Forgot your password?
typodupeerror
Privacy Cellphones Network Your Rights Online Politics

Preventing Another Carrier IQ: Introducing the Mobile Device Privacy Act 60

Posted by Soulskill
from the stop-with-the-tracking-and-suchforth dept.
MrSeb writes "Lawmakers in Washington have turned their sights on mobile device tracking, proposing legislation aimed at making it much harder for companies to track you without consent. The Mobile Device Privacy Act (PDF) makes it illegal for companies to monitor device users without their expressed consent. The bill was introduced Thursday by Massachusetts Democrat Representative Edward Markey, co-Chair of the Bi-Partisan Congressional Privacy Caucus. Much of the impetus for the bill came from last year's Carrier IQ debacle, where it emerged that the company's software was found to exist on both iOS and Android devices on AT&T and Sprint's networks. While the company denied any wrongdoing, the software captured keystrokes and sent the details of your device usage back to the carriers. If passed, the legislation would require the disclosure of including tracking software at the time of the purchase of the phone, or during ownership if a software update or app would add such software to the device, and the consumer gains the right to refuse to be tracked. This disclosure must include what types of information is collected, who it is transmitted to, and how it will be used."
This discussion has been archived. No new comments can be posted.

Preventing Another Carrier IQ: Introducing the Mobile Device Privacy Act

Comments Filter:
  • I have an iPhone 3GS on AT&T. How do I check if Carrier IQ is on it? Did that program show up "randomly" or only on new phones after a certain date?

    • Re:Carrier IQ (Score:4, Informative)

      by tlhIngan (30335) <slashdot AT worf DOT net> on Friday September 14, 2012 @04:08PM (#41339187)

      I have an iPhone 3GS on AT&T. How do I check if Carrier IQ is on it? Did that program show up "randomly" or only on new phones after a certain date?

      Carrier IQ exists on several levels. For Android, it went particularly deep, enough to be able to capture the key codes (whe you typed). For iOS, it couldn't go as deep, so it was used mostly for its ability to collect diagnostic data ("send diagnostic information to Apple").

      I believe it came in around iOS 4 or so, but 5 I think eviscerated it as Apple implemented it themselves. If not, the sure way is to just disable sending diagnostic information to Apple.

      • by DJRumpy (1345787)

        It was disabled by default on iOS. In order to enable it you had to go into your debugging settings (General - About - Diagnostic and Usage Data), and turn it on. You also had to allow to upload the data to Apple. Unless both of those were on, it wasn't able to do anything.

        It was removed completely in iOS 5 meaning you can't even turn it on (the option is grayed out).

    • On the iPhone CarrierIQ did not do [arstechnica.com] most of the stuff the Android version did - no key logging for example.

      Apple got rid of CarrierIQ with iOS5 updates anyway.

  • Laws don't matter (Score:3, Insightful)

    by Anonymous Coward on Friday September 14, 2012 @03:53PM (#41339033)

    They'll just put the required consent in the Terms of Service. Problem solved.

    • by icebike (68054) * on Friday September 14, 2012 @04:43PM (#41339581)

      Exactly.

      Go read the bill folks. All it does is mandate DISCLOSURE

      It doesn't mean that you get to disapprove of the monitoring software and still get to to keep the device or maintain service to the device. Where have you ever seen the ability to selectively accept or decline the boilerplate provisions of your contract? Check this box saying you agree to all the terms here in or we can terminate your contract and require you pay your Early Termination Fee.

      The biggest hole is with manufacturer installed monitoring software. Its not at all clear that disclosure would be required if it was on the device at the point of manufacture as opposed to being added later (2a3).

      Further the Exemptions clause (2d) is so broad the you could drive a truck thru it. No disclosure necessary if there was a "reasonable expectation" that monitoring software might exist on the device. What precisely is Reasonable? Some mumbo-jumbo about service quality management buried in the fine print?

      Its a good start, it just needs to be tougher.
      Simply prohibit carrier or manufacturer installation of such software outright.
      Make it an after market package you can sign up for if you have problems and uninstall after the fact.

