Palm Pre Reports Your Location and Usage To Palm 314
AceJohnny writes "Joey Hess found that his Palm Pre was ratting on him. It turns out the Pre periodically uploads detailed information about the user to Palm, including the names of installed apps, application usage (and crashes), as well as GPS coordinates. This, of course, is without user consent or control. The only way he found to disable the uploads was to modify system files."
User Consent ... (Score:5, Informative)
This, of course, is without user consent or control.
But From Palm Infocenter, they say [palminfocenter.com]
Palm's own "Terms and Conditions" statement, along with their Privacy policy, detail that Palm basically maintains it has the right to indefinitely collect, process, store and share this information. Users must accept this multipage collection of fine-print waivers and disclaimers in full during the initial device setup process before being able to utilize the device.
EVERY cellular phone tracks you (Score:1, Informative)
even if it doesn't send any data, just by being in contact with some base station tower every few minutes. That tracking info IS used in civil and LE investigations regularly. And as Hans Reiser found, removing your phone battery to stop the tracking is considered incriminating evidence in its own right.
Re:Oh no! Automated Dr. Watson (Score:3, Informative)
That would depend on the programs running at the time, wouldn't it? After all, some do use the GPS coordinates, so it is reasonable that some have a bug in how they do so...
Re:Oh no! Automated Dr. Watson (Score:5, Informative)
It's not just crash data. It sends that too, but it also uploads your GPS coordinates daily along with the app use data (what you've used and for how long) according to TFA. It's customer profiling, not bug testing.
Won't they ever learn? (Score:2, Informative)
You know, that total control of their users and the things they can and can't do. Apple should not control their users like that, it's just...
Oh wait, you mean someone else than Apple is doing that?
Damn you Microsoft, always controlling your users....
Oh wait, you mean it's neither Apple or Microsoft?
So, you zealots who always bash on Apple and Microsoft... what FUD will you say to protect your precious Palm now? And wasn't Google's Android doing something similar too?
The solution is easy: get a cellphone that's JUST A GODAMN PHONE.
Re:Boycott (Score:5, Informative)
Closed source and closed hardware devices mean these little surprises will continue to happen.
Re:Oh no! Automated Dr. Watson (Score:5, Informative)
Re:Did it not occur to PALM that this is BAD? (Score:1, Informative)
some do. its just hit the lawyer boards.
http://autoadmit.com/thread.php?thread_id=1062087&mc=1&forum_id=2
Re:Oh Noes! (Score:2, Informative)
Your comment is super behind the times. The Pre is a slick little device, and easily stands with other moderm smartphones.
Including in the "violate user's privacy" space, it seems.
Re:Did it not occur to PALM that this is BAD? (Score:2, Informative)
Re:Did it not occur to PALM that this is BAD? (Score:5, Informative)
> Likely there will be no repercussions whatever.
Right. You'll whine and whine, but you'll keep right on buying the stuff.
Re:Yea, and.... (Score:5, Informative)
"Hell, I thought all phones did this anyway"
Running the GPS on a phone eats up the battery, I wouldn't assume any phone company would be purposefully sabotaging the battery life of its own products to piss off its customers.
And tracking of cell phones has come up in the past, and is generally quite controversial: http://www.insidetech.com/news/articles/2299-controversial-study-tracks-movement-via-cellphones [insidetech.com]
I honestly don't know why Palm thought it could get away with it without some outrage. Especially when it has such a steep hill ahead of it already.
TFA Text (Score:5, Informative)
Woops, looks like /. is hammering the server. Here's a copy of the text (as of now):
Re:EVERY cellular phone tracks you (Score:3, Informative)
No, that's not the case. A GSM phone will only call in every few hours; when it is switched on or off; when it needs to call out or send an SMS; when it is asked to call in; or when or when it moves between areas covered by different MSC/VLRs. An MSC/VLR covers a large area of a country with thousands of base stations. The bit about "asked to call in" is interesting. The network knows that the handset is in the area covered by an MSC/VLR, but not where, so it broadcasts a request for contact over the base stations in the area. The handset responds, localising itself to a base station. The point is to minimise signally costs and battery power consumption.
