Preventing Another Carrier IQ: Introducing the Mobile Device Privacy Act 60
MrSeb writes "Lawmakers in Washington have turned their sights on mobile device tracking, proposing legislation aimed at making it much harder for companies to track you without consent. The Mobile Device Privacy Act (PDF) makes it illegal for companies to monitor device users without their expressed consent. The bill was introduced Thursday by Massachusetts Democrat Representative Edward Markey, co-Chair of the Bi-Partisan Congressional Privacy Caucus. Much of the impetus for the bill came from last year's Carrier IQ debacle, where it emerged that the company's software was found to exist on both iOS and Android devices on AT&T and Sprint's networks. While the company denied any wrongdoing, the software captured keystrokes and sent the details of your device usage back to the carriers. If passed, the legislation would require the disclosure of including tracking software at the time of the purchase of the phone, or during ownership if a software update or app would add such software to the device, and the consumer gains the right to refuse to be tracked. This disclosure must include what types of information is collected, who it is transmitted to, and how it will be used."
Carrier IQ (Score:2)
I have an iPhone 3GS on AT&T. How do I check if Carrier IQ is on it? Did that program show up "randomly" or only on new phones after a certain date?
Re:Carrier IQ (Score:4, Informative)
Carrier IQ exists on several levels. For Android, it went particularly deep, enough to be able to capture the key codes (whe you typed). For iOS, it couldn't go as deep, so it was used mostly for its ability to collect diagnostic data ("send diagnostic information to Apple").
I believe it came in around iOS 4 or so, but 5 I think eviscerated it as Apple implemented it themselves. If not, the sure way is to just disable sending diagnostic information to Apple.
Re: (Score:2)
It was disabled by default on iOS. In order to enable it you had to go into your debugging settings (General - About - Diagnostic and Usage Data), and turn it on. You also had to allow to upload the data to Apple. Unless both of those were on, it wasn't able to do anything.
It was removed completely in iOS 5 meaning you can't even turn it on (the option is grayed out).
Don't worry about it (Score:2)
On the iPhone CarrierIQ did not do [arstechnica.com] most of the stuff the Android version did - no key logging for example.
Apple got rid of CarrierIQ with iOS5 updates anyway.
Re: (Score:2)
Laws don't matter (Score:3, Insightful)
They'll just put the required consent in the Terms of Service. Problem solved.
Re:Laws don't matter (Score:4, Insightful)
Exactly.
Go read the bill folks. All it does is mandate DISCLOSURE
It doesn't mean that you get to disapprove of the monitoring software and still get to to keep the device or maintain service to the device. Where have you ever seen the ability to selectively accept or decline the boilerplate provisions of your contract? Check this box saying you agree to all the terms here in or we can terminate your contract and require you pay your Early Termination Fee.
The biggest hole is with manufacturer installed monitoring software. Its not at all clear that disclosure would be required if it was on the device at the point of manufacture as opposed to being added later (2a3).
Further the Exemptions clause (2d) is so broad the you could drive a truck thru it. No disclosure necessary if there was a "reasonable expectation" that monitoring software might exist on the device. What precisely is Reasonable? Some mumbo-jumbo about service quality management buried in the fine print?
Its a good start, it just needs to be tougher.
Simply prohibit carrier or manufacturer installation of such software outright.
Make it an after market package you can sign up for if you have problems and uninstall after the fact.
Re: (Score:3)
Five will get you ten that your "right to refuse it" is the exact same "right to refuse" that you've had since the shitstorm started: don't buy the phone. Otherwise, consent is implied.
These are cell phone carriers we're talking about. There's nothing too scummy for them.
Re: (Score:2)
Its there, but its weak. See section 3.
How about having to OPT IN 1st?Re:Screw Disclosure (Score:2)
Make "thou shalt not snoop" the law of the land, with narrow exceptions that require prior consent (for cases other than self-defense), imposing jailtime and fines on all who infringe upon anyone's privacy.
Re: (Score:2)
And on the 237th page of the EULA... (Score:2)
Re: (Score:2)
And, the EULA will say that laws, class action suits, and any form of redress for anything they do is hereby absolved by your using the device.
Re: (Score:2)
Are you telling me that CM will let you install apps that need e.g. "phone state and identity" but will feed them false information?
If so, I'm definitely switching to CM.
Re: (Score:2)
Fuck that. Don't even play THAT nice.
CyanogenMod balked at it because they didn't want to piss off the developers (boo fucking hoo), but PDroid [google.com] solves the "neutered apps crash" problem by feeding it bogus data.
Re: (Score:2)
(1) The disclosures shall be made in a clear andconspicuous manner, to be determined by the Federal Trade Commission.
(2) The disclosures shall be displayed in a clear and conspicuous manner on the website of a person required to make such disclosures, except that if such person does not maintain a website, such person shall file such disclosures with the appropriate Commission.
So probably not in a EULA, although it would be up to the FTC to make the appropriate regulation. In any case, they also have to report it to the FTC, and on their website, so people will be able to know about it, which is a significant improvement over the current situation.
Re: (Score:3)
Android is already pretty good at this, by giving users a pretty detailed list of what information an app has access to at the time the app is installed
Well, not really all that good.
Its there, but does your mom understand it?
Why should merely mentioning that the Game you just installed has access to your address book be enough?
Android needs, (and there is some movement towards this) a much finer grain control, where an app will be subject to a permissions module
that the user can control to deny access to specific things at the OS level. If said games stop working because the users deny access to
contacts or emails, thats fine. At least we know where we s
My EULA (Score:4)
Re: (Score:2)
I just noticed in my EULA that I have renounced my citizenship and rights as a US citizen.
