:Conspiracy theories aside...

[Anonymous Coward]

Total Android worldwide phone sales since 2008 launch - 218m (Guardian, Nov 15 2011)

Total installs of Carrier IQ - 141m (front page of Carrier IQ's website).

That's a very significant chunk of the market even if you enlarge it to include Blackberry and others (we are not sure exactly what platforms CIQ targets other than Android). If we assume that CIQ is primarily focussed on Android then its a reasonable guess that you have a much better than 1 in 2 chance of finding it on a new phone.

From www.rgbfilter.com/?p=15818 - "Carrier IQ is known to be on Sprint and Verizon phones, and Carrier IQ has partnerships with Vodafone Portugal as well as hardware makers NEC and Huawei. Out of the other major OSes, it appears that both iOS and Windows Phone are free of Carrier IQ software."

Interesting to see the language they use at Carrier IQ - that's not 'installs' but 'handsets deployed'... and you thought you owned your phone...

CarrierIQ know that what they are doing is dodgy. This is from http://www.fiercewireless.com in 2008...

"The company [CarrierIQ], which was formed in 2005, says its biggest challenge is convincing the mid-level technology executives at companies to deploy their technology. CEO Mark Quinlivan says that the senior executives understand the importance of it but some of the operational people realize that by deploying Carrier IQ, they may not look so good. "It doesn't always make them happy. We are basically telling them their baby is ugly," Quinlivan says."

Re:Conspiracy theories aside...

[Anonymous Coward]

Apple has a process running on iOS called "IQAgent" - one of those things it's harmless to delete when you jailbreak.

No-one seems to know what it's for...

Re:Conspiracy theories aside...

[Anonymous Coward]

Huh, all mentions of "com.apple.iqagent.plist – The functionality of this demon is unknown, removal does not compromise the functionality of your iPhone" seem to come from an old 2009 post. Did nobody dig around there since then?

What phones and providers to avoid?

[aliquis]

So, will someone set up a list for which products not to buy?

If I get a phone here in Sweden which is just plain vanilla stock version will that contain the software or is it something the service providers install on "their own" phones?

Re:What phones and providers to avoid?

[xaxa]

I don't see it on my UK stock (non-branded) Desire.

Look in "All Applications" as explained by the video. I haven't checked with the debugger.

CyanogenMod

[monkeyhybrid]

FTA: "it cannot be turned off without rooting the phone and replacing the operating system"

So even more reason to flash your droid with CyanogenMod or custom ROM of your choice.

Re:CyanogenMod

[Fri13]

By my opinion, every Android phone should be upgradable by the user in any country legally, when ever new ROM is released, from Google or from third party.
After all, phone manufacturers and carriers are just selling hardware and services, not the software.

Re:CyanogenMod

[muffen]

So even more reason to flash your droid with CyanogenMod or custom ROM of your choice.

There is still a level of trust required, you shift from trusting your tele-operator to trusting the Cyanogen-mod people.

To be honest, the best, relatively doable way, is to compile the ROM yourself. It's not that hard, XDA Developers has great information on how to do so. Sure, in this case you need to trust google but in the previous cases you need to trust google + teleoperator, or google + cyanogen mod devs.

Lets not forget that your operator can track your calls quite easily even without software.

I'd be interested in a list of operators that use this software, and an explanation as to what they are using it for, and how they verify that it isn't used for spying on people.

Re:CyanogenMod

[mea_culpa]

It would be nice if smartphones were given the same level of respect that PCs get.
Unlocked boot loaders, choice of operating systems, and more protection from illegal search and seizure from law enforcement.

Re:CyanogenMod

[MimeticLie]

Please don't reply that Android is open source, unless you can show me the sources for CIQ!!!

Please don't reply that Linux is open source, unless you can show me the sources for Flash or Opera.

Re:CyanogenMod

[Catnaps]

Wow, you're a smart one.

Re:CyanogenMod

[l3v1]

Please don't reply that Android is open source, unless you can show me the sources for CIQ!!!

Uhmm... how so? Android's openness has nothing to do with CIQ.

Re:CyanogenMod

[Anonymous Coward]

Compiling yourself only helps if you read and understood the source code first. (And not just the Android sources, also those of your compiler, etc.)

Re:CyanogenMod

[Anonymous Coward]

Lets not forget that your operator can track your calls quite easily even without software.

Indeed. I'm quite aware of it- which is why I question that they even NEED this software on the device in the first place. With the ability they actually currently have for call trace, etc. through most of the mobile networks, they don't need anything like this at all.

Re:CyanogenMod

[Dorkmaster Flek]

Indeed, it's precisely because of Android's openness that we can even find out about this kind of software, or at least make it a lot easier to find out about it.

Re:CyanogenMod

[GPLHost-Thomas]

Nice try, but neither Flash or Opera are coming pre-installed, hidden from the user, and impossible to force-kill. When I install Debian, I have the source for absolutely ALL what is in it (and no, Flash isn't part of Debian, it's in non-free, and non-free isn't part of Debian, that is written everywhere, and as for Opera, it's not even in non-free).

Re:CyanogenMod

[gnud]

Not to mention the compiler that was used to compile _your_ compiler - http://cm.bell-labs.com/who/ken/trust.html

Re:CyanogenMod

[flimflammer]

Nice try, but CarrierIQ isn't a part of Android either so you're point is moot. Android is completely open source, just like you note base Debian is. You're not getting stock Android from Google on your phone are you? No. You're getting the carrier's own personal version with their own personal additions. This is no different than someone creating their own Debian-based distro and putting tracking software in it, then complaining about Debian itself instead of this third party distro.

Re:CyanogenMod

[flimflammer]

Aw man, I just know I'm going to get grammar nazi'd on my misuse of "you're" instead of "your" if I don't say something first. Perhaps even after I do.

