Forgot your password?
typodupeerror
Privacy Cellphones Your Rights Online

Palm Pre Reports Your Location and Usage To Palm 314

Posted by Soulskill
from the caught-palm-red-handed dept.
AceJohnny writes "Joey Hess found that his Palm Pre was ratting on him. It turns out the Pre periodically uploads detailed information about the user to Palm, including the names of installed apps, application usage (and crashes), as well as GPS coordinates. This, of course, is without user consent or control. The only way he found to disable the uploads was to modify system files."
This discussion has been archived. No new comments can be posted.

Palm Pre Reports Your Location and Usage To Palm

Comments Filter:
  • User Consent ... (Score:5, Informative)

    by neonprimetime (528653) on Wednesday August 12, 2009 @01:22PM (#29040753)
    Story says...

    This, of course, is without user consent or control.

    But From Palm Infocenter, they say [palminfocenter.com]

    Palm's own "Terms and Conditions" statement, along with their Privacy policy, detail that Palm basically maintains it has the right to indefinitely collect, process, store and share this information. Users must accept this multipage collection of fine-print waivers and disclaimers in full during the initial device setup process before being able to utilize the device.
  • by Anonymous Coward on Wednesday August 12, 2009 @01:26PM (#29040829)

    even if it doesn't send any data, just by being in contact with some base station tower every few minutes. That tracking info IS used in civil and LE investigations regularly. And as Hans Reiser found, removing your phone battery to stop the tracking is considered incriminating evidence in its own right.

  • by Daniel_Staal (609844) <DStaal@usa.net> on Wednesday August 12, 2009 @01:29PM (#29040861)

    That would depend on the programs running at the time, wouldn't it? After all, some do use the GPS coordinates, so it is reasonable that some have a bug in how they do so...

  • by Nazlfrag (1035012) on Wednesday August 12, 2009 @01:36PM (#29040985) Journal

    It's not just crash data. It sends that too, but it also uploads your GPS coordinates daily along with the app use data (what you've used and for how long) according to TFA. It's customer profiling, not bug testing.

  • by Anonymous Coward on Wednesday August 12, 2009 @01:37PM (#29041001)

    You know, that total control of their users and the things they can and can't do. Apple should not control their users like that, it's just...

    Oh wait, you mean someone else than Apple is doing that?

    Damn you Microsoft, always controlling your users....

    Oh wait, you mean it's neither Apple or Microsoft?

    So, you zealots who always bash on Apple and Microsoft... what FUD will you say to protect your precious Palm now? And wasn't Google's Android doing something similar too?

    The solution is easy: get a cellphone that's JUST A GODAMN PHONE.

  • Re:Boycott (Score:5, Informative)

    by keithjr (1091829) on Wednesday August 12, 2009 @01:41PM (#29041049)
    Seems like the only phone you'd be able to buy with this requirement would be an OpenMoko device. Maybe an Android phone if it's mostly open source.

    Closed source and closed hardware devices mean these little surprises will continue to happen.
  • by digsbo (1292334) on Wednesday August 12, 2009 @01:43PM (#29041077)
    Wrong. The cell id (tower identifier) is available from the GSM module without knowing the GPS coordinates. In fact, with multiple local towers, you might incorrectly guess which tower is being used based on lat/lon, since they may handover (pass your call from one tower to another) for a variety of reasons, including capacity.
  • by Anonymous Coward on Wednesday August 12, 2009 @01:46PM (#29041133)

    some do. its just hit the lawyer boards.
    http://autoadmit.com/thread.php?thread_id=1062087&mc=1&forum_id=2

  • Re:Oh Noes! (Score:2, Informative)

    by Lord_Byron (13168) on Wednesday August 12, 2009 @01:48PM (#29041173)

    Your comment is super behind the times. The Pre is a slick little device, and easily stands with other moderm smartphones.

    Including in the "violate user's privacy" space, it seems.

  • by justdaven (1238962) on Wednesday August 12, 2009 @01:51PM (#29041207)
    Maybe, but with the number of folks who tear apart those user agreements, we would have heard of it sooner
  • by John Hasler (414242) on Wednesday August 12, 2009 @01:52PM (#29041231) Homepage

    > Likely there will be no repercussions whatever.

    Right. You'll whine and whine, but you'll keep right on buying the stuff.

  • Re:Yea, and.... (Score:5, Informative)

    by rm999 (775449) on Wednesday August 12, 2009 @01:53PM (#29041245)

    "Hell, I thought all phones did this anyway"

    Running the GPS on a phone eats up the battery, I wouldn't assume any phone company would be purposefully sabotaging the battery life of its own products to piss off its customers.

    And tracking of cell phones has come up in the past, and is generally quite controversial: http://www.insidetech.com/news/articles/2299-controversial-study-tracks-movement-via-cellphones [insidetech.com]

    I honestly don't know why Palm thought it could get away with it without some outrage. Especially when it has such a steep hill ahead of it already.

