The Apple Core

Jason D. O'Grady & David Morgenstern

Apple: We stopped using Carrier IQ in iOS 5

By | December 1, 2011, 6:21pm PST

Summary: Apple washed its hands of the Carriergate scandal today stating that it will remove Carrier IQ completely in a future software update.

Wow, what a debacle. Since I posted my piece late Tuesday about a rootkit called Carrier IQ that was discovered monitoring potentially millions of Android devices, it’s erupted into a bona fide scandal.

AT&T and Sprint have admitted using Carrier IQ and United States Senator Al Franken asked its CEO if it complies with the Computer Fraud and Abuse Act (18 U.S.C. § 1030). Carrier IQ has responded by saying that its software only monitors data related to call quality, battery life, device crashes and that it ignores personal data. Carrier IQ’s Andrew Coward tells AllThingsD:

The software receives a huge amount of information from the operating system… But just because it receives it doesn’t mean that it’s being used to gather intelligence about the user or passed along to the carrier.

The big news is that Apple stopped using Carrier IQ’s software in iOS 5. In an attempt to distance itself from Carriergate, Apple today issued this statement:

We stopped supporting Carrier IQ with iOS 5 in most of our products and will remove it completely in a future software update. With any diagnostic data sent to Apple, customers must actively opt-in to share this information, and if they do, the data is sent in an anonymous and encrypted form and does not include any personal information. We never recorded keystrokes, messages or any other personal information for diagnostic data and have no plans to ever do so.

In addition to walking away from Carrier IQ, Apple’s Diagnostics and usage data settings are strictly opt-in and you don’t need a special piece of software to turn it off.Th e setting and privacy policy are right there in the Settings > General > About > Diagnostics & Usage (pictured above).

ZDNet’s own Zack Whittaker has posted an excellent piece on which phones, networks run Carrier IQ — which is highly recommended reading.

Related:

Kick off your day with ZDNet's daily e-mail newsletter. It's the freshest tech news and opinion, served hot. Get it.

Topics

Jason O'Grady is a journalist and author specializing in mobile technology. He has published six books on Apple and mobile gadgets and his PowerPage blog has been publishing for over 15 years.

Disclosure

Jason D. O'Grady

Jason D. O'Grady is the creator and editor of O'Grady's PowerPage, which has been publishing mobile technology news since 1995. He maintains an advertising relationship with the following legacy advertisers on the PowerPage:

  • Amazon Associates
  • Google Adsense
  • Tekserve
  • Advertising on the PowerPage is brokered by a third-party agency (BackBeat Media) and he recuses himself from these negotiations.

Biography

Jason D. O'Grady

Jason D. O'Grady developed an affinity for Apple computers after using the original Lisa, and this affinity turned into a bona-fide obsession when he got the original 128 KB Macintosh in 1984.

He started writing one of the first Web sites about Apple (O'Grady's PowerPage) in 1995 and is considered to be one of the fathers of blogging. He has been a frequent speaker at the Macworld Expo conference and a member of the conference faculty. He also co-founded the first dedicated PowerBook User Group (PPUG) in the United States.

After winning a major legal battle with Apple in 2006, he set the precedent that independent journalists are entitled to the same protections under the First Amendment as members of the mainstream media.

O'Grady is the author of The Nexus One Pocket Guide, The Droid Pocket Guide, The Google Phone Pocket Guide, and The Garmin nuvi Pocket Guide (Peachpit Press), the author of Corporations That Changed the World: Apple Inc. (Greenwood Press), and a contributor to The Mac Bible (Peachpit Press). In addition, he has contributed to numerous Mac publications over the years, including MacWEEK, Macworld, and MacPower (Japan).

When he's not writing about Apple for ZDNet at The Apple Core, he enjoys spending time with his family in New Jersey.

45
Comments

Join the conversation!

Just In

RE: Apple: We stopped using Carrier IQ in iOS 5
deusexmachina  9th Dec
@warboat

The references to CarrierIQ in OS5 are legacy, and are NOT maintained in the code. In actual use, the primary reference to the /var/wireless/Library/Logs/IQAgent/ folder where most of there files reside has now been replaced by /var/wireless/Library/Logs/awd.
0 Votes
+ -
So they stopped it using in iOS 5? That means every iPhone user - and probably every iPad user- below iOS 5 has Carrier IQ running on their devices, even in this very moment, reading these lines.