Re:CyanogenMod

[thetoadwarrior]

Yeah because most users can or will do that.

Re:CyanogenMod

[grcumb]

Aw man, I just know I'm going to get grammar nazi'd on my misuse of "you're" instead of "your" if I don't say something first. Perhaps even after I do.

That's 'grammar nazied' or 'grammar nazi'ed', bitch.

8^)

Re:CyanogenMod

[Anonymous Coward]

Nice try, but Android does not come with CarrierIQ installed.
Case in point: The model I purchased does not (no, it is not rooted or anything of the sort).

Any other tricks?

[Anonymous Coward]

Did Eckhart specify if this CarrierIQ could also relay microphone data in any way?

Re:Any other tricks?

[shutdown -p now]

He didn't demo it in the video, but there was one bit where he showed permission list for the app - and it basically owns the world. And yes, this includes recording audio. Whether it's actually using that permission for anything is an interesting question.

Worse than the papers

[dcarmi]

News International shut down a paper because it was caught hacking voicemails. These guys are pretty much hacking everything.

How many people have access services via mobile with their work accounts? More than a few I would guess.

Three-letter agencies

[MimeticLie]

I saw a comment on another website speculating that the NSA might be involved with this. I'm not nearly enough of a tinfoil hat wearer to accept that without any evidence, but I think it says something that this looks big enough that people think it must be a government effort.

Just another example of how Big Brother has gone corporate.

Re:Three-letter agencies

[thsths]

> I saw a comment on another website speculating that the NSA might be involved with this. I'm not nearly enough of a tinfoil hat wearer to accept that without any evidence

Haha, good luck finding the evidence. The NSA is trying really hard to avoid leaving any hard evidence behind.

Personally I think this has NSA written all over it. It is a software clearly designed to spy on customers, although I tend to believe that it is not usually report back the findings. Of course that is only a switch that you have to flip... and who would like to be able to do that? Bingo.

NSA

[Anonymous Coward]

>[..] and an explanation as to what they are using it for, and how they verify that it isn't used for spying on people.

Ever heard of the NSA? This was designed to spy on people. Hmm... the only people interested in this sort of spyware are actual spies and criminals. So any carrier running this on their sets are either criminals or an NSA goal-keeper.

Credit card number exposure

[SlashRAH]

When somebody installs a skimmer on an ATM or fuel pump, there are criminal penalties for (attempted) fraud. How is this software any different?

Re:Credit card number exposure

[TheGratefulNet]

phone carriers are 'friends' with law enforcement, remember.

they get special benefits (ewwww!).

both are thugs and both like their organized crime way of life.

and they both tolerate you and I as long as we don't stir up the game that they both have going.

Re:Credit card number exposure

[totalg33k]

This is different because the end user signs a contract (as many have stated before) allowing the collection of data by the carrier. The onus is on the carrier to use the data with a neutral intent, but they are still given the right to collect the data by the end user. In the case of a skimmer, the person using the pump or ATM has no a priori knowledge their information is being recorded, and that makes all the difference.

Re:Credit card number exposure

[Anonymous Coward]

It is a big company and not a couple of criminals. Sad but true.

Re:Credit card number exposure

[Anonymous Coward]

You probably lost the battle when you signed the skimmer's contract or clicked through the EULA. ;)

If you read your cell contract, dollars to doughnuts the verbiage is in there and you gave it your blessing. Now do you see the difference?

Pizza

[JustOK]

There's the story about how intelligence was gathered by watching the number of pizza deliveries to the White House.
Imagine how much better this would be. Not only spying for the govt, and by the govt, but for corp espionage.

Company A: Hey, out data shows a number of people at our competitor are gathering at an off-site location...hmmm

Re:Pizza

[LoRdTAW]

Probably gathering for a pizza party!

Shhhh

[Anonymous Coward]

They just need to find an internal cache that never leaves the owner's devices to really highlight this problem in the world's press

Wow, a dumb troll

[SmallFurryCreature]

Linux is the kernel, neither Opera and Flash are required for the kernel or indeed many a distro ESPECIALLY Debian. There are many alternative browsers to Opera which has a tiny market share and not having Flash doesn't seem to have stopped iOS at all.

So, how does it feel to fail even at trolling?

Re:Wow, a dumb troll

[Catnaps]

He was being sarcastic, but do carry on.

Re:Wow, a dumb troll

[Anonymous Coward]

GP's point was that CarrierIQ is as much part of Android as Flash or Opera is part of Linux. The fact that it runs on Android and that carriers install it on Android doesn't change that.

How does it feel to fail even at basic reading comprehension skills?

Re:Wow, a dumb troll

[Anonymous Coward]

Carrier IQ is not required for the kernel either, and there are Android versions without it.

How does it feel to fail trolling the troll?

Re:Wow, a dumb troll

[Pi1grim]

Well, then nobody can use linux on computers with NVidia video card and call it linux? Or broadcomm wifi chips? That is the main problem with android — we don't have open source drivers for the phones. And that is the fault of mobile phone manufacturers. As well as locked bootloaders.

As for the CIQ — it is not a part of android. It is a third-party app, so comparison with flash is quite adequate. Heh, using your own argument — not having CIQ didn't stop CyanogenMod or other roms. Heck, I'm pretty sure there are some phones with stock android, that don't have CIQ preinstalled (mostly the ones, that carriers didn't get their dirty little hands on).

is this on iphone too?

[sunr2007]

would like to know whether apple/AT & T or apple/any other carriers do this on iphone too?

That makes it clear.

[Stumbles]

Their program is nothing more than a keylogger.

Re:That makes it clear.