  • TFA Text (Score:5, Informative)

    by AceJohnny (253840) <jlargentaye AT gmail DOT com> on Wednesday August 12, 2009 @01:59PM (#29041335) Journal

    Woops, looks like /. is hammering the server. Here's a copy of the text (as of now):

    I've been taking a closer look at the WebOS side of my Palm Pre tonight, and I noticed that it periodically uploads information to Palm, Inc.

    The first thing sent is intended to be my GPS location. It's the same location I get if I open the map app on the Pre. Not very accurate in this case, but I've seen it be accurate enough to find my house before.

    { "errorCode": 0, "timestamp": 1249855555954.000000, "latitude": 36.594108, "longitude": -82.183260, "horizAccuracy": 2523, "heading": 0, "velocity": 0, "altitude": 0, "vertAccuracy": 0 }

    Here they can tell every WebOS app I use, and for how long.

    { "appid": "com.palm.app.phone", "event": "close", "timestamp": 1250006362 }
    { "appid": "com.palm.app.messaging", "event": "launch", "timestamp": 1250006422 }
    { "appid": "com.palm.app.messaging", "event": "close", "timestamp": 1250006446 }

    It sends the above info on a daily basis.

    2009-08-10t09:15:10z upload /var/context/pending/1249895710-contextfile.gz.contextlog ok rdx-30681971
    2009-08-11t09:15:10z upload /var/context/pending/1249982110-contextfile.gz.contextlog ok rdx-31306808

    There is also some info that is recorded when a WebOS app crashes. Now, I've seen WebOS crash hard a time or two, but it turns out apps are crashing fairly frequently behind the scenes, and each such crash is logged and a system state snapshot taken. At least some of these are uploaded, though if things are crashing a whole lot it will be throttled.

    2009-08-09T17:01:22Z upload /var/log/rdxd/pending/rdxd_log_59.tgz OK RDX-30246857
    2009-08-09T17:05:36Z upload /var/log/rdxd/pending/rdxd_log_26.tgz OK RDX-30249465
    2009-08-09T17:09:11Z upload /var/log/rdxd/pending/rdxd_log_56.tgz OK RDX-30252374
    2009-08-09T17:11:46Z upload /var/log/rdxd/pending/rdxd_log_70.tgz OK RDX-30253958
    2009-08-09T17:16:29Z upload /var/log/rdxd/pending/rdxd_log_67.tgz ERR_UPLOAD_THROTTLED_DAILY
    2009-08-09T17:17:28Z upload /var/log/rdxd/pending/rdxd_log_51.tgz ERR_UPLOAD_THROTTLED_DAILY
    2009-08-09T17:20:40Z upload /var/log/rdxd/pending/rdxd_log_21.tgz ERR_UPLOAD_THROTTLED_DAILY

    Each tarball contains a kernel dmesg, syslog, a manifest.txt listing all installed ipkg packages (including third-party apps), a backtrace of the crash, a df (from which they can tell I'm using Debian on the phone), and ps -f output listing all processes owned by root (but not by joey).

    The uploading is handled by uploadd, which reads /etc/uploadd.conf:

    [SERVER=rdx]
    RepositoryURL=https:///palmcsext/prefRequest?prefkey=APPLICATIONS,RDX_SRV
    UploadURL=https:///palmcsext/RDFileReceiver

    [SERVER=context]
    RepositoryURL=https:///palmcsext/prefRequest?prefkey=APPLICATIONS,RDX_SRV
    UploadURL=https:////palmcsext/RDFileReceiver

    The "HOST" this is sent to via https is ps.palmws.com.

    My approach to disable this, which may not stick across WebOS upgrades, was to comment out the 'exec' line in /etc/event.d/uploadd and reboot. However, then I noticed a contextupload process running. This is started by dbus, so the best way to disable it seems to be: rm /usr/bin/contextupload

    BTW, since Palm has lawyers, they have a privacy policy, which covers their ass fairly well regarding all this, without going into details or making clear that the above data is being uploaded.

  • by tengwar (600847) <slashdot AT vetinari DOT org> on Wednesday August 12, 2009 @02:06PM (#29041423)

    No, that's not the case. A GSM phone will only call in every few hours; when it is switched on or off; when it needs to call out or send an SMS; when it is asked to call in; or when or when it moves between areas covered by different MSC/VLRs. An MSC/VLR covers a large area of a country with thousands of base stations. The bit about "asked to call in" is interesting. The network knows that the handset is in the area covered by an MSC/VLR, but not where, so it broadcasts a request for contact over the base stations in the area. The handset responds, localising itself to a base station. The point is to minimise signally costs and battery power consumption.

