Carrier IQ Drama Continues

alphadogg writes "A Cornell University professor is calling the controversial Carrier IQ smartphone software revelations a privacy disaster. 'This is my worst nightmare,' says Stephen Wicker, a professor of electrical and computer engineering at Cornell. 'As a professor who studies electronic security, this is everything that I have been working against for the last 10 years. It is an utterly appalling invasion of privacy with immense potential for manipulation and privacy theft that requires immediate federal intervention.'" Read on for a grab-bag of other news about the ongoing story of Carrier IQ's spyware. Federal intervention is already on the menu; new submitter mitcheli writes "Following the video from Trevor Eckhart on Youtube after the filing of the Cease and Desist letter and subsequent reply by the EFF and apology letter (as reported on Slashdot), Senator Franken of the Subcommittee on Privacy Technology and the Law asks some rather pointed questions."

Franken has more reason, apparently, to look into this than might legislators in other countries; an anonymous reader submits news that Cambridge researchers have found the software to be confined to (or at least only confirmed in) American customers' phones. From their report: "We performed an analysis on our dataset of 5572 Android smartphones that volunteers from all over the world helped us create. From those 5572 devices, only 21 were found to be running the software, all of them in the US and Puerto Rico. The affected carriers we observed were AT&T, Boost Mobile and Sprint.
We found no evidence of the Carrier IQ software running on Android devices in any other country."

Another anonymous reader suggests that "Apart from anything else, the fundamental mistake that Carrier IQ made was attempting to silence a developer using a heavy-handed legal threat. Certainly this was the tipping point in terms of bring the whole incident to the public's attention."

Like apparently begets like; reader adeelarshad82 writes "Not surprisingly, the Carrier IQ controversy has resulted in some legal action. Class-action lawsuits have been filed in California and Missouri that accuse Carrier IQ, as well as Samsung and HTC, of violating federal wiretap laws. The California case was filed on behalf of four smartphone users with HTC and Samsung devices and accuses the companies of violating the Federal Wiretap Act, which prohibits the unauthorized interception or illegal use of electronic communications, and California's Unfair Business Practice Act."

Finally, GMGruman writes with the cautionary note that Carrier IQ and Facebook pose "the least of your privacy threats": "[S]o far these forms of monitoring anonymize the data, so an individual's actual privacy is not invaded. And while people fret over these potential invasions, a more pernicious privacy invasion is under way, one that monitors actual individuals and then uses that information to try to direct their behavior. For example, car insurers give monitoring boxes to customers to track their driving behavior and offer a discount if it is 'good.' Of course, the flip side is higher rates or no coverage if the black box decides you are "bad." And, as this blog post points out, this is just one of many such 'Big Brother corporation' efforts out there that give significant power to insurers and others who have a history of abusing personal information, such as for redlining and coverage denial."

Comments

Analytics for Mobiles

[InsightIn140Bytes]

Isn't it interesting that the only OS that sent the info out by default was Android? iPhone didn't. While they were there too, Carrier IQ was disabled by default.

And after all, Carrier IQ was just Google Analytics to mobiles. I can just hope that people start the same kind of uproar once they realize how much Google is spying them. If it's not allowed on mobiles, I don't see why it should be allowed on our computers and internet. Maybe there's still some hope in humankind.

Re:Analytics for Mobiles

[masternerdguy]

The general population of Slashdot finds these things distasteful, and I'm sure the rest of the world would too if they actually knew about it. This isn't the kind of news the majority hears.

Re:Analytics for Mobiles

[Spad]

Nice troll, but the vanilla Android devices (Nexus line) don't ship with the CarrierIQ software, which means that either the handset manufacturers or, much more likely given the US-centric focus, the carriers are responsible for installing it.

Re:Analytics for Mobiles

[InsightIn140Bytes]

That might be so, but it doesn't change the fact that it's only Android devices where it's enabled by default.

Re:Analytics for Mobiles

[Lisias]

Isn't it interesting that the only OS that sent the info out by default was Android? iPhone didn't. While they were there too, Carrier IQ was disabled by default.

So interesting as the fact that only Noth America seems to have Carrier IQ on their Android devices...

And after all, Carrier IQ was just Google Analytics to mobiles. [...]

Google Analytics ANALyses every keystroke on your computer? Because Carrier IQ receives every dialer keystroke on the device.

(I'm not saving Google's face here)

Re:Analytics for Mobiles

[Anonymous Coward]

Wrong. Apple install it by default and even obfuscate the files. It doesn't exist in Android, only the US carriers are installing it. Typical myopic Apple zealot, aren't you.

Re:Analytics for Mobiles

[Anonymous Coward]

Isn't it interesting that the only OS that has Carrier IQ on every single device, supplied by the OS developer, is iOS?

See, it works both ways. Now how about we stop turning this into a retarded smartphone manufacturer fanboy flamewar and throw stones at Carrier IQ and the carriers that support them, which is where they belong?

Re:Analytics for Mobiles

[larry bagina]

Traditional BSD/GPL flamewars boil down to "freedom for the user" vs "freedom for the developer". Android is "freedom for the handset manufacturers and telcos".

Re:Analytics for Mobiles

[Anonymous Coward]

-which would be like saying that it's only windows based laptops ship with adware installed by default. It might be true but it's missing the point.
Whether it was included or enabled was purely the manufacturer's design and has nothing to do with which os it runs on; a more relevant observation would be which phone manufacturer chose to include Carrier IQ on their android phones, in this case AT&T, Boost Mobile and Sprint.

But I have the feeling that calling those guys evil doesn't have the same punch as calling android out.

Re:Analytics for Mobiles

[Anonymous Coward]

As a Linux fan through and through for fourteen years and counting I am endlessly surprised at the android circle jerk. Linux's customers are smart people who choose to use Linux, and linux distro providers work to supply them with what they want. Apple's customers are (probably also) smart people who don't want to care how a computer works (for good or bad) or customers with money to burn. Still, apple work to give them what they want . Microsoft's customers are people who want to get a job done with standards (even if they're bad), and MS will work to give them what they want (even if I disagree with the quality of what they provide)

But google's customers are advertisers. We, the users, are the product not the clientele, and issues like this with android WILL NOT END until google fundamentally changes its business model.

Google has and always will work to give their advertisers and marketers what they want first. The users and our privacy are a secondary priority

Re:Analytics for Mobiles

[Anonymous Coward]

The problem is that if enough people have google analyics installed on their websites, that it doesn't matter whether you use it yourself or not. When I started using no-script I was surprised at how many websites try to serve up scripts from google analyics (easliy more than 50 %).

Re:Analytics for Mobiles

[thisnamestoolong]

There is a big, BIG difference between CIQ and Google Analytics. Google Analytics tracks your browsing behavior, which is on the open web, and is being done in public. While it is certainly creepy that your web browsing behavior is being tracked, you are still doing all of that in public, where you have no expectation of privacy. CIQ, on the other hand, is a keylogger. It can track private communications that you are intending to send out encrypted before you even send them. This is a whole different ball of wax, and is considered to be criminal behavior in almost all cases in the PC world. Comparing Google Analytics to CIQ is like comparing a case of the common cold to ebola, there are certainly similarities, but one is VERY different in terms of degree.

Re:Analytics for Mobiles

[pushing-robot]

the vanilla Android devices (Nexus line) don't ship with the CarrierIQ software, which means that either the handset manufacturers or, much more likely given the US-centric focus, the carriers are responsible for installing it.

...Which is a very good point. Google gives not only end users but also manufacturers and carriers relatively free reign over Android phones. Apple retains much more control over the iPhone.

While it's easy to see how Apple's strategy can hurt power users, Google's strategy can hurt users also.

Re:Analytics for Mobiles

[rvw]

That might be so, but it doesn't change the fact that it's only Android devices where it's enabled by default.

That's probably because the carriers are not able to enable it in iOS. So Apple - the only manufacturer of iOS devices - doesn't want it enabled in their phone, and the carriers are not able to do this. Android is more open, so either the phone manufacturers like Samsung and HTC can install it, or the carriers. So it's true, but it's only true because of the open nature of Android.

Re:Analytics for Mobiles

[Anonymous Coward]

That might be so, but it doesn't change the fact that it's only Android devices where it's enabled by default.

If you had read the article you'd have seen that not all Android devices are affected. I quote you the fucking article:
        "We found no evidence of the Carrier IQ software running on Android devices in any other country."
Given the huge number of Android devices sold abroad, this is only a fraction of total Android sales.

Also, contrary to what you stated earlier, it's not the OS that sends out your info, it's an app that carriers installed. Since you're so unaware of the amount of customization that the various carriers make on their Android phones I think it's safe to assume that you're an Iphone user. And one who lacks a basic understanding of logic too.

Re:Analytics for Mobiles

[madmark1]

As a 'Linux fan', you should know that not everything provided in your install was provided by the manufacturer, or was part of 'Linux'. Neither is CarrierIQ in any way part of Android. It is a separate piece of software, installed on some Android based phones by the carrier. It does not send data to Google, and there is even some debate on whether it sends anything, or merely logs it. Google is not benefitting from this data, nor can they sell it to others, since it isn't data they collected, or even knew about. It also, I might add, is installed on every iPhone from AT&T. It is likely still logging, but only sends the data back to CIQ if you allow it (which on older iPhones, is when you activate it. there seems to be no way to turn it off after that).

Re:Analytics for Mobiles

[jhoegl]

Actually it was carried on NBC the other night where I heard about it first.

There are conflicting reports about it actually sending data vs not sending.

Re:Analytics for Mobiles

[masternerdguy]

That's a good sign, do you have a link to the story? Nobody I know has heard of it, and I first heard of it from Slashdot.

Re:Analytics for Mobiles

[Anonymous Coward]

Only America America. Canadian carriers don't, and I haven't heard anything about the rest of NA (you know, those other countries South of the US?)

Re:Analytics for Mobiles

[Ostracus]

How Carrier IQ was wrongly accused of keylogging

Re:Analytics for Mobiles

[Anonymous Coward]

Google Analytics ANALyses every keystroke on your computer? Because Carrier IQ receives every dialer keystroke on the device.

(I'm not saving Google's face here)

The article you linked to doesn't say anything about that. It just speculates that a future Google product might collect a bunch of data about you. Google does not ship any products with Carrier IQ. That is something added by your phone company or whatever.

Re:Analytics for Mobiles

[justforgetme]

the story "Usually coupled with a lot of FUD" has been circling the facebooks, g+s and reddits for about a week(?) now.
Mass media have also gotten attention to it, I saw it on the news yesterday on a b side channel..

What I still can't fathom is why apple was shipping it "disabled" by default.... misplaced bits?

Re:Analytics for Mobiles

[jhoegl]

MSNBC Look at December 1st, "Secret software tracks phone activity"

Re:Analytics for Mobiles

[ColdWetDog]

It would be interesting to see if CarrierIQ was installed on Android / iOS phones from some of the more 'repressive' regimes like China, India or Middle Eastern countries.

Re:Analytics for Mobiles

[davester666]

Something that hasn't been brought up is: Who is paying for transmitting the data from your handset to CarrierIQ?

Re:Analytics for Mobiles

[Anonymous Coward]

They probably refused to give Apple a share of the profits. Considering how mercenary they are, I'd say that's the only real explanation.

Re:Analytics for Mobiles

[Anonymous Coward]

Freedom can hurt people, yes. Freedom also lets you install vanilla android (or a community flavor, or whatever). The only problem with that might be some kind of warranty violation--but again, that is an evil of the manufacturer or carrier. Not Google.

AT&T can still violate the privacy of your iPhone. So can Apple. Google _cannot_ because (theoretically) you could check for and remove such violations. Is that done? Well, maybe or maybe not. But that's still better than Apple where it's impossible.

Re:Analytics for Mobiles

[SadButTrue]

While it may be true that Google's users are indeed it's products and advertisers are it's customers it is sloppy logic to see this as a bad thing.

Humans are a fairly unique product. We possess both free will and emotions. It is in Google's best interest to make sure that their product is never injured or angered in any way. Also, if Google wishes to keep or grow their production they must provide new and interesting things. Being a product is actually a very pleasant experience as long as you always have the option to leave. Pretty sure trophy girlfriends figured this out millenia ago ^^

Re:Analytics for Mobiles

[b4dc0d3r]

Your quote says "receives" but your link says "logs". We still don't know what happens to those logs. There may be no privacy problem here other than potential availability to malware.

Yes, that is important, and yes the logs should be stopped. But you are asserting something we don't know is true.

Re:Analytics for Mobiles

[Anonymous Coward]

But, google analytics only tracks the drones who allow javascript. They subsidize us intelligent people.

Re:Analytics for Mobiles

[tqk]

Whether it was included or enabled was purely the manufacturer's design ...

I believe the article at the register included a quote from HTC, saying they installed it at the behest of the carriers, on the phones they were manufacturing for those carriers.