[shutdown -p now]

It's a bit more than that - e.g. it can log distinct events such as receiving an SMS (complete with text), or URLs you type in the browser (not as separate keystrokes, but a complete URL).

The pertinent question is, what exactly gets sent over the network?

Re:That makes it clear.

[Anonymous Coward]

Using "nothing less than" would have made your meaning clearer to the sibling poster.

(Not a grammar nazi, just saying).

Not PCI compliant

[kooky45]

I believe this rules out all Android devices with CarrerIQ agents from being used to handle payment card numbers. There's no obvious mention on CarrerIQ's website of PCI compliance or how they protect the user's data. It probably also contravenes SOX, HIPAA and and host of other industry regulations. Bye bye lots of commercial use of Android handsets, especially Blackberry.

Re:Not PCI compliant

[Catnaps]

Haha oh wow, that's an excellent fucking point there my friend. Damn, I didn't even think of that.

Re:Not PCI compliant

[perryizgr8]

where does blackberry come in?

Re:Not PCI compliant

[Dan East]

And therein lies the solution to this problem. As soon as someone hacks into their database and steals a ton of credit card info, personal data, etc, there will be enough uproar and backlash to kill off CarrerIQ, and bite carriers like AT&T that preinstalled it.

Re:Not PCI compliant

[chrb]

Bye bye lots of commercial use of Android handsets, especially Blackberry.

Which Blackberry devices run Android?

Re:Not PCI compliant

[MimeticLie]

Poor phrasing. Blackberries don't run Android, but they do run CarrierIQ.

Re:Not PCI compliant

[gknoy]

I'd much prefer that their database never gets hacked. As effective as that might be at causing change, I don't relish the idea of all of that customer data in the open.

Re:Not PCI compliant

[Anonymous Coward]

Uhmm... Blackberry uses Android? Since when?

Just don't use devices from a carried that uses CIQ, simple as that. Vendor doesn't matter when it's the carrier installing the shit you don't want.

CAPTCHA: liberate

Re:Not PCI compliant

[Bucky24]

As far as I can tell (haven't read TFA OR TFS so if anyone knows other wise please correct me) this CarrierIQ software is installed on blackberries as well.

May I suggest...

[aug24]

...someone with skillz makes a freely installable CIQ clone that sends them back fake, randomly generated results.

Re:May I suggest...

[Catnaps]

Or Goatse. Lots and lots of Goatse. And Tubgirl. And Two Girls... well, you get the idea.

What are they thinking?

[joh]

I mean, really. Android (and the Android market and Android apps) already has grown a reputation of being full of crap and scamware and spyware and Google is somehow very much "we spy on you but in turn everything we offer is free" anyway. With things like that Google and the carriers just nail down Android phones as something you have to sell your soul for getting some free candy. And yes, people love free candy and have not really a use for their souls, but then smartphones aren't free at all. Things like this are just poison for the smartphone business, believe me.

Re:What are they thinking?

[Maow]

With things like that Google and the carriers just nail down Android phones as something you have to sell your soul for getting some free candy.

A couple things:

1) It's also on Blackberries, I think he said Nokia (Win phones? Symbian?), and who knows about Iphones - I suspect it is.

2) Google wasn't spying enough, so a 3rd party provided the software to the carriers, not through the app store to users.

It could be that Android's openness is what allowed this to be discovered.

How this will affect the smartphone market is hard to say, but I suspect people will want their "candy" and damn the consequences. So I kinda agree with you about peoples' candy desires, but disagree that this will significantly change the smartphone market (although I hope the carriers are sued silly over this).

Re:What are they thinking?

[thetoadwarrior]

It wasn't Android's openness that helped discover it otherwise it wouldn't have been found on the closed platforms and it's not like it was found straight away.

That's one big problem with the Android platform. It's open source so a lot of people think it's safe because there's obviously millions of people sifting through the code. Google's released code in no way tells you what is actually on the phone and people's trust in it being open source is just a false sense of security.

What about doing Internet Banking on one of these?

[Anonymous Coward]

Do they now have your details? What any other passwords you have entered on the device?

This explains...

[dohcvtec]

why Android phones are so laggy/sluggish.

Re:This explains...

[wall0645]

It's laggy/sluggish because the UI is written in Java.

Re:This explains...

[perryizgr8]

naah, that's just java.

Not found on stock Desire HD

[Catnaps]

I just checked a Desire HD we have here at work- bought in the UK a year ago, SIM-free, totally stock. No trace of CIQ in running applications. Maybe this is indeed US-only, or perhaps carrier-branded-only.

Re:Not found on stock Desire HD

[gl4ss]

carrier hands passed only.

what would samsung do with your information?

Re:Not found on stock Desire HD

[perryizgr8]

carrier hands passed only.

what would htc do with your information?

ftfy

In Soviet Russia phone would spy on you...

[Moskit]

...wait, it's true, only in Corporate USofA and today!

Read P.K.Dick on world taken over by corporations. He wa a visionary, like so many S-F writers. They have foreseen all things that happen, technically and morally.

But is the data actually transmitted anywhere?

[Wyzard]

In this video, the researcher is looking at debug logs from the phone itself, not network traffic logs showing remote communication. He clearly shows that keystrokes and URLs are being passed to the IQ software running on the phone, but presents no evidence that the data is actually sent to anything outside of the phone.

Has anyone determined what the IQ software does with all this information besides writing it to the debug logger? Is it actually sent somewhere, or saved to persistent storage on the phone? (I'm no Android expert, but I'm under the impression that debug messages are discarded when there's no debugger attached.)

Having this software running in the background is sneaky and certainly makes spying more possible than it would be otherwise, but it's not necessarily the huge immediate privacy violation that everyone seems to be assuming it is.