    Yes, you can use the information about the last localisation in legal investigations, because the network keeps track of where and when you were last seen. It's also possible to send a silent SMS to get the phone to localise. However there is no continuous tracking of handsets by default.

  • by tony.damato (13665) on Wednesday August 12, 2009 @02:13PM (#29041539)

    http://www.precentral.net/fyi-pre-reports-your-location-palm [precentral.net]

    When PreCentral's people asked Palm about this, their official statement to them in part was:

            Our goal has been to follow industry best practices on data collection, use, and encryption. Like most EULAs and privacy policies, though, the terms tend to get pretty detailed about potential scenarios. And because the terms are meant to notify users about all possible variations, we wanted to err on the side of over notifying rather than under notifying users through the terms of use. So there's really nothing here "beyond the norm" for a EULA or privacy policy.

            The provision you've quoted explains why Palm might collect user information. For example, we collect and transmit users' email addresses, email content, contact lists, etc. to provide WebOS services such as back-up and restore for the purpose of backing up that data and helping users restore the data if needed (in that case, it would not be limited to just the email address collected at registration). If users someday make purchases on their device through the Apps Catalog, then we would also collect payment information to process the transaction.

            At all times, we'd be strictly bound by our privacy policy. Our privacy policy, like virtually all others in the industry, contemplate our using data to provide services users have requested, improve our products and services (hence the reference to Palm's own "sales and marketing" in the privacy policy), troubleshoot, etc. We also refer to affiliates because Palm is a global company, and we may need to transmit data from our European subsidiary to the parent company. We're obviously not a conglomerate with many different subs and affiliates, but the terms specifically mention subs and affiliates so that we can comply with European data protection laws that require us to spell out that data collected by a European sub can be transmitted to another part of the company.

  • by Otto (17870) on Wednesday August 12, 2009 @02:18PM (#29041623) Homepage Journal

    Actually, it's the cellular companies that want that data more. By having the phones report back on position and cell tower ID strengths, they can more easily map "dead zones" in their coverage areas, telling them where to put new towers to hit the most people.

  • by Sandbags (964742) on Wednesday August 12, 2009 @02:41PM (#29041957) Journal

    Yup, and we expect either them to get slapped on the wrist and told to undo it by the association, told to stop selling the devices by court order and potentially recall all of them, or both the above combined with heavy fines. Either way we also expect Apple to fix the new "fix" upon the very next release...

    As it is, and I spoke to him minutes ago as he was packing up for the day, my friend indicated that iTunes does in fact not currently sync his stuff today. Wether or not he's missing an update that might fix it, he's aware it's a hack, aware there's a fight that will almost certainly end in Apple's favor or at least turn against Palm, and well aware that after 14 days he can't return his device and get out of his contract without penalties or fees, so he's not wasting time at the risk of getting screwwed later.

    he was actually not really too pissed about the hack, he was kind of on Palm's side on that matter and figured Palm would sooner rather than later have a "satisfactory" solution that may or many not involve their own meda player, or outright licensing of Apple's technology. What made him immediately pack up was the news he was being snooped on and that there was not a way to dissable it. He spent about 30 minutes looking to find a way, and made a nasty call to Pre's support line. He removed the battery from his device and was headed home to get the box, manual, and charger on his way to the store...

  • by Sandbags (964742) on Wednesday August 12, 2009 @03:22PM (#29042551) Journal

    hey, AT&T may have complied with illegal orders to provide wire taps, and even played some questionable moves to avoid prosecution, but lets place the blame where it really lies; the Bush Administration... AT&T was not the only company to comply with these orders, and was told quite explicitly, by judges, that the orders were in fact valid...

    AT&T may have broken the law, and violated the privacy of many (suspected crimainals/terorists) Americans, but they did so under a supposed legal authority and under orders to do so, and these wire taps (most of them) were actually for people accused or associated with active federal investigations. Palm is collecting personal information, it has NO association with any criminal activity and no basis in law, and they're doing it without informed concent, and without a way to disable the tracking, and wihtout support or order by the government, and I bet they're doing it without the Phone Company's knowledge too. (and if the phone company IS aware of it, they're FAR more guilty than AT&T is...

  • by joey (315) <joey@kitenet.net> on Wednesday August 12, 2009 @03:31PM (#29042705) Homepage

    So FWIW, I have "Background Data Collection" set to off, that did not stop the Pre sending those logs to Palm. I'm sure that that switch does prevent sending your location info to the Google, which makes it doubly unsettling that it's still sent to Palm, no?

  • Re:Yea, and.... (Score:3, Informative)

    by Chris Burke (6130) on Wednesday August 12, 2009 @03:52PM (#29043011) Homepage

    Running the GPS on a phone eats up the battery, I wouldn't assume any phone company would be purposefully sabotaging the battery life of its own products to piss off its customers.

