CarrierIQ hit with Senate Investigation; Spying/Keylogging over 140+ Million Mobile devices

[*Shinzon*]

So apparently this software was installed on almost all android devices sold in order to log user data to provide manufacturers with information on usage and improve the devices. Problem? It logs every keystroke in the phone, even stuff that is encrypted is transmitted back to the company. Turns out the company is breaking several privacy laws and wiretapping laws.

Carrier IQ, the software that secretly records actions on many smartphones, is creepy and scary, and there's nothing you can do about it. But the U.S. Senate can, and Senator Al Franken just sent the company a nastygram.

Earlier today Franken fired off a letter to Carrier IQ CEO Larry Lenhart raising questions about the company's practices and demanding answers by December 14.

Senator Franken nods to the need for diagnostics, but then lays the hammer down, noting that the company may be violating the law:

[I]t appears the software captures a broad swath of extremely sensitive information from users that would appear to have nothing to do with diagnostics—including who they are calling, the contents of the texts they are receiving, the contents of their searches and the websites they visit.

These actions may violate federal privacy laws, including the Electronic Communications Privacy Act and the Computer Fraud and Abuse Act. This is potentially a very serious matter.

Potentially serious? I'll say! Franken goes on to ask a series of questions of Carrier IQ, that when answered should get to the bottom of some of our biggest mysteries about exactly what it's doing with all that data it is capturing. Hopefully, this is going to help put a stop to what seems to be nothing short of a very scummy practice.

You can read the complete letter below, or on Franken's website.

http://gizmodo.com/5864218/carrieriq...?tag=carrieriq

PS: Gizmodo also has another article better explaining exactly what the software does: http://gizmodo.com/5864220/what-is-c...?tag=carrieriq

[Brill Weave]

And I just got a Droid last week!!!

[Brill Weave]

Read Franken's website. Poses some good questions. Should be interesting to see how Lenhart responds.

[Kuya]

I hope the Senate isn't too busy raping the Constitution to pay attention to this.

[Stumblingdrunk]

after constitution rape its senate secret santa time

[Stumblingdrunk]

which, coincidentally was also started by Franken

[Brill Weave]

I can't decide who needs a hug more. Kuya or Plow. I'm leaning towards Kuya.

[jmc]

Just moved back to android a few weeks ago, and first thing I did was install a rom that did not have CIQ.

Fuck those guys

[*Shinzon*]

Yeah I've been using Sprint's Rom but I rooted it and was using a different Kernel. I was about to unroot my phone so I could update to the newest droid rom but now that I see this I think I'm most certainly going custom.

[SephYuyX]

I still use a Palm.

[*Shinzon*]

Here is Engadget's article. It's much more in depth about the company and more of the legal details. Apparently if found to be violating these federal laws a class action lawsuit will most likely be filed.
http://www.engadget.com/2011/12/01/c...t-you-need-to/

[Aevis]

you might want to change that title a bit to not raise any false hope for other OS users. it doesn't really have anything to do with the OS itself as it is injected into the firmware by the providers. carrierIQ has been found in other devices too (Symbian, iOS, BlackBerry, WebOS) with the exception of w7 and bada (so far).

it looks a bit better for europe with our tighter privacy laws. at least the big providers in switzerland and germany have already published statements in which they deny any installation of carrierIQ on their devices.

[Celeras]

you might want to change that title a bit to not raise any false hope for other OS users. it doesn't really have anything to do with the OS itself as it is injected into the firmware by the providers. carrierIQ has been found in other devices too (Symbian, iOS, BlackBerry, WebOS) with the exception of w7 and bada (so far).

^ This. It's not on any Verizon wireless devices, either. OP read a headline and decided to become an activist.

[Vincento]

Throwing my vote in for a title edit.

Detecting carrierIq via app

Company statements

Apple:

We stopped supporting Carrier IQ with iOS 5 in most of our products and will remove it completely in a future software update. With any diagnostic data sent to Apple, customers must actively opt-in to share this information, and if they do, the data is sent in an anonymous and encrypted form and does not include any personal information. We never recorded keystrokes, messages or any other personal information for diagnostic data and have no plans to ever do so.

AT&T:

In-line with our privacy policy, we solely use CIQ software data to improve wireless network and service performance.

Bell:

Bell doesn't install or support Carrier IQ or similar programs. You may want to connect with the device manufacturers for the industry-wide perspective.

Fido:

Carrier IQ is not on any of our devices.

Google, which has never shipped CarrierIQ on its Nexus devices:

We do not have an affiliation with CarrierIQ. Android is an open source effort and we do not control how carriers or OEMs customize their devices.

