Forgot your password?
typodupeerror
Cellphones Android Encryption Privacy Your Rights Online

Android Dev Demonstrates CarrierIQ Phone Logging Software On Video 322

Posted by Soulskill
from the hand-in-cookie-jar dept.
Token_Internet_Girl writes with a followup to last week's news about Android developer Trevor Eckhart, who was researching software from CarrierIQ, installed on millions of cellphones, that secretly logged a variety of user information — from button presses to text message contents to browsing data. CarrierIQ tried to silence Eckhart, but later backtracked. Now, Eckhart has posted a video demonstration of CarrierIQ's logging software. From the article: "The company denies its software logs keystrokes. Eckhart’s 17-minute video clearly undercuts that claim. ... The video shows the software logging Eckhart's online search of 'hello world.' That's despite Eckhart using the HTTPS version of Google, which is supposed to hide searches from those who would want to spy by intercepting the traffic between a user and Google. ...the video shows the software logging each number as Eckhart fingers the dialer. 'Every button you press in the dialer before you call,' he says on the video, 'it already gets sent off to the IQ application.'"
This discussion has been archived. No new comments can be posted.

Android Dev Demonstrates CarrierIQ Phone Logging Software On Video

Comments Filter:
  • by Anonymous Coward on Wednesday November 30, 2011 @06:22AM (#38212228)

    There is an asymmetry in the system as it works right now. Which private customers have the will, time, and money to sue companies that illegally wiretap their customers? Isn't there anything that can be done against this? (Of, I'm talking about action against CarrierIQ but about action against the carriers that use their software.)

    • by fsckmnky (2505008) on Wednesday November 30, 2011 @06:35AM (#38212280)

      companies that illegally wiretap their customers

      Therein lies the rub. In order to use your cellphone/smartphone, you have to sign the carriers agreement, and in the carriers agreement, there is undoubtedly a clause where you give them permission to collect your data and use it as they see fit. This makes the data collection legal, not illegal, as you agreed to it.

      Nothing short of privacy regulation specifically forbidding carriers to use this information, or at the very least, allowing you to specify that you would like your data to remain private, will prevent this practice from being standard, as the monetary incentive is to collect the data. Corporations have an obligation to protect and grow shareholder value, no matter how many advertisements they run claiming "We care about our customers."

      • by Theophany (2519296) on Wednesday November 30, 2011 @06:47AM (#38212322)
        A contractual agreement to something deemed illegal does not overrule the law.

        If a judge found the activity to be unlawful, which I suspect is where the core of the issue rests, then whether or not there was a contractual agreement is irrelevant. I see no reason for a carrier's data collection policy to include keylogging everything a customer does outside of extenuating circumstance (suspected terrorist or something).
        • by Serpents (1831432) on Wednesday November 30, 2011 @07:04AM (#38212380)
          The EU finally admitted that nobody reads ToS [smh.com.au] and it's going to curb such practices.
        • by fsckmnky (2505008) on Wednesday November 30, 2011 @07:06AM (#38212390)

          A contractual agreement to something deemed illegal does not overrule the law.

          It is not illegal, for you to agree, to the carriers collection of the data, which is why regulation specifically making it illegal, or spelling out your rights, is required to stop it.

          I see no reason for a carrier's data collection policy to include keylogging everything a customer does outside of extenuating circumstance (suspected terrorist or something).

          Yes, you, like myself, see no reason "to allow" carriers to collect this data. That said, a carrier has "every incentive to collect" this data. It has commercial value. They can sell it to the government / police for investigative purposes, they can data mine it in order to find hidden value, and every bit of data sent can be counted towards your monthly usage cap, thereby, increasing the odds that you will run over and incur additional charges.

          Please understand I am not arguing on behalf of carriers, merely attempting to point out the reality of the current environment. I don't own a smart phone, as I am aware that the reality of it, is that, I am paying to be spied on.

          • by fsckmnky (2505008) on Wednesday November 30, 2011 @07:16AM (#38212438)
            I should add, that the moment I heard that Google was releasing a smartphone OS aka Android, my first thought was "Nice. Now google can spy on everyone when they are away from their computer and follow their movements in the physical world."

            Beware of free ice cream from pimply faced CEOs of publicly traded corporations who claim to have your best interests in mind.

