Slashdot Mirror
Preventing Another Carrier IQ: Introducing the Mobile Device Privacy Act
MrSeb writes "Lawmakers in Washington have turned their sights on mobile device tracking, proposing legislation aimed at making it much harder for companies to track you without consent. The Mobile Device Privacy Act (PDF) makes it illegal for companies to monitor device users without their expressed consent. The bill was introduced Thursday by Massachusetts Democrat Representative Edward Markey, co-Chair of the Bi-Partisan Congressional Privacy Caucus. Much of the impetus for the bill came from last year's Carrier IQ debacle, where it emerged that the company's software was found to exist on both iOS and Android devices on AT&T and Sprint's networks. While the company denied any wrongdoing, the software captured keystrokes and sent the details of your device usage back to the carriers. If passed, the legislation would require the disclosure of including tracking software at the time of the purchase of the phone, or during ownership if a software update or app would add such software to the device, and the consumer gains the right to refuse to be tracked. This disclosure must include what types of information is collected, who it is transmitted to, and how it will be used."
I have an iPhone 3GS on AT&T. How do I check if Carrier IQ is on it? Did that program show up "randomly" or only on new phones after a certain date?
My first Journal Entry ever, in 8 years! http://slashdot.org/journal/365947/aphelion-scifi-fantasy-horror-poetry-webzine
They'll just put the required consent in the Terms of Service. Problem solved.
All this will due is put some disclosure into EULA's, certainly buried way toward the back in small print, because everyone knows that users read EULA's before giving their consent, right? But the cat is out of the bag, and this won't cause vendors to stop trying to collect or sell your data. Android is already pretty good at this, by giving users a pretty detailed list of what information an app has access to at the time the app is installed. I've been alarmed at the number of apps that want permission to access information that they really don't need. I've also been alarmed at apps that want your Facebook login. I won't use apps like that, but I think I'm unique among users. Maybe I missed it, but I have not seen any kind of widespread user revolt against this kind of thing, just articles here and there vaguely implying misbehavior (like CarrierIQ). I haven't seen any comments on in the Android app store saying "you don't need that permission". The users don't care, so we're going to be railroaded out of the info no matter what we do, because someone else finds it profitable.
1^2=1; (-1)^2=1; 1^2=(-1)^2; 1=-1; 1=0.
I just noticed in my EULA that I have renounced my citizenship and rights as a US citizen.
As much as I - as one of the Android world's major fighters of CIQ - and the rest of /. may like this, we all know it's not going anywhere. Regulatory capture, anyone?
"Representative" in that context is a title, like "Sir" or "Lord". It's part of the proper name; the grammar was fine (in that sentence, anyway).
Everything is better with chainsaws.
I love how the government is trumpeting the fact that they're doing this, because they're all upset that THEY should be the only ones allowed to track people.
A legal solution is fine, but it isn't sufficient by itself. It's like trying to legalize that I don't receive spam. Well, the law can't really do that (it's tried). I can only do that myself, by being careful with who I give my email to.
So this seems like the same idea. Such a law doesn't hurt, but it isn't enough, by itself. What's needed is a technical infrastructure where the people who buy mobile products fully control them, from the hardware on up, rather than some phone carrier controlling them. Then I can blow away whatever crapware comes with the device by installing my own operating system and only running software I trust.
As long as the device is secured against the people who buy them, there can be no trust that we have any privacy.
If they wanted to pass a better law, they'd have passed one like that: carriers cannot secure phones against who buys the phones.
I've said it once, and I'll say it again: carriers have no busyness selling mobile phones, they need to be separate things, to avoid vendor-lock in, and plenty of other issues.
I'm still surprised how many people in the US seem to buy their phones from their carriers really. Phones need to be sold in closed boxes on default factory settings, and sold by phone-selling companies. Otherwise, there's a severe conflict of interests.
Imagine if PCs were sold by ISPs, and TVs by cable-companies!
First and Foremost needs to be the mention of such privacy-violating software in the EULA/ToS of the agreement. Screw all the other parts. Make this paramount.
Still waiting on Serviscope_minor to wake up to fucking reality and realize that Jessica Price isn't going to fuck him.
I love our new Congress: Nothing is illegal, as long as its documented.
#fuckbeta #iamslashdot #dicemustdie
On the iPhone CarrierIQ did not do most of the stuff the Android version did - no key logging for example.
Apple got rid of CarrierIQ with iOS5 updates anyway.
"There is more worth loving than we have strength to love." - Brian Jay Stanley
Disclosure is pointless. Firstly, it doesn't prevent the carrier from installing spyware on your device. Secondly, it's often worded in a way which leaves the customer clueless:
"..In agreeing to these terms, you authorize
Sprint to collect the necessary data needed to improve
and maintain equipment, networks, and customer service.
At no time will Sprint share this information with unaffiliated
third-parties, or individuals"
People just "meh" at shit like this and click through it. The lawyers know it too. I say, If you're going to raise hell about CarrierIQ, make a policy that requires the individual to Opt-in.
Join the Slashcott! Feb 10 thru Feb 17!
Its there, but its weak. See section 3.
Sig Battery depleted. Reverting to safe mode.
Oh, it'll pass, but disclosure will be buried in a EULA or thick contract, and you won't be prompted if you want to remove it. You'll have to ask with forward knowledge that the software exists. At least, that's what the wording of the summary suggests. (maybe I should RTFA...)
Charisma is the measure of someone's ability to lie with a straight face.
Carriers will merely put this into their TOS or other contacts with fine print that a lot people don't read but sign anyways. Mandate a specific title and format of the text so people actually notice it before they just agree. Better yet, mandate it a yes or no question on the agreement. It'd be no different than the customer improvement prompt you get for certain software to know how you use it.
If the carrier can not capture keystrokes. How would it know that you want to make a phone call or what the text should say or what website to display? Sometimes I wonder about privacy freaks... Maybe I shouldn't do that.... They might pass a thought law.... Never mind...
Are you telling me that CM will let you install apps that need e.g. "phone state and identity" but will feed them false information?
If so, I'm definitely switching to CM.
1^2=1; (-1)^2=1; 1^2=(-1)^2; 1=-1; 1=0.
You think they're going to pass this? Bwahahaha.
this is about the carrier getting a full keystroke log from your phone
so if you typed something decided it was stupid edited it to something sane THE CARRIER WOULD GET BOTH VERSIONS
so lets say you decided to text somebody half drunk after knocking over a convenience store. you decide to NOT tell the world that you just hit %store% but decided to say something else. The Police could get the Evidence version.
Any person using FTFY or editing my postings agrees to a US$50.00 charge
Five will get you ten that your "right to refuse it" is the exact same "right to refuse" that you've had since the shitstorm started: don't buy the phone. Otherwise, consent is implied.
These are cell phone carriers we're talking about. There's nothing too scummy for them.
Fuck that. Don't even play THAT nice.
CyanogenMod balked at it because they didn't want to piss off the developers (boo fucking hoo), but PDroid solves the "neutered apps crash" problem by feeding it bogus data.
Make "thou shalt not snoop" the law of the land, with narrow exceptions that require prior consent (for cases other than self-defense), imposing jailtime and fines on all who infringe upon anyone's privacy.
Be careful of new laws: "No company can track you, but the government can do whatever it wants."
They're perfectly content to let you rage on about the pseudo-evil of corporations while Sauron bides his time.
(-1: Post disagrees with my already-settled worldview) is not a valid mod option.