It's fortunate that at least some rights cannot be waived though. Whether EULAs are legal or not, any clauses demanding your soul or your firstborn are invalid
Someone should write and then try to enforce EULA that renounces user's citizenship. It would be helpful for something like that to go through the court system! (assuming it gets undone, that is...)
Re: (Score:2)
Bought and paid for (Score:2)
Hypocracy (Score:4, Insightful)
need a technical solution, too (Score:3, Interesting)
A legal solution is fine, but it isn't sufficient by itself. It's like trying to legalize that I don't receive spam. Well, the law can't really do that (it's tried). I can only do that myself, by being careful with who I give my email to.
So this seems like the same idea. Such a law doesn't hurt, but it isn't enough, by itself. What's needed is a technical infrastructure where the people who buy mobile products fully control them, from the hardware on up, rather than some phone carrier controlling them. Then I can blow away whatever crapware comes with the device by installing my own operating system and only running software I trust.
As long as the device is secured against the people who buy them, there can be no trust that we have any privacy.
If they wanted to pass a better law, they'd have passed one like that: carriers cannot secure phones against who buys the phones.
Re: (Score:2)
How about a law that says if you cannot compile and build your own phone software you have no business having a mobile phone?
How about a similar law that says if you cannot build and install Linux from source you cannot have a computer? Proof of such ability results in a federal license which is then required to buy any computer or computer parts. And the penalty for selling such devices to anyone without a license is banishment to some tiny island without Internet access.
The only problem with that is we
Carriers shouldn't sell phones (Score:5, Insightful)
I've said it once, and I'll say it again: carriers have no busyness selling mobile phones, they need to be separate things, to avoid vendor-lock in, and plenty of other issues.
I'm still surprised how many people in the US seem to buy their phones from their carriers really. Phones need to be sold in closed boxes on default factory settings, and sold by phone-selling companies. Otherwise, there's a severe conflict of interests.
Imagine if PCs were sold by ISPs, and TVs by cable-companies!
Re: (Score:2)
I'm still surprised how many people in the US seem to buy their phones from their carriers really.
Faced with the choice of a $700 phone and $50/month service, or a $99 phone and $89/month + 2-year service contract, most people will choose the subsidized option. Most, as in just about everybody. And if I bring my own phone to a provider, they're still going to charge me the higher price, so I might as well get the subsidized phone.
You're onto something about PCs from ISPs. Notice all the netbooks for sale at cell phone stores? I think that's the future business model for computers, especially with
Re: (Score:2)
Minor nitpick: In the US, I beleive only T-mobile offers a (small) discount on the service charge if you bring your own device.
So really, you mean a $700 phone + $89/month (no contract) or $99 phone + $89/month 24-month contract, or $700 phone + $69/month service + shitty coverage...
Re: (Score:2)
IMO it's not just subsidies. It's also that every network in the US is using incompatible standards. Verizon and Sprint are CDMA; AT&T and T-Mobile are GSM. But if you want anything more than 2G you then get into a mess of UTMS vs LTE vs HSPA[+] vs WiMax vs CDMA2000 vs who knows what else. Even then if you have the right interface you need it to be on the correct frequency.
Making a phone that works on all the standards would be prohibitive. Deciphering all the standards to get a compatible handset
Re: (Score:2)
Useless measure (Score:2)
First and Foremost needs to be the mention of such privacy-violating software in the EULA/ToS of the agreement. Screw all the other parts. Make this paramount.
Not illegal (Score:2)
I love our new Congress: Nothing is illegal, as long as its documented.
Re: (Score:2)
It's ok as long as they cops are doing it? We need a it's not legal to track people without a warrant for anybody. Exceptions for with consent for research or internally for network development (no sending the data over the wall to advertising).
disclosure (Score:4, Interesting)
Disclosure is pointless. Firstly, it doesn't prevent the carrier from installing spyware on your device. Secondly, it's often worded in a way which leaves the customer clueless:
"..In agreeing to these terms, you authorize
Sprint to collect the necessary data needed to improve
and maintain equipment, networks, and customer service.
At no time will Sprint share this information with unaffiliated
third-parties, or individuals"
People just "meh" at shit like this and click through it. The lawyers know it too. I say, If you're going to raise hell about CarrierIQ, make a policy that requires the individual to Opt-in.
Re: (Score:2)
It still doesn't help to have an op-in. The carriers will just require you to op-in before using any of the features of the phone. Since all carriers will have nearly identical EULAs you will be required to op-in if you want to communicate in the modern world.
Re: (Score:2)
If it's required, then it's not "opt-in". That's not an option; that's a compulsion.
Workaround (Score:1)
Carriers will merely put this into their TOS or other contacts with fine print that a lot people don't read but sign anyways. Mandate a specific title and format of the text so people actually notice it before they just agree. Better yet, mandate it a yes or no question on the agreement. It'd be no different than the customer improvement prompt you get for certain software to know how you use it.
Not sure what this would mean.... (Score:1)
If the carrier can not capture keystrokes. How would it know that you want to make a phone call or what the text should say or what website to display? Sometimes I wonder about privacy freaks... Maybe I shouldn't do that.... They might pass a thought law.... Never mind...
Re: (Score:2)
Too stupid to be trolling.
Difference between the PHONE and the Carrier (Score:2)
this is about the carrier getting a full keystroke log from your phone
so if you typed something decided it was stupid edited it to something sane THE CARRIER WOULD GET BOTH VERSIONS
so lets say you decided to text somebody half drunk after knocking over a convenience store. you decide to NOT tell the world that you just hit %store% but decided to say something else. The Police could get the Evidence version.
The house just reupped FISA till 2017 (Score:1)
Hobbits with furry feet...and hands. (Score:1)
Be careful of new laws: "No company can track you, but the government can do whatever it wants."
They're perfectly content to let you rage on about the pseudo-evil of corporations while Sauron bides his time.