            This situation is only going to get worse. The same data collection practices concerning smartphones are being adopted by car manufacturers, and Google wants to use event data that your spiffy new car collects, in order to "predict" and "suggest" a route for you to travel. Do you really think Google ( and other companies active in this area ) are doing all this work for free because they like you ?

            http://media.ford.com/article_display.cfm?article_id=34591 [ford.com]
            • by andydread (758754)
              Oh how nice of you to lump Google into this. I wonder if you are just pro trolling, or some fanboy of some type. . THis event has nothing to do with Google. It is installed by the cell carrier and there are clients available to carries for ALL mobile operating systems and it has been found on other non Android phones. Nice attempt to smear Google with this one.
            • by nahdude812 (88157) * on Wednesday November 30, 2011 @03:04PM (#38217352) Homepage

              I should add, that the moment I heard that Google was releasing a smartphone OS aka Android, my first thought was "Nice. Now google can spy on everyone when they are away from their computer and follow their movements in the physical world."

              It should be noted that CarrierIQ is not Google and is not related to Google. This is a third party which makes a rootkit/spyware app that carriers have installed on handsets that they sell (it is not part of a vanilla Android install).

          • Added to the fact that you can't have a contract for something that breaks the law is the legal principle that both parties have to be agreeing to the same contract - i.e. there has to be a meeting of minds on the terms of the contract.

            Just saying that the carriers are going to collect data is not enough in my opinion, as the way in which this data is collected and the depth of of the data that is going to be collected was not spelled out. And that is for obvious reasons: not many people would willingly

      • by GPLHost-Thomas (1330431) on Wednesday November 30, 2011 @06:50AM (#38212330)

        you have to sign the carriers agreement, and in the carriers agreement, there is undoubtedly a clause where you give them permission to collect your data and use it as they see fit

        That would seem right, but only for the time of the contract. What if, as in the video, you have a phone which isn't bound to a contract anymore, and still spying on you?

        • by fsckmnky (2505008)
          Certainly, the army of attorneys at the disposal of the carriers, has been careful to word the agreement such that your scenario also applies.
        • Just because you no longer have an early termination fee doesn't mean that you're no longer under contract; you're still operating under the same terms as before except that you can cancel service at any time. Glance at click-through licenses some time; they say things like "use of this device constitutes..." rather than "use of this service constitutes..."
          • by Maow (620678) on Wednesday November 30, 2011 @08:54AM (#38212908) Journal

            doesn't mean that you're no longer under contract; you're still operating under the same terms as before except that you can cancel service at any time.

            In the video, he explains he has a separate phone for development, without any mobile provider / SIM, which he also plays games on.

            It was connected via Wifi. Every keystroke, HTTPS search, etc. was recorded and presumably uploaded to CarrierIQ or to ATT (or whomever).

            His device is not of concern to any mobile operator.

            That's a significant issue, and I doubt he'd be hard pressed to convince a lawyer to take it on.

            (IANAL, etc.)

          • What happens when you aren't under a service contract any more? I never turn my old phone over to the carrier when I upgrade. The previous one makes a good toy for the little kids in the family. It has no cell service. I do still connect it to the family wireless.
      • by Anonymous Coward on Wednesday November 30, 2011 @07:51AM (#38212612)

        Carrier IQ DENIES that they are recording keystrokes. They deny this right now, on their website in a PDF, that is linked to right at the top of their home page:
        "While we look at many aspects of a device’s performance, we are counting and summarizing performance, not recording keystrokes or providing tracking tools. The metrics and tools we derive are not designed to deliver such information, nor do we have any intention of developing such tools."

        So even if our agreement with the carrier permits logging/capturing of this data, it doesn't allow you to LIE about doing it. Their software clearly logs data. We don't know if it keeps that data or transmits it back to anyone. But the data is clearly being captured in some fashion as demonstrated by the video.

        • by fsckmnky (2505008) on Wednesday November 30, 2011 @08:01AM (#38212658)

          Carrier IQ DENIES that they are recording keystrokes.

          They aren't recording "keystrokes" .... they are recording "event data" of which, keystrokes are merely a sub-class of events. It's not a lie, just like when Bill Clinton told everyone "I did not have sexual relations with [Monica Lewinsky]." He didn't have sexual relations, as in, intercourse, he just played around with a cigar.

          So even if our agreement with the carrier permits logging/capturing of this data, it doesn't allow you to LIE about doing it.

          As argued above, they are not "lying." They are simply being extremely technically specific in their statements.

          We, as private citizens, need to get better at reading between the lines, as that is where the truth is, in order to protect ourselves from the non-lying-liars.

