Ramblings of an old Doc

 

My prior post was to alert you folks with cell phones and other mobile devices about a particular piece of software present on your devices.

This is a bit of software installed on millions of phones and other devices that has access to a huge amount of user data. As developers hinted for months and

which Mr. Eckhart eventually proved on camera, the software is aware of SMS content, secure web traffic, contacts, key presses, and more.

All this, we have been asked to believe, in the never ending quest to provide better service (fewer dropped calls) to the customer.

 

Carrier IQ developed the software. Who asked them to do so and who eagerly bought it and installed it on your devices? Your carrier, and in one case an OS maker (Apple).

Which carriers are involved?

Sprint, AT&T, T-Mobile.

Which handset makers are involved?

Apple (prior to iOS 5), HTC, Samsung (some models, per carrier request), Motorola (spin: Only per operator requirement), RIM (spin: If any has been found, it was installed without RIM’s knowledge or permission).

 

What does all this boil down to?  In my opinion (spin: Derived from Sgt. Schultz’s line: All I know is based on second hand information only), the carriers are the ones wearing the black hats, but CarrierIQ isn’t off the hook. Not by a long shot.

“Facilitation” is the word I hunted for some time. What does that mean? Well, say a person kills another with an automatic weapon (for the argument). The dead person’s family sues the killer and the firearm manufacturer. The manufacturer states, “The proper use of the weapon is hunting and self-defense. We cannot be held responsible for the regrettable death.”

That’s like I. G. Farben saying, “Zyklon-B (Potassium cyanide which generates cyanide gas) is clearly marked as a rat poison. Any use to harm people is without our knowledge or complicity.”

The purpose of a firearm is to harm (animal or human) offensively or defensively. The purpose of Zyklon-B was to murder innocent men, women, children and babies (may they rest in peace).

The purpose of CarrierIQ’s software was tracking. They actively advertised, negotiated, sold and gave installation instruction to the carriers. Any other statement is mendacious.

As for the carriers? They are guilty of collecting your information without your explicit consent. What they did with it will come out. They need to be called out on it, fined and they need to be sued by the folks whose info was “collected for their benefit”.

If it had been one intellectually, morally and ethically challenged carrier – well, the remedy is relatively simple.

It was not. It was industry wide. This says a lot, and none of it good. That needs a systemic remedy.

Sen. Al Franken (D-MN), the chairman of the Senate Judiciary Subcommittee on Privacy, Technology & the Law, said Eckhart's findings show the need for Congress to pass legislation protecting the sensitive information of consumers and that CarrierIQ has a lot of questions to answer. Granted, they do. However, the wrath of the internet (and our great Solons) should be more rightfully pointed at the carriers. The link to Sen. Franken’s letter to CarrierIQ’s CEO led me to the message “This is a damaged file” and it wouldn’t download (pdf) for me to view.

I’m letting my carrier know I want the software off my phone, and none like it in the future. You might think of doing the same.

 

Sources:

http://techcrunch.com/2011/12/02/dont-blame-the-iq-blame-the-carrier/

http://www.pcmag.com/article2/0,2817,2397128,00.asp  - Which devices/carriers/hand sets are involved)

http://www.huffingtonpost.com/2011/12/01/al-franken-carrier-iq_n_1123942.html

 

 

 


Comments (Page 1)
2 Pages1 2 
on Dec 03, 2011

Great!  I personally have a Motorola and also two HTC's on my family account with AT&T too!

on Dec 03, 2011

Hmm, so even Samsung could be affected.  I have a Samsung from about 2 years ago.

This is a serious breach of trust, privacy, ethics and in a lot of cases, the law.  May they (CarrierIQ and all the Carriers involved) get what they deserve.

on Dec 03, 2011

Not "affected". This was an active installation by the carrier... not some malware that 'happened' to get installed by browsing the wrong site.

on Dec 03, 2011

Yes.  I just wonder whether my Samsung was one that had the carrier installation on it.  It just goes to show, where there's a way to mine information, even if it is illegal and highly unethical, many companies will go for it surreptitiously.

Btw: by carrier, do you mean the mobile phone makers, or the telecommunications companies that run the networks?

on Dec 03, 2011

Which reinforces my decision not to own one. I just hope Windows doesn't get jammed up with it. That'll really piss off a whole helluva lot of people ... again.

on Dec 03, 2011

Funny thing is when I browse my apps on my Motorola Atrix 2. I do not see CarrierIQ on the list.  Maybe I am not knowledgeable enough though to find it.  I did find a strange app though titled "DataCollectorProvider", and when you read the description it says"This is an old application process that is being kept for better speed in case it is needed again. There is usually no reason to stop it." So what the heck, why is it even there taking up space and memory! I can stop the service however. I really hope these privacy invaders get what's coming to them, and not my data either!

on Dec 03, 2011

Perhaps its time to apply 'corporate personhood' in a fair and balanced manner.  If and when convicted - give the corporation jail time, not just a 'fine' which is just passed along as a 'cost of doing business.'

on Dec 03, 2011

Useful information for those concerned:

Trevor Eckhart, the guy at the center of this exposure, has posted a very useful security tool that people here may find useful.  

Here is his apk for scanning your phone for CIQ (and other loggers) with the option of removing them.  It requires a rooted Android phone.  I'm not advocating rooting or not (it may void your warranty).  But it is a great tool. 

