Android Dev Demonstrates CarrierIQ Phone Logging Software On Video 322
Token_Internet_Girl writes with a followup to last week's news about Android developer Trevor Eckhart, who was researching software from CarrierIQ, installed on millions of cellphones, that secretly logged a variety of user information — from button presses to text message contents to browsing data. CarrierIQ tried to silence Eckhart, but later backtracked. Now, Eckhart has posted a video demonstration of CarrierIQ's logging software. From the article:
"The company denies its software logs keystrokes. Eckhart’s 17-minute video clearly undercuts that claim. ... The video shows the software logging Eckhart's online search of 'hello world.' That's despite Eckhart using the HTTPS version of Google, which is supposed to hide searches from those who would want to spy by intercepting the traffic between a user and Google. ...the video shows the software logging each number as Eckhart fingers the dialer. 'Every button you press in the dialer before you call,' he says on the video, 'it already gets sent off to the IQ application.'"
Can't someone sue the carriers? (Score:5, Insightful)
There is an asymmetry in the system as it works right now. Which private customers have the will, time, and money to sue companies that illegally wiretap their customers? Isn't there anything that can be done against this? (Of, I'm talking about action against CarrierIQ but about action against the carriers that use their software.)
Caught in a lie then. (Score:5, Insightful)
That's just nasty. First try to silence the researcher, then try to deny what's going on when you've already been caught.
The question is, will this have any effect? Will carriers stop shipping this stuff ? Will consumers care?
My guess is no, they'll just try to hide it better in future.
I have (Score:2, Insightful)
Always been suspicious of the countless android apps that REQUIRE device permissions such as "full internet access", "read phone state and identity" etc...
Needs to be labeled as spyware (Score:5, Insightful)
Conspiracy theories aside... (Score:5, Insightful)
What software is actually affected? What phone models? What platforms? What applications?
If it's just AT&T and its victims, well, it's their own private little hell. Otherwise, some facts would be nice.
For now, (quoting from the article), phrase of "millions of Android, BlackBerry and Nokia phones" smacks of cheap propaganda and scaremongering.
Regards,
Ruemere
Comment removed (Score:5, Insightful)
CyanogenMod (Score:5, Insightful)
So even more reason to flash your droid with CyanogenMod or custom ROM of your choice.
Re:Can't someone sue the carriers? (Score:5, Insightful)
If a judge found the activity to be unlawful, which I suspect is where the core of the issue rests, then whether or not there was a contractual agreement is irrelevant. I see no reason for a carrier's data collection policy to include keylogging everything a customer does outside of extenuating circumstance (suspected terrorist or something).
Re:Conspiracy theories aside... (Score:5, Insightful)
Seems like none of phones sold in EU comes with this preinstalled.
Think about it. EU would rip every carrier, phone manufacturer and software company in pieces if such privacy abusing would rise.
Not even any end user license would protect those companies at all.
Re:Needs to be labeled as spyware (Score:5, Insightful)
. . . at your expense.
So guess who pays for the transmission of all those logged clicks . . . ?
. . . and you thought some other app was draining you battery and carrier account limit . . . ?
Comment removed (Score:4, Insightful)
Comment removed (Score:4, Insightful)
Credit card number exposure (Score:5, Insightful)
Re:CyanogenMod (Score:4, Insightful)
Uhmm... how so? Android's openness has nothing to do with CIQ.
Not PCI compliant (Score:5, Insightful)
Comment removed (Score:5, Insightful)
Re:Can't someone sue the carriers? (Score:4, Insightful)
While I agree with the spirit of your rant, AT&T did just show us this past spring that we might already be in such a dystopia. They challenged a customer's right to partake in a class-action lawsuit (when a customer had signed an binding arbitration contract. AT&T took it to the supreme court and won. [arstechnica.com]
Re:Can't someone sue the carriers? (Score:5, Insightful)
So, a third party had to make this spy app for the carriers because Google was not spying enough on users for their taste. And your conclusion is that Google is evil.
Re:Can't someone sue the carriers? (Score:4, Insightful)
Yep. This is why I will never get an Android device or use Google+. They want to spy, and they spy everything. On top of that, other companies will start to feel that it's ok to do. If the practice can continue without interruption, we will all lose privacy. It's funny how everyone always fights losing privacy to the government. Google, Carrier IQ and the companies are just middle hands for that!
But why single out Google? All smart phones are going to do crap like this so the only way to escape it is to only use products that are completely open and unlocked.
Bear in mind that this thread is not actually about anything Google can change, it is about some extra software that carriers (ie - AT&T, etc) are adding to android after google are done with it. There is very little you can do to avoid this as all the carriers are just as bad but you can at least not just blame google because they created an open phone platform that some other company wrote bad software for. Do you blame Apple for Mac IE5 being shit or Microsoft?
Comment removed (Score:5, Insightful)
Re:Can't someone sue the carriers? (Score:4, Insightful)
They aren't recording "keystrokes" .... they are recording "event data" of which, keystrokes are merely a sub-class of events. It's not a lie...
"While we look at many aspects of a device’s performance, we are counting and summarizing performance, not recording keystrokes or providing tracking tools."
While I appreciate your efforts at devil's advocate throughout this thread, you seem to have missed the mark on this one. It is immaterial that keystrokes are a sub-class of the event data they are collecting; it is a lie to say categorically that you are not collecting keystrokes when you are.
Re:CyanogenMod (Score:4, Insightful)
Re:Can't someone sue the carriers? (Score:3, Insightful)
Re:Can't someone sue the carriers? (Score:5, Insightful)
"like apple, they could have owned the phone companies. they had the hot product and they could have dictated 'do not be evil to our customers!' to the phone companies."
No, they were a newcomer in the market. In the portable device industry, they didn't have the clout that Apple had thanks to iTunes + iPod. As a result, Apple is still the only company that can successfully tell a North American carrier to fuck themselves.
And anyway - yes Google allowed it. The whole point of Android is its openness - unfortunately, on some devices, the carrier abuses that openness. Don't like it, go buy a Nexus.
Re:Caught in a lie then. (Score:5, Insightful)
This to me sounds like it could be bordering on illegal
Bordering? It might be legal federally, but if I recall correctly (not a lawyer), there are States where recording such data is a violation of wiretap unless both parties are aware of the recording. And such some people here on /. are pointing to contract clauses where "data necessary to the functioning of the network" or similar are spelled out and saying that people consented (and are thus aware, which is suspect in itself). But let's take this a step further. CarrierIQ says in plain English that they're not logging keystrokes. Any customer who knows about carrierIQ and has seen carrierIQ's statement has a reasonable expectation that "logging keystrokes" is not part of the data logging they're agreeing to. "Aha!" says the weasel lawyer "the ordinary people didn't know about carrierIQ! Only our execs knew it was installed on our phones." To which I say, "did carrierIQ misrepresent its logging nature to those execs?" if it did, then carrierIQ might be logging keystrokes between a user and the phone company when the phone company execs have a reasonable expectation that carrierIQ isn't doing that. Then carrierIQ is in trouble in two-party states.