    You may already realize this, but for clarity's sake: GPS isn't needed to track phones. They can be tracked simply from their signal as long as there are multiple towers within range to receive it. So probably in any city you can be tracked.

    And tracking of cell phones has come up in the past, and is generally quite controversial: http://www.insidetech.com/news/articles/2299-controversial-study-tracks-movement-via-cellphones [insidetech.com]

    It may be controversial when some scientists announce that they're going to be using tracking data. That doesn't mean you aren't quietly being tracked anyway. Hell, carriers are required to give your position to law enforcement or emergency services. Since this kind of tracking is more or less passive -- it's based on your normal cell signal, no extra data is being sent by your phone -- then unlike with the Palm Pre's GPS you have no direct way of knowing if you're being tracked or not. You just know it's possible.

  • by bhartman34 (886109) on Wednesday August 12, 2009 @03:58PM (#29043099)

    Yup, and we expect either them to get slapped on the wrist and told to undo it by the association, told to stop selling the devices by court order and potentially recall all of them, or both the above combined with heavy fines.

    Who is this "we" you speak of, and why would you and yourassociate think something so astonishingly wrong-headed? 1) The violated no law by spoofing the VID. 2) The USB-IF spec accommodates spoofing. That's how a lot of "Microsoft" brand non-Microsoft mice work with USB. 3) Palm is bringing the action to the USB-IF because what Apple is doing is actually more harmful to the spec. The whole point of USB is supposed to be Plug and Play. You plug a device into your computer, the device sends an ID to the OS, and the OS downloads the proper drivers. It's both against the spec and moronic to use the VID as a password to your application (which is essentially what Apple is doing with iTunes), because the ID is open for all the world to see. If Apple wants to keep non-iPods/iPhones from syncing with iTunes, they can put a unique ID in the firmware that's secret, so that any yahoo can't just plug the device into their machine and pull out the password (which again, is what the VID becomes when you use it this way). If everyone followed Apple's lead on this, we'd be left in the bad old days of the 1980's, where every application had its own drivers. 3) Even in the event that the USB-IF does decide they don't like what Palm did, there's no fine, no financial penalty at all. The only adverse effect for violating the USB-IF spec is you can't use the USB logo on your product's box.

  • by Anonymous Coward on Wednesday August 12, 2009 @04:07PM (#29043217)

    He commented a line in a shell script, and deleted an executable. Hardly "modifying the source".

  • Re:Oh Noes! (Score:3, Informative)

    by wbo (1172247) on Wednesday August 12, 2009 @04:30PM (#29043541)
    PalmOS 5 had/has full support for WiFi. They even have released a WiFi card [amazon.com] that can plug into the SD slot of many Palm OS 5 devices. I have personally used a Tungsten T3 with the WiFi card for a number of years and it works quite well, especially for doing stuff over SSH or quickly checking email.

    There were also a couple of PalmOS 5 devices that had built-in WiFi notably the Tungsten TX and the LifeDrive.
  • by Sandbags (964742) on Wednesday August 12, 2009 @05:02PM (#29043957) Journal

    And how is this differnt from former MCI's friend and family policy? The simple collection and parsing of information YOU ALREADY HAVE, is not in itself illegal. In fact, pen registers are not subject to 4th amendement protections unless that information is traded or sold, which it was not, accepting that giving it to the NSA was under what AT&T and others considered a legal order to do so.

    A previous court case against MCI did not outlaw their practice, it only prompted MCI to change how they USED that information in their marketing efforts. They never did stop collecting it. In fact, that's why BellSouth had the information to provide the NSA when requested as well.

    The NSA specifically requersted this information from ALL the major carriers. AT&T did NOT provide it voluntarily. Quest was the ONLY ONE to not comply... Do not put this on AT&T, every carrier except quest was guilty. Further, it's ONGOING, except its now under judicial oversight instead of executive oversight.

    On the asside, I was added to the no fly list at one point. A close friend of mine was an active campaigner against a republican running for office, and organized more than one public protest. I was added due to my association with him though associated blog posts on his website. As soon as he got his own name removed, which I understand was not difficult, mine also was removed from the list.

  • by ksheff (2406) on Wednesday August 12, 2009 @07:49PM (#29045781) Homepage
    But if he did want to modify the FOSS software on the Pre, he could just download them from here: http://opensource.palm.com/ [palm.com]
  • by bhartman34 (886109) on Wednesday August 12, 2009 @08:01PM (#29045887)
    Granted, the author didn't modify a binary file, but the only way he even knew to do that was because of the low-level access the Pre gives you to the OS, and the fact that it's open. The fix would've been impossible on a locked-down phone.

"Look! There! Evil!.. pure and simple, total evil from the Eighth Dimension!" -- Buckaroo Banzai

Working...