          • by CowTipperGore (1081903) on Wednesday November 30, 2011 @09:49AM (#38213302)

            They aren't recording "keystrokes" .... they are recording "event data" of which, keystrokes are merely a sub-class of events. It's not a lie...

            "While we look at many aspects of a device’s performance, we are counting and summarizing performance, not recording keystrokes or providing tracking tools."

            While I appreciate your efforts at devil's advocate throughout this thread, you seem to have missed the mark on this one. It is immaterial that keystrokes are a sub-class of the event data they are collecting; it is a lie to say categorically that you are not collecting keystrokes when you are.

          • by Hentes (2461350)

            If they recorded only events that weren't keystrokes, then it wouldn't be a lie. But that is not the case.

      • by gl4ss (559668)

        there's a LOT of things you can't just ask consumers for permission on the TOS and then go "nanananan it's legit you signed the contract!".
        same thing applies to that you can't sign away your career through non-competes even if some employer wants you to believe so.
        I wonder why so many people nowadays think that such clauses and shenigans are legit? is it because people read donald duck comics where they serve as plot devices? usury is illegal too - even if someone writes a contract for it(fyi uncle scrooge

        • by alostpacket (1972110) on Wednesday November 30, 2011 @08:25AM (#38212764) Homepage

          While I agree with the spirit of your rant, AT&T did just show us this past spring that we might already be in such a dystopia. They challenged a customer's right to partake in a class-action lawsuit (when a customer had signed an binding arbitration contract. AT&T took it to the supreme court and won. [arstechnica.com]

        • by fsckmnky (2505008) on Wednesday November 30, 2011 @08:33AM (#38212792)

          there's a LOT of things you can't just ask consumers for permission on the TOS and then go "nanananan it's legit you signed the contract!". same thing applies to that you can't sign away your career through non-competes even if some employer wants you to believe so.

          There is no law that I am aware of, that prevents private parties ( carrier and customer ) from agreeing to share information with each other. As for non-compete agreements, that is an entirely different issue ( legally ) than information sharing. It is voluntary for you to share, or not share, information with another party, while it is decidedly not voluntary for you to work and earn a living, unless someone else is working and earning a living to support you.

          if it were legal to write any fucking kind of contract you want we would all be living in some crazy dystopia where everybodys life was determined by contracts written and signed before the person was even born(that would be pretty much what sucked about the middle ages).

          I hate to break the news to you, but this is the world you live in now. Contracts are binding unless found all or in part ( under specific circumstances ) to be invalid by prior legislation or precedent.

          because it's such a fucked up business decision in the first place and only serves to move money _away_ from the operator.

          No. It increases shareholder value, up until the point where the public 1) becomes aware of it and 2) refuses to accept it and 3) finds the will to boycott the service. Unless all 3 of those things happen, the data collection is valuable, and enhances the bottom line.

          so do you really think it would be legal for at&t to start generating traffic using cIQ and place all their customers to 1 million dollar debt by leaving it to transfer data all night long? that's what you're implying the tos would allow them to do and what they _should_ do "to increase shareholder value" . it's just ridiculous.

          It is legal for AT&T to define "data usage" and "data caps" as "including data required to operate the service." As for whether they do this or not, cheCk your specific TOS. As an example of another industry that successfully did this, look at hard drive manufacturers. They have been claiming "300 Megabytes" when only "270 Megabytes" were in fact usable for over a decade now with much success.

          As to your example of 1 million dollars in debt from carrier generated data streams, yes, that would cause the public to boycott the service and create lawsuits and bad debt. It is your extreme hypothetical abusive interpretation of the definitions that is ridiculous. In practice, this would optimally, from a revenue generation standpoint, be an amount that customers do not notice, whatever that amount may be.

          I have not suggested carriers do anything, in any of my comments. I have merely attempted to explain the current ecosystem. No need to kill the messenger if you don't like the message.

          • by delinear (991444)

            I hate to break the news to you, but this is the world you live in now. Contracts are binding unless found all or in part ( under specific circumstances ) to be invalid by prior legislation or precedent.

