AT&T, Sprint: Carrier IQ Tracking Agreed To By Customers

More than two weeks ago, security researcher Trevor Eckhart posted a video about Carrier IQ, an obscure software installed on approximately 150 million smartphones. The 17-minute video sparked a firestorm not only because it alleged the software logged numerous details about users' activities, but also because it did so without their knowledge.

But this week, two wireless carriers that use Carrier IQ's software said customers should not have been surprised that some of their activities were being tracked. In letters to Sen. Al Franken (D-Minn.), who asked them to explain how they used the software, AT&T and Sprint said Carrier IQ's capabilities were clearly outlined in their privacy policies.

AT&T gives "clear notice" to customers that "we collect network, performance and usage information from our network and customer devices, and we use that information to maintain and improve our network and their wireless experience," wrote Timothy McKone, AT&T's executive vice president for federal relations.

"Sprint believes customers expect service providers and network operators to take reasonable technological steps to maintain the performance of their networks and device functionality in order to effectively deliver call and data services to users," wrote Vonya McCann, senior vice president for government affairs at Sprint. "Sprint's privacy policy contains notice of the information we collect."

The mobile carriers told Franken they use Carrier IQ software only to collect diagnostic information about their networks to improve customers' experiences. But their responses did not satisfy Franken, who said he was "still very troubled by what's going on."

"People have a fundamental right to control their private information," Franken said in a statement. "After reading the companies' responses, I'm still concerned that this right is not being respected. The average user of any device equipped with Carrier IQ software has no way of knowing that this software is running, what information it is getting and who it is giving it to -- and that's a problem."

According to reports, Sprint says it is disabling Carrier IQ software on its devices.

Samsung and HTC, which also wrote letters to Franken, said they install Carrier IQ software on their devices at the behest of mobile carriers and do not receive data collected by the software. Franken gave T-Mobile and Motorola until Dec. 20 to explain their usage of Carrier IQ's software.

Eckhart's video claimed the software logs every text message, Google search and phone number typed on a wide variety of smartphones and reports them to the mobile phone carrier. But AT&T said it uses Carrier IQ only to collect phone numbers sent and received by customers and Sprint said it uses Carrier IQ only to collect the URLs of websites customers visit and only for troubleshooting purposes.

In a 19-page statement released Monday, Carrier IQ acknowledged its software contained "an unintended bug" that "unintentionally" captured and transmitted encoded SMS messages to its carrier customers, including wireless companies -- Sprint, T-Mobile and AT&T. The company said the bug occurred only in "unique circumstances," like when a user receives a text message during a call, though the messages are "not human readable."

But the company denied that its software captures or forwards to wireless carriers the content of multi-media messages (MMS), emails, photos, web pages, audio or video.

Following Eckhart's video, Carrier IQ, which is based in Mountain View, Calif., was hit with a class-action lawsuit.

Earlier this week, Carrier IQ CEO Larry Lenhart and VP of Marketing Andrew Coward met with members of the Federal Trade Commission and Federal Communications Commission "in the interest of transparency and full disclosure, and to answer their questions," said Carrier IQ spokeswoman Mira Woods.

On Wednesday, FBI Director Robert Mueller denied the bureau had ever sought information from Carrier IQ, but said he could not rule out the possibility it obtained data collected by the controversial software through requests from wireless carriers. AT&T and Sprint told Franken they had never disclosed Carrier IQ data to law enforcement.

Comments

[DanInAustin]

10:19 AM on 12/20/2011

There's always the option of uninstalling it. Sure, it takes some doing (rooting the phone, installing a third-party ROM), but it's a viable option nonetheless, and you get some cool perks as well (free tethering/wifi hotspot that technically violates your contract).

[papagroove]

02:01 PM on 12/19/2011

""People have a fundamental right to control their private information," Franken said in a statement"

only in a for-profit society mister franken...

What is privacy in a truly free society? Why would it exist in a free society? What''s the benefit?
the act of hiding unlawful acts? (are you really in a free society if this is true?)
or
the act of protecting personal knowledge. (which again, are you really in a free society if people are protecting information that could be used for public good? ie, Patent and Copyright laws, trade secrets..etc)

[JWoode]

09:17 AM on 12/19/2011

Just accept that it isn't a "smartphone", it's a tracking device with communication and entertainment features.

[Busterx4x]

04:23 AM on 12/19/2011

Not to go all paranoid or anything...but if this capability even exists, let alone whether the companies use it or not, isn't it just a matter of time until the government decides that this information is absolutely essential in its efforts in the 'war on terrorism'?

[ebanks84]

06:25 AM on 12/19/2011

But who are the terrorists when it's being used on citizens?

[Busterx4x]

06:56 AM on 12/19/2011

Hopefully, my thoughts on that were clearly implied by my original comment. I think you and I are on the same wavelength.

[guajiro]

07:24 PM on 12/19/2011

This article omits a very important fact; and that is that ATT, BEFORE 9-1-1, already listened in, at the time illegally, to citizens conversations and then later when the legislation was passed the U.S. Patriot Act made it legal for them to do. At this very moment all the major telecoms are monitoring EVERY call in the U.S., so why this was not mentioned is strange to me.
http://en.wikipedia.org/wiki/NSA_warrantless_surveillance_controversy

[bathroomonkey7]

03:14 AM on 12/19/2011

Why would Sprint disable the software? Sounds like they are covering up something. Glad I'm a Verizon user. ;)

[papagroove]

02:03 PM on 12/19/2011

Verizon uses it too...

