Carrier IQ Hit With Class-Action Lawsuit After Privacy Outcry

SAN FRANCISCO -- Technology bloggers are asking if our cellphones are spying on us after a security researcher said a piece of software hidden on millions of phones was recording virtually everything people do with them.

Amid a broad outcry, Sen. Al Franken (D- Minn.) is calling for an investigation. A class-action lawsuit has been filed against the software's maker, Carrier IQ Inc. of Mountain View, Calif.

The software, which Carrier IQ says is used on some 150 million mobile devices, appears relatively innocuous. It does watch what owners of Sprint Nextel Corp. and AT&T Inc. smartphones do with them, including what people type and the numbers they dial. But it doesn't seem to transmit every keystroke to the company. Instead, it kicks into action when there's a problem, like a call that doesn't go through, and it lets the phone company know.

"It is software that is developed in partnership with carriers with the intent to improve network performance. As far as we can tell, it meets this description in execution," said Tim Wyatt, principal engineer at Lookout, a cellphone security company.

"In line with our privacy policy, we solely use CIQ software data to improve wireless network and service performance," AT&T said in a statement.

Carrier IQ says the data its software gathers is stored by the phone companies or at Carrier IQ's facilities. It doesn't sell the data to third parties. Phone companies, of course, already are custodians of a wealth of private information, including whom you call, where you surf and what your text messages say.

The brouhaha started a few weeks ago, when a programmer named Trevor Eckhart documented Carrier IQ's workings with videos on his blog. The software company threatened him with a lawsuit if he didn't take the information down. The Electronic Frontier Foundation took on Eckhart's case, and the company backed down.

Eckhart posted another video this week, showing Carrier IQ's software logging keystrokes on an HTC EVO 3D from Sprint.

A central privacy worry is what kind of data Carrier IQ is retaining.

Andrew Coward, a Carrier IQ vice president, said the software doesn't record every keystroke or send information about all of them back to the company. The only keystrokes it cares about are specific administrative commands, including those instructing the software to phone "home." The rest it discards, Coward said.

"We never expected to need the content of SMS messages, so we didn't code for it," Coward told The Associated Press in an interview.

Apple Inc. has said it has stopped supporting Carrier IQ in most of its products. Separately, the company came under fire last year over location-tracking features of the iPhone and made a software change to keep data on users' movements for less time.

For now, there's no easy way to uninstall the Carrier IQ software without unsanctioned third-party software. Coward said it is "too early to tell" whether the company will make any substantial changes to the software because of the uproar.

___

Svensson reported from New York.

Check out our slideshow (below) to see what mobile carriers and manufacturers have to say about Carrier IQ software.

Comments

[Tophito]

06:54 PM on 12/17/2011

Under the Patriot Act couldn't this all be legal? Did we as Americans just find out that all our lives are being watched and act surprised from it? Please, anyone that naive needs to be taken into counseling.

[blackreign]

03:26 PM on 12/05/2011

It should be a Felony for any company to install this type of software without separate and explicity permission from the cellphone owner/customer.

[georgecarlin76]

01:54 AM on 12/05/2011

Good...now lets get rid of ALL the telecom's legal immunity. They have become criminal. We don't allow lawyers or doctors to sell out private information just because it flows through them so I believe these telecoms need to have their executives prosecuted.

[CorpGreedSux]

12:14 AM on 12/05/2011

herd the sheep through the technology shoot so we can spy on them then subliminally control them control them

oppps........

[olddognewtrick]

11:48 PM on 12/04/2011

My guess is...they probably saw that coming...

[Stefan Dembowski]

09:27 PM on 12/04/2011

IMO, Might be a bit premature...

[YoBear]

02:35 PM on 12/04/2011

The carriers are the one, if any, who should be sued. The lawyers don't have the guts. They can only pick on the little guy (who IMO is innocent)

[ur2nutty4me]

01:07 PM on 12/04/2011

It seems the only thing the corporations and government can do well is deprive the citizens of their rights. I bet if we had all the money they all spent on surveillance and tactical equipment to spy and control their own citizens we would have half the deficit. Our tax dollars and personal purchases used against us. And the insane answer from the right will be if you are not doing anything wrong what are you worried and concerned about totally void of whats happening to their freedoms.

I suggest we stop them now, both parties let this happen. If ever there was a bipartisan issue for all Americans this is it.

[TwoZeroOZ]

12:31 PM on 12/04/2011

Trevor Eckhart is a child. He's a child that knows how to get the gullible masses worked up.

Simple.