Re:Analytics for Mobiles

[spauldo]

That applies to all smart phones, not just Android.

I'd say Android provides more freedom for the user and developer than the iPhone or any of the other default phone operating systems (not sure about Windows phones). You can add non-market software to them without jailbreaking them. You can't do that with the iPhone or (last I heard) a Blackberry.

Any of them are going to come with crap the manufacturer wants on there, and likely prevents you from uninstalling it as best they can. The carriers are worse, so if you bought a phone with a carrier bundle, you've got all kinds of crap on there you likely don't want. The base OS of the phone doesn't really matter - Android, iOS, BlackberryOS etc. all have crap added to them that you'd probably rather not have.

There are projects for running Linux on the iPhone, various Android phones, and probably others as well. That might be looking into if you're worried about developer and user freedom.

Re:Analytics for Mobiles

[icebike]

And also:
http://www.msnbc.msn.com/id/45527898/ns/technology_and_science-wireless/

Re:Analytics for Mobiles

[icebike]

That might be so, but it doesn't change the fact that it's only Android devices where it's enabled by default.

That's probably because the carriers are not able to enable it in iOS. So Apple - the only manufacturer of iOS devices - doesn't want it enabled in their phone, and the carriers are not able to do this. Android is more open, so either the phone manufacturers like Samsung and HTC can install it, or the carriers. So it's true, but it's only true because of the open nature of Android.

Hate to break it to you, but Apple has their own stuff built into the systems.
But because its closed source its harder to detect, and because it all goes back directly to Apple, embedded in all the other apple traffic, its much harder to spot.

http://theweek.com/article/index/214437/is-your-iphone-spying-on-you
http://appadvice.com/appnn/2011/04/iphones-camera-spying
http://www.nowpublic.com/tech-biz/your-iphone-spying-you-al-franken-questions-steve-jobs-2779484.html

Re:Analytics for Mobiles

[grcumb]

the vanilla Android devices (Nexus line) don't ship with the CarrierIQ software, which means that either the handset manufacturers or, much more likely given the US-centric focus, the carriers are responsible for installing it.

...Which is a very good point. Google gives not only end users but also manufacturers and carriers relatively free reign over Android phones. Apple retains much more control over the iPhone.

While it's easy to see how Apple's strategy can hurt power users, Google's strategy can hurt users also.

Between iOS and Android, you're just trading one bucket of problems for another. Siri will find you a dentist if you tell it you broke a tooth and point you to the nearest escort agency if you're looking for one, but it won't help you if you need to renew your birth control prescription refilled. If you tell it you've been raped, it blithely replies, "Really!"

Apple and Wolfram Alpha can say what they like about the service's beta status; the likeliest reason for this is that they didn't want to touch one aspect of societal behaviour because it might upset parents and affect sales to teens.

Google errs on the other side, empowering handset providers, allowing them to indulge their baser instincts when it comes to how they view customers on their networks. For telcos, the customer is the commodity.

In both cases, corporate entities feel entitled to decide what we are allowed to know about them and what they are allowed to know about us. The contrast between the two couldn't be stronger.

In fairness, this is a common human failing. When it's my information at stake, we call it privacy. When it's someone else's, we call it secrecy.

The only way to square this circle is to remove the dichotomy altogether. Paradoxically, the only way we can be sure that others aren't abusing our private data is through transparency, which requires less, not more, privacy. In the end, the best we can hope for is a kind of neo-Victorianism, in which we are more willing to accept polite behaviour at face value and overlook all but the more egregious failings. Ultimately, we will have to learn to accept that we are all no better than we should be.

I have no faith whatsoever that American society will be able to accomplish this. The Protestant ethic of probity and respect has long since been extinguished in favour of a mix of fundamentalist, moralistic witch-hunts and ugly prurience.

Re:Analytics for Mobiles

[shutdown -p now]

Um, there was a video which showed how keystrokes are logged to a file as they are being entered. It's still an open question whether said log file is transmitted anywhere after it has been logged - and the linked article seems to say that it's not - but why log it, then?

Re:Analytics for Mobiles

[Mr_Silver]

Nice troll, but the vanilla Android devices (Nexus line) don't ship with the CarrierIQ software, which means that either the handset manufacturers or, much more likely given the US-centric focus, the carriers are responsible for installing it.

By "responsible" you need to mean that the carriers asked the manufacturer to install, enable and configure (to a carrier defined list of settings) Carrier IQ on a device and that the manufacturer agreed to do so.

I know it's not as exciting as thinking carriers just went off and sneakily installed it themselves (despite them having no access to the source code or, generally, phone OS development experience) but for those of us who have worked in that area, this sadly common misconception is more at home on CSI.

Re:Analytics for Mobiles

[Ostracus]

Maybe the indented audience was UI designers?

Re:Analytics for Mobiles

[PNutts]

That applies to all smart phones, not just Android.

Nope.

The carriers are worse, so if you bought a phone with a carrier bundle, you've got all kinds of crap on there you likely don't want. The base OS of the phone doesn't really matter - Android, iOS, BlackberryOS etc. all have crap added to them that you'd probably rather not have.

Would you clarify what AT&T added to my iPhone that I'd rather not have?

Re:Analytics for Mobiles

[pinkeen]

"The device ends up storing about 200 kilobytes of data," he says. "That's typical upload size. When it gets to the point that it's full, it'll do an upload or it'll drop data and start wrapping and store summary information." (Customers aren't charged for the upload, and it's disabled when the phone is roaming.)" How Carrier IQ was wrongly accused of keylogging

Re:Analytics for Mobiles

[PNutts]

Wow. Not true and debunked. You may certainly go to MacRumors to start a FUD war, but please have more respect for (what used to be) a technical forum.

Re:Analytics for Mobiles

[PNutts]

One AC calling another an idiot. I'd say the score is tied.

Re:Analytics for Mobiles

[PNutts]

The only way to square this circle is to remove the dichotomy altogether. Paradoxically, the only way we can be sure that others aren't abusing our private data is through transparency, which requires less, not more, privacy. In the end, the best we can hope for is a kind of neo-Victorianism, in which we are more willing to accept polite behaviour at face value and overlook all but the more egregious failings. Ultimately, we will have to learn to accept that we are all no better than we should be.

I have no faith whatsoever that American society will be able to accomplish this. The Protestant ethic of probity and respect has long since been extinguished in favour of a mix of fundamentalist, moralistic witch-hunts and ugly prurience.

Wow. Someone's getting mileage out of their Word a Day calendar.

Re:Analytics for Mobiles

[spauldo]

You're right. It's been a while since my iPhone hit the asphalt at 75mph.

There was crap on my iPhone I didn't want and couldn't remove, but Apple put it there. My main point was about the software freedom angle anyway.

Re:Analytics for Mobiles

[digitalchinky]

The customer is paying. Minimally you could assume this will only send out info when you have a data connection established. The payload is too large to make use of the signalling system (which is often saturated with SMS as it is) so it's either carrier data or wifi.

Re:Analytics for Mobiles

[wygit]

But as other have pointed out, the article says it's the carriers who have installed it on the Android phones, along with the "enhanced" shells and crap that insist on.

But Apple doesn't allow the carriers to do that, so guess who installed Carrier IQ on your phone, regardless as to whether it's enabled by default or not.
That is to say, it's not enabled in THIS version of iOS. But of course Apple can enable it in the next update if they choose. After all, they didn't tell you it was on your phone in the first place.
Because Apple's ALWAYS been in the habit of installing apps that don't do anything, just to have them there, for... um... something

Re:Analytics for Mobiles

[Anonymous Coward]

That's probably because the carriers are not able to enable it in iOS. So Apple - the only manufacturer of iOS devices - doesn't want it enabled in their phone...

The ONLY reason Apple wouldn't want it enabled on their phone would be because Apple isn't getting a cut of the revenue generated by it.

Re:Analytics for Mobiles

[jonwil]

There is a quote or comment somewhere (cant find it) from someone who said something like "I work/worked for an android OEM and AT&T basically said 'install CarrierIQ or we wont sell the product'". I may have gotten the details wrong because I cant find or remember the exact quote/comment but the gist of it is that its the carriers that are insisting on this and the handset makers have no choice but to comply.

Re:Analytics for Mobiles

[grcumb]

Wow. Someone's getting mileage out of their Word a Day calendar.

No, someone is making use of 4 years of post-secondary education in a 'useless' English degree programme.

Re:Analytics for Mobiles

[Attila Dimedici]

Yes, but if our only choice was IOS-like phones, we probably would not know about it yet. Then it would be sitting there waiting to be activated at some point. The fact that it was on the Iphones suggests that Apple would have turned it on at some point (not that Apple should be condemned, just that one should not get too comfortable with the fact that they had it turned off by default at this time).

Re:Analytics for Mobiles

[PopeRatzo]

That might be so, but it doesn't change the fact that

No, but it changes the meaning of that fact.

Re:Analytics for Mobiles

[PopeRatzo]

Would you clarify what AT&T added to my iPhone that I'd rather not have?

A contract?

Re:Analytics for Mobiles

[PopeRatzo]

Wow. Not true and debunked.

I'm interested. Can you give some details of the debunking? You seem to know something, and it would be nice if you shared it.

Re:Analytics for Mobiles

[joe_frisch]

If you are in the US, the cost of the data is minimal. It really would be adding injury to insult though if you were being charged roaming rates for the stolen data when you out of the country.

Re:Analytics for Mobiles

[PopeRatzo]

Paradoxically, the only way we can be sure that others aren't abusing our private data is through transparency, which requires less, not more, privacy.

You've got it mixed up. The "transparency" is for the corporations and government who exist because we as a society allow them to. Corporations exist because governments allow them to exist and governments exist because we allow them to.

People get privacy. Every level of organization above the family gets transparency. Let me say it again: Privacy is for human beings. Transparency is for organizational entities that are not human.

If you breathe, you get privacy. If you exist because of a piece of paper, such as a corporation or government, you get transparency. That's the way it's supposed to work. When we start to assign metaphysical meaning to these paper entities, via fallacies such as patriotism and the "free market" then we get into all sorts of trouble. We think we can't expect transparency from our government because "we're patriotic and our government can do no wrong". We say we can't expect transparency from corporations because "corporations are persons and they have the rights of persons". We can see how quickly such notions can totally fuck things up.

We have heard a lot from the tea party saying "government needs to fear the people" and just because it's nothing more than a slogan to them doesn't mean they're not right. Just the same, corporations need to fear the people, maybe even more than governments because of the special benefits they have been given by society. I say, it's best to make sure we understand that both governments and corporations only exist to the extent that we allow and we have every right to demand transparency from both. Of course, people who would misuse the special benefits we have given them hate the notion of transparency and hate the notion that governments and corporations are ultimately answerable to the people (and not just people as consumers, by the way). That's why you're seeing the wildly over-the-top response to the anti-corporate message of Occupy Wall Street. Because if people figure out that we don't have to allow corporations to fuck with our lives then all hell could break lose and some very wealthy and powerful people might be made very uncomfortable.

I don't know where you got the idea that transparency requires less privacy for people, but it's a very dangerous and very wrong notion. You really need to re-think this.

Re:Analytics for Mobiles

[Anonymous Coward]

Wow...you certainly get the cake for an incredibly stupid and myopic view!

Google's business plan is the best from our - the users'- view point. Google has the most to lose if the users do not like them. This is because if the users turn away from Google, advertisers will immediately go away too.
Microsoft's main revenue generators on the other hand are corporations, governments and educational institutions and Microsoft have proven time and again that they will screw over the common user to increase their bottom line. Apple has a loyal fanbase that will buy their products in spite of Apple screwing them over. So Google's is the best business plan and I hope Apple and Microsoft change their before it is too late.

I didn't know such dumb idiots as the parent poster AC really existed on this earth. Revelation indeed.

Re:Analytics for Mobiles

[Excelsior]

So you are suggesting the solution to privacy issues is a proprietary black box, where one benevolent corporation, who is trying to eek every bit of profit out their platform, is the only one in control? That's the solution? Really? Have we already forgotten the situation where iOS was keeping a log of the phone's location?

At least with Android I know I can flash a new (AOSP) ROM where every line of code is OSS, and know what is truly happening with my device.

Re:Analytics for Mobiles

[Cornwallis]

There is a quote or comment somewhere (cant find it) from someone who said something like "I work/worked for an android OEM and AT&T basically said 'install CarrierIQ or we wont sell the product'". I may have gotten the details wrong because I cant find or remember the exact quote/comment but the gist of it is that its the carriers that are insisting on this and the handset makers have no choice but to comply.

In a chat conversation with AT&T (my carrier) support, they told me that AT&T does not install CarrierIQ on their phones. I looked through the phone and can't find it. So what gives?

Re:Analytics for Mobiles

[Anonymous Coward]

I'm just going to throw this in here. Al Franken is a hell of a guy. Who would of known. And when he was elected I suspected good would come of it. I'd love to see Jon Stewart or Stephen Colbert run.......

