Carrier IQ has recently found itself swimming in controversy. The analytics company and its eponymous software have come under fire from security researchers, privacy advocates and legal critics not only for the data it gathers, but also for its lack of transparency regarding the use of said information. Carrier IQ claims its software is installed on over 140 million devices with partners including Sprint, HTC and allegedly, Apple and Samsung. Nokia, RIM and Verizon Wireless have been alleged as partners, too, although each company denies such claims. Ostensibly, the software’s meant to improve the customer experience, though in nearly every case, Carrier IQ users are unaware of the software’s existence, as it runs hidden in the background and doesn’t require authorized consent to function. From a permissions standpoint — with respect to Android — the software is capable of logging user keystrokes, recording telephone calls, storing text messages, tracking location and more. It is often difficult or impossible to disable.
How Carrier IQ uses your behavior data remains unclear, and its lack of transparency brings us to where we are today. Like you, we want to know more. We’ll certainly continue to pursue this story, but until further developments are uncovered, here’s what you need to know.
What is Carrier IQ, anyway?
Privacy concerns surrounding Carrier IQ were initially brought to light by Trevor Eckhart, a security researcher who became alarmed by the extent of information accessible by the analytic software. In the following video, Trevor presents much of his findings, which seemingly demonstrate Carrier IQ’s keystroke logging, location tracking and ability to intercept text messages. Even information that should be transferred only within encrypted sessions is captured in plain text by Carrier IQ. During the entire demonstration, Trevor’s phone was in airplane mode, operating only over WiFi. Although his actions were outside the scope of his wireless carrier (Sprint), the software continued to monitor his every key press. On his Android device, it’s evident that Carrier IQ is running, even though it does not appear in the list of active processes. Further, the application doesn’t respond to “Force Quit” commands, and it’s set to startup when Android launches.
After watching Trevor’s video, it’s easy to form opinions that Carrier IQ may be the omnipresent snoop. In some ways, it is. The software has the ability to record nearly every action you perform with your phone. The actual data logged, however, isn’t determined by Carrier IQ, but rather its clients. The system enables manufacturers and carriers to examine how phones are used, how they behave and to aid in resolving issues that customers may experience. Clients are able to define specific parameters they wish to track, and also set events that would cause the device to report this information back to Carrier IQ. For instance, a manufacturer may wish to know which currently installed applications use the most battery life, while a carrier may choose to query the devices that experienced a service outage in a particular region during a given time frame.
Unfortunately, without Carrier IQ or its clients being explicit in the information it tracks, there remains a very real concern for individual privacy. As of present time, nobody is handling this quite well.
Carrier IQ was founded in 2005 in Mountain View, California. It’s a privately held operation, with investors including Accel Partners, Bridgescale Partners, Charles River Ventures, Mohr Davidow Ventures and Natua Capital. Intel Capital is known to be a prior investor as well, although it’s unclear whether it still holds equity in the firm. Carrier IQ’s management of these privacy concerns so far has been a mess, to say the least. After Trevor Eckhart reported his findings, which included the company’s training materials, Carrier IQ attempted to silence him with a cease-and-desist letter, demanding he replace his analysis with a statement disavowing his research. The company has since retracted its threat and apologized for its behavior, but not without first earning a black eye in the process.
The company’s newly appointed CEO, Larry Lenhart — who remains part of Mohr Davidow Ventures — recently published a video to YouTube explaining the firm’s stance on privacy, in which he outright denies that Carrier IQ records keystrokes or provides tracking tools. Perhaps the company is truthful in its assertion, although the statement seems to contradict the design and capabilities of its software.
For some further insight into Carrier IQ, we’ll examine some of these aforementioned training materials that we obtained from Trevor Eckhart’s website, along with one of the company’s patents concerning data collection. On the analytics end, the software features a portal that allows administrators to create events that would trigger a Carrier IQ-enabled device to “phone home,” and choose the data which is to be sent. Alternatively, admins may also submit queries to individual devices, either by using an equipment or subscriber ID — or, they may choose to query pools of handsets by inserting wildcards into the string. The extent of information available to administrators upon querying a specific device is unknown.
Seemingly contradictory to Carrier IQ’s assertion that it does not collect keystrokes is the company’s patent application #20110106942, published May 5, 2011. An excerpt of the claims follows:
2. A method for collecting data at a server coupled to a communications network, comprising: transmitting to a device a data collection profile, wherein the data collection profile comprises a plurality of parameters defining a set of data to be collected by the device, a first condition under which the set of data is to be collected, and a second condition under which the set of data is to be transmitted; and receiving from the device the set of data collected in response to the second condition.
10. The method of claim 2, wherein the set of data relates to an end user’s interaction with the device.
11. The method of claim 10, wherein the interaction with the device comprises the end user’s pressing of keys on the device.
For its part, Sprint has denied any foul play:
“Carrier IQ is used to understand what problems customers are having with our network or devices so we can take action to improve service quality. It collects enough information to understand the customer experience with devices on our network and how to devise solutions to use and connection problems. We do not and cannot look at the contents of messages, photos, videos, etc., using this tool.”
HTC also insists it’s benign:
As the Carrier IQ controversy comes to a boil, it’s not only privacy advocates that are taking notice. Paul Ohm, a former prosecutor for the Department of Justice and current professor at the University of Colorado Law School believes the software may violate federal wiretap laws, based on its perceived collection of text messages without users’ consent. If so, says Ohm, then there are sufficient grounds for a class action lawsuit. He adds, “In the next days or weeks, someone will sue, and then this company is tangled up in very expensive litigation. It’s almost certain.”
There’s no denying that lawsuits can be a royal pain for everyone involved, but if it escalates to that level, a good possibility exists that Carrier IQ will be required to disclose the extent of its data collection in the discovery process. Our take? If it requires a courtroom battle to force transparency about the collection of your information and usage habits, then bring it.
In an industry where the protection of intellectual property is paramount, it seems that so much of this controversy could have been avoided with a simple opt-in policy. Executed properly, Carrier IQ has the potential to improve the quality of service for millions of mobile customers — provided that the data collected stays on the up-and-up. What remains clear is that until Carrier IQ or its partners address these privacy concerns with explicit evidence and formal policies to the contrary, this issue isn’t going away.