Re:But is the data actually transmitted anywhere?

[Catnaps]

Just because you don't have proof that the card skimmer on the local ATM isn't sending data back to its installers, doesn't mean it's not. It has the potential to, and it's designed to do exactly that- which should be enough for CIQ to be harpooned with all due haste.

Re:But is the data actually transmitted anywhere?

[WonderGod]

I was wondering the same thing. I would expect that if I hooked my phone up to a logger that it would grab everything including key strokes. How else could something be troubleshooted if the device had an issue.

I didn't see anything showing the device logging an outgoing network event to send the data anywhere. Or any other type of snoop showing data being sent to "The Man"

Some think it doesn't need to be running all the time but I could see this as being useful if the device suddenly had a serious error and you had to send it in to the device manufacturer to diagnose what the heck happened. Although it is sneaky. There should be an opt out of the software running.

Re:But is the data actually transmitted anywhere?

[WonderGod]

While you are correct, most applications have some type of debugger to log events in case something goes wrong so that a root cause can be determined after the fact.

Not saying it does or doesn't send it, just saying the video doesn't prove anything but a debug log of events is written.

Re:But is the data actually transmitted anywhere?

[b4dc0d3r]

Since you're already at +5, I'll just add that you, sir or madam or mixed/indeterminate gender person, have won today's "Critical thinking on the internet" prize.

Nothing has been proven, so we can't say that it is, or is not, being transmitted. clearly undercuts that claim is demonstrably false. From CIQ's own statement:

While we look at many aspects of a deviceâ(TM)s performance, we are counting and summarizing performance, not recording keystrokes or providing tracking tools.

It is entirely plausible that keystrokes are logged, and summarized, and the summary data is sent instead of each keystroke., making CIQ's claims entirely true. This does not eliminate the possibility of malware reading the logs, which presents a super serious privacy problem. But we have not shown that CIQ or anyone else gets individual keystrokes as part of normal operation of the software.

The fact that such a log exists, and can be read by any Android Market app that requests normally innocuous read access makes this software a serious privacy concern, but only with 3rd party applications installed - not inherently.

Re:But is the data actually transmitted anywhere?

[thetoadwarrior]

The problem is more that it doesn't tell you what it does or allow you to get rid of it and even if they're telling the truth it's a built in keylogger that someone else could use to make it easier to get your data. That and if they don't need to know what your typing then why log unique numbers for each key. Why not just log something like "key pressed" rather than what is effectively saying "B key pressed"?

Re:But is the data actually transmitted anywhere?

[Anonymous Coward]

Why on earth would you spend time developing a stealthy program that has access to the full systems of the phone logging everything and then not doing anything with it (which implies sending it somewhere).You think this app was designed to be some art project?

Re:But is the data actually transmitted anywhere?

[strags]

Go to CarrierIQ's site. All these questions are answered.

Re:But is the data actually transmitted anywhere?

[thoromyr]

where? All I saw was some flash and a link to a PDF that says, "no, we don't". It doesn't explain why they need to log which key is pressed if they are only tracking number of key strokes or some other aggregate information. It *also* implies that the information is shipped off the phone ("stays within the carrier's network" or something like that). GP is right, why else are they doing it.

So where does he show this data is sent anywhere?

[Anonymous Coward]

I can see in the Video that the application gets notified about a lot of stuff, could someone show that the data actually leaves the phone?

iPhone

[koan]

So is this a +1 for the iPhone and Apple's need to control their shiz or our they doing the same thing internally? Since CarrierIQ is effectively a key logger doesn't that make it illegal" Are we going to see some legal action here?

Re:iPhone

[kuhnto]

If I send an email to a co-worker via Blackberry that contains proprietary company or government information, there is a possibility that the data is now in the hands of a third party. I may now be liable for criminal and civil penalties because of this shared data... or not. the entity that did share it most likely would though.

Re:iPhone

[koan]

Yes so in effect CarrierIQ is doing just that and it should be (or maybe is) illegal, I think we may be hearing more about this.

FWIW

[Cornwallis]

I have an AT&T provided Samsung Galaxy and don't see it on that phone. AT&T Support also provided the following:

Please note: Protecting your personal information is one of our highest priorities; hence, you will be required to provide account related information to ensure whom we are working with. Data encryption is also enabled to protect your personal information during this chat session. For more information please go to http://www.wireless.att.com/privacy/ or http://www.att.com/privacy/. Please wait for a site operator to respond.

You are now connected with 'Allison'.

Allison: Thank you for contacting Business Data Support. My name is Allison. Before we begin, can I confirm the wireless number that we will be working with is XXX-XXX-XXXX?

Me: Correct

Allison: I understand you want to know if your phone has CarrierIQ on it, is that correct

Me: Correct

Allison: I'll be more than happy to assist you, one moment please.

Allison: That does not come installed on any of our devices.

Me: Thank you.

Allison: If you need additional assistance specific to your device, you can view our website at http://www.att.com/biztech. We welcome your feedback; please take a moment to complete our Customer Satisfaction Survey. Thank you for your business and have a pleasant day.

Chat session has been terminated by the specialist.

Re:FWIW

[Andy Dodd]

Which "Galaxy" - The Captivate, the S II, or the Shitrocket?

Allison lied to you - the Shitrocket is definitively confirmed to have Carrier IQ. Most likely the HTC Vivid also has it.

The Galaxy S II does not have it.

The Captivate does not have it, but Gingerbread for the Cappy might have it.

The Infuse does not have it, but Gingerbread for the Infuse will.

Re:So where does he show this data is sent anywher

[toonces33]

That's probably the next step. Using a WiFi network and a packet sniffer, one ought to be able to see what traffic is generated.