Re:Analytics for Mobiles

[Anonymous Coward]

eh? the company has a partnership with Vodafone Portugal... eh? Carrier IQ and Huawei Expand Relationship with New Global... read their website http://www.carrieriq.com/company/news.htm

Re:Analytics for Mobiles

[grcumb]

Let me say it again: Privacy is for human beings. Transparency is for organizational entities that are not human.

You didn't read the linked article, did you?

The problem with privacy is that everyone has to respect it. What you say about corporate bodies is valid, as far as it goes. But the thing that everyone - yourself included - seems to overlook is that the same information technologies that make it easy for organisations to abuse their knowledge also makes it easy for individuals to find out more about you than ever before.

Living with the Internet means composing an indelible journal of words, images and opinions that, for the most part, never goes away. I can find out who my current partner used to shag, I can find their weepy high school poems, their drunken university antics, their political screeds... just about anything they've ever done online.

Being circumspect with what you post online is one thing, but you have to rely on others to be circumspect as well. Which is the fundamental point I was trying to make when I talked about the necessity for a sort of neo-Victorianism in modern society.

In short, we're going to have to learn to be far more respectful of other people's privacy and far more tolerant about humanity's inherent foolishness and weakness of character if we're going to live our lives online.

Re:Analytics for Mobiles

[KahabutDieDrake]

Why are we laying the fault for nefarious tracking schemes at Apple or Google's doors? Aren't the carriers the ones behind this? I know debating Android vs iOS is a favorite pass time, but... FOCUS.

Re:Analytics for Mobiles

[DJRumpy]

Apple has already released what they used to use it for (it was removed in iOS5 except for a few stray bits that no longer function which are to be removed in future updates). It was used to collect anonymous usage data, but only if the user opted to turn on the Diagnostic usage. It was set up that way on purpose.

Re:Analytics for Mobiles

[DJRumpy]

Actually they removed it in iOS 5 (it no longer exists in a usable form in iOS 5 although bits of code remain it is non-functional), so no, they won't be enabling it. They also released a statement indicating exactly what they used it for, and that it was opt in (anonymized collection of usage data...what apps you run, crash data, etc, but not identifying information and no key logging).

Re:Analytics for Mobiles

[ncgnu08]

You can't do that with the iPhone or (last I heard) a Blackberry.

Any of them are going to come with crap the manufacturer wants on there, and likely prevents you from uninstalling it as best they can. The carriers are worse, so if you bought a phone with a carrier bundle, you've got all kinds of crap on there you likely don't want.

Yes but if you believe what was just released on Wikileaks then even RIM is working proactively to know what we do on our phones and who we call.... None of this surprises me, and all of it scares me. The only thing that gives me any feeling of security is there is so much being collected it is probably hard to stand out from the herd.

Do my fellow /.'ers think this is just the first program to be found, and there are many more that do the same or worse?

Re:Analytics for Mobiles

[lonecrow]

Not to mention that you can disable Google Analytics simply by blocking it with NoScript.

Re:Analytics for Mobiles

[Anonymous Coward]

It doesn't have to do with any 'open' nature of Android; rather, the contract model chosen by Google between it and the carriers.

Re:Analytics for Mobiles

[Anonymous Coward]

I can't link to others' info about the location logs on iPhones, only my own experience of what they did.

I cleared my iPhone, installed it fresh, then 20 minutes later checked the (now new) location logs that were supposedly tracking me. In the logfiles were over fifty cell tower locations within a roughly 80km radius around me, all timestamped with the same time/date, a few minutes after the iPhone started up - many of them ones my iPhone could not have found by itself

Also included were a 1-2km wide circle of many hundreds of wifi base stations and their locations. Most of these also ones my iPhone couldn't have found by itself - so they must have been downloaded from a service of some kind (apparently that used to be skyhook, but is now Apple's own internal collection)

After a week of moving around it became clearer that the iPhone would find where it was (via GPS or cell tower or wifi location, I'm unsure) send that location to Apple, and download a circle of convenient already accessible wifi/cell points that'd help its GPS from then on, and dump those into this logfile all with the same time/date stamp. When I drove a hundred km away, and then back to my house, all the cell/wifi spots around my house were updated with the new datestamp once I'd returned - *overwriting* the old ones. There were also hotspots along all roads within 40-50km parallel to my journey contained in the database on the phone.

Even though the log didn't end up cleared out in its entirety (because if I went somewhere six months ago and didn't return, the last time/date I was around that area would still be stored), the information in the logs was kinda pointless for long-term tracking. The only thing you could say was I was last within 50km of site X at a certain time, within a few hours' accuracy.

From the way the logfiles actually worked and updated, Apple's explanation of it being for an Assisted GPS cache and not a tracker held water, for me. Most recent data for any locations I'd been only, timestamped not with unique times that could triangulate me, and location accuracy was within massive wide circles.

That doesn't mean it wasn't a privacy leak, or that the information obtained from it couldn't be used against someone - but it wasn't an accurate time or location tracking log. Since location data *is* sent to Apple (or one of their service providers for locations) in order to have close-by locations sent back to me, you could probably make assumptions about Apple's storage of that detected location data - but you could do that with anything else that used AGPS and asked some online service for an initial location based on a cell tower/wifi point position.

Re:Analytics for Mobiles

[rtb61]

Do you have any idea about the fight going on between the FCC and the carriers. The huge battle over 'network neutrality'. When it comes to carriers they don't need to put anything on you phone, your phone is a brick until it communicates with their towers and their network. They can track your movements, intercept all your calls and, monitor all your data access.

When it comes to additional software on your phone, they only people who need to do that are the phone manufacturers and other companies. Apple tracks you and via the walled garden monitors everything you do and of course protects their walled garden and the profits for their privacy invasiveness by blocking everyone else from gaining that access "FOR FREE".

Re:Analytics for Mobiles

[Anonymous Coward]

There was a video showing keystroke events being written out to debug print, not to a log file. It appeared that they were just capturing a class of events that included keystrokes, printing off the event to debug, and then doing something with it (possibly discarding it if it was keystroke related; we don't know, because that's as much depth as that video went into). Debug print isn't saved anywhere, isn't even displayed anywhere unless you're debugging the software.

Re:Analytics for Mobiles

[thegarbz]

The contracts exist between Google and the handset vendor. Carrier IQ comes in at the contract between the vendor and the Carrier. This has little to do with Google who only write and provide an operating system.

The one phones where Google's contract is made directly with the carriers is on the Nexus line, and as far as I have read the Nexus phones are free of both carrier crapware and the Carrier IQ software.

Re:Analytics for Mobiles

[dririan]

You can't do that with the iPhone or (last I heard) a Blackberry.

No, just no. BlackBerries have always been able to install apps from any source. Hell, they work with most J2ME apps also. BlackBerry App World only came out in 2009. Kinda hard to limit apps to an app store when one doesn't exist, no?

Re:Analytics for Mobiles

[thegarbz]

So on the one hand we have a security researcher being quoted in the news and we are going on his word that he disassembled the software and found no evidence that it was capturing keystrokes. His credentials are that he discovered vulnerabilities in Linux.

On the other hand we have a video of an active android developer who originally found the CarrierIQ software showing via the Android debugger that when he presses a key on his Android device that key gets passed to and processed by Carrier IQ's running process, even though the key in question is a softkey used by a different application (the numbers on the phone dialler for instance which no app should have any business reading).

Sorry but so far I'm sceptical about the CNN article. Maybe someone can debunk exactly what's going on in the video which was posted then the CNN article and the security researcher's claims would be more valid. They have the burden of proof at this point.

Re:Analytics for Mobiles

[thsths]

> (Customers aren't charged for the upload, and it's disabled when the phone is roaming.)"

Are we sure of that? I would be rather surprised...

> How Carrier IQ was wrongly accused of keylogging

Nice try, but factually wrong. Carrier IQ *is* keylogging, and that has been demonstrated. It is not clear whether the app is storing the data, but there is no evidence to the contrary (200kB can easily contain all your keystrokes for the day). And since communication is encrypted, nobody except Carrier IQ can proof that they are not. They have put a lot of spin on it, and acted in any other way like they were found out. They have not provided any evidence that keystrokes are not transmitted.

Re:Analytics for Mobiles

[PopeRatzo]

In short, we're going to have to learn to be far more respectful of other people's privacy and far more tolerant about humanity's inherent foolishness and weakness of character

I agree with that, and it is not specific to behavior online.

However, if you take all the violations of privacy together, you will find that the cases of individuals violating others' privacy are relatively rare compared to the violation of privacy by corporations. Further, when a corporation violates privacy, it does so to huge numbers of people. Worse, it claims special privacy for itself when the violation is exposed.

I think we pretty much agree on these things. I seem to have caromed from the point you were making to a somewhat different one, using your words but not your meaning. Sorry.

Re:Analytics for Mobiles

[am 2k]

I'm interested. Can you give some details of the debunking?

There's some detailed discussion on the topic on John Gruber's blog.

Re:Analytics for Mobiles

[Anonymous Coward]

your browsing behavior, which is on the open web, and is being done in public [...] where you have no expectation of privacy.

Since when did what I type into my URL bar become PUBLIC? What about private communications I send through web mail? Are those also public? How can you differentiate between web mail and any other browsing behavior? The only thing that should be considered public is what I post on forums after clicking "I agree" to the thingy that says what I write here will be made public. That's it.

Re:Analytics for Mobiles

[pinkeen]

I didn't say I believed them but... First of all, the thing that was demonstrated is that CIQ spits out debugging messages containing key strokes. Who's to say that this isn't just an echo of an unimplemented feature. Nobody has shown a remotely convincing proof that this information is stored. Keylogger stores keystrokes.

Secondly, somebody actually disassembled the damn thing:
> Rosenberg told CNET. His reverse-engineering showed that "there is no code in Carrier IQ that actually records keystrokes for data collection purposes."

I am not defending anyone. CIQ still records and transmits other data, but for fucks sake, get your facts straight!

Some guy showing debugging messages does not prove anything.

Re:Analytics for Mobiles

[Anonymous Coward]

InsightIn140Bytes is a Microsft shill, look at his history

Re:Analytics for Mobiles

[V!NCENT]

There has to be much more of this stuff, as deep package inspection is kinda fishy at the network level and this is a perfect workaround for the load balancing.

However, if you buy your phone seperate (without SIM-lock and from a webshop, but with a plan) then it's probably not there, or there has to be some 3G specification thing that requires manufacturers to put all kinds of crap in the firmware to be able to be compatible with network x, y and z.

Re:Analytics for Mobiles

[Anonymous Coward]

You can add non-market software to them without jailbreaking them. You can't do that with the iPhone or (last I heard) a Blackberry.

False. RIM has never had restrictions on applications that YOU put on YOUR phone.

Blackberry applications have been around for close to a decade, long before Steve Jobs ever thought of making a phone.

What Apple did was make it easy to sell & charge for apps - they get your itunes billing info up front when you start using the iphone.

Any of them are going to come with crap the manufacturer wants on there, and likely prevents you from uninstalling it as best they can.

False. Blackberry makes it easy to delete apps you don't want, regardless of where they come from.

Re:Analytics for Mobiles

[thisnamestoolong]

What you type into the URL bar is not public -- but where you go when you hit enter is. It has to be. That is the way the web works. When you travel around you are broadcasting your IP as you connect to different servers around the globe. The servers that you connect to are under no obligation to hide the fact that you have been in there. Think of the Internet as a big city (a city where you really, really want to stay away from the red-light district); as you walk around you are essentially anonymous due to the mass of people, but in reality everything you are doing is in the open. If you walk into a store and buy something, the store is not violating your privacy by acknowledging that you were there. If this were not the case, society wouldn't work. The Internet is the same thing; it is essentially anonymous due to the overwhelming amount of traffic, but at the end of the day, everything you are doing is public.

Encrypted data, however, is a different thing entirely. Encrypted data is more akin to carrying a letter around this city in a sealed envelope. There IS an expectation of privacy as to the contents of that letter; you put it in an envelope so that the guy sitting next to you on the train can't read it. Now, I know that Google does analyze the content of encrypted emails, but you are using their service, so this should again be expected. If I were to write something on paper while sitting in a Google office, I would have a very different expectation of privacy; it should be expected that they are able to monitor what happens on their own service (or building, in this analogy).