HP:

HP does not install nor authorize its partners to embed Carrier IQ on its webOS devices.

HTC:

Statement 1: HTC, like most manufacturers, has an opt-in error reporting function built in to our devices. If your phone experiences an error, you have the option of 'Telling HTC' so we can make improvements to our phones. Details about this are in our privacy policy on each device and in order for data to be collected, you have to opt-in. If you do opt-in, we protect your privacy by de-identifying and encrypting the data. HTC is committed to protecting your privacy and that means a commitment to clear opt-in/opt-out as the standard for collecting any information we need to serve you better. Statement 2: Carrier IQ is required on devices by a number of U.S carriers so if consumers or media have any questions about the practices relating to, or data collected by, Carrier IQ we'd advise them to contact their carrier. It is important to note that HTC is not a customer or partner of Carrier IQ and does not receive data from the application, the company, or carriers that partner with Carrier IQ. HTC is investigating the option to allow consumers to opt-out of data collection by the Carrier IQ application.

Microsoft:

Since people are asking -- Windows Phones don't have CarrierIQ on them either.

Nokia:

Nokia is aware of inaccurate reports which state that software from Carrier IQ has been found on Nokia devices. Carrier IQ does not ship products for any Nokia devices, so these reports are wrong.

RIM:

RIM does not pre-install the Carrier IQ app on BlackBerry smartphones or authorize its carrier partners to install the Carrier IQ app before sales or distribution... RIM also did not develop or commission the development of the Carrier IQ application, and has no involvement in the testing, promotion, or distribution of the app.

Rogers:

Hi all. I'm happy to confirm that we have investigated and Carrier IQ is NOT on any of our devices

Samsung:

Some Samsung mobile phones do include Carrier IQ, but it's very important to note that it's up to the carrier to request that Samsung include that software on devices. One other important point is that Samsung does not receive any consumer user information from the phones that are equipped with Carrier IQ.

Sprint:

Carrier IQ provides information that allows Sprint, and other carriers that use it, to analyze our network performance and identify where we should be improving service. We also use the data to understand device performance so we can figure out when issues are occurring. We collect enough information to understand the customer experience with devices on our network and how to address any connection problems, but we do not and cannot look at the contents of messages, photos, videos, etc., using this tool. The information collected is not sold and we don't provide a direct feed of this data to anyone outside of Sprint.

Sprint is well known for our serious commitment to respecting and protecting the privacy and security of each customer's personally identifiable information and other customer data. A key element of this involves communicating with our customers about our information privacy practices. The Sprint privacy policy makes it clear we collect information that includes how a device is functioning and how it is being used. Carrier IQ is an integral part of the Sprint service. Sprint uses Carrier IQ to help maintain our network performance.

T-Mobile:

T-Mobile utilizes the Carrier IQ diagnostic tool to troubleshoot device and network performance with the goal of enhancing network reliability and our customers' experience . T-Mobile does not use this diagnostic tool to obtain the content of text, email or voice messages, or the specific destinations of a customers' internet activity, nor is the tool used for marketing purposes.

Verizon:

To be 100% clear: Carrier IQ is *not* on Verizon Wireless phones.

Motorola didn't have an official statement, but did mention that Carrier IQ is only pre-loaded as an operator requirement. According to MobileSyrup, Virgin Mobile Canada, Telus and Videotron have also confirmed that Carrier IQ is not loaded on any of their devices.

[MaachaQ]

I went and watched some of the YouTube videos, and did a double take when I saw one of the recommended videos:


One of these things is not like the others~♫

The company rep in this video is lying through his teeth, I hope they nail this company.

[*Shinzon*]

you might want to change that title a bit to not raise any false hope for other OS users. it doesn't really have anything to do with the OS itself as it is injected into the firmware by the providers. carrierIQ has been found in other devices too (Symbian, iOS, BlackBerry, WebOS) with the exception of w7 and bada (so far).

it looks a bit better for europe with our tighter privacy laws. at least the big providers in switzerland and germany have already published statements in which they deny any installation of carrierIQ on their devices.

Yeah it's been found on other devices as well, its just the big one to worry about is really Android because of the volume of phone they sell. I'll edit it though.

[Ragnus]

I just checked my phone with that voodoo app to double check Verizon's statement. My phone is clean.

[Necronus]

I just checked my phone with that voodoo app to double check Verizon's statement. My phone is clean.

Ditto

[Nightfyre]

Stupid smartphones and their keyloggers.

[Avanarius]

It's not a coincidence that wikileaks released their spy cables just before this went big. I suggest that everyone take a look at those, interesting stuff.