[YoBear]

02:39 PM on 12/04/2011

Agreed. He was so enamored w HTC and holds them completely innocent. Yet it's HTCs phone and the put the IW service on it.

[Eris23]

11:18 AM on 12/04/2011

"Eckhart posted another video this week, showing Carrier IQ's software logging keystrokes on an HTC EVO 3D from Sprint."

Bad reporting again. Eckhart has not posted a single video that showed Carrier IQ logging anything. The videos showed Carrier IQ receiving data, but not necessarily logging it. The only entity responsible for logging anything that can be proven is Eckhart.

[LightShadow62]

12:13 PM on 12/04/2011

What is ridiculous is the Eckhart will likely wind up making a mint from his erroneous claims.

[Mitchman57]

10:58 AM on 12/04/2011

I like the idea that I don't have to report back to Verizon, AT&T, etc., where my signal strength is strong or weak, what call didn't get though to me and why, which of my texts didn't make it to a tower and where I was at the time.

We ask for this stuff to work.... how do you all think they fix the problems we all encounter? When was the last time you called AT&T and told them about the last failed text message, where you were, what tower, road, building, battery strength?

Jeez. We asked for this, let's all sit back and let the gizmos do their magic with minimum of human intervention.

[radicalranger]

04:53 PM on 12/17/2011

And I say "hznell no!' I will jealously guard my privacy and freedoms intended for me by the flipping US Constitution. I am not a sheep to be herded obediently and do not grant anyone this kind of totalitarian control over my life. Shame on you!

[Mitchman57]

10:40 PM on 12/17/2011

I think you should read the contract that you agree to when you enter into an agreement with a service provider. The constitution isn't a stand-in for non-understanding.

If you don't like the agreement, don't do business with them. Pretty simple to retain your rights if you'll just stop being a pr ick about it.

[Pavane]

10:42 AM on 12/04/2011

Do these phones need Carrier IQ's services in order to work? If not ...

[Mitchman57]

10:51 AM on 12/04/2011

No, but it sounds like you need it to be in place when you have a problem and expect a solution.

[Pavane]

11:05 AM on 12/04/2011

Thanks, Mitch. I am not educated in these things.

[jeffhintx]

10:21 AM on 12/04/2011

Just for the record, software like CIQ does have its uses. The "can you hear me now" guy doesn't actually walk around with a phone repeating that idiotic phrase.

I know, because I did that job for Sprint, ATT, T Mobile and Verizon all at the same time.

It's called DRIVE TESTING and they mount eight or ten phones in your car connected to computers, and also connected to a map tracking GPS software program like Microsoft Streets and Trips.

And you drive everywhere, through every street in a section of town and the phones use CIQ to track call quality.
The result is a signal strength map color coded to represent the different call quality levels in various spots, combined with real time test call data recorded by computer.

[jsimpy]

08:19 AM on 12/05/2011

If you've done that a couple times though why have it on millions of phones?

[jeffhintx]

10:22 PM on 12/05/2011

I did that job for nine months. Why is it on individual phones? It's pretty much a scaled down version of the same concept.
I'm not saying that it's a great idea to have it installed on customer phones, in fact I happen to think it's a lazy approach to doing something phone companies should do in a testing environment instead.

But I do not believe it is there to "spy on people".
It's like an automobile or aviation black box.

[thetxsndn]

10:01 AM on 12/04/2011

And people wonder why hubby & I don't habla cell phone. The computer is bad enough.

[bring in swat]

10:11 AM on 12/04/2011

the computer is more than likely worse...and your tv, car, credit cards/debit/atm.......you'll never escape it.

[RemoveTheGreedyOnes]

10:16 AM on 12/04/2011

Yup.

[AlexHoff]

11:01 AM on 12/04/2011

The computer is WAY worse. If your ISP (internet service provider) gets subpoenaed by court they information about every website you have ever been to. (This is in simply terms of course. It's a bit more complicated then that)

[Mitchman57]

11:00 AM on 12/04/2011

You think your land-line is less intrusive?

[thetxsndn]

12:35 PM on 12/04/2011

I'm sure you're right and at my age, I don't need more leashes. :)

[ThatsTheTheWayItIs]

09:25 AM on 12/04/2011

The suit will fail. Carrier IQ just wrote the software, they are not gathering the data. It's like suing camera manufacturers because their products are used to invade privacy. Or suing gun manufacturers for the damage use of their product causes, that doesn't work. __ Sue the telecoms, those using the software. They'll just settle on an "opt-out" option for customers, which also disables the most useful features. That will satisfy any lawsuit, and do no good whatsoever.