Tracking-Software Maker Stirs Phone-Privacy Fears
Little-known software installed on millions of smartphones is raising fresh questions about what data are being collected from mobile devices, where it’s going and what it is being used for.
Security researchers have published blog posts and videos that appear to show software— from a company called Carrier IQ Inc.—collecting information on an HTCCorp. smartphone, running Google Inc.’s Android operating system. The software, which security researchers said was not transparently visible to consumers, is shown tracking actions such as when buttons are pressed and collecting personal data such as the content of text messages.
Phone-Privacy Fears
Such disclosures, which began making waves a couple weeks ago, prompted concerns from users and regulators alike, who began asking how many devices used the software and what it did. HTC said Thursday it isn’t a customer, but that some carriers require the software to be used. Apple Inc., meanwhile, said it was already phasing out use of the software.Nokia Corp., meanwhile, said it hasn’t used it.
A spokesman for Google said the search giant doesn’t have an affiliation with Carrier IQ, adding that it doesn’t control how mobile carriers or handset makers might customize Android. Google distributes the software free and allows device makers to change its code to add or remove features.
Some wireless carriers, including Sprint Nextel Corp., AT&T Inc. and T-Mobile USA, ask some of their phone manufacturers to put Carrier IQ on their devices. Each said they use the technology to monitor their networks and improve service.
The dust-up is the latest in a string of privacy controversies that have concerned consumers and lawmakers. Privacy researchers recently have uncovered information about smartphones tracking user’s location history and apps that access and transmit user’s personally identifying information.
On Capitol Hill, Sen. Al Franken (D., Minn.) has asked the company to answer questions about what data it collects, where that information is sent and how it is handled, among other things.
Carrier IQ said in a statement late Thursday that its software does not record, store or transmit the contents of text messages, emails, photographs, audio or video. Instead, it said it tracks whether text messages are sent accurately, for example, and figures out which applications drain a handset’s battery. The company maintained that the software it makes is used to monitor and improve device and network performance, not to collect personal information.
“Our software makes your phone better by delivering intelligence on the performance of mobile devices and networks to help the Operators provide optimal service efficiency,” it said.
“The revelation that the locations and other sensitive data of millions of Americans are being secretly recorded and possibly transmitted is deeply troubling,” Sen. Franken said in a statement. “Consumers need to know that their safety and privacy are being protected by the companies they trust with their sensitive information.”
The company earlier sent a letter to one security researcher, Trevor Eckhart, demanding he remove any reference to Carrier IQ in his published research, or face court proceedings and fines.
Carrier IQ later withdrew its demand after the Electronic Frontier Foundation, a digital rights advocacy group, backed Mr. Eckhart’s research.
The EFF said it is acting as legal counsel for Mr. Eckhart and will continue to monitor the situation. Mr. Eckhart didn’t respond to a request for comment.
A former executive of Carrier IQ described the company’s technology as a “mobile intelligence service” being used on roughly 150 million devices world-wide. He also said that wireless companies in particular use the product to help analyze dropped calls, for example, or understand how much data a user downloads to their phone.
“We give them insight that they previously haven’t had into their end users’ experience, and the usability of the product,” he said.
Dan Rosenberg, security consultant for Virtual Security Research, believes the software doesn’t create a comprehensive log of all user keystrokes and send it to carriers. Rather, based on his own analysis, it appears that certain key-presses can be recorded, which may be used for technical support.
HTC said Carrier IQ’s software is required by “a number of U.S. carriers,” and that it isn’t a customer or partner of the firm. HTC also said it doesn’t receive any data from the company or the carriers who partner with Carrier IQ.
Samsung Electronics said Carrier IQ is available on some of its phones, but that carriers must request that it be added. The South Korean company said it doesn’t receive any information from Carrier IQ.
Apple said it stopped supporting the software from Carrier IQ in most of its products when they were upgraded to the iOS 5 mobile operating system, which was released two months ago alongside the iPhone 4S.
Apple added that it plans to remove Carrier IQ completely in a future software update, though the tech company will still offer customers an opt-in diagnostic service that doesn’t include recording of button presses or collection of any other personal information.
Microsoft Corp. said it doesn’t ship Carrier IQ with its mobile phone software. U.S. cellular data carrier, Verizon Wireless, said it doesn’t add Carrier IQ to its phones.
Sprint said it requests handset makers to add Carrier IQ “because it’s a diagnostic tool that helps us make the phones work better and the networks work better and them all communicate better.” “Generally speaking, all carriers use some service like this to basically determine what issues are occurring and how to fix them.”Sprint said it doesn’t and can’t look at the contents of messages, photos, and videos using Carrier IQ.
AT&T said “we solely use CIQ software data to improve wireless network and service performance.”