I have an HTC Amaze from T-Mobile, and so far I haven't found any signs of a HTCIQ app. I suppose they could have renamed it, or maybe it isn't present. I will try the logcat thing later to see..

Absolutely illegal

[Riskable]

Some other folks were speculating that since you signed an agreement with your carrier that it somehow makes this legal. This is absolutely false. There are certain rights that you can sign away, certainly, but don't think of it like that. Think of it like, "What is Verizon doing with this data and how are they transporting it?"

Here's a few laws and industry regulations they are violating (by recording all keystrokes) off the top of my head:

1) The Payment Card Industry Data Security Standard (PCI DSS): If anyone ever (ever) enters credit card information into their phone (via an app, web page, whatever) that data must be protected according to the DSS (because all the carriers accept credit cards, that is). That means it must be encrypted in transit, when it is stored, and more importantly: certain information must *NOT* be stored (again, ever). For example, if a user enters the CVV2 from their card into an online form the carrier must ensure that this data does not get stored (good luck with THAT regex! hah!).

2) Graham Leach Bliley Act (GLBA). Undoubtedly, personally identifiable financial information is being recorded, transported, and stored without the user's knowledge or consent (each transaction/event would need its own notice and agreement with the carrier). That could add up to literally MILLIONS of violations.

3) Sarbanes Oxley: If they're recording this data they had better damned well keep an audit trail on it and be regularly disclosing that they're doing so to all their investors. They also must have documented controls & procedures and (likely) perform regular audits to ensure that said controls & procedures are being properly followed.

4) They can be held liable for having knowledge of crimes but not reporting them.

5) They can lose their common carrier status: Since they're now recording literally everything users do online they can be held (partially) accountable for what those users do. If you recorded the data you certainly could've audited it for fraudulent activity. "Have you been the victim of a crime that took place over a cell phone? Call the law offices of Sue & Win."

6) There's probably a dozen laws that say you can't intercept and/or store information related to people's banking accounts and financial transactions (unless you're the bank that the customer is interacting with). These laws are the ones that should make the carriers quiver in their boots. Some of these were written specifically to deal with gangsters and organized crime and as such could land executives in prison (not that I think the U.S. Attourney General would prosecute since our government is sadly, "stupidly hard on individual crime but soft on corporate crime").

7) Unless their contract specifically spells out that they're going to record every keystroke you enter into your phone they've opened themselves up to millions of lawsuits. If anyone ever wins one of these it will be game over for the carriers. "verizon" and "at&t" will likely become some of those "$50-per-click" Adwords on Google.

8) If they're not using proper encryption of this data in transit and storage, the PCI DSS will be the least of their problems... That's criminal negligence right there. After hearing all the controls the Payment Card Industry requires of the carriers for something as simple as a credit card number what jury could be convinced of a defense such as, "We didn't know!"?!? I mean, seriously. Forget being fired. If someone knowingly decided it was a good idea to record all keystrokes they should go to prison. It is the penultimate example of why you don't put non-technical people in charge of making technical decisions.

Re:Absolutely illegal

[AB3A]

Going a step further, there should be liability for those who collect this data: If the user downloads kiddie porn, they're now liable because they were able to know this and didn't act. If the User stalks someone and they do not report this to authorities, they should be held liable. If someone tweets messages that indicate suicidal tendencies and they take no action, they can be held liable.

Collect this data at your peril. You want to know all about me? Fine. Now you become an accessory for everything I do wrong.

Re:Absolutely illegal

[__aagmrb7289]

While I agree, as far as I can tell, with all of your other points, PCI compliance is not an issue for this company. These rules apply only to companies that are processing credit cards. It's quite legal for anyone to store as much plaintext credit card information as they want - they will just not be allowed to actually process data through PCI compliant processors. I bring this up because many other posts on this thread mention the same issue. And it's important, in my opinion, to focus your efforts on things based in real facts. So, point is, these companies are not in compliance with PCI, but they are also not required to be in compliance with PCI, based on what I've seen posted about them.

Re:Absolutely illegal

[Riskable]

I used to be a Payment Card Industry Qualified Security Assessor (QSA). I would to go into a business, audit them, and then give a big report to their payment processor detailing every little thing (related to security controls and credit card stuff) they're doing wrong (and to be fair, everything they're doing right). In this case, all of the U.S. carriers *do* accept and store customer credit card information which means they regularly have QSAs stopping by to audit the place (at least once a year). Therefore they *must* comply with the PCI DSS.

There's no question in my mind: If I were performing a PCI audit of Verizon or AT&T and I stumbled across credit card information in some database along with CVC/CVV2 codes that also happened to have people's usernames and passwords that would definitely go into my report (it would also likely warrant a call to my contacts at the PCI org and the payment processor ASAP)! It would raise all sorts of red flags and they'd have to account for it and protect it like any other credit card/financial data. I'd demand that they show me the following:

1) Where the data came from?
2) How it was being transmitted over the network (cleartext? Hah! That'll increase transaction fees)?
3) How is it being stored? If it isn't encrypted they'd be in serious trouble.
4) CVV2 data? That's just asking to be fined a huge sum of money and to have your transaction fees increased (which in the case of the carriers would be a much worse punishment than a measly seven figure dollar amount). They'd need to provide me a detailed remediation plan for that one (as in, "You have until the end of my audit to write up a detailed plan on how you're going to scrub the CVC/CVV2 data from the database").
5) Specifications and configuration details on all hardware that runs this collection software. From the perspective of PCI every phone collecting such data is now classified as a terminal. They won't be able to get away with saying it is a service (like a website where the terminals aren't controlled by them) which means they'd say goodbye to me at the end of MY audit and say hello to the PCI org's internal hardware audit team (that usually works with companies that make payment terminals and credit card scanning machines). They're MUCH more strict and have a *lot* more rules than the measly little DSS.