  • All this will due is put some disclosure into EULA's, certainly buried way toward the back in small print, because everyone knows that users read EULA's before giving their consent, right? But the cat is out of the bag, and this won't cause vendors to stop trying to collect or sell your data. Android is already pretty good at this, by giving users a pretty detailed list of what information an app has access to at the time the app is installed. I've been alarmed at the number of apps that want permission
    • by gstoddart (321705)

      All this will due is put some disclosure into EULA's, certainly buried way toward the back in small print, because everyone knows that users read EULA's before giving their consent, right?

      And, the EULA will say that laws, class action suits, and any form of redress for anything they do is hereby absolved by your using the device.

    • by Baloroth (2370816)
      From the proposed bill:

      (1) The disclosures shall be made in a clear andconspicuous manner, to be determined by the Federal Trade Commission.

      (2) The disclosures shall be displayed in a clear and conspicuous manner on the website of a person required to make such disclosures, except that if such person does not maintain a website, such person shall file such disclosures with the appropriate Commission.

      So probably not in a EULA, although it would be up to the FTC to make the appropriate regulation. In any case, they also have to report it to the FTC, and on their website, so people will be able to know about it, which is a significant improvement over the current situation.

    • by icebike (68054) *

      Android is already pretty good at this, by giving users a pretty detailed list of what information an app has access to at the time the app is installed

      Well, not really all that good.
      Its there, but does your mom understand it?

      Why should merely mentioning that the Game you just installed has access to your address book be enough?

      Android needs, (and there is some movement towards this) a much finer grain control, where an app will be subject to a permissions module
      that the user can control to deny access to specific things at the OS level. If said games stop working because the users deny access to
      contacts or emails, thats fine. At least we know where we s

  • by puddingebola (2036796) on Friday September 14, 2012 @04:09PM (#41339201) Journal
    I just noticed in my EULA that I have renounced my citizenship and rights as a US citizen.
    • by Mitreya (579078)

      I just noticed in my EULA that I have renounced my citizenship and rights as a US citizen.

      It's fortunate that at least some rights cannot be waived though. Whether EULAs are legal or not, any clauses demanding your soul or your firstborn are invalid

      Someone should write and then try to enforce EULA that renounces user's citizenship. It would be helpful for something like that to go through the court system! (assuming it gets undone, that is...)

  • As much as I - as one of the Android world's major fighters of CIQ - and the rest of /. may like this, we all know it's not going anywhere. Regulatory capture [wikipedia.org], anyone?
  • Hypocracy (Score:4, Insightful)

    by mewsenews (251487) on Friday September 14, 2012 @04:12PM (#41339231) Homepage
    I love how the government is trumpeting the fact that they're doing this, because they're all upset that THEY should be the only ones allowed to track people.
  • by Anonymous Coward on Friday September 14, 2012 @04:12PM (#41339233)

    A legal solution is fine, but it isn't sufficient by itself. It's like trying to legalize that I don't receive spam. Well, the law can't really do that (it's tried). I can only do that myself, by being careful with who I give my email to.

    So this seems like the same idea. Such a law doesn't hurt, but it isn't enough, by itself. What's needed is a technical infrastructure where the people who buy mobile products fully control them, from the hardware on up, rather than some phone carrier controlling them. Then I can blow away whatever crapware comes with the device by installing my own operating system and only running software I trust.

    As long as the device is secured against the people who buy them, there can be no trust that we have any privacy.

    If they wanted to pass a better law, they'd have passed one like that: carriers cannot secure phones against who buys the phones.

    • by cdrguru (88047)

      How about a law that says if you cannot compile and build your own phone software you have no business having a mobile phone?

      How about a similar law that says if you cannot build and install Linux from source you cannot have a computer? Proof of such ability results in a federal license which is then required to buy any computer or computer parts. And the penalty for selling such devices to anyone without a license is banishment to some tiny island without Internet access.

      The only problem with that is we

  • by hobarrera (2008506) on Friday September 14, 2012 @04:15PM (#41339261) Homepage

    I've said it once, and I'll say it again: carriers have no busyness selling mobile phones, they need to be separate things, to avoid vendor-lock in, and plenty of other issues.
    I'm still surprised how many people in the US seem to buy their phones from their carriers really. Phones need to be sold in closed boxes on default factory settings, and sold by phone-selling companies. Otherwise, there's a severe conflict of interests.
    Imagine if PCs were sold by ISPs, and TVs by cable-companies!