And sprint is doing it as a stop gap due to pubic outrage.

[guajiro]

08:04 PM on 12/19/2011

I think your "wink-- ; " tells me you know that ALL major telecoms are using equivalent software to listen in on people. After all it's allowed to by the Patriot Act under the Homeland Security Provisions. That these types of legislation was copied practically word for word from Hitler's government is no surprise to me.

[purplemaize]

08:18 PM on 12/18/2011

you can look up your own phone number and your carrier does not own that number Verizon owns all the numbers there is a code next to each set of telphone number. You can also request from a couple of links information where that person lives, conversations anything u like. Dont let your carrier tell u that they own the numbers because the operators or sales person does not know what they are talking about. Find all your information on google. Check it out. That's why it is good to get all your numbers blocked. You need ur privacy, I feel violated... bummer.

[April22]

05:32 PM on 12/18/2011

Don't ya just love the ornate and grandiloquent expressions of justification, of which, I am so sure many understood, let alone read when they signed on.

But then, that's what "they" count on.

[Barb Payne]

05:06 PM on 12/18/2011

Hmm, yet another reason -- in addition to headaches, tumors, and other health effects from the radiation exposure -- to turn the darn thing off except when I truly need it. Gee, what a surprise: the manufacturers and carriers are self-interested. If they don't soon start apologizing to me for hidden truths like this and about the radiation instead of saying "we don't have to make sure you know what we're doing (to you), you're not entitled to an opinion, and you're not allowed to complain so deal with it," they can say b-bye to this subscriber. Isn't it time everybody wakes up to being duped into thinking we rely on them for survival? It's a huger than huge money-making business (again, is this any surprise?). I should pay money to them for exactly what benefit ... zaps of radiation, invasion of privacy, and being given information that "they" say I want? Ahh, not so much.

[ArnoldZiffle]

08:07 PM on 12/18/2011

Sorry to go all conspiratorial on you, but there is evidence that simply "turning off" a cell phone does not stop a number of privacy issues. Do a Wikipedia Search of Cell Phone Tracking and you will discover that GPS tracking works even with the phone turned off.

[Israel4Ever]

04:52 PM on 12/18/2011

We have met big brother and he is us.

[MIKEinNYC]

03:09 PM on 12/18/2011

There probably isn't one Sprint or AT&T customer who knows that she or he consenting to this intrusion.

How about I come up with a secret policy where I bill the carriers for taking information from me and using it for their profit-making purpose. Seems fair.

[King7David]

06:56 PM on 12/18/2011

Tell us how you really Mike.

[robbor]

11:22 AM on 12/19/2011

huh?

[Kojak007]

01:17 PM on 12/18/2011

So is it big government if a corporation uses your phone to track your every physical movement, your every internet movement, your every communication to every person and then turns around and makes it available to the government? Isn't this more of on over reach than say, making health care affordable?

www.currentlychicago.com

[cavegal]

01:01 PM on 12/18/2011

It is impossible in today's society with so many cameras in every neighborhood for a high level of privacy.  We have created our very own big brother state.  Phones are just another way to keep tabs on us as well as through email and our search histories.

[MilesLong]

12:51 PM on 12/18/2011

ANY expectation of privacy in today's world is foolish.

Every single email that is sent in this country is automatically scanned by the government.
Every telephone call into or out of the country is listened in on.

We let this happen...

Miles "Deal With It" Long

[MilesLong]

12:55 PM on 12/18/2011

I forgot to add, AT&T, and every other telco is complicit in eliminating your privacy. Corporate America is just the means with which Big Brother gets things done.

If AT&T is collecting your SMS messages, storing all of your Internet usage, etc, do you really think that information isn't directly transferred to Uncle Sam? {grin}

Miles "Just Sayin'" Long

[cavegal]

12:56 PM on 12/18/2011

I definitely agree that we let this happen.  Who you reward with your hard earned $$ basically says you approve of what they stand for.  Glad I'm with Virgin Mobile!  Best service, awesome plans and great phones for so much less!!

[Danielle Stevenson]

05:50 PM on 12/18/2011

As a fellow Virgin Mobile user, you do know that VM is owned by Sprint, and uses the Sprint Network, right? They are very most likely collecting data on us, too. Sprint also owns Boost Mobile.

[dukeitout]

12:50 PM on 12/18/2011

If you want anonymity don't buy one of these phones and stay off the big social sites. Figure it out people. They make money on your personal information. Just say no to them. When they say "we will keep your information confidential", what they mean is "we reserve the right to distribute it to others" and what are you gonna do about it fella.

[ArnoldZiffle]

08:10 PM on 12/18/2011

But if we do what you suggest, how are we gonna get to see photos of our friends, relatives and coworkers at drunken orgies?

[Karelh]

12:46 PM on 12/18/2011

As if you have a choice if you want to use their product. The only choice is to not use their product, you cannot negotiate the small print in their user agreements, it's take it or leave it...so it's either use a cell phone or not, as all the carriers' user agreements are pretty much all the same. And to call it an agreement is really a stretch, more like a dictate.