Also, it's not opt-in either. It would be opt-in if it wouldn't be on by default. Since it is, it's opt-out. Whether it's Apple or the carrier setting that default doesn't matter in the end and you won't able to tell anyway.
@ff2
Mine always asked me during set up if I want to enable it or not (sending usage data)... the ones that never asked were always off when I went to check, so I'm guessing it is off by default like they say... what makes you think its on by default?
@doh123: ... the information that gathered has nothing to do with real privacy concerns -- no keystrokes, messages or whatever was ever registered.
@doh123 that's simply not true. Even Carrier IQ are only going so far as to say the *CONTENTS* of messages aren't sent. There product says

"Capture a vast array of experience data including screen transitions, BUTTON PRESSES, service....View application and device feature usage, such as camera, music, messaging, browser and TV"

So presumably you will not accept that this is a privacy violation?
@doh123
Asking you to opt out is all fine and good but that doesn't mean that the data cannot be exploited. Next up will be malwares that will turn it on for you even if you opt out. The bottom line is that it shouldn't be there at all. I don't care how harmless people want to tell you it is. You can say the foul smelling guy that twitches uncontrollably is harmless but I ain't sitting next to him.
@ff2 - My 4s also asked me during setup. 'roid fanboys with no actual iPhone experience should "just shut-up and accept the fact that unlike Google, Apple usually gets it right"
0 Votes
+ -
Have you ever used an iPhone?
use_what_works_4_U 2nd Dec
@ guihombre
I had the original iPhone and I had an iPhone 3G. In both cases the phones explicitly asked if I wanted to allow diagnostic data to be sent to Apple. In other words, I had to give it permission in order for them to do anything with my usage data. I never did and I am confident that the data was never sent. If Apple wanted the data to be sent secretly it would have been far simpler never to prompt for permission to do something that (at the time of the original iPhone launch) no one would have known was possible. This is consistent with Apple (and Microsoft) policies and procedures on there computers for *at least* the last decade, if not longer. If you choose to believe they are deceiving you then you are simply twisting the evidence to fit your conspiracy theory.

By contrast, about a year ago ATT finally ticked me off enough that I left the iPhone (which I still regret) for an HTC Evo Shift on Sprint. This phone runs carrier IQ with NO notice other than the suppositions you could make based on Sprint's contract (which does tell you they will gather usage data for the purpose of improving your service experience). If Apple had wanted to gather the data without your knowledge it would have been vastly simpler to follow that route.

Aside from preferring the iOS interface for its simplicity, this is yet another reason why I will go back to the iPhone in a year when my upgrade eligibility returns.
@macadam
so because it asked you for permission you believe that saying no makes you more secure. Does extra TSA agents at the airport make you more secure? Does the extra pat down and security devices make you immune to a terrorist attack? You can say no don't log anything but that doesn't mean someone else can't activate it without asking you. The fact that a simple yes/no can trigger this process means malware writers will be abusing this in high fashion
@macadam
hope you don't use Siri because that spyware data mines for Apple. On top of that it is able to dynamically change it's operation to suit Apple or whoever gets control of your Siri. Hope to hell no malware makes it into the appstore that can abuse it. One of the developers got fired by Apple because he showed he was able to get a piece of malware into the Appstore.
If you think Apple doesn't datamine, they are the subject of lawsuits regarding the datalogging of geodata from iphones.
Malware: it just works!
0 Votes
+ -
@warboat - I've asked for proof of your siri theory a few times with no response from you - therefore I must conclude that you are some sort of ihater troll flinging FUD like a monkey flings poo.
0 Votes
+ -
Siri Exploitation
warboat Updated - 5th Dec
@Pete "athynz" Athens
look up SiriProxy.
hackers have already managed to open up Siri using SiriProxy
It allows you to use Siri to control external devices, but it opens up the possibility to maliciously control the 4S as well. And this was done through a weak CA exploit with non-jailbroken 4S.
It is more than just spying, it means that Apple or any SiriProxy has your iPhone 4S by the balls.

update: oh! now an app has made it into the appstore that interacts with SiriProxy; FASTPDFKIT. If the appstore allows apps to interact with Siriproxy (still not approved by Apple), then I'm afraid Charlie Miller was sooo right. It is only a matter of time before someone makes siriproxy malware.
0 Votes
+ -
@ff2

Apple's realing in an attempt to deceive more consumers..."But we stopped using it at IOS5" So you screwed millions before that and it's supposed to be OK? What's funny is the Apple fanatics will just keep on supporting these clowns and act like this isn't a major issue! It's time to wake up and realize your beloved Apple is as crooked as Google!
0 Votes
+ -
@rob.sharp@...

Do you even bother to read?!? Apparently not, or you would realize that EVERY thing you wrote is complete garbage.
1) The coreservice runs as opt-in. You are EXPLICITLY asked if you want to run it.
2) No one was screwed. No user data was sent. NONE.
3) There is no such word as "realing".
@ff2 My first gen ipad is still not updated to ios 5.0, but when I looked up the above was set at "don't send".
0 Votes
+ -
What about Nokia?
guihombre 1st Dec
Nokia were also claimed to install it. Do we get a denial from Nokia? A claim it was only on Symbian and never ported to Mango? Only S60s? What? Where's the Nokia statement?

Where's the Samsung Statement? I see it's not on my Galaxy S but that doesn't mean it's not on a USA Galaxy S. Where's Samsung's action plan for this? Did they install it? Which versions? What markets? For whom? What's the plan for fixing this? How can users remove this?