            They might want you to believe that, but any contract still has to be able to withstand a test of reasonableness in court. Some might say a weasel worded contract by a multi-national company enabling them to spy on what you as a customer believed were encrypted transmissions potentially beyond the life of the contract is a tad one sided and might just possibly be deemed not worth the paper it's written on. Companies rely on most people not knowing their rights to be able to continually get away with this ga

          • by gl4ss (559668)

            in general, in the west - that doesn't seem to include USA anymore - there's certain consumer rights and privacy expectations, you can't force consumers to waive warranty with shrink wraps.

            having to have a telecoms operator isn't voluntary either, in the west it is regarded as a basic service that you can't just attach any clause you want to. you have to have a phone and it can't come with bigger privacy invasions than necessary. it's an utility.

            I don't think shareholder value had anything to do with the de

      • by Gr8Apes (679165)

        I believe that should there be confidential transactions of any sort, such as client attorney privs, done over the phone that CIQ would log would be illegal regardless of whatever "contractual" terms you sign. After all, the phone is presented as a communications device, not a device to eavesdrop on everything you do.

      • Depends on where you're from. In parts Canada we have privacy laws that state that if a company is going to receive private information from you they have to explicitly disclose how/where it will be used. Failure to notify the customer when you are about to use the data for an unintended purpose can weigh a hefty fine on the company.

        Where the ambiguity comes in is where we draw the line as "private information". Is your conversation or web history considered private? You'd have to convince the courts shou
        • by tqk (413719)

          Where the ambiguity comes in is where we draw the line as "private information". Is your conversation or web history considered private? You'd have to convince the courts should you take it that far.

          No, I would not need to convince a court of anything. I would, however, talk to my cellphone provider to see if they did anything like this. If so, I'll find another provider that doesn't. If I can't find one, then I'll do without.

          This is close to the most despicable business practice I've heard of in a long time. My provider runs a hidden keylogger/spyware app on my phone, for which I'm paying the bills?!?

          I've read the CarrierIQ "Privacy and Security" disclaimer. I don't believe them. I've also read

  • by Nursie (632944) on Wednesday November 30, 2011 @06:22AM (#38212230)

    That's just nasty. First try to silence the researcher, then try to deny what's going on when you've already been caught.

    The question is, will this have any effect? Will carriers stop shipping this stuff ? Will consumers care?

    My guess is no, they'll just try to hide it better in future.

    • by gstoddart (321705)

      The question is, will this have any effect? Will carriers stop shipping this stuff ? Will consumers care?

      Will the FCC decide this is a violation of what they're allowed to do?

      This to me sounds like it could be bordering on illegal ... and, of course, how likely is it that law enforcement is requesting this data and forcing the carriers to keep it secret?

      • by Culture20 (968837) on Wednesday November 30, 2011 @02:10PM (#38216662)

        This to me sounds like it could be bordering on illegal

        Bordering? It might be legal federally, but if I recall correctly (not a lawyer), there are States where recording such data is a violation of wiretap unless both parties are aware of the recording. And such some people here on /. are pointing to contract clauses where "data necessary to the functioning of the network" or similar are spelled out and saying that people consented (and are thus aware, which is suspect in itself). But let's take this a step further. CarrierIQ says in plain English that they're not logging keystrokes. Any customer who knows about carrierIQ and has seen carrierIQ's statement has a reasonable expectation that "logging keystrokes" is not part of the data logging they're agreeing to. "Aha!" says the weasel lawyer "the ordinary people didn't know about carrierIQ! Only our execs knew it was installed on our phones." To which I say, "did carrierIQ misrepresent its logging nature to those execs?" if it did, then carrierIQ might be logging keystrokes between a user and the phone company when the phone company execs have a reasonable expectation that carrierIQ isn't doing that. Then carrierIQ is in trouble in two-party states.

    • ...capitalists spy on you.

  • I have (Score:2, Insightful)

    by Anonymous Coward

    Always been suspicious of the countless android apps that REQUIRE device permissions such as "full internet access", "read phone state and identity" etc...

    • Re:I have (Score:5, Informative)

      by Chrisq (894406) on Wednesday November 30, 2011 @06:25AM (#38212246)

      Always been suspicious of the countless android apps that REQUIRE device permissions such as "full internet access", "read phone state and identity" etc...

      As far as I can gather this is worse. It comes pre-installed by your carrier, you never grant it access to everything and there is no sign that it is installed.

    • Re:I have (Score:5, Informative)

      by Fri13 (963421) on Wednesday November 30, 2011 @06:27AM (#38212254)

      Then install Permission Denied application (you need root) what gives you possibility to rip those permissions off from application https://market.android.com/details?id=com.stericson.permissions [android.com].