Yes, you can use the information about the last localisation in legal investigations, because the network keeps track of where and when you were last seen. It's also possible to send a silent SMS to get the phone to localise. However there is no continuous tracking of handsets by default.
article on precentral.net (soon to be slashdotted) (Score:4, Informative)
http://www.precentral.net/fyi-pre-reports-your-location-palm [precentral.net]
When PreCentral's people asked Palm about this, their official statement to them in part was:
Our goal has been to follow industry best practices on data collection, use, and encryption. Like most EULAs and privacy policies, though, the terms tend to get pretty detailed about potential scenarios. And because the terms are meant to notify users about all possible variations, we wanted to err on the side of over notifying rather than under notifying users through the terms of use. So there's really nothing here "beyond the norm" for a EULA or privacy policy.
The provision you've quoted explains why Palm might collect user information. For example, we collect and transmit users' email addresses, email content, contact lists, etc. to provide WebOS services such as back-up and restore for the purpose of backing up that data and helping users restore the data if needed (in that case, it would not be limited to just the email address collected at registration). If users someday make purchases on their device through the Apps Catalog, then we would also collect payment information to process the transaction.
At all times, we'd be strictly bound by our privacy policy. Our privacy policy, like virtually all others in the industry, contemplate our using data to provide services users have requested, improve our products and services (hence the reference to Palm's own "sales and marketing" in the privacy policy), troubleshoot, etc. We also refer to affiliates because Palm is a global company, and we may need to transmit data from our European subsidiary to the parent company. We're obviously not a conglomerate with many different subs and affiliates, but the terms specifically mention subs and affiliates so that we can comply with European data protection laws that require us to spell out that data collected by a European sub can be transmitted to another part of the company.
Re:Apps installed OK, crashes OK, location - HELL (Score:5, Informative)
Actually, it's the cellular companies that want that data more. By having the phones report back on position and cell tower ID strengths, they can more easily map "dead zones" in their coverage areas, telling them where to put new towers to hit the most people.
Re:Did it not occur to PALM that this is BAD? (Score:3, Informative)
Yup, and we expect either them to get slapped on the wrist and told to undo it by the association, told to stop selling the devices by court order and potentially recall all of them, or both the above combined with heavy fines. Either way we also expect Apple to fix the new "fix" upon the very next release...
As it is, and I spoke to him minutes ago as he was packing up for the day, my friend indicated that iTunes does in fact not currently sync his stuff today. Wether or not he's missing an update that might fix it, he's aware it's a hack, aware there's a fight that will almost certainly end in Apple's favor or at least turn against Palm, and well aware that after 14 days he can't return his device and get out of his contract without penalties or fees, so he's not wasting time at the risk of getting screwwed later.
he was actually not really too pissed about the hack, he was kind of on Palm's side on that matter and figured Palm would sooner rather than later have a "satisfactory" solution that may or many not involve their own meda player, or outright licensing of Apple's technology. What made him immediately pack up was the news he was being snooped on and that there was not a way to dissable it. He spent about 30 minutes looking to find a way, and made a nasty call to Pre's support line. He removed the battery from his device and was headed home to get the box, manual, and charger on his way to the store...
Re:Did it not occur to PALM that this is BAD? (Score:5, Informative)
hey, AT&T may have complied with illegal orders to provide wire taps, and even played some questionable moves to avoid prosecution, but lets place the blame where it really lies; the Bush Administration... AT&T was not the only company to comply with these orders, and was told quite explicitly, by judges, that the orders were in fact valid...
AT&T may have broken the law, and violated the privacy of many (suspected crimainals/terorists) Americans, but they did so under a supposed legal authority and under orders to do so, and these wire taps (most of them) were actually for people accused or associated with active federal investigations. Palm is collecting personal information, it has NO association with any criminal activity and no basis in law, and they're doing it without informed concent, and without a way to disable the tracking, and wihtout support or order by the government, and I bet they're doing it without the Phone Company's knowledge too. (and if the phone company IS aware of it, they're FAR more guilty than AT&T is...