I'd also like to mention that the fact that they still collect data from customers that aren't on contract anymore is an order of magnitude worse than anything else I've previously mentioned. I can't even fathom how pissed a jury would be with Verizon or AT&T (companies that everyone already loves to hate) for knowingly collecting HIPAA-classified private health information alongside GLBA-classified financial information in secret. Throw in a data leak and you've got yourself one hell of a rap sheet.

Re:Absolutely illegal

[__aagmrb7289]

Good points! I was thinking less in terms of the carriers (and by the way - good chance they outsource the storage of that information - so they may NOT need to be PCI compliant - their processors might be handling that for them - my company does this for many other companies) - and more in terms of the software company that created the crapware.

Re:Absolutely illegal

[kumanopuusan]

I'm just curious—what's the ultimate example?

Re:Absolutely illegal

[fsckmnky]

1) The Payment Card Industry Data Security Standard (PCI DSS):

The PCI DSS is not a law or an industry regulation, but an industry standard that is an agreement between private parties, and it is up to the mastercard/visa people to pursue in civil court if they so decide. No crime here.

2) Graham Leach Bliley Act (GLBA). Undoubtedly, personally identifiable financial information is being recorded, transported, and stored without the user's knowledge or consent (each transaction/event would need its own notice and agreement with the carrier). That could add up to literally MILLIONS of violations.

GLBA applies to "financial institutions" and Verizon / CarrierIQ are not financial institutions.

Also, from Verizons website, which, I am assuming is part of their TOS/customer contract:

Verizon Wireless may use mobile usage information and consumer information for certain business and marketing reports. Mobile usage information includes the addresses of websites you visit when you use our wireless services. These data strings (or URLs) may include search terms you have used. Mobile usage information also includes the location of your device and your use of applications and features. Consumer information includes information about your use of Verizon products and services (such as data and calling features, device type, and amount of use) as well as demographic and interest categories provided to us by other companies (such as gender, age range, sports fan, frequent diner, or pet owner).

Note where it says "includes." Legally the term "includes" does not exclude other types of data not specifically mentioned.

3) Sarbanes Oxley: If they're recording this data they had better damned well keep an audit trail on it and be regularly disclosing that they're doing so to all their investors. They also must have documented controls & procedures and (likely) perform regular audits to ensure that said controls & procedures are being properly followed.

- Has nothing to do with customer information transmitted on Verizons network. Only pertains to corporate accounting practices.

4) They can be held liable for having knowledge of crimes but not reporting them.

If the data is not analyzed for criminal activity, then the company has no knowledge of crimes. Data != knowledge of criminal activity. If you have a specific legal reference or precedent, by all means let everyone know about it.

5) They can lose their common carrier status: Since they're now recording literally everything users do online they can be held (partially) accountable for what those users do. If you recorded the data you certainly could've audited it for fraudulent activity. "Have you been the victim of a crime that took place over a cell phone? Call the law offices of Sue & Win."

From wikipedia:

Internet Service Providers have argued against being classified as a "common carrier" and, so far, have managed to do so.

This seems to be pure speculation on your part.

6) There's probably a dozen laws that say you can't intercept and/or store information related to people's banking accounts and financial transactions

There's probably a dozen planets with intelligent alien lifeforms. Without details, it will remain a probability of an unknown quantity.

7) Unless their contract specifically spells out that they're going to record every keystroke you enter into your phone they've opened themselves up to millions of lawsuits. If anyone ever wins one of these it will be game over for the carriers. "verizon" and "at&t" will likely become some of those "$50-per-click" Adwords on Google.

Their website, as noted above, and assumed to be part of their TOS, states they are recording "mobile usage information

It's doesn't necessarily log keystrokes

[Anonymous Coward]

It may just be counting them. From a press release [pdf] Carrier IQ issued about this issue:

While we look at many aspects of a device's performance, we are counting and summarizing performance, not recording keystrokes or providing tracking

If they count keystrokes they probably do that by adding an eventhandler to the appropriate event and have it add 1 to a counter on each keystroke. If you let a debugger show those method calls I would expect to see exactly what the video shows. The SMS and HTTPS search URL look similar to me: event handlers being called with event data.

Carrier IQ may be doing nothing more than they claim they do: count things. Perhaps they are doing nastier things, but I don't see anything that convinces me of that in this video. The video shows methods being called, not what is being done with the data.

Having said that, I think that a user should be the user's choice to have statistics being collected about him/her. It should be possible to disable Carrier IQ, it shouldn't even be enabled without the user's permission.

"Cellphones are Stalin's dream" -- Stallman

[Squidlips]

Yes another reason to not have a cell phone. I don't have one and don't miss this electonic leash a bit. I intend to enjoy these last few years of freedom before Big Brother REQUIRES us all to carry one. Already various states are thinking of requiring GPS-enabled transponders in cars.

Re:"Cellphones are Stalin's dream" -- Stallman

[peppepz]

Yet another reason to have a cell phone whose software can be built from source by its owner.

As we used to be able to do on dear old PCs, before we were taught that we actually don't need that, that the average user doesn't want that, that we are geeks and should therefore shut up, that plaform lockdown would have led us to a world of everlasting software security, etc.

Wait a minute

[Anonymous Coward]

The article says:

"By the way, it cannot be turned off without rooting the phone and replacing the operating system."

Can anyone elaborate on that? Does it mean that also those who flashed cyanogenmod are not safe?

Not exactly accurate...

[djrbliss]

Disclaimer: I have thoroughly reverse engineered CarrierIQ's software.