CIQ, however, effectively breaks all of our expectations of privacy. In this analogy, even if you locked yourself in your bedroom, made sure nobody was around, wrote the letter, and then sealed it in a light-proof envelope, CIQ would still know what you wrote on that letter. They would know because THEY WATCHED YOU WRITING IT. While you were writing that letter and taking all the proper measures to keep it private, they had a camera over your shoulder watching as your pen scribbled across the page. It was never disclosed to you that this camera was here. Now, they are defending themselves by saying that we cannot prove that the camera was actually transmitting the data back home, but we know for a fact that it was there and it was recording data. This is why a keylogger is a whole new level of privacy violation; it violates the sanctity of the physical device you are working on. This is what makes it orders of magnitude worse than anything in Marc Zuckerberg's wildest dreams. This is also why keyloggers are almost universally criminal. To compare it to Google Analytics belies a fundamental misunderstanding of the tech at hand. There is a relevant exchange in Pulp Fiction:

Vincent: I didn't say it's the same thing, I said it's the same ballpark.
Jules; Ain't no fuckin' ballpark neither! It ain't the same fuckin' league, it ain't even the same fuckin' sport!

While these characters were talking about something different, the same principle applies. Not only are Google Analytics not the same ball park, they ain't even the same fuckin' sport. The difference in magnitude is astonishing, and making such ill-fitting comparisons only diminishes the affront to decency that this software poses.

Re:Analytics for Mobiles

[Anonymous Coward]

Different yes, but not to as large a degree as you're claiming, I think. When you browse the "web' from your personal computer in the privacy of your own home you are not "in public". That would be akin to saying the phone company has the right to record, preserve, and share (or sell) about whose phone numbers you ask for from information services. They may in fact do that, but they shouldn't have any inherent right to. You have (or should have) the right to expect that such things are between you and the phone company only. I should have the same expectation when I go "surfing", and my browser shouldn't even remember that, much less collect it and transmit it to some entity without my consent, much, much less without even my fore-knowledge. If U.S. law permits that, then it's the law that's flawed, not my expectation of privacy.

Re:Analytics for Mobiles

[Anonymous Coward]

I have to question the logic of your statement, which is shaped by the word "public" as it relates to your surfing the web. I'm not sure there is an expectation by people that their web surfing be publicly accessible or viewable. And going down that slippery slope gets us to the same point that CIQ/carriers may be trying to implement now.

Namely, that what you type in on your screen becomes fodder for another company or perhaps law enforcement/govt to use/abuse.

What I see is an incremental encroachment on all aspects of our lives, even those that were considered private. Some are giving it away for the benefit of using facebook or google search, while others are quietly doing so without our choice (such as the carriers, CIQ, ISP's).

When are the rights of the individual going to mean something TO US? When do we say enough is enough?

Companies KNOW this is a touchy subject, otherwise they wouldn't be trying to do things like this quietly, and use weasel language in contracts or offer up weak mea culpas AFTER the fact.

The fact remains that money seems to be the driving force to overlook the respected/expected rights of individuals.

Re:Analytics for Mobiles

[niftymitch]

Your quote says "receives" but your link says "logs". We still don't know what happens to those logs. There may be no privacy problem here other than potential availability to malware.

Yes, that is important, and yes the logs should be stopped. But you are asserting something we don't know is true.

Now that the log is known to exist the data mining
begins. Recall the /. article where a judge ordered
the sharing of Facebook and other social media sites
so discovery of "stuff" could begin.

Employer, spouse, x-spouse, law enforcement,
DHS, FBI, NSA (makes password cracking a snap),
TSA (because they have you on a list)...... for some
it requires a judge. For others it is a letter that enjoins
you from disclosing that the request was made
and data transferred.

AND if there are knobs that can be dialed remotely
all of the above will be demanding this knob and
that knob be dialed and this data and that data be
delivered. Again some will need a judge others
have power under the law.

Any international IP address or phone number places
the tool in the hands of all agencies. And there is
the international roaming game. They have the magic
codes for sure and can request even demand them.

Re:Analytics for Mobiles

[Anonymous Coward]

Good benefits; terrible group to work with, would never be clean again. Afghanistan isn't the only place begetting PTSD. SC

Re:Analytics for Mobiles

[Anonymous Coward]

So interesting as the fact that only Noth America seems to have Carrier IQ on their Android devices...

That's because the European Union has actual privacy laws in place.

Re:Analytics for Mobiles

[ScrewMaster]

That might be so, but it doesn't change the fact that it's only Android devices where it's enabled by default.

So what? Don't try to make this into an Android vs iOS issue, because it's not. The real question is: who put it there, and who decides whether it's enabled?

Put it this way: there's no real percentage to installing anything like this for Google or the hardware manufacturers, whose credibility would be shot once it gets out. So far as I'm aware, no such application exists in the Android Open Source Project source tree: if there were, we'd have heard about it by now considering how many eyes are on that code. Most likely it's the carriers that are installing this for their own purposes (nefarious or not, we don't know yet.)

If it bothers you that much, buy the phone direct rather than from a provider and check it to see if it has CarrierIQ on it. Alternatively, root it and install Cyanogenmod or some other decent third-party ROM. I run CM myself, and it doesn't have CarrierIQ. Keep in mind that the big boys generally have source code access to the phones they sell. In the case of Android, well, that's because it's an open source operating system, which allows them to do anything they wish including installing unwanted system apps. Even with Windows Mobile and iOS, odds are they have agreements with Microsoft and Apple to allow them some level of access to the source. Even if that weren't so, if AT&T were to tell Apple "ship this app or we won't let your iOS on our network", well, believe me that app will be there ... Apple is not your friend in this regard.

Basically, if you're buying a computer system from an untrustworthy source (and none of the major cellular providers qualify as trustworthy) you can expect this kind of nonsense to occur regardless of the device or its operating system. Google allows the entire world to see what is in its stock firmware releases, so if something untoward appears on your device, you have a pretty good idea who put it there.

Re:Analytics for Mobiles

[Anonymous Coward]

The customers paid.

Has anybody organized a class action lawsuit yet?

In most states, anything over a certain dollar amount is automatically felony fraud!

There's also anti-wire tapping laws.

Were any of those cell phones owned by law enforcement personnel? That can mean automatic jail time depending on the state!
 

Re:Analytics for Mobiles

[Anonymous Coward]

There's some detailed discussion on the topic on John Gruber's blog.

John Gruber is the most rabid apple fanboy of them all, he gets overly pedantic about details concerning apple but makes broad and disingenuous statements when it comes to android, which clearly shows bias. He could have said some HTC Android phones on some US carriers when referring to devices with CarrierIQ but he went with HTC Android phones, now that would be fine if wasn't so hypocritical when it comes to being pedantic about defending what apple does.

Re:Analytics for Mobiles

[Anonymous Coward]

As a Linux fan through and through for fourteen years and counting I am endlessly surprised at the android circle jerk. Linux's customers are smart people who choose to use Linux

No, they just aren't. Most people who use linux don't even know they are using linux.

Re:Analytics for Mobiles

[tombeard]

Doesn't matter the amount as long as they were charged. That is certainly a population base for a class action lawsuit.

Re:Analytics for Mobiles

[Lisias]

By "Carrier IQ", I was meaning the software, not the company. I apologize for the misunderstanding.

In my defense, I want to quote, ipsi literis, the article I linked where I understood and used myself "Carrier IQ" as the software, not the company:

To be clear, the “information” I’m talking about are the Android intents logged by Carrier IQ, discovered by TrevE, which include your location, when you open an app and what app you open, what media you play and when you play it, when you receive an SMS, when you receive a call, when your screen turns off or on, and what keys you press in your phone dialer.

That article referenced another one, where the term "Carrier IQ" is explicitly used meaning a software:

And the spy and invasion of privacy saga continues, but this time XDA Recognized Developer TrevE seems to have hit the very core of most of what is happening with devices. You may recall from a few articles back that we started talking about something called CIQ or Carrier iQ.

My rationale is that If the thing logs something, they must first receive it from somewhere.

Re:Analytics for Mobiles

[kermidge]

Gosh, and here I thought someone was choosing words from his available vocabulary to convey his intended thoughts. Silly me.

Re:Analytics for Mobiles

[Xest]

Yes, people blaming Android, Google, Samsung, HTC or whatever are completely missing the point. All UK carriers have said this isn't used here in the UK, so saying "It may be on Apple, but it's not used, so it's Android's fault" is rediculous, it's clearly the fault of the carriers, else, if it was an Android problem as the OP claims, then it'd effect those of us in the UK and elsewhere too.

Re:Analytics for Mobiles

[Anonymous Coward]

To be honest that makes a lot of sense (enabled on Android and not on Apple- not the rest of your post). Android is an Open-source OS. In fact that may also be a reason as to why so many of these cell phones are being shipped with outdated versions of Android. It is likely because it was the last version of Android which was open and thus they were able to mod the OS to bake their software into the platform. Apple (as we all know) is always more controlling. So ti is no surprise that they would not allow a piece of software to impact the over all performance of THEIR device. I think that last modifier was key. remember Apple owns the end-to-end on their devices, Google does not. If this CIQ software is in Android's base OS then go after the Goog, otherwise start sharpening your pitchforks and go after the device manufacturers & the providers.

Re:Analytics for Mobiles

[Stud McPeckChest]

Google errs on the other side, empowering handset providers, allowing them to indulge their baser instincts when it comes to how they view customers on their networks. For telcos, the customer is the commodity.

I am not saying that is impossible but an NPR story on this concluded that:

"So when Siri goes out into the Internet looking for what an abortion center is or what an abortion provider is, it hits on these non-abortion-providing organizations because they're the ones who use the word to underlie their websites," [Damon Poeter, a reporter for PC Magazine] says.

Re:Analytics for Mobiles

[wilec]

"We say we can't expect transparency from corporations because "corporations are persons and they have the rights of persons"."

I like your argument. And regardless of what our "Supreme Legislature" says, I'll consider accepting corporations as persons when Texas executes a couple.

matthew

Re:Analytics for Mobiles

[Anonymous Coward]

What about that worthless piece of shit known as safari?

I love it!

[swonkdog]

We need government intervention they claim; right up until the next revelation is that Carrier IQ's biggest client is the United States government. Whoopsies!

Re:I love it!

[Anonymous Coward]

Herr professor was actually angry that Carrier IQ was not installed and activated on all phones, because everyone knows that the educations system is there to promote the state, and it's what he's been working for his entire life.

Re:I love it!

[fuzzyfuzzyfungus]

Why would the government purchase Carrier IQ's software or services? As it stands, there would appear to be absolutely no effective barriers to their just getting the data from the carrier who installed it...

questions

[Tom]

Very good question from the senator:

Does Carrier IQ believe that its actions comply with the Computer Fraud and Abuse Act (18 U.S.C. Â 1030)? Why?

That's the kind of question you don't want to be asked. People don't ask that way if they don't already have an opinion. Basically, he wants to see them dig their own grave, and enjoy it.

That's good news. Let's see if they spring the lobby machine into overdrive and try to get the issue "lost" in sub-comittees and extended deadlines.

Re:questions

[Anonymous Coward]

Not a big fan of Franken, but he seems to be quite clued on Technological issues.

Re:questions

[MyFirstNameIsPaul]

I have a question for the senator:

Does the Computer Fraud and Abuse Act comply with the Constitution?

Re:questions

[Ihmhi]

I have never been so happy as to have a shit-stirrer of Al Franken's quality in our government. I think we need more cynical comedians in politics, just because they have some of the most eloquent BS detectors in the world. Murray/Akroyd 2012!

Re:questions

[sphealey]

And I think the answer to that will be, it was the carriers that decided what functions to enable. And the carriers were exempted from all electronic spying restrictions by the FISA extension of 2008 (aka absolve AT&T bill).

sPh

Re:questions

[nightfell]

The Senate isn't the proper body for answering that question, the Supreme Court is.

However, what makes you question the constitutionality of the law in the first place? Care to enlighten us?

Re:questions

[grcumb]

I have never been so happy as to have a shit-stirrer of Al Franken's quality in our government. I think we need more cynical comedians in politics, just because they have some of the most eloquent BS detectors in the world. Murray/Akroyd 2012!

Indeed. Better comedians than clowns.

Re:questions

[Ostracus]

Not a big fan of Franken, but he seems to be quite clued on Technological issues.

Look at the list of co-sponsors for ProtectIP.

Re:questions

[TubeSteak]

And I think the answer to that will be, it was the carriers that decided what functions to enable. And the carriers were exempted from all electronic spying restrictions by the FISA extension of 2008 (aka absolve AT&T bill).

My understanding is that the information flows directly back to Carrier IQ.
And that would be why they're fucked.

Re:questions

[tftp]

Better comedians than clowns.

Perhaps; but that's irrelevant. You are getting actors who are working from professionally written scripts. You don't know who writes the script, and you don't vote for those writers, or against them.

Actors are disposable; if Obama fails the reelection then it's OK too - there are others ready to take the crown for a while and then, four years later, disappear into the sunset, all set for life.

Re:questions

[Anonymous Coward]

But we already have some thirty-six dozen jokes running the government...

Re:questions

[fsckmnky]

CarrierIQ, and the carriers ( AT&T, Verizon, etc ) are not "fucked" as you put it at all.