Re:Settings to disable (Score:5, Informative)
So FWIW, I have "Background Data Collection" set to off, that did not stop the Pre sending those logs to Palm. I'm sure that that switch does prevent sending your location info to the Google, which makes it doubly unsettling that it's still sent to Palm, no?
Re:Yea, and.... (Score:3, Informative)
Running the GPS on a phone eats up the battery, I wouldn't assume any phone company would be purposefully sabotaging the battery life of its own products to piss off its customers.
You may already realize this, but for clarity's sake: GPS isn't needed to track phones. They can be tracked simply from their signal as long as there are multiple towers within range to receive it. So probably in any city you can be tracked.
And tracking of cell phones has come up in the past, and is generally quite controversial: http://www.insidetech.com/news/articles/2299-controversial-study-tracks-movement-via-cellphones [insidetech.com]
It may be controversial when some scientists announce that they're going to be using tracking data. That doesn't mean you aren't quietly being tracked anyway. Hell, carriers are required to give your position to law enforcement or emergency services. Since this kind of tracking is more or less passive -- it's based on your normal cell signal, no extra data is being sent by your phone -- then unlike with the Palm Pre's GPS you have no direct way of knowing if you're being tracked or not. You just know it's possible.
Re:Did it not occur to PALM that this is BAD? (Score:2, Informative)
Yup, and we expect either them to get slapped on the wrist and told to undo it by the association, told to stop selling the devices by court order and potentially recall all of them, or both the above combined with heavy fines.
Who is this "we" you speak of, and why would you and yourassociate think something so astonishingly wrong-headed? 1) The violated no law by spoofing the VID. 2) The USB-IF spec accommodates spoofing. That's how a lot of "Microsoft" brand non-Microsoft mice work with USB. 3) Palm is bringing the action to the USB-IF because what Apple is doing is actually more harmful to the spec. The whole point of USB is supposed to be Plug and Play. You plug a device into your computer, the device sends an ID to the OS, and the OS downloads the proper drivers. It's both against the spec and moronic to use the VID as a password to your application (which is essentially what Apple is doing with iTunes), because the ID is open for all the world to see. If Apple wants to keep non-iPods/iPhones from syncing with iTunes, they can put a unique ID in the firmware that's secret, so that any yahoo can't just plug the device into their machine and pull out the password (which again, is what the VID becomes when you use it this way). If everyone followed Apple's lead on this, we'd be left in the bad old days of the 1980's, where every application had its own drivers. 3) Even in the event that the USB-IF does decide they don't like what Palm did, there's no fine, no financial penalty at all. The only adverse effect for violating the USB-IF spec is you can't use the USB logo on your product's box.
Re:Did it not occur to PALM that this is BAD? (Score:2, Informative)
He commented a line in a shell script, and deleted an executable. Hardly "modifying the source".
Re:Oh Noes! (Score:3, Informative)
There were also a couple of PalmOS 5 devices that had built-in WiFi notably the Tungsten TX and the LifeDrive.
Re:Did it not occur to PALM that this is BAD? (Score:3, Informative)
And how is this differnt from former MCI's friend and family policy? The simple collection and parsing of information YOU ALREADY HAVE, is not in itself illegal. In fact, pen registers are not subject to 4th amendement protections unless that information is traded or sold, which it was not, accepting that giving it to the NSA was under what AT&T and others considered a legal order to do so.
A previous court case against MCI did not outlaw their practice, it only prompted MCI to change how they USED that information in their marketing efforts. They never did stop collecting it. In fact, that's why BellSouth had the information to provide the NSA when requested as well.
The NSA specifically requersted this information from ALL the major carriers. AT&T did NOT provide it voluntarily. Quest was the ONLY ONE to not comply... Do not put this on AT&T, every carrier except quest was guilty. Further, it's ONGOING, except its now under judicial oversight instead of executive oversight.
On the asside, I was added to the no fly list at one point. A close friend of mine was an active campaigner against a republican running for office, and organized more than one public protest. I was added due to my association with him though associated blog posts on his website. As soon as he got his own name removed, which I understand was not difficult, mine also was removed from the list.
Re:Did it not occur to PALM that this is BAD? (Score:2, Informative)
Re:Did it not occur to PALM that this is BAD? (Score:2, Informative)