This issue has been blown out of proportion. CarrierIQ has hooks that respond to events triggered by keystrokes, web traffic, and SMS messages. It also makes the mistake of printing debugging output containing plaintext of some of this data, which is a pretty bad screwup. Additionally, there's no real reason CIQ should have hooks in those places in the first place.

What they don't do is actually store any of this information and report it to your carrier (keep in mind I know this because I actually looked at the application). In terms of what's actually being stored, I've seen no evidence that CIQ is collecting anything more than what they have publicly claimed: anonymized metrics data. That doesn't mean users shouldn't be able to opt-out of this software, since it still represents a potential risk to privacy. But at this point, this whole thing has turned into a witch hunt.

In short, there's a big difference between "look, it does something when I press a key!" and "it's storing all my keystrokes and sending them to my carrier!". This video demonstrates the first, but the second doesn't actually happen. They shouldn't be doing what they're doing, and users should be able to opt out, but this isn't nearly as evil as people are making it out to be.

Re:Not exactly accurate...

[flimflammer]

Interesting, if true then even my take on it has been overblown. I guess I should have known if this guy claims not having an end user friendly application name, a custom icon, a clear privacy policy, and a widget is tantamount to undermining the functionality of operating systems and therefore is a rootkit.

Re:Not exactly accurate...

[Anonymous Coward]

It's not hard to understand why he wants to sensationalize the issue. He sells a $0.99 app on the Android marketplace to remove the software. That probably explains why he can't show that the data is actually stored anywhere, or what gets sent back to the mother ship, or why he'd claim that logging the URL for the google GET of a search shows his search terms (I see the same thing with wireshark on my PC, the https stuff isn't cracked.) Even in all the training manuals he found none of the sample screens ever show a name, just device ID's and phone numbers.

He works for a company that actually does log user activity in real time (and knows how that can cause publicity.)

http://www.linkedin.com/in/trevoreckhart/

Check out the telogis home page, watch the sample displays with employee names being monitored real time.

http://www.telogis.com/

Where is the "remove telogis" app?

Re:Not exactly accurate...

[Anonymous Coward]

>>> Disclaimer: I have thoroughly reverse engineered CarrierIQ's software.

When? Why? Can you provide proof of *your* claims?

The whole purpose of the software is to upload usage information! That's its whole reason for being. If you couldn't find the uploading code, then you messed up big time.

Also, you might not have exposed all code paths, even if you ran the executable in a virtual machine for some time. A trigger might dynamically load new code, and you might not have the knowledge needed to recreate the trigger conditions.

You might have convinced yourself that you were thorough, but there is no way to judge your assertions without direct evidence.

Re:Not exactly accurate...

[Anonymous Coward]

What they don't do is actually store any of this information

Which probably means actual keys and SMS texts, unlike keypress and SMS counts.

But I second the request for more details.

Re:Not exactly accurate...

[Anonymous Coward]

The purpose of it is to provide debugging information when things go wrongs, like a dropped call, the data is going to your carrier not CarrierIQ, your carrier already knows your usage, but it may not know what your phone is doing or seeing when your phone drops a call.

I'm almost totally with this guy, but...

[flimflammer]

On his site, while trying to define CarrierIQ as a rootkit, he pulls an excerpt from the definition on Wikipedia that states a rookit "subverts standard operating system functionality." This is absolutely true, but he then goes on to say:

Carrier IQ also subverts standard operating system functionality. For any application, I believe standard operating functionality includes having a descriptively named application; a launcher icon, settings menu, widget, or other method to allow the end user to access the application; and a privacy policy clearly available on the device the application is installed on.

Huh? This guy clearly does not understand what the word "subvert" means. It's tantamount to undermining the functionality of the operating system if you don't have a descriptively named application, a custom icon, a settings menu, widget, and a visible privacy policy? That has got to be the worst grasping of straws I've seen anyone attempt while trying to make a point.

I completely agree with his overall message -- this CarrierIQ thing is ridiculous and I hope they are eventually held accountable for their gross violation of privacy, but seriously now. It's not a rootkit for not having a settings menu, widget, custom launcher icon, or end user friendly application name. It's a rootkit because it can't be shut off and for all intents and purposes tries hard to stay hidden while completely violating the security of anyone using the phone.

Re:I'm almost totally with this guy, but...

[flimflammer]

In amendment to my post, after having read this comment and if it's in fact true, I'm not sure what to make of this whole ordeal. Now I feel silly for going along with the hype. It would certainly still be a large privacy violation (and I still consider the inability to disable/remove puts it in rootkit territory since it is not essential to the functionality of the OS or service) but not close to the scale being trumpeted.

how can i hire a team of...

[Anonymous Coward]

How can i hire a team of specialises to read every EULA to make sure my privacy and rights to use a product i buy with my money to be used as i feel.

Is there a way to buy the/a device and use it without signing the EULA?

Spoof?

[seven of five]

Can't someone simply write a spoof program to mimic Carrier IQ's output and send them spurious junk?

Re:Spoof?

[Squidlips]

Vast, vast quantities of spurious junk...from all over the world...

In Soviet America...

[openfrog]

...capitalists spy on you.

I want CarrierIQ on my phone

[spaceman375]

I mean, I REALLY want it. I like it so much that I want my phone to continuously send a stream of keystrokes, URLs, and any other data that fits into their protocol directly to their servers, even if I have to stuff it directly from a random number generator. Hell, can I get 3 or 4 streams going at once? How about ten or more from my PC, tablet, and laptop too? My GPS numbers can demonstrate faster than light travel around the planet! Perhaps a direct feed rebroadcast from live news sites might help them fill their databases. They want data - let's flood them with it until their data is so full of garbage that no one will buy it.

How to know do I have it installed?

