Slipshft.com

The saga with Carrier IQ’s ability to procure information from your phone continues. AT&T, Sprint, and T-Mobile have all said that they use Carrier IQ to improve network and handset performance. Some security ‘experts’ have stepped forward to say that this whole thing is way ‘overblown’, that they are really only collecting metrics.

While I agree, that not enough information is known at this point, I would also like to point out that to collect metrics an application should not need to permissions that the Carrier IQ application has. Why would they need the ability to write a contact to your phone or intercept a call? Why would they need the ability to modify (write) the hardware settings on your OS? Why would the need to be able to create a bluetooth connection? They don’t need the permission for these things to collect metrics, they do need it if they want to control your phone from afar.

There are now lawsuits starting, we will see how far they get.

I will say it again, they got caught and are now trying to say ‘We only do <blank>.’ until someone can prove that they are doing more than they admit to. Wait for it…

Carrier IQ was outed when a developer (TrevE) started looking into what it really does. Now Carrier IQ claims that they are not collecting keystrokes (see this Media PDF for the claim), however TrevE shows (video here) that in fact the software collect each keystroke (both press and release) for each key (or button) that you press. Additionally, TrevE shows that the software collects data that should be encrypted (HTTPS) and forwards it in plain text before it gets encrypted. So any sensitive information is transmitted to where-ever Carrier IQ sees fit. It could be your carrier, one of the Carrier IQ auditing locations, or perhaps the government.

Another item that sticks out like a sore thumb, is the lack of a privacy policy or opt out option. What if I do not want to participate in their ‘research’? What if I want to keep my passwords private? Too bad is the answer.

While I understand the need to collect performance data to make better handsets, this is going to far. Having permission to hijack my phone calls, change my audio settings or bluetooth settings, and all without my knowledge or a by your leave. Pretty crass if you ask me, but not unexpected. Since the software is hidden, and rather ubiquitous, you can imagine that they have garnered quite a bit of personal data on everyone with a cell phone (and no it does not have to be active on the network). Now you no longer have to wonder how they know so much about how you live your life, they steal it.

They claim that they do not garner personal data, but the truth is already out of the bag. Now let’s see if there is a class action lawsuit for this…

This is my opinion and will not change until proven otherwise.