The basis for all the "evesdropping" and "wiretapping" accusations and laws, include the phrase "without authorization" but when you read the TOS contracts and privacy policies that everyone with cell phone service from a carrier signs and agrees to, they clearly state that device information and usage information is collected. The service contracts and privacy policies clearly spell out that you essentially have no privacy, with the caveat that at least Verizon claims to anonymize the data before they share it. If you don't believe this, the laws and contracts are on the web for everyone to read. Check it out.

For all the lawsuits and illegal activity accusations, its pure politics, because currently, the carriers are well within the law because they have notified everyone in their privacy policies that as a customer of the service you have little expectation of privacy.

There have been alot of comments concerning Google and Android being/not being involved. After having read Verizons policies at least, they state that Verizon can share the information with third parties. This is where Googles involvement *might* come into play. Who is to say, that Google hasnt allowed the carriers to install Android and use it in a commercial environment after modifications, in exchange for your usage information ? Im not claiming this is happening, but merely that the policies that users agree to would easily allow for this.

According to http://source.android.com/source/licenses.html ... "The preferred license for the Android Open Source Project is the Apache Software License, 2.0 ("Apache 2.0"), and the majority of the Android software is licensed with Apache 2.0." The Apache license states "6. Trademarks. This License does not grant permission to use the trade names, trademarks, service marks, or product names of the Licensor, except as required for reasonable and customary use in describing the origin of the Work and reproducing the content of the NOTICE file."

So, the trademark "Android" appears to be protected, while the OS itself appears to be open source. A quick search of the trademark database returned the following URL http://tess2.uspto.gov/bin/showfield?f=doc&state=4009:ksf9at.2.45 ... "Owner (APPLICANT) Google Inc. CORPORATION DELAWARE 1600 Amphitheatre Parkway Mountain View CALIFORNIA 94043." Google appears to own the trademark of "Android" for mobile phone operating systems.

Connecting the dots, one can see where Google, wielding its trademark ownership, which is not part of the Apache license for the software itself, can in exchange for allowing carriers to use Android(tm) in its marketing, receive all of the usage data users agree to allow the carriers to collect and share with third parties.

The rabbit hole is deep.

Comments apply to US environment. Other environments of course, are subject to other laws.

Re:questions

[fsckmnky]

Update .. branding guidelines here http://www.android.com/branding.html

Re:questions

[fsckmnky]

An article briefly touching on the cozy relationship between Google, carriers, and your personal info:

http://arstechnica.com/gadgets/news/2011/03/googles-nfc-plan-involves-data-sharing-targeted-ads-and-discounts.ars

Re:questions

[Anonymous Coward]

This is a question for the Supremes... Senators craft laws, not judge their constitutionality.

Re:questions

[Anonymous Coward]

The Supremes

Re:questions

[Anonymous Coward]

822 ? I feel like I'm seeing Bilbo Baggins totter out at the end of LOTR. ^_^

Re:questions

[Anonymous Coward]

The Apache license states "6. Trademarks. This License does not grant permission to use the trade names, trademarks, service marks, or product names of the Licensor, except as required for reasonable and customary use in describing the origin of the Work and reproducing the content of the NOTICE file."

You even quoted the passage that allows carriers to use the trademark in their advertising.

Re:questions

[sjames]

So they're pretty much the same as politicians but they have better taste in writers?

Re:questions

[Anonymous Coward]

The Senate isn't the proper body for answering that question, the Supreme Court is.

The Senate, just like the courts takes an oath to uphold the constitution. No where in the constitution does it say that it is only the court's job. Sadly, they are the only branch to keep that oath any more. I've seen presidents sign bills while saying they are unconstitutional and no one bothered to impeach them.

even if it does NOTHING...

[RyuuzakiTetsuya]

the problem is transparency.

If not Carrier IQ what next? What information are they gathering? What's the performance cost with this thing running in the background?

Somewhere in the back of my head Richard M. Stallman is laughing(and eating foot fungus).

This, among other reasons...

[Anonymous Coward]

Is why I still use a "dumb" phone and keep my landline. I was originally concerned about hacks and privacy invasion from outside threats. The Windows experience has proven that no publicly networked device can be safe from threats. But the providers can get away with this shit, even more than the gangsters.

Re:This, among other reasons...

[PNutts]

The Windows experience has proven that no publicly networked device can be safe from threats.

Ah, Slashdot. You never fail to disappoint.

Wrong

[SuperKendall]

Wrong. Apple install it by default and even obfuscate the files.

Wrong yourself, or at least misleading - The carrier IQ that Apple ships with does not record anything at all by default, and even if you could figure out how to enable it records only a tiny bit of data, no keystrokes or SMS for example...

Nor do they obfuscate anything (unless you call shipping with it off a form of obfuscation).

Re:Wrong

[Stalks]

You're missing his point.

Carrier IQ is installed on every iPhone device, stock, or carrier shipped. Only carrier shipped Android devices with custom carrier ROMs have it installed.

Re:Wrong

[Anonymous Coward]

No, you're missing the point. On iOS it's really just analytics. People lump it in with the setup on Android because it's all CarrierIQ, but it's totally different.
The scary part about CarrierIQ on Android is that it actually logs keystrokes. Passwords, emails, everything is logged. That is unbelievably invasive and no one could argue that is necessary for analytics. iOS doesn't log any of that stuff.

Re:Wrong

[Anonymous Coward]

After reading this article: http://news.cnet.com/8301-31921_3-57335715-281/how-carrier-iq-was-wrongly-accused-of-keylogging/
I take back the comment above. It appears it doesn't actually log keystrokes. I was just going on what I read earlier.

Re:Wrong

[Stalks]

What I was pointing out was this:

It doesn't exist in Android, only the US carriers are installing it.

I didn't "miss" anything else as I wasn't discussing anything else. Go defend Apple with someone who cares.

Re:Wrong

[PNutts]

Carrier IQ is installed on every iPhone device, stock, or carrier shipped.

And it is disabled by default, not supported in iOS5, and will be removed in a future iOS5 update.

Re:Wrong

[Anonymous Coward]

Right. And are you absolutely sure this can't be enabled through technologies like OMA CP/OMA DM/SyncML (=> allows to change settings and do lots of other stuff on customer's phones through the use of binary SM messages) sent by carriers ?

Re:Wrong

[niftymitch]

As best I can see it does not key log it traps all events
passes them to a filter and logs the result of the filter.

Since the android equivalent of keystrokes generates
events the package sees all events and "could" log them.

Apparently there is a set of bits that enable and disable
various functions. The state and purpose of these bits
is unknown and it is also unknown (to me) if they can be toggled
remotely. AT&T has a tool "Mark the Spot" it does ask
if a diagnostic can be run if you trigger it. I assume that
"Mark the Spot" like the Apple tool digs and roots about and even generates
traffic that it can review for a user, handset, distro, update or an area.
Since the interesting stuff was the last 10-20 min of service I would
expect that the log is continuous and exhaustive.

I wonder if my recent android hangs were the result of
this logging software itself. That would be a HOOT if
AT&T found that this tool caused more than PR and Legal
problems.

Those that know strace and ptrace and their history know that
these tools are problematic in their own right and early
versions introduced instability.

Since this one company has data on multiple carriers
the anti trust folk will want to see it too. The recent rejection
of AT&T merger goals come to mind. Those that oppose
and those that wish to promote it will WANT the data.
What better way to discover tower by tower if the consumer
will gain or loose in the game.

I wish I had the storage contract for Carrier IQ. The next
injunction will be to "freeze" all data as it is and to freeze
all remote configurations.

Wait

[M0j0_j0j0]

But why is are not the Telecoms on the noise???? they are the ones using the weapon, CIQ is only the manufacturer!!!!

Re:Wait

[fuzzyfuzzyfungus]

To go with an unfortunately appropriate analogy, CIQ is just a street-level heavy. Three of the largest telcomm corporations in the United States are Al Capone. The latter party is almost certainly the driving force behind the former party's crimes; but he's virtually untouchable and isn't exactly going to get his hands dirty to keep a lacky from getting thrown under the bus.

The carriers, while they almost certainly are up to their eyeballs in slime, have zillion-page 'contracts' with the people they are screwing, massive lobbying expertise, and quite possibly de facto or even de jure legal impunity when it comes to a little of the old wiretapping(just look at the, er, unimpressive consequences when their collaboration with the NSA was revealed...) CIQ, by contrast, is just a little coder shop somewhere, 6 years of history, not even the flimsiest of contracts with any phone users, and no obvious friends. Everybody who isn't their customers certainly has no reason not to want them gone, and even their customers would almost certainly rather switch spyware vendors(they've got plenty of options) than endure the PR hit of defending their present vendor...

Much as I'd love to watch CIQ's operations burned down with those responsible locked inside, I suspect that the focus on CIQ will drown out the (far more dire) fact that contemporary communications technology is running headlong into the dystopian future, and the world is crawling with upmarket spyware vendors who provide very similar products and services worldwide. CIQ was unlucky enough to land in hot water

Just a little while back, Etisalat was trojaning its blackberry customers with (poorly made) spyware from the wonderful people at SS8. Guess who suffered no consequences whatsoever and is still merrily peddling "Lawful intercept solutions"?

Re:Wait

[Naerymdan]

Owwww.... That burns dude. The shop I work for is currently revamping the SS8 "Control UI" and I'm the contract I'm personally working on is a neat little app for "parents" to "monitor" their "child" for BlackBerry and Android.

Blaming the developer is not the solution nor the right thing to do. Carriers have decided to install this CIQ app, carriers have decided to obfuscate the CIQ UI, carriers are to blame.

Without CIQ, something else would be used, regardless.

Re:Wait

[fuzzyfuzzyfungus]

I've never understood the argument that the fungibility of hatchetmen in some way makes them less guilty of being hatchetmen...

It is true that their fungibility prevents them from being able to halt their employer's agenda just by walking out; but it doesn't change the fact that, while many people could have done it, they did it. It is also true that, if you are playing whack-a-mole, number of moles whacked is not a terribly useful metric of actual progress toward solving the problem; but that is hardly the same thing as demonstrating that the moles don't deserve to be whacked in parallel with whoever is behind their continuing to pop up...

Re:Should have got a blackberry...

[MachDelta]

Yes, because Blackberry has never handed over the keys to BBM when a nation-state has demanded them...

Laws needed to ensure opt-out

[whoever57]

Let's assume that the carriers put a clause in their agreements that authorizes them to collect and analyze all data. What happens if all carriers do this with all phones? If the only option is to not carry a phone, is there really an option?

That's why this needs to end up with a law that requires carriers to provide a real opt-out.

Re:Laws needed to ensure opt-out

[fuzzyfuzzyfungus]

"Opt-out" is basically CYA bullshit. The notion that what amounts to 'consent through cluelessness' could possibly be valid makes a mockery of the idea of a contract. There's a reason why "opt-out" is so popular with various sorts of scumbags trying to avoid real control over their abuse of 'consumers'...

Re:Laws needed to ensure opt-out

[Fri13]

We do not need Opt-Out, we need Opt-In.

Such features, options, possibilities etc should be OPT-IN. If someone has problems with their carrier network. Then they can turn diagnostic tool ON and report it.

Re:Laws needed to ensure opt-out

[tepples]

So how should carrier tech support handle a user who can't get to the form with the diagnostic tool switch?

Universal Wind.

[Ostracus]

Skeptics find flaws in Carrier IQ application analysis

As I posted in another forum, the court of public opinion isn't in complete agreement.

Re:Universal Wind.

[flimflammer]

I wish I had mod points for you.

Re:Universal Wind.

[Anonymous Coward]

It's called peer review, and is an essential component of real science. Why should we be surprised by this? If you would have RTFL correctly, you would see that these 'skeptics' are unable to disprove Eckhart's claims because CIQ is not exactly forthcoming with information. The only factual basis for these counterclaims is the disassembly of several installed instances: "what he found was a large, powerful program with a lot of capabilities". Ever tried to disassemble a large program and infer all its inner workings?

Moreover, the dispute seems to be on CIQ's transmission capabilities only, not its logging capacity. The peers seem to agree that "We need more awareness of what it can do and the ability to opt out of it".

I particularly like this gem, from CIQ CEO: "'It's the operator that determines what data is collected". What operator? Oh, he means the network operator, not the phone operator...

Where are skilled slashdotters?

[Fri13]

Where are those skilled network hackers who reads and comments to slashdot, and who would do tests does CarrierIQ send data over network?

Would it be possible to test with WLAN sniffing? Collectin data from specific period, like one week and check what it actually brings up?

Re:Where are skilled slashdotters?

[Em Adespoton]

To test, I think you'd have to set up your own cell, as this doesn't use the wifi network. People with their own personal cell tower to test with probably work for or with the carriers, and so are under NDA WRT the whole thing. About the only thing that could be done is a custom android build with this installed that would spit out the data before it was handed over to the radio. As the carriers have already stated that they use it to monitor QoS, there are likely trigger conditions that will cause the data to be sent... kind of like sending MS or Apple your crash logs. The fact that the end user is NOT alerted that anything is being sent is the real issue. Likely the carriers figure that it's their network and their device data that's at issue here, and they don't really care about personal info for the task at hand, so they've never considered the gross privacy violations that the system potentially enables.