      After selecting what permissions the app can have, you need to reboot to take it affect.
      And the other great application is Droidwall what is firewall (needs root as well) where you choose per application does it have access to WLAN or 3G internet connection. Great to limit some apps only to use WLAN instead 3G or vice versa.

      • by rhizome (115711)

        What application's permissions would be modified to protect a persons phone from CarrierIQ with your app?

      • Re: (Score:3, Informative)

        by Catnaps (2044938)
        If you need root for these things, you may as well just grab a custom ROM to go along with it which has CIQ removed (well, most devs remove it anyway). I know my Sensation third-party ROM (ARHD 4.1.x) doesn't have CIQ anywhere in it, I've checked.
        After all, flashing a ROM after rooting is a really small step in terms of difficulty and then you're totally free of CIQ.
    • Re:I have (Score:5, Informative)

      by daid303 (843777) on Wednesday November 30, 2011 @08:17AM (#38212732)

      One of the latest (7.2 or something) CyanogenMOD versions allows you to revoke permissions on installed apps. Which is the main reason why I installed Cyanogen.

  • by assemblerex (1275164) on Wednesday November 30, 2011 @06:26AM (#38212248)
    Clearly that's what it is, it spies to enrich the company at your expense.
  • by ruemere (1148095) on Wednesday November 30, 2011 @06:26AM (#38212250) Homepage

    What software is actually affected? What phone models? What platforms? What applications?
    If it's just AT&T and its victims, well, it's their own private little hell. Otherwise, some facts would be nice.

    For now, (quoting from the article), phrase of "millions of Android, BlackBerry and Nokia phones" smacks of cheap propaganda and scaremongering.

    Regards,
    Ruemere

    • So, will someone set up a list for which products not to buy?

      If I get a phone here in Sweden which is just plain vanilla stock version will that contain the software or is it something the service providers install on "their own" phones?

      • by xaxa (988988)

        I don't see it on my UK stock (non-branded) Desire.

        Look in "All Applications" as explained by the video. I haven't checked with the debugger.

    • by Fri13 (963421) on Wednesday November 30, 2011 @06:52AM (#38212336)

      Seems like none of phones sold in EU comes with this preinstalled.

      Think about it. EU would rip every carrier, phone manufacturer and software company in pieces if such privacy abusing would rise.
      Not even any end user license would protect those companies at all.

  • CyanogenMod (Score:5, Insightful)

    by monkeyhybrid (1677192) on Wednesday November 30, 2011 @06:45AM (#38212312)
    FTA: "it cannot be turned off without rooting the phone and replacing the operating system"

    So even more reason to flash your droid with CyanogenMod or custom ROM of your choice.
    • by Fri13 (963421)

      By my opinion, every Android phone should be upgradable by the user in any country legally, when ever new ROM is released, from Google or from third party.
      After all, phone manufacturers and carriers are just selling hardware and services, not the software.

    • by muffen (321442)

      So even more reason to flash your droid with CyanogenMod or custom ROM of your choice.

      There is still a level of trust required, you shift from trusting your tele-operator to trusting the Cyanogen-mod people.

      To be honest, the best, relatively doable way, is to compile the ROM yourself. It's not that hard, XDA Developers has great information on how to do so. Sure, in this case you need to trust google but in the previous cases you need to trust google + teleoperator, or google + cyanogen mod devs.

      Let

    • by mea_culpa (145339)

      It would be nice if smartphones were given the same level of respect that PCs get.
      Unlocked boot loaders, choice of operating systems, and more protection from illegal search and seizure from law enforcement.

  • I saw a comment on another website speculating that the NSA might be involved with this. I'm not nearly enough of a tinfoil hat wearer to accept that without any evidence, but I think it says something that this looks big enough that people think it must be a government effort.

    Just another example of how Big Brother has gone corporate.
    • by thsths (31372)

      > I saw a comment on another website speculating that the NSA might be involved with this. I'm not nearly enough of a tinfoil hat wearer to accept that without any evidence

      Haha, good luck finding the evidence. The NSA is trying really hard to avoid leaving any hard evidence behind.

      Personally I think this has NSA written all over it. It is a software clearly designed to spy on customers, although I tend to believe that it is not usually report back the findings. Of course that is only a switch that you

  • by SlashRAH (1236462) on Wednesday November 30, 2011 @07:22AM (#38212466)
    When somebody installs a skimmer on an ATM or fuel pump, there are criminal penalties for (attempted) fraud. How is this software any different?
    • phone carriers are 'friends' with law enforcement, remember.

      they get special benefits (ewwww!).

      both are thugs and both like their organized crime way of life.

      and they both tolerate you and I as long as we don't stir up the game that they both have going.