[Anonymous Coward]

Any quick way to find, do I have it installed? Non-rooted, factory default firmware, updated over the air to latest Android available for the device, which is 2.3.6.

CarrierIQ intrusivity = 911 benefits for everyone?

[keneng]

We rely on the fact that CarrierIQ staff are reliable, trustworthy, vigilant and proactive. In that manner the CarrierIQ System will benefit everyone, not just the government.

Recently a man I knew passed away from a heart attack while attempting to make a 911 emergency call. He managed to dial "9" and "1", but not the final "1". The CarrierIQ system could have detected this and proactively alerted the relevant authorities. The CarrierIQ system is passively relaying data to the overseeing security/police authorities anyways so it is reasonable to request they modify the CarrierIQ system to proactively identify probable emergency scenarioes and help bring aid as soon as possible. Phones could have built-in sensors to activate and confirm the emergency scenario in order to prevent wasted resources from mobilizing.

Of course CarrierIQ has a lot of room for corruption and abuse. That's why these systems need transparency and accountability and other checks and balances. One thing is certain: the general public should pay more attention to CarrierIQ because it is so highly intrusive into our private lives.

Hats off to Trevor Eckhart for being so vigilant.

The video proofs nothing

[Anonymous Coward]

The video just shows, what events go into the local agent and not wether this information is stored and send anywhere.

It is the normal behaviour of most applications to filter out only a small part of interesting events for further processing.

Lots of other systems (eg desktop Windows for a long time) make pretty easy to get information about other applications input (which did not mean that every application receiving a specific event, is also using it).

So the interesting question would be, what is actually send.

A remark about the privacy policies (and EULAs alike): Do you really believe any user actually reads them (and understands what he is agreeing to)?

gagggg

[Anonymous Coward]

man i'm so happy to be rooted and alt-rommed today .... ah ah ah , is this little piece of crapware present on "most" platforms ?

Google ALLOWED It?

[Anonymous Coward]

Your argument is idiotic. Android is open source. They can not dictate the actions of the phone companies due to the GPL.

Anyone can roll their own distro with a root kit or spyware installed. The trick is to get the unwitting consumer to drink the poisoned Kool-Aid. Now that consumers have done so, with both Android and Apple products, they have no grounds to lay the blame on Google.

Re:Google ALLOWED It?

[toadlife]

Your argument is idiotic. Android is open source. They can not dictate the actions of the phone companies due to the GPL.

Only the kernel is GPL. The rest of Android is licensed under the Apache license, and Google is under NO obligation to license it that way...or even release it.

Who's being idiotic now?

Two quibbles

[alispguru]

Apple develops the hardware, the OS, and the debugger - and it is all closed source.

Most of iOS is open source.

There could easily be something like CarrierIQ in the closed parts of iOS. However, it would not be useful to Apple unless it phoned home somehow, and that network activity is detectable whether or not the platform source is open.

Re:Two quibbles

[exomondo]

Most of iOS is open source.

Except that since you can't get the source code to iOS (you can't build iOS) that makes it closed source.

Re:Two quibbles

[Anonymous Coward]

Not "most". More like "virtually none". Did you even look at that link? It's just Webkit and a few compiler tools, which has very little to do with the OS itself.

call carrierIQ on +1 650 625 5400

[Anonymous Coward]

I guess the best way to find out is to call CarrierIQ (Phone: +1 650 625 5400) and ask how to stop/remove that !@*# software ... sorry I tried to be polite

You rang?

[Anonymous Coward]

It is not! illegal! for you to agree! to! the! carriers! collection of the data! which! is why! regulation specifically! making it illegal! or! spelling out your rights! is! required! to stop it!

And I prefer to be called Captain Kirk, thankyouverymuch

Send an email or letter to your carrier

[Anonymous Coward]

Seriously, nothing here in Slashdot or on that dude's website will catch the ear of Sprint, Verizon, etc. So take a minute and send an email to let them know you aren't happy about this. If enough people do it and it gets traction, then something might happen.

If you email from your smartphone, then you might not even need to hit the button....

Contact CarrierIQ, demand opt-out information

[Anonymous Coward]

CarrierIQ has posted a notice with (mostly false) information on their website. They include a media contact, Mira Woods, at (617) 513-7020. If you own one of these phones, call them and demand information on how to remove it or opt out of their data collection.

The more people they hear from, the better.

I use an iPhone

[Paul1969]

Recording of signal quality, etc., is done by Apple on an opt-in basis. It is off by default.
Apple's refusal to allow carriers to add whatever "enhancements" they wanted is the main reason it took so long for carriers other than AT&T to get the iPhone.

National Security stupid

[Anonymous Coward]

How is this not a national security issue? This the one of the many reasons they don't want the President using personal communication devices? I'd love to know if CIQ is loaded on Obama's phone.

I was ALMOST going to buy an Android

[assertation]

I've been putting off buying a smart phone for years. First, because I didn't want another monthly bill and I rarely use my cell phone as it is.

Then the controversy with the iPhone and Android tracking your location.

Now the Android is logging keystrokes ( I would bet the iPhone is as well ).

The other week I found out I can get a pay as you go smart phone which fits my needs perfectly. I was planning to start shopping for an Android.

I think I will save myself some money and my privacy by skipping that chore for a few more months.

Carrier IQ can be removed

[Anonymous Coward]

Carrier IQ can be removed from Android devices rather easily by either installing a custom ROM or installing an app that can be found on the Android Market. You can find more information on this at: http://www.android-advice.com/2011/remove-carrier-iq-ciq-keylogger-on-android/

get the carriers out of distributing cell phones

[theangryswede]

If phones and their respective plans were purchased separately like in Europe this problem would most likely have been avoided along with a host of other problems such as bloatware, annoying carrier branding, etc...