Or they've been mandated to install it.

Re:Where are skilled slashdotters?

[Ostracus]

To test, I think you'd have to set up your own cell, as this doesn't use the wifi network. People with their own personal cell tower to test with probably work for or with the carriers, and so are under NDA WRT the whole thing.

Such a thing is called a microcell and can be purchased by the public.

Re:Where are skilled slashdotters?

[Anonymous Coward]

What use is the data if the data is not transmitted? Therefore, logically it must be transmitted.

Re:Where are skilled slashdotters?

[Anonymous Coward]

Cellular telephones emit RF. Are they transmitting this logged data? Find someone with a radio receiver (Amateur Radio operator or a police scanner) that goes into this (2GHz?) frequency range, plug the receiver into your sound card and record the data stream for analysis.

Don't forget about the Government

[7-Vodka]

Let's not forget about the incredible risk brave whistleblowers took on to let us know that the federal government is copying ALL internet an phone traffic and keeping information on ALL US citizens without anonymizing ANYTHING.

They've likely served all of your service providers and google, yahoo etc with thousands of secret letters that force them to divulge information on YOU and also compell them on pain of prison, not to divulge the existence of the letters. These letters can be served to anyone, a financial institution, a pharmacy, a drug company, your employer, your doctor, your LAWYER, your old priest. They can be served in person or electronically by the hundreds.

The federal government can declare a US CITIZEN an enemy combatant without any oversight, deprive him or her of all their constitutional rights and even KILL them without due process on foreign OR US soil. What if someday soon they chose to do this to people who disagreed with them politically?

Don't forget the most inciduous enemy.
Vote for Ron Paul or someone who agrees with the same policies. Don't vote for the status quo, the above is now the status quo.
End the FED.

Re:Don't forget about the Government

[7-Vodka]

Sorry, insidious.

Re:Don't forget about the Government

[Anonymous Coward]

No problem. Echelon corrected it too.

Re:Don't forget about the Government

[shentino]

Doe v. Ashcroft overturned the NSL provisions already.

Re:Don't forget about the Government

[7-Vodka]

On September 6, 2007, Judge Marrero struck down the NSL provision of the revised Act, ruling that even with limited judicial review granted in the amended law, it was still a violation of separation of powers under the United States Constitution and the First Amendment. This is not yet enforced, pending a possible government appeal.

It's still under appeal according to wikipedia.

On August 10, 2010, after 6 years Nicholas Merrill was partially released from his gag order and allowed to reveal his identity, although he could not reveal what information the FBI sought from him.

Only one person has been partially un-gagged, the 'Doe' in Doe v Ashcroft.

what about costs?

[s2r]

If CIQ is found guilty what would happen with the extra costs people paid while sending all that information without its knowledge?

T-Mobile?

[Anonymous Coward]

So it looks like T-Mobile is the only "good" carrier here that doesn't install such spyware.

Lets see the other carriers burn for this because it's pretty much all their fault for installing this potentially illegal software.

Re:T-Mobile?

[Tacvek]

What about Verizon wireless? Or did you exclude them for other reasons?

Re:T-Mobile?

[517714]

Nope! "T-Mobile utilizes the Carrier IQ diagnostic tool to troubleshoot device and network performance with the goal of enhancing network reliability and our customers' experience. T-Mobile does not use this diagnostic tool to obtain the content of text, email or voice messages, or the specific destinations of a customers' Internet activity, nor is the tool used for marketing purposes."

Verizon, C Spire, MetroPCS, and US Cellular are the only US carriers currently denying Carrier IQ is used on their systems.

If you're not doing anything illegal....

[ra9869]

Sad to say, but this probably falls under what is a reasonable expectation of privacy. I'd expect this to be covered deep down in a EULA somewhere. Honestly, folks, what do you expect? Haven't you been listening to anything? Did you read your EULA? We'll be indignant for a week or two and then go back to worrying about what the Kardashians are doing (via our smartphones, of course). Remember, if you are not doing anything illegal, then you don't have anything to worry about!

Re:Should have got a blackberry...

[fuzzyfuzzyfungus]

" "RIM does not pre-install the CarrierIQ app on BlackBerry smartphones or authorize its carrier partners to install the CarrierIQ app before sales or distribution," the company said in a statement. "RIM also did not develop or commission the development of the CarrierIQ application, and has no involvement in the testing, promotion, or distribution of the app," the statement said"

I know that that statement makes me fully confident... "CIQ is not installed on Blackberry smartphones." is short, punchy, and sounds nice. Who wants to guess why their spokesweasel went with the above, instead?

After All teh Rest

[Anonymous Coward]

Absolutely the worst. After PROMIS, Echelon, all the trojans, worms, loggers, loaders, spam, commercial datamining, geolocation, auto-celltracking, the end of Magnas Cartae, Civil Rights, The Universal Declaration of Human Rights, The Geneva Convention and its multiples, The Nurenberg Trials, ... and all the rest.

How shocking!. Shocking!

Ah, just hang the CEOs, marketdrones, white-collar collaborators in general, and their financiers up by their thumbs. Tar and feather them, Then Send them to Texas. Fair's fair.

Re:Should have got a blackberry...

[MyFirstNameIsPaul]

True, but you can install any app you want on a BlackBerry, including ones that allow users to use their own keys. You can even get BES for free and run your own mailserver with your own keys. I realize RIM has fallen behind in many areas, but I have to say I am quite disappointed that practically none of the major tech blogs has discussed the fact that Carrier IQ is not only not installed on BlackBerry devices, but it is a violation of RIM agreements for a carrier to install this app on a phone. From RIM support forum:

RIM can attest that it does not pre-install the CarrierIQ application on BlackBerry smartphones and has never done so. Furthermore, RIM does not authorize its carrier partners to install the CarrierIQ application on BlackBerry smartphones before sales or distribution and has never done so. RIM also did not develop or commission the development of the CarrierIQ application, nor is RIM involved in any way in the testing, promotion, or distribution of the CarrierIQ application.

Re:Should have got a blackberry...

[Anonymous Coward]

Because they cannot guarantee no one installs it despite lacking authorisation?

Re:Should have got a blackberry...

[MyFirstNameIsPaul]

They stated even more than what you stated: they stated that not only is it not installed on the phones, but it isn't authorized to be installed by carrier partners. How is that not a stronger statement? Then they continued on to state that they have never had anything to do with Carrier IQ. I don't understand how you infer otherwise.

Re:AT&T denial

[Ihmhi]

What the actual fuck is this?

Is some CIA agent in Tangiers using Slashdot as a communication outpost, or did someone forget to take their meds today?

Re:AT&T denial

[damn_registrars]

I would immediately moderate that comment up if I had mod points today. That gibberish deserves to score (+5, insightful) for sure. Way better than the goatse or GNAA stuff that is usually posted anonymously here.

Is some CIA agent in Tangiers using Slashdot as a communication outpost

Admittedly, that wouldn't be that bad of an idea, since nobody reads Slashdot any more any ways.

The failed federal government.

[Anonymous Coward]

Is the reason any company would think they could get away with this.

Re:The failed federal government.

[lightknight]

Then it may be time to remind them that they cannot. ;-)

Why would the feds object?

[sphealey]

>> It is an utterly appalling invasion of privacy with immense potential for
>> manipulation and privacy theft that requires immediate federal intervention.'"

Why would the Federal Gov't intervene? Seems like a capability tailor-made for use in surveillance by three-letter agencies.

sPh

Re:Why would the feds object?

[lightknight]

Were I a lawyer, I'd be looking at fraud...messages sent to and from people's phones without their authorization, silently jacking up people's phone bills (not everyone has unlimited data/messaging/talk). And were I Congress, I'd consider it under my jurisdiction because of their favorite clause in the constitution, the interstate commerce clause...someone is going to buy something, even if it's a ringtone, on one of those phones, and chances are the ringtone company is out of state, ergo it's interstate commerce, ergo "Congress must regulate it."

I'll be in the other room, drinking. Thinking like this always depresses me. That it's getting easier to do so is a sure sign that the pills aren't working anymore...^_^

How unexpected is this, really?

[damn_registrars]

After all, your carrier already knows what numbers you are communicating with, how often, for how long, and when. They know the text of the messages you send, as well. The only difference is now there is a company who you are not directly paying who is also watching what you're up to. I'm not saying I approve of it, but it really isn't that big of a change form my perspective. If your carrier just sold your calling records to someone, would it be this much of an issue?

Ultimately, any carrier that doesn't already have this kind of detailed information on every one of their customers is at the least irresponsible and more likely idiotic - and even more likely soon out of business. Even for the "unlimited" plans out there, it is still worthwhile for the companies to watch what is going on in order to properly position themselves for future changes in consumer and business phone use.

Re:How unexpected is this, really?

[CynicTheHedgehog]

While this is true, the part I find most disturbing about CarrierIQ is its capture of HTTPS request details and traffic over Wifi, neither of which would be available to the carrier otherwise. Yes, meta data related to calls are logged... carriers are in fact required to do so for a number of reasons (billing, mediation, audits, and servicing subpoenas, etc.) However, I do not subscribe to a data plan and any traffic I send over a Wifi connection should be between me, the Wifi router, and the remote machines I am connected to, particularly when using "secure" protocols like HTTPS.

Re:How unexpected is this, really?

[fermion]

My opinion is that what CarrierIQ is doing, with the traditional cell phone setup in the US, is not out of bounds. Cell companies generally own the phone. Even after the contract expires, and the phone is paid for, the monthly rate does not decrease. The part of the monthly rate that pays for the subsidized phone continues to be paid by the user. In fact this indicates that the cell phones companies are renting the phones, not selling them, and at some point, now after two years, the phone has depreciated enough to be of not value.

So the mobile firms in the us basically own the phone, the network, the data. It is unreasonable to assume they do not monitor everything about the phone. This would not be such a big deal because all cellular data is transmitted over private networks, and there has traditionally been limits on what the mobile companies can use the data for.

Of course non of this true anymore. The user has the ability to modify the handsets which can potentially expose flaws in any monotering the cell companies do. Thought the handsets are still, in essence, owned by the mobile companies, they do not have the same control. It is possible that private personal data will be transmitted through public networks and this is where the danger happens. The US phones companies do have the control they once did, and i think this tracking is a response to this. But they are going to have to get used to less control.

Re:How unexpected is this, really?

[Anonymous Coward]

Did the video show a WLAN sniffing where pressed keys (letters, numbers etc) and HTTPS metadata were visible?

So far I have not seen WLAN sniffing of that thing, just using USB debug mode what proofs that application really is collecting every input and output and doing something for them. (If it can read and collect, that is enough for wiretapping)

Software freedom is the solution.

[jbn-o]

As I'm sure you know: Without complete corresponding source code to all of the software running on a phone, you'll never know the answer to those questions.

RMS knew the solution to this problem before the problem became widespread (as he often does) and he got the solution right early on: this is a social problem, not a technological problem. The solution is software freedom for all computer users for all the software they run.

Sadly, the Carrier IQ debacle is unlikely to propel people to see this solution. The problem is too weak in its urgency because Carrier IQ's (or any other workalike) privacy violations are merely annoying or scary. Privacy violations usually don't kill or maim anyone. Also, the affected audience has low market value: the general public. When proprietary software used in internal medical devices fails and kills someone, there will be another opportunity to talk of software freedom as a social solution to be taken seriously. And, for a time, people will be more receptive to the idea that all computer users deserve software freedom. People seem to have no problem hiring professionals in other fields they don't understand (plumbers, doctors, lawyers, mechanics, builders) so it's not far-fetched to expect the public to hire computer programmers to inspect and modify programs on their behalf.

Re:Software freedom is the solution.

[Anonymous Coward]

The trouble is that his solution is purely theoretical. If the working of all software and hardware were free and open, then in theory people could check it and everything would be checked.

But most people are incapable of checking it, fewer care, and there's far too much software and hardware constantly being created to allow anyone to keep track.

Re:Software freedom is the solution.

[Jeremi]

As I'm sure you know: Without complete corresponding source code to all of the software running on a phone, you'll never know the answer to those questions.

It's worse than that.... even with complete source code you won't know the answer, because (a) you're not smart enough and/or you don't have enough time to analyze the thousands of pages of source code of all the software you run, and (b) even if you did, you have no way to guarantee that the source code you analyzed is the same as what is actually running on the phone, and (c) even if you had a way to guarantee that, you have no way to guarantee that there isn't other software running on the phone that you aren't aware of. And even if you had complete knowledge of your cell phone, it still wouldn't guarantee you anything, because your cell provider still has full access to their network and servers, and you do not. So even if your cell phone is 100% trustworthy, they could still install spyware at any other point in their infrastructure.