  • by JustOK (667959)

    There's the story about how intelligence was gathered by watching the number of pizza deliveries to the White House.
    Imagine how much better this would be. Not only spying for the govt, and by the govt, but for corp espionage.

    Company A: Hey, out data shows a number of people at our competitor are gathering at an off-site location...hmmm

  • would like to know whether apple/AT & T or apple/any other carriers do this on iphone too?
  • Their program is nothing more than a keylogger.
    • It's a bit more than that - e.g. it can log distinct events such as receiving an SMS (complete with text), or URLs you type in the browser (not as separate keystrokes, but a complete URL).

      The pertinent question is, what exactly gets sent over the network?

  • Not PCI compliant (Score:5, Insightful)

    by kooky45 (785515) on Wednesday November 30, 2011 @07:46AM (#38212594)
    I believe this rules out all Android devices with CarrerIQ agents from being used to handle payment card numbers. There's no obvious mention on CarrerIQ's website of PCI compliance or how they protect the user's data. It probably also contravenes SOX, HIPAA and and host of other industry regulations. Bye bye lots of commercial use of Android handsets, especially Blackberry.
  • May I suggest... (Score:5, Interesting)

    by aug24 (38229) on Wednesday November 30, 2011 @08:01AM (#38212656) Homepage
    ...someone with skillz makes a freely installable CIQ clone that sends them back fake, randomly generated results.
  • I mean, really. Android (and the Android market and Android apps) already has grown a reputation of being full of crap and scamware and spyware and Google is somehow very much "we spy on you but in turn everything we offer is free" anyway. With things like that Google and the carriers just nail down Android phones as something you have to sell your soul for getting some free candy. And yes, people love free candy and have not really a use for their souls, but then smartphones aren't free at all. Things like

    • by Maow (620678)

      With things like that Google and the carriers just nail down Android phones as something you have to sell your soul for getting some free candy.

      A couple things:

      1) It's also on Blackberries, I think he said Nokia (Win phones? Symbian?), and who knows about Iphones - I suspect it is.

      2) Google wasn't spying enough, so a 3rd party provided the software to the carriers, not through the app store to users.

      It could be that Android's openness is what allowed this to be discovered.

      How this will affect the smartphone

  • why Android phones are so laggy/sluggish.

  • ...wait, it's true, only in Corporate USofA and today!

    Read P.K.Dick on world taken over by corporations. He wa a visionary, like so many S-F writers. They have foreseen all things that happen, technically and morally.

  • by Wyzard (110714) on Wednesday November 30, 2011 @09:05AM (#38212960) Homepage

    In this video, the researcher is looking at debug logs from the phone itself, not network traffic logs showing remote communication. He clearly shows that keystrokes and URLs are being passed to the IQ software running on the phone, but presents no evidence that the data is actually sent to anything outside of the phone.

    Has anyone determined what the IQ software does with all this information besides writing it to the debug logger? Is it actually sent somewhere, or saved to persistent storage on the phone? (I'm no Android expert, but I'm under the impression that debug messages are discarded when there's no debugger attached.)

    Having this software running in the background is sneaky and certainly makes spying more possible than it would be otherwise, but it's not necessarily the huge immediate privacy violation that everyone seems to be assuming it is.

    • by Catnaps (2044938)
      Just because you don't have proof that the card skimmer on the local ATM isn't sending data back to its installers, doesn't mean it's not. It has the potential to, and it's designed to do exactly that- which should be enough for CIQ to be harpooned with all due haste.
  • I have an AT&T provided Samsung Galaxy and don't see it on that phone. AT&T Support also provided the following:

    Please note: Protecting your personal information is one of our highest priorities; hence, you will be required to provide account related information to ensure whom we are working with. Data encryption is also enabled to protect your personal information during this chat session. For more information please go to http://www.wireless.att.com/privacy/ [att.com] or http://www.att.com/privacy/ [att.com]. Please

  • Absolutely illegal (Score:5, Informative)

    by Riskable (19437) <YouKnowWho@YouKnowWhat.com> on Wednesday November 30, 2011 @09:40AM (#38213230) Homepage Journal

    Some other folks were speculating that since you signed an agreement with your carrier that it somehow makes this legal. This is absolutely false. There are certain rights that you can sign away, certainly, but don't think of it like that. Think of it like, "What is Verizon doing with this data and how are they transporting it?"

