The Cell Phone Junkie

We talked last week about the data logging Carrier IQ software, and the Android developer who exposed what could be done with the rootkit application.  Carrier IQ responded at the time by clarifying the actual uses of the software, including identifying problems and helping phones work better through collected data.  Then on Tuesday, Wired reported that the software is actually logging nearly everything on the phone…and has the video to prove it.

After connecting his HTC device to his computer, Trevor Eckhart found that IQRD is secretly logging every single button that he taps on the phone, even dialing phone numbers and text messages.

The article kicked off a deluge of news coverage, manufacturer and carrier statements, and even government intervention.  Here’s what device and software makers had to say:

Apple – The Verge reported that well-known iPhone hacker Chpwn tweeted that versions as recent as iPhone OS 3.1.3 contained references to Carrier IQ and later confirmed it’s in all versions of iOS, including iOS 5 mention it as well.

Apple supplied the following statement to AllThingsD:

“We stopped supporting Carrier IQ with iOS 5 in most of our products and will remove it completely in a future software update. With any diagnostic data sent to Apple, customers must actively opt-in to share this information, and if they do, the data is sent in an anonymous and encrypted form and does not include any personal information. We never recorded keystrokes, messages or any other personal information for diagnostic data and have no plans to ever do so.”

The information logged for iOS seems limited to phone call activity and location (if Location Services are enabled). Also unlike the implementation found on Eckhart’s HTC, iOS users can opt out of these diagnostics by simply going to Settings -> General -> About -> Diagnostics & Usage -> Don’t Send. The actually logged diagnostic data appears to be fully accessible for perusal in that same setting menu.

Google – We do not have an affiliation with CarrierIQ. Android is an open source effort and we do not control how carriers or OEMs customize their devices.

HTC – Says they do use the software, as required by US carriers:

“Carrier IQ is required on devices by a number of U.S carriers so if consumers or media have any questions about the practices relating to, or data collected by, Carrier IQ we’d advise them to contact their carrier.”

It is important to note that HTC is not a customer or partner of Carrier IQ and does not receive data from the application, the company, or carriers that partner with Carrier IQ. HTC is investigating the option to allow consumers to opt-out of data collection by the Carrier IQ application.”

Microsoft – Corporate vice president and director of Windows Phone Program Management Joe Belfiore tweeted the following:

“Windows Phones do not have any Carrier IQ software installed.”

Nokia – Early reports said Nokia phones were among those with the software, though the company denies the report, saying:

“Nokia is aware of inaccurate reports which state that software from CarrierIQ has been found on Nokia devices. CarrierIQ does not ship products for any Nokia devices, so these reports are wrong.”

RIM – Says they do not pre-install the software:

“RIM is aware of a recent claim by a security researcher that an application called ‘CarrierIQ’ is installed on mobile devices from multiple vendors without the knowledge or consent of the device users,” the company said in a statement. “RIM does not pre-install the CarrierIQ app on BlackBerry smartphones or authorize its carrier partners to install the CarrierIQ app before sales or distribution. RIM also did not develop or commission the development of the CarrierIQ application, and has no involvement in the testing, promotion, or distribution of the app. RIM will continue to investigate reports and speculation related to CarrierIQ.”

Samsung – Confirmed the software is present in “some Samsung mobile phones,” but says:

“It’s very important to note that it’s up to the carrier to request that Samsung include that software on devices. One other important point is that Samsung does not receive any consumer user information from the phones that are equipped with Carrier IQ.”

CyanogenMod – The CM team says they doesn’t use Carrier IQ. Never have, never will.

Regarding carriers:

AT&T – Confirms it uses the software, though for limited network enhancing purposes:

“In line with our privacy policy, we solely use CIQ software data to improve wireless network and service performance.”

Verizon - Verizon stated that it does not use the software.  Jeffrey Nelson, part of the company’s Communications team, tweeted:

“To be 100% clear: Carrier IQ is *not* on Verizon Wireless phones.”

Sprint – Sprint says it collects “enough information to understand the customer experience with devices on our network,” but that it can’t look at the contents of messages, photos, or videos using Carrier IQ.

T-Mobile- T-Mobile does install Carrier IQ on some of its smartphones, including multiple Android devices and BlackBerry Bold 9900, Curve 9360 and Torch 9810.

Across the pond, UK carriers Vodafone, Orange and O2 all told the Guardian they do not install the software on any of their devices in the UK, and to their knowledge it isn’t shipped on any of the phones that they sell.

Up in Canada, Rogers announced that the software is not present on any of the devices they sell.

By the end of Thursday, Minnesota Senator Al Franken asked Carrier IQ to clarify exactly what its software can do. Franken specifically wants to know what data is recorded on devices with Carrier IQ, what data is sent, if it’s sent to Carrier IQ or carriers themselves, how long it’s stored once received, and how it’s protected once stored.  Senator Franken asked that Carrier IQ answer 11 questions related to its practices by December 14th.

Carrier IQ issued another press release defending its business and that they work for carriers.  In their release, they say:

“Carrier IQ acts as an agent for the Operators. Each implementation is different and the diagnostic information actually gathered is determined by our customers – the mobile Operators. Carrier IQ does not gather any other data from devices.”

Finally, class action lawsuits have been filed against Samsung, HTC and Carrier IQ by Friday.  HTC, Samsung and Carrier IQ have been accused of violating the Federal Wiretap Act which “protects  the privacy of wire, oral, and electronic communications” of all Americans. A St. Louis lawsuit against HTC states the following:

“Plaintiff, Erin Janek owns an HTC Android phone using the Sprint network. At all relevant times Plaintiff used her phone to electronically send over her cell phone network various types of private data. This data was not readily accessible to the general public. She did not know that Defendants were surreptitiously monitoring and collecting this data, nor did she give them permission to do so.”

Image Credit: Android Central