So it really boils down to trust -- at some point you have to either trust your cell phone provider not to screw you, or stop using a cell phone. Access to source code is a bit of a red herring.

Re:Software freedom is the solution.

[RyuuzakiTetsuya]

The solution isn't Free Software, the solution is trust and trying to tamp down on malfeasance by software and hardware vendors.

There are three big problems with Free Software. First, the assumption that having the source code is useful for the average user. Second, the assumption that having source code available is useful for those who are technically competent. Not every geek is going to analyze every piece of code that comes out. I'd wager a lot of code would go largely unreviewed. Third, the assumption that somehow techies can eat and survive when their code is being passed around freely and they have no right to see a dime for their work.

As long as those problems exist, we're stuck with trusting carriers and software vendors to do the right thing.

Re:Software freedom is the solution.

[Rennt]

So it really boils down to trust -- at some point you have to either trust your cell phone provider not to screw you, or stop using a cell phone

I don't see it that way. I have complete faith that my mobile provider will try to screw me, just like my ISP. A phone is just like any other equipment you connect to the Internet - you just consider networks that you do not control as hostile and go from there.

Re:Software freedom is the solution.

[Squiggle]

Access to source isn't necessarily a red herring, although you are right the bigger issue is trust. But source opens up markets for trust.

If you/someone you trust had access to the source of all the software on your phone/device you could use trusted services that compare your phone's software (binaries) to a trusted compile. (Trusted binaries could be provided by proprietary software creators, but I'd rather not trust the software creators and have it independently compiled by a company whose business is security/trust.) Transparency and source are the first steps towards building a functional trust market where you have real choices of businesses that offer services that increase the trust you have of your devices. Extending trust to your network is certainly problematic, but I would hope eventually network providers would have their networks independently audited by security/trust companies, but that would require enough demand (and potentially redundant networks so that you could choose to only use those that you deemed secure enough).

People haven't really groked that the physical things in their life that run software may actually be controlled by someone else. That is a pretty foreign concept, but I'm hoping that once it really sinks in we'll see some real businesses that specialize in keeping your software working for you (not just anti-virus). At that point free software will have an insurmountable advantage over proprietary.

Re:Software freedom is the solution.

[LordLucless]

Nobody said the solution was free software; the solution is open source software.

How are you going to "tamp down on malfeasance" when you don't even know what code your device is running? Yes, you may not be able to understand the code your device runs, even if you are a competent dev. But there are thousands of other people in the world who can. Moreover, once a bit of malware is found, there are even more people who can verify it. And it's much, much harder to hide stuff in your code when your source is available for inspection.

Finally, open source has nothing to do with protecting your software from being copied. Have a look at the Pireate Bay - how many of those pieces of software are pirated because their source is available? Hiding your source is only useful if you don't want someone to know what you are doing, or how you are doing it. The first case is unethical (you're trying to hide what the software is doing from the person you sold it to) and the second is futile - there are very few features that a moderately-skilled developer couldn't re-implement themselves, and most of those features are generally fairly abstract, highly mathematical processes (like compression) which are generally protected by patents rather than copyright (i.e. the same process can be run with different code, making copyright a poor defence against duplication)

Re:Software freedom is the solution.

[RyuuzakiTetsuya]

I thought Free Software was Free as in Freedom? Yes, someone was suggesting Free Software.

Also part of Software Freedom is the freedom to copy.

Re:Software freedom is the solution.

[Anonymous Coward]

So even if your cell phone is 100% trustworthy, they could still install spyware at any other point in their infrastructure.

Guess you're not familiar with SSL.

Re:Software freedom is the solution.

[jbn-o]

You are apparently confusing permission and ability. Freedom is about permission, not skill. You might not have time to read and understand complete corresponding source code, but the free software movement has proven that collectively this work can be done because it is being done. Very complex programs are being read, written, and maintained for our mutual benefit by collective action. People must be allowed to decide for themselves what level of programming they want to undertake.

You'd have us believe that a phone works radically differently from any other networked computer. You don't have full access to most servers you use now but you'd be a fool to think that software freedom does you no favors to make your computer more trustworthy. Installing spyware without my consent on my 100% trustworthy phone would not be possible because such a phone lets me disallow installation of whatever software I want to disallow. The conversation data could be copied and stored but that's no different than tapping into the line; this has to do with the trouble with relying on other computers to get work done, and to some degree this problem is mitigated. The situation we face is not perfection or nothing; FLOSS didn't get as far as it has come by giving up because perfection is unattainable.

As for guarantees, I never said anything was guaranteed. Speaking of guarantees is silly. Real life offers no guarantee you'll understand and modify computer program source code, the plumbing in a house, the inner workings of your own body, and other complex things. Many other fields benefit from studying available documentation and doing experiments to figure out how things work and improve collective understanding. Proprietary software is different because it is designed to prevent such documentation and experimentation, therefore proprietary software puts us in a position of dependency not freedom. People apparently need to increase the odds that they can run something trustworthy. That trust comes from software freedom for cell phone software just like free software for any other computer. Anyone should be allowed to learn to program and control their computer entirely. We all need software freedom for all of our programs.

Join the Classaction Suit!

[joocemann]

This is a link to the attorneys that are representing the national class action lawsuit.

http://www.hbsslaw.com/ciq/

It's Bill Lee

[Anonymous Coward]

... whackin' in Tangiers.

And now I'm out on the sole surviving with my Beatnik peers. Analog reel and a little distortion.

(etc.)

Re:Should have got a blackberry...

[Anonymous Coward]

Because they didn't say no. They used a lot of words about what they don't do, but they never said flat out that CarrierIQ is not installed on BlackBerries. Just that they had no hand in it.

Re:Should have got a blackberry...

[Anonymous Coward]

And if iPhones or Android phones are being sold in those countries then you can be sure that the data from them is being intercepted as well, otherwise the handsets would not be allowed in the country. Do not kid yourself.

Remember when Google so bravely stood up to China? Remember about three weeks later when google.cn was back up? What do you think happened?

Re:AT&T denial

[shentino]

Who says the two possibilities are mutually exclusive?

Re:Should have got a blackberry...

[Beriaru]

Can you categorically say there's no horsecock porn in your computer after sending it to repair to the geek squad?

Re:Should have got a blackberry...

[lightknight]

They're probably calling every carrier who offers their phones, and making sure they don't install it. RIM has had enough problems over the past few years, they don't need this one.

Hot Coffee = Above the Law

[CuteSteveJobs]

Yes, they may have violated wiretapping law but I bet no one goes to jail and if there is a fine, it doesn't dent their profits. But these guys not only are above the law. They write it. There is a HBO Documentary called Hot Coffee I recommend. You remember the McDonald's coffee case? An old lady who bought a cup of coffee, recklessly drove off with it between her legs suing for $2M?

Turns out there is a whole other side to these stories. In her case the coffee really was too hot (scalding temperature), and the photos of her burns are really bad! Not superficial; I mean bad! She was in the parking lot *parked* when it happened, and she was a passenger. She had asked for was to cover medical costs of treating the burns, but McDonalds brushed her off. It was a jury that awarded the figure because there had been 700 other burn cases and McDonalds had done nothing. An arrogant McDonalds manager said "700? pfffft... surprised it isn't more." She settled for less than the awarded amount. They made her sign a gag order.

And after that they badmouthed her with other big companies to lobby successfully for 'tort reform' using this case. Sounds like a great idea until it happens to you. This really limits the ability of the public to hold corporations to account. So, they are above criminal law (corporations may be people, but you can't jail them) and above civil law thanks to tort reform.

Re:Hot Coffee = Above the Law

[Anonymous Coward]

People try to defend the hot coffee incident with claims of "it was really hot" etc... Many people that call that lawsuit bullshit are capable of comprehending what actually happened here. That movie bought no difference in their opinion of the case. Putting something hot, really hot, or an unknown amount of hot liquid between your legs in a whimpy Styrofoam cup is stupid. No one can dispute that. If you did this yourself in your own microwave or your own coffee pot, would you be able to sue someone? Do people that heat their own coffee know to only heat it to 150F and they actually monitor that temperature to be sure? NO. Why would someone assume that hot coffee as supplied by a company should be at a temperature that they can put it on themselves one minute after it was given to them in a fairly insulated cup? Do people spill coffee on their legs all of the time and it never results in getting burned and so now they assume they can always spill it on themselves? Hey it sucks, the coffee did not have to be that hot but 2 million dollars is OUTRAGEOUS. Anyone who watches that movie and thinks that figure is justified is very gullible.

Re:Hot Coffee = Above the Law

[CuteSteveJobs]

> Hey it sucks, the coffee did not have to be that hot but 2 million dollars is OUTRAGEOUS.

Hard to debate it when you post anon but: You look at her burns and *you* tell me what you think those are worth? The jury (11 people like you) came up with the $2M figure. When the plaintiff shows wanton disregard an award can contain a punitive component to punish the plaintiff. That is on top of her economic damages which was the hospital bills and pain and suffering. You understand? The figure was deliberately set high to punish McDonalds. That is the whole point when a criminal remedy isn't available. (As it was it 2 days worth of coffee sales - and the figure settled was less anyway.)

Re:Hot Coffee = Above the Law

[Anonymous Coward]

I know the case, I know the details. My opinion is not swayed by the movie or anyone else that brings up the same points or references the same movie. Two million dollars was WAY the hell over what she should have got. Had she been in McDonalds and someone else spilled coffee on her or the person at the window threw it at her, maybe. There are thousands of cases a year that people are injured far worse and suffer much worse through absolutely no fault of their own and they get nothing or a tiny fraction of that 2 million dollars she got.

Re:Hot Coffee = Above the Law

[CuteSteveJobs]

Like I said, the $2M was to punish McDonalds. That was on top of her medical costs + pant and suffering.

You don't dispute that McDonalds deserved to be punished? Punitive damages are the only way that you can punish someone in a civil case. There is a lot of unethical behaviour which isn't criminal.

Now in a way, you're right. *She* didn't deserve the punitive damages. The 700 odd other people who reported it to McDonalds (and those that didn't) deserved it as well. And that is one fault with punitive damages. It goes to the person who brings the suit. You might argue the punitive damages should go to them, or the State - but why reward the State for sitting on its butt? It's the person who brings the suit (or their lawyer) who takes the risk. Give them the reward for doing the hard yards. In the old days criminal charges could be bought civilly, but increasingly the State took that over. Now a civil suit is the only chance you have of punishing a wrongdoer.

PS. And for God's sake get a login! ;-)

What about the EU?

[Gravis Zero]

we know that the EU is giving facebook flack for their privacy issues, so what do you think they are going to do to Carrier IQ?

i get the feeling that in a couple months we will see the a headline about Carrier IQ going under.

Re:What about the EU?

[ianare]

The EU will do nothing, since no cellphone has been found with CarrierIQ running outside of the US.

Re:Should have got a blackberry...

[Anonymous Coward]

Yes, because Blackberry has never handed over the keys to BBM when a nation-state has demanded them...

Because there is no need. You really don't understand how BBM works. BBM is encrypted with 3DES.

Now, 3DES is an old algorithm, but the keyspace is small. Brute-forcing 3DES is easy for a government, or anyone else with $100k in computer gear or many Amazon compute nodes.

Further, how does every blackberry decrypt the BBM messages? The reason is that the default 3DES key is installed on every blackberry. Further, the default BBM 3DES key is well known in the security community (and no, I won't tell you what it is).

In RIM's documentation about BBM, they refer to it as "scrambled" and not "encrypted".

So, to summarize:

- BBM uses a weak algorithm
- BBM uses a well known key

Any government that claims they can't decrypt BBM without RIM's assistance is either lying or run by idiots.

By comparison, blackberry email uses AES. Good luck cracking that.

It is possible with a blackberry enterprise server to change the BBM encryption key for your company's blackberries, but you're still using 3DES.

Re:Should have got a blackberry...

[Anonymous Coward]

I know that that statement makes me fully confident... "CIQ is not installed on Blackberry smartphones." is short, punchy, and sounds nice. Who wants to guess why their spokesweasel went with the above, instead?

Because RIM can't block other people from installing apps after the fact. RIM can't block YOU from installing apps. The platform is designed that way.

RIM has always been very honest about their software. The RIM software clearly lists apps that are installed, and the authors. RIM software lets you selectively grant or deny permissions to software YOU install on YOUR blackberry. RIM software lets YOU delete software from YOUR blackberry.

Moreover, a few years back when Etisalat (an Arab mobile carrier) tried to trick its users to installing spyware, RIM was clear and honest about it:

http://us.blackberry.com/ataglance/security/regappremover.jsp

RIM was very clear that the software wasn't from them, they didn't write it, they didn't assist Etisalat in writing it, RIM didn't authorize it, and how to remove the spyware from YOUR blackberry if YOU choose to.

http://www.engadget.com/2009/07/21/etisalat-blackberry-update-was-indeed-spyware-rim-provides-a-so/

Privacy.

