Carrier IQ Rekindles Debate on Digital Privacy

The latest revelation in the battle for digital privacy came in the form of a rootkit installed on close to 150 million cellphones on Android, BlackBerry, and other devices that can track user locations and log keys they press.

The findings are raising ire over whether companies have the right to log this data, and inquiries into what the data is being used for. Last month, Android security researcher Trevor Eckhart blew the lid on the pre-installed software from a company known as Carrier IQ.

If left unaltered, Carrier IQ alerts users of its presence and lets users fill out surveys for any errors in their service—including dropped calls and Web browser crashes. “Unfortunately this is not always the real world case, it can be modified to be completely hidden,” states Eckhart.

Administrators can alter this, however, allowing them to single out individual phones and log nearly any data they'd like. “So instead of seeing dropped calls in California, they now know Joe Anyone’s location at any given time, what he is running on his device, keys being pressed, applications being used,” Eckhart states.

The emergence of Carrier IQ sparked suspicion over whether it was being used by law enforcement. MuckRock, an open government tool for filing Freedom of Information Act (FOIA) requests, sent a request to the FBI for “manuals, documents, or other written guidance used to access or analyze data gathered by programs developed or deployed by Carrier IQ.”

The request was denied, however, on grounds from the Department of Justice “that there is a pending or prospective law enforcement proceeding relevant to these responsive records; and that release of the information contained in these records could reasonably be expected to interfere with the enforcement proceedings,” according to the document.

MuckRock notes it is unclear whether this suggests the FBI is investigating Carrier IQ, or if data from Carrier IQ’s software is being used in their own investigations.

No response was received from calls to Carrier IQ as of press deadline, but a Carrier IQ spokesperson told VentureBeat via e-mail, however, “Just to clarify all of the media frenzy around the FBI, Carrier IQ has never provided any data to the FBI.”

Common Practice

Several companies collect this type of data—with or without Carrier IQ.

In May, both Google and Apple had to testify before Congress explaining how they protect user privacy, following findings that the Apple iPhone was storing data on the user’s location, and Android phones were transmitting user location data to Google.

“Recent advances in mobile technology have allowed Americans to stay connected like never before and put an astonishing number of resources at our fingertips,” stated Sen. Al Franken (D-Minn.), chairman of the Judiciary Subcommittee on Privacy, Technology, and the Law, in an April 25 press release announcing the hearing.

“But the same technology that has given us smartphones, tablets, and cellphones has also allowed these devices to gather extremely sensitive information about users, including detailed records of their daily movements and location. This hearing is the first step in making certain that federal laws protecting consumers’ privacy—particularly when it comes to mobile devices—keep pace with advances in technology,” Franken stated.

Pressure on Google and Apple seems to have done little to stop the trend, yet it may be partly due to demand from consumers.

“At Google, we have seen an explosion in demand for location-based services,” Alan Davidson, Google’s director of public policy, stated during the May 10 hearing, in a prepared testimony.

Davidson said location tracking is very common, and works behind several key services—including the U.S. Postal Service application for finding nearby post offices, Twitter geotag functions, Yelp and Urbanspoon showing local search results, and many others.

Other companies have joined the bandwagon since then. Verizon announced in October they would begin tracking user locations, which websites they visit, and what apps they use—and sell this data to third parties.

Just prior to that, OnStar announced they would continue tracking the locations of drivers even after they cancel the service—and also sell the data to third parties. New York Sen. Charles Schumer called for an investigation by the Federal Trade Commission, stating, “By tracking drivers even after they’ve cancelled their service, OnStar is attempting one of the most brazen invasions of privacy in recent memory.”

Access to Data

Although Carrier IQ’s role in law enforcement is still being investigated, access to this data already exists—with or without Carrier IQ.

According to digital rights organization the Electronic Frontier Foundation (EFF), all cellphones have unique identifying numbers connected to the user’s identity, and the user’s location can be tracked through their connection to cellular towers.

“Cellphones communicate with transmission towers. The strength of the signal received by these towers from a phone is a measure of distance, and this allows the phone network to know where its users are,” states the EFF. “Many, if not all, networks log approximate location on a regular basis. These records may be subject to subpoena. If your adversary is law enforcement and has probable cause for a warrant, they could receive continuous triangulation location surveillance data from the network.”

Intercepting data from phone calls is just as easy, since “Cellphone communications are sent through the air like communications from a walkie-talkie, and encryption is usually inadequate or absent,” it states.