    Here's a few laws and industry regulations they are violating (by recording all keystrokes) off the top of my head:

    1) The Payment Card Industry Data Security Standard (PCI DSS): If anyone ever (ever) enters credit card information into their phone (via an app, web page, whatever) that data must be protected according to the DSS (because all the carriers accept credit cards, that is). That means it must be encrypted in transit, when it is stored, and more importantly: certain information must *NOT* be stored (again, ever). For example, if a user enters the CVV2 from their card into an online form the carrier must ensure that this data does not get stored (good luck with THAT regex! hah!).

    2) Graham Leach Bliley Act (GLBA). Undoubtedly, personally identifiable financial information is being recorded, transported, and stored without the user's knowledge or consent (each transaction/event would need its own notice and agreement with the carrier). That could add up to literally MILLIONS of violations.

    3) Sarbanes Oxley: If they're recording this data they had better damned well keep an audit trail on it and be regularly disclosing that they're doing so to all their investors. They also must have documented controls & procedures and (likely) perform regular audits to ensure that said controls & procedures are being properly followed.

    4) They can be held liable for having knowledge of crimes but not reporting them.

    5) They can lose their common carrier status: Since they're now recording literally everything users do online they can be held (partially) accountable for what those users do. If you recorded the data you certainly could've audited it for fraudulent activity. "Have you been the victim of a crime that took place over a cell phone? Call the law offices of Sue & Win."

    6) There's probably a dozen laws that say you can't intercept and/or store information related to people's banking accounts and financial transactions (unless you're the bank that the customer is interacting with). These laws are the ones that should make the carriers quiver in their boots. Some of these were written specifically to deal with gangsters and organized crime and as such could land executives in prison (not that I think the U.S. Attourney General would prosecute since our government is sadly, "stupidly hard on individual crime but soft on corporate crime").

    7) Unless their contract specifically spells out that they're going to record every keystroke you enter into your phone they've opened themselves up to millions of lawsuits. If anyone ever wins one of these it will be game over for the carriers. "verizon" and "at&t" will likely become some of those "$50-per-click" Adwords on Google.

    8) If they're not using proper encryption of this data in transit and storage, the PCI DSS will be the least of their problems... That's criminal negligence right there. After hearing all the controls the Payment Card Industry requires of the carriers for something as simple as a credit card number what jury could be convinced of a defense such as, "We didn't know!"?!? I mean, seriously. Forget being fired. If someone knowingly decided it was a good idea to record all keystrokes they should go to prison. It is the penultimate example of why you don't put non-technical people in charge of making technical decisions.

    • by AB3A (192265)

      Going a step further, there should be liability for those who collect this data: If the user downloads kiddie porn, they're now liable because they were able to know this and didn't act. If the User stalks someone and they do not report this to authorities, they should be held liable. If someone tweets messages that indicate suicidal tendencies and they take no action, they can be held liable.

      Collect this data at your peril. You want to know all about me? Fine. Now you become an accessory for everything I

  • by djrbliss (1926364) on Wednesday November 30, 2011 @10:30AM (#38213748)

    Disclaimer: I have thoroughly reverse engineered CarrierIQ's software.

    This issue has been blown out of proportion. CarrierIQ has hooks that respond to events triggered by keystrokes, web traffic, and SMS messages. It also makes the mistake of printing debugging output containing plaintext of some of this data, which is a pretty bad screwup. Additionally, there's no real reason CIQ should have hooks in those places in the first place.

    What they don't do is actually store any of this information and report it to your carrier (keep in mind I know this because I actually looked at the application). In terms of what's actually being stored, I've seen no evidence that CIQ is collecting anything more than what they have publicly claimed: anonymized metrics data. That doesn't mean users shouldn't be able to opt-out of this software, since it still represents a potential risk to privacy. But at this point, this whole thing has turned into a witch hunt.

    In short, there's a big difference between "look, it does something when I press a key!" and "it's storing all my keystrokes and sending them to my carrier!". This video demonstrates the first, but the second doesn't actually happen. They shouldn't be doing what they're doing, and users should be able to opt out, but this isn't nearly as evil as people are making it out to be.

Those who can, do; those who can't, simulate.

Working...