Here is a scanning tool that will let you know if you're Android phone has CIQ.  Because it does not require root access it can not remove CIQ, only inform you that it is there. 

Also anyone running a custom ROM likely has nothing to worry about (though you should check to be sure).  


A few of my random thoughts on the subject (I apologize for the length, I'm opinionated and this is a subject I've spent a lot of time on both in my graduate program and in real life):

Everyone should make sure they're placing the blame in the right place here.  The entity(ies) largely responsible for this are the carriers, not the manufacturers or CIQ.  CIQ is providing a service.  If they didn't provide it someone else would.  The manufacturers of the devices bake CIQ's software into their phones based on carrier demand.  Verizon phones have so far all tested clean, even though cross carrier devices (some of Samsung's stuff for example) has CIQ for the same models on AT&T.  The difference is that AT&T insists Samsung include the software, while Verizon doesn't use it. 

Secondly, I'm torn on the outcry over this.  Do people honestly think that carriers don't have access to your texts, voice mails, and browsing habits (at a bare minimum)?  All of this data exists ON THEIR SERVERS.  If you accept that they can have access to your info, how much more outrageous is it for them to use CIQ for usability information directly from the handsets?   How many people who are freaking out over CIQ don't even have pins or passwords on their phones?  44% of all smart phones aren't secured even with a basic access pin.  And of those that are 65% are forced to do so by their employer.  If you don't have a password on your phone this story is basically a non-issue to you because your security and privacy are significantly more at risk from the unsecured device and IT'S YOUR OWN FAULT.  

I'm not trying to defend the carriers at all.  Merely pointing out that this is the very tiny tip of a much larger issue that people really need to think through.  Think of how big of a deal it would be for you to lose your phone (stolen, misplaced, whatever).  If your answer is that it would be a big deal at all and you haven't though through all of the issues brought up by the CIQ story then you are doing yourself a disservice.  

Personally I think that if the carriers were upfront about what they were tracking and allowed the user to understand what they were doing and WHY as well as gave the user the option to not have their data sold to 3rd parties (Verizon is the only one who provides this option off the top of my head), this would mostly be a non-issue.  

The carriers don't give a damn about your personal info.  They do all of this tracking so they can detect larger trends.  Usability issues can be discovered, problems with technology (radio issues, software issues) can be found without the user reporting issues.  They can find gaps in their existing product offerings, apps, network, etc.  The carriers that sell the data do so to companies that analyze all this info and then resell it as "marketing reports". How many people have crashes on Windows and click the "Don't Report" or "Cancel" button but still bitch about bugs and problems?  That is a part the problem they are trying to solve.  The issue is that the users have no idea what carriers are tracking via their phones because the carriers go out of their way to hide it and in most cases (Verizon not withstanding only very recently) sell that info to third parties.  The the first thing I do is root my phones and throw custom ROMs on them because of this.  

Also keep in mind that many of the advancements we all enjoy in mobile computing depend on this type of service.  The rapid increases in usability from IOS1 to IOS5 or from Android Cupcake to Ice Cream Sandwich largely depend on services like these.  In house usability studies can at best hit hundreds or maybe a thousand people.  These services give the usability engineers millions of data points.  Does that make this sort of service right?  No idea.  But many of the things everyone enjoys about their phone are the results of this very thing. 

I don't really have a grand overall point.  I have just seen the CIQ story generate lots of bad information (not from the Dr. here, but on the Internet in general).  On the one hand I see people freaking out because Big Red may be reading your sexts to your secret lover.  That's not the problem because they don't give a damn about your sex life.  The problem is that they are collecting data about how you use your phone, when you use it, what you use it for all without your permission and in many cases they are reselling that data to third parties.  

Don't count yourself lucky if you're using IOS5 or have Verizon as your carrier.  They may not use CIQ, but they are absolutely collecting the same information through some other means.  Their business model (and consumer expectations) demands that they do.  The fact that they don't use CIQ specifically just allows them to deny any association with this particular story.  

on Dec 03, 2011

ElanaAhova
Perhaps its time to apply 'corporate personhood' in a fair and balanced manner.  If and when convicted - give the corporation jail time, not just a 'fine' which is just passed along as a 'cost of doing business.'

I'm sorry, but this issue just isn't that cut and dry.  See my meandering and way too long post above.

on Dec 03, 2011

StevenAus
Btw: by carrier, do you mean the mobile phone makers, or the telecommunications companies that run the networks?

The company you contracted with... like the ISP for your telephone, though.

Here's a list:  http://www.mobilephonesecrets.com.au/australian-mobile-phone-networks.html

on Dec 03, 2011

@Kantok   i appreciated your 'reply #8' which was posted after my brief post.  I'm not sure how my comment was understood to become a 'cut and dried' judgement on CIQ concerns and practices.   My comment includes a conditional clause "if." 

on Dec 03, 2011

Just took the time to install this new app. Once again you are on the cutting edge of great software. So far its running great, I feel as if I no right to privacy at all!    

 

Let's go shopping!  

 

on Dec 04, 2011

I agree with seanw3 .... lets go shopping. I just got to wait for the kickbacks to roll in first from CICutesy first. lol

on Dec 17, 2011

Yes... that is some good news, isn't it.

My advice? "Root" your phone.

 

2 Pages1 2