[ieatcookies]

I honestly couldn't care less if logged SMS and keystrokes as long as it doesn't cost me on my data package. What I do care about is that it apparently sends unencrypted data about the encrypted site you may be surfing. Seems like this could be exploited for more nefarious purposes.

Carrier IQ has now infected Canada

[cimmerian]

It's not just happening in the US. All the major carriers in Canada had initially denied having Carrier IQ on their phones (Rogers/Bell/Telus) but it has recently been found on the Rogers LG Phoenix.

http://mobilesyrup.com/2011/12/02/uh-oh-carrier-iq-found-on-the-rogers-lg-phoenix/

You can put anything on iPhone without a jailbreak

[tlambert]

You can put anything on iPhone without a jailbreak

You just have to pay for a developer's license and enroll your phone.

What you don't get is the ability to to put any software you want on other people's phones by letting them download your application from your web site, you have to go through iTunes for that, and doing that requires Apple to approve your application. But when we get to that point, we've stopped talking about developer freedom and started talking about entrepreneurial freedom, which is something completely different.

PS: iPhones don't come with carrier crap installed; that's one of the reasons Apple didn't initially partner with Verizon; the other two reasons were the Qualcomm patent tax on CDMA hardware, and Verizon not wanting to set up a Visual Voice Mail service that met Apple's requirements.

PPS: All of the projects for running Linux on phones are only going to get somewhere if they break signature verification in the boot loaders, and the baseband software runs on a separate chip, rather than on the same chip as applications. That lets out a lot of smartphones (e.g. anything running a Qualcomm Snapdragon CPU). If they try to go ahead on those phones anyway, men in suits will show up citing the Code of Federal Regulations, 47, Section 2.944 covering Software Defined Radio.

-- Terry

Re:Should have got a blackberry...

[MyFirstNameIsPaul]

A BES admin could install Carrier IQ on a phone without the user's knowing, so it is not possible for RIM to state "Carrier IQ is not installed on BlackBerries" because they are not in control of every BlackBerry.

Re:You can put anything on iPhone without a jailbr

[spauldo]

A good chunk of developer freedom is tied up in distribution.

If you're allowed to develop, but not distribute, then your freedom as a developer has been compromised. Consider the various free applications available from the Cedega app installer - there's no entrepreneurial angle there.

Concerning the PS, yes, you're right. Apple is likely the one exception, since they're really the only ones who can get away with it.

Concerning the PPS, I'm honestly not expecting non-corporate Linux distros to "get anywhere" on phones anyway, due to a lot of other reasons, but there's plenty of phones out there without integrated radios. I imagine hobbyist distros will be developed for phones as long as there are phones for them to be developed on.

Re:Should have got a blackberry...

[Anonymous Coward]

They didn't. They showed the governments why they couldn't, then cut them a deal on BES, which they could cut over their infrastructure onto. In the end, they didn't - it was too costly and cumbersome. Oh, and that little bit about not getting the trade deals with Canada that they wanted out of the whole game of schenanigans.

All of this you should know, and probably do. But you still spread your ignorant view. Why is that?

Re:Should have got a blackberry...

[RocketRabbit]

It's pretty clear that the phrase above is not an unequivocal no.

Equivocation is a neat trick and it seems to work much of the time. It clearly worked on you!

Re:Should have got a blackberry...

[MyFirstNameIsPaul]

Again, I will request that you directly point out the weakness in their statement to disprove your apparent lack of reading comprehension.

The BlackBerry platform allows anyone to install any app they want on their phones, and BES admins can also install anything they want. If RIM were to state "Carrier IQ is not installed on BlackBerry smartphones," they would probably be wrong. So the only thing they can state is that they do not install the software; they do not authorize their carrier partners to install the software; and they have never worked with Carrier IQ. That's all they can state.

Log is Requested, Not Transmitted

[Anonymous Coward]

Perhaps the CIQ log is not transmitted in realtime... Perhaps, the log is sent "on request" for example when big brother wants to see what you've been up to... if they have a legal wiretap they simply pull your ciq log.

Why blame Carrier IQ?

[majest!k]

IMO people who demonize CIQ are missing the target. You should demonize the companies who employed CIQ technology to spy on their customers.

The only thing CIQ is guilty of is being a for-profit company in a capitalist society. Where there is demand (AT&T, HTC, Samsung, Motorola) there will be supply (CIQ). Just like the spam issue.

If you don't existinguish the demand by penalizing CIQ's customers, perhaps through legislature, CIQ 2.0 will be incorporated in no time and you better believe the next root kit will be a lot harder to detect.

AB

Re:Why blame Carrier IQ?

[Anonymous Coward]

"...CIQ 2.0 will be incorporated in no time and you better believe the next root kit will be a lot harder to detect."

And off we go into another field of battle, only this time we the consumers pay for it with monthly bills instead of war bonds. In one way, or another, it is ALWAYS the consumer that pays.

I am fully convinced that unless three things happen--global free trade, single global currency and a complete global ban on military formation and production of armaments--we humans are fucked, completely.

Our resources ARE finite, as it turns out, and we are consuming them at a rate that cannot be maintained for long...all in the name of war. War, along with market manipulations that are enabled by a lack of free trade and global currency, are sucking us dry. We covert all our energy, human and resources, into things to be blown up. We are literally destroying our future while the 1% profits from it (or so their simple, ego-driven minds think).

Technology has simply made more kinds of war possible.

captcha : antics

Re:Should have got a blackberry...

[Anonymous Coward]

Prove it, or shut the fuck up.

Re:Should have got a blackberry...

[Anonymous Coward]

Depends on if you read "didn't authorize" as "forbid" or as "didn't give explicit permission to"

Re:Should have got a blackberry...

[Anonymous Coward]

That depends on what the definition of is is.

Re:Should have got a blackberry...

[Anonymous Coward]

A BES admin could install Carrier IQ on a phone without the user's knowing,

False. The blackberry platform doesn't have hidden applications. If you want to see what apps are installed on your blackberry, just go to Options, Applications and see for yourself.

A BES admin could block you from deleting the application, but there is no way to hide it from the user.

Re:You can put anything on iPhone without a jailbr

[froggymana]

A good chunk of developer freedom is tied up in distribution.

If you're allowed to develop, but not distribute, then your freedom as a developer has been compromised. Consider the various free applications available from the Cedega app installer - there's no entrepreneurial angle there.

There would be nothing from stopping you distributing your code for an iOS app. In order for your "users" to install it though, they would need to pay the $99 fee for a developer license or be jailbroken. Your right as a developer to distribute software is still there, not very conveniently though but there none the less.

Re:AT&T denial

[Ihmhi]

"We've translated the code! 'The Pink Elephants are after me again.' What was Jenkins' assignment in Tangiers?"

"Raiding an illicit drug lord's hideout."

"What sort of drugs are we talking about here?"

"Files say... cocaine, meth, and... LSD."

"Mother of god."

No CIQ on our phones

[SpaghettiPattern]

Here in CH my family has in total 4 Android phones. None of them has CIQ. Possibly because we bought them directly and not through service plans. I don't know whether phones with service plans do have CIQ installed. My hunch is that a scandal would break out should such a practice be discovered here in CH. Or in neighbouring EU countries where privacy is highly considered, like DE for instance.

Re:No CIQ on our phones

[Anonymous Coward]

No CIQ has been found on any phones in Europe.

Re:Should have got a blackberry...

[MyFirstNameIsPaul]

I did not claim that the app would be hidden. A BES admin can install any app without a user's permission, so the user would have to be regularly checking installed apps to see if it was installed. Also, the BES admin can prevent the user from removing apps, so even if the user discovered an app installed, they likely can't remove it.

Not on my Samsung with AT&T

[Anonymous Coward]

I checked my Samsung Captivate yesterday (on AT&T network). No CarrierIQ files were found. (my phone is rooted too).
Also checked my wife's phone, nothing there either.

Re:Not on my Samsung with AT&T

[Anonymous Coward]

Check again....
run alogcat or download asi_log* from your phone and look
Then trigger the AT&T tool "Mark the Spot" and check again.

The code is there and while it seems to only be invoked
in a diagnostic way it is not clear what it sends. It is also
not clear if it can be triggered in other ways. ./mnt/sdcard/AndroidSystemInfo:
asi_logs-20110902-20243219.log

Re:Should have got a blackberry...

[gr8dude]

"RIM does not pre-install the CarrierIQ app on BlackBerry smartphones or authorize its carrier partners to install the CarrierIQ app [A] before sales or distribution," the company said in a statement. [B] "RIM also did not develop or commission the development of the CarrierIQ application, and has no involvement in the testing, promotion, or distribution of the app," the statement said"

[A] What about after?
[B] No one said they were developing it or paying for its development. This part of the statement doesn't say there is no CarrierIQ for BlackBerry, it simply says "our company did not develop or test it".

Such verbosity can be a sign of the fact that they're attempting to cover something. They list multiple cases for which the answer is "no": test, develop, promote, pay for development) to distract you from an edge case for which the answer is "yes".

What nasty things can they do, without contradicting the above?
- store the logs,
- cooperate in altering the billing reports such that the CarrierIQ traffic is not counted
- giving carriers the info they need to set up CarrierIQ after distribution. Note that the statement says "pre-install", what about "post-install"?

Re:Should have got a blackberry...

[CheerfulMacFanboy]

And if iPhones or Android phones are being sold in those countries then you can be sure that the data from them is being intercepted as well, otherwise the handsets would not be allowed in the country. Do not kid yourself.

Syria banned iPhones but not Android - draw your own conclusions.

Re:Should have got a blackberry...

[MyFirstNameIsPaul]

And this is why the OP's title makes so much sense (and yours makes so little): Apps cannot be installed remotely on a BlackBerry unless the BlackBerry is part of a BES, so post-sales install by a carrier is not possible. BlackBerry platform allows users to install any software they want and developers to develop any app they want, and since BlackBerry cannot control firms outside their own, the only thing they can state is that they played no part in the development of the app.

Your post demonstrates that you know very little about the BlackBerry platform.

Re:Should have got a blackberry...

[Anonymous Coward]

I am indeed not familiar with the platform and am not aware of its constraints, thanks for pointing that out.

My comment is about the statement's verbosity and how it leaves room for maneuvering if more details come to the surface.

Re:it's time to talk about teh penus

[Anonymous Coward]

i'd enjoy a miniture football helmet for my penis

wahoo!

Miniture
The size is right....

Re:You can put anything on iPhone without a jailbr

[ScrewMaster]

A good chunk of developer freedom is tied up in distribution.

If you're allowed to develop, but not distribute, then your freedom as a developer has been compromised. Consider the various free applications available from the Cedega app installer - there's no entrepreneurial angle there.

There would be nothing from stopping you distributing your code for an iOS app. In order for your "users" to install it though, they would need to pay the $99 fee for a developer license or be jailbroken. Your right as a developer to distribute software is still there, not very conveniently though but there none the less.

Not really, at least not in any meaningful sense. Just like how copyright law allows you to make duplicates of copyrighted material for personal use ... but denies you the right to acquire the tools needed to do that in most cases. A right that you have but do not have the power to exercise is not a right but is, in the end, a privilege. On that may be revoked at any time.

Re:Wrong -- stability is not ..

[Anonymous Coward]

Well stability of any performance tool is key.
Here is a big NOT ready for anything critical.
09-02 20:08:45.976 W/ActivityManager(2487)Scheduling restart of crashed service com.att.android.markthespot/com.carrieriq.att.service.IQService in 44984ms

Samsung hardware....

Re:Should have got a blackberry...

[RocketRabbit]

You seriously need to look into the definition of equivocation. If this person is telling the truth, his answer is still equivocal.

Clearly their lack of authorization has little to do with what actually goes on once they ship those phones to the carrier. Carriers often install their own software onto the phone.

Perhaps he knows that RIM doesn't install the software, and the carriers do not do it, but a third party that handles installing phone rom images that are tailored to specific carriers do install Carrier IQ - therefore he can't say no unequivocally, because the third party is installing Carrier IQ after the phones leave the manufacturing facility, but before the carriers get the phones.

You see their statement can be viewed as an innocent yet overly-complicated answer to the question, or it can be viewed as a vehicle for deception.

Re:Should have got a blackberry...

[MyFirstNameIsPaul]

The statement reads, "...before sales or distribution." This would clearly include a 3rd party doing something before the phone is sold. So you're still wrong.

I am actually very happy with the controversy..

[cheros]

.. because it means people have started to care again about privacy after years of brainwashing by self-interested parties such as the UK and US governments and companies like Facebook and Google. The latter happily profited from what can be called as the biggest assault on privacy in decades.

Carrier IQ is far from the only company doing what it does, but keep in mind they do so because there is a market for it. Follow the money..