    • I'm still surprised how many people in the US seem to buy their phones from their carriers really.

      Faced with the choice of a $700 phone and $50/month service, or a $99 phone and $89/month + 2-year service contract, most people will choose the subsidized option. Most, as in just about everybody. And if I bring my own phone to a provider, they're still going to charge me the higher price, so I might as well get the subsidized phone.

      You're onto something about PCs from ISPs. Notice all the netbooks for sale at cell phone stores? I think that's the future business model for computers, especially with

      • Minor nitpick: In the US, I beleive only T-mobile offers a (small) discount on the service charge if you bring your own device.

        So really, you mean a $700 phone + $89/month (no contract) or $99 phone + $89/month 24-month contract, or $700 phone + $69/month service + shitty coverage...

      • IMO it's not just subsidies. It's also that every network in the US is using incompatible standards. Verizon and Sprint are CDMA; AT&T and T-Mobile are GSM. But if you want anything more than 2G you then get into a mess of UTMS vs LTE vs HSPA[+] vs WiMax vs CDMA2000 vs who knows what else. Even then if you have the right interface you need it to be on the correct frequency.

        Making a phone that works on all the standards would be prohibitive. Deciphering all the standards to get a compatible handset

    • For a while Telus (landline, phone & internet company) was giving away "free computers" to people that signed up for a certain level of internet access. As far as I know it wasn't THAT popular, but I do know at least 1 person (completely non-technical user) that got the laptop offer.
  • First and Foremost needs to be the mention of such privacy-violating software in the EULA/ToS of the agreement. Screw all the other parts. Make this paramount.

  • I love our new Congress: Nothing is illegal, as long as its documented.

    • It's ok as long as they cops are doing it? We need a it's not legal to track people without a warrant for anybody. Exceptions for with consent for research or internally for network development (no sending the data over the wall to advertising).

  • disclosure (Score:4, Interesting)

    by sl4shd0rk (755837) on Friday September 14, 2012 @04:35PM (#41339489)

    Disclosure is pointless. Firstly, it doesn't prevent the carrier from installing spyware on your device. Secondly, it's often worded in a way which leaves the customer clueless:

    "..In agreeing to these terms, you authorize
    Sprint to collect the necessary data needed to improve
    and maintain equipment, networks, and customer service.
    At no time will Sprint share this information with unaffiliated
    third-parties, or individuals"

    People just "meh" at shit like this and click through it. The lawyers know it too. I say, If you're going to raise hell about CarrierIQ, make a policy that requires the individual to Opt-in.

    • It still doesn't help to have an op-in. The carriers will just require you to op-in before using any of the features of the phone. Since all carriers will have nearly identical EULAs you will be required to op-in if you want to communicate in the modern world.

  • Carriers will merely put this into their TOS or other contacts with fine print that a lot people don't read but sign anyways. Mandate a specific title and format of the text so people actually notice it before they just agree. Better yet, mandate it a yes or no question on the agreement. It'd be no different than the customer improvement prompt you get for certain software to know how you use it.

  • by Anonymous Coward

    If the carrier can not capture keystrokes. How would it know that you want to make a phone call or what the text should say or what website to display? Sometimes I wonder about privacy freaks... Maybe I shouldn't do that.... They might pass a thought law.... Never mind...

    • ^
      Too stupid to be trolling.
    • this is about the carrier getting a full keystroke log from your phone

      so if you typed something decided it was stupid edited it to something sane THE CARRIER WOULD GET BOTH VERSIONS

      so lets say you decided to text somebody half drunk after knocking over a convenience store. you decide to NOT tell the world that you just hit %store% but decided to say something else. The Police could get the Evidence version.

  • You think they're going to pass this? Bwahahaha.
  • Be careful of new laws: "No company can track you, but the government can do whatever it wants."

    They're perfectly content to let you rage on about the pseudo-evil of corporations while Sauron bides his time.

A rock store eventually closed down; they were taking too much for granite.

Working...