Every handset maker should realize this is Phorm again, software that records handset specific data must be recording it per handset, and that means per subscriber. It follows that any 'aggregate' defense will collapse under scrutiny.

Diagnostic software that intercepts URLs? Pull the other one it has ringtones on it.

They can't ride this one out, HTC have blamed the carrier and are investigating ways to remove the software, I don't accept this, they installed the software on behalf of the carrier, they are culpable.

How come all US carriers required it be installed? Is this another NSA domestic snooping thing, where they *paid* carriers to plug into their networks. Is that what this is? Or is it only one or two carriers that required it, error and incompetence rather than the systematic snooping that *every* *US ONLY* carrier requiring it would suggest.
@guihombre
Nokia already said it never used it in their phones.
0 Votes
+ -
@owlnet,
Yeh the other Zdnet article noted it.
To me that makes Nokia phones more attractive and Samsung phones less attractive. I think this helps the Nokia Windows phone quite a bit, they should hammer that point home. I imagine as the months unfold and Carrier IQ details leak, and lawsuits arrive, this story will churn and Nokia can take advantage of that.

I note Wikileaks has a site based on some documents on telecoms snooping tech document they have ( spyfiles dot org ). Some of it seem old, the Amdocs scandal is old news, for example, but there's quite a few companies listed I haven't gone through yet. Carrier IQ aren't listed, yet I sort of expect this to run and run as leaks happen and fingers are pointed.
0 Votes
+ -
RE: Apple: We stopped using Carrier IQ in iOS 5
deusexmachina  Updated - 9th Dec
@guihombre
What on earth are you babbling about. Certainly not CarrierIQ, since it does none of the things you are talking about.
0 Votes
+ -
mountain from molehill
ron.cleaver@... 2nd Dec
must be a slow news day.
0 Votes
+ -
@ron.cleaver@... This third-party has been able to capture EVERY keystroke anyone enters into their Android, Blackberry or Symbian phone -- including usernames, passwords, even encrypted data (since it captures the keystrokes prior to encryption). They could have highly sensitive, individual-specific, personally-identifiable data that can be correlated on 140 MILLION users, allowing them to know virtually everything about them, from their bank accounts (including account numbers, login ids and passwords) to who they call, what web pages they view, emails and texts they send and receive, and much, much more. This is enormously invasive -- and it was done all via covert, hidden apps that couldn't be force-quit, without any warning.

Carrier IQ is now being investigated for possibly violating wire-tapping laws and other violations. If found guilty, they would be guilty of violating the privacy of 140 million (and counting) customers over a span of several years! And the carriers could be right there with them in the hot seat.

I'm no privacy nut, but I hardly think this is a mole hill. This could easily be the broadest, deepest, most widespread violation of individuals' rights to privacy EVER.
0 Votes
+ -
RE: Apple: We stopped using Carrier IQ in iOS 5
deusexmachina  Updated - 9th Dec
@jscott69

Please bother to read the issues involved and at least TRY to know what you are talking about before you post. None of what you wrote is even REMOTELY accurate.
Getting a Win7 phone so I don't care about this at all tbh..
0 Votes
+ -
@DJK2

yeah, thanks for posting that you don't care.

Pity you didn't waste your effort in hitting send to say you can't be bothered by this.

So you'll buy a Win 7 phone and not realise that they like any sensible manufacturer will do some kind of performance use tracking so they can help their customers?

Do you know how many times I have answered opt-in questions about user tracking in windows software in the last 24 hours?

Hint: way more than zero.

So if you think Win really is not being tracked in the same way as an iPhone - think again!!

And thanks for your uninterested honesty, it is refreshing.
0 Votes
+ -
Funny cause it's true:)
James Quinn 2nd Dec
@richardw66

Pagan jim
0 Votes
+ -
?
The most powerful leader of the Free world uses Blackberry,now what?
would it be terribly *cynical* to match that decision's timing to the "discovery" of CarrierIQ on several Apple competitor platforms?
0 Votes
+ -
w
littlepitcher 2nd Dec
Do any smart phone apps, especially OS, use this electronic burglary software? If so, please let us know which ones so we can delete, dispute, or litigate.
0 Votes
+ -
@littlepitcher

Nothing CarrierIQ does is "electronic burglary" and your suit would be laughed out of court.
0 Votes
+ -
"The software receives a huge amount of information from the operating system??? But just because it receives it doesn't mean that it's being used to gather intelligence about the user or passed along to the carrier."

So I guess if I got caught illegally tapping my neighbor's telephone calls I could just explain to the Judge that I didn't do anything wrong at all. My defense could be that I didn't get around to listening to the tapes yet, so no crime was committed! Does anyone feel that would constitute a viable defense? At the base level, this isn't much different. Anyone NOT horrified by an unregulated third party having access to their Online Banking ID and password info needs their morning coffee brewed a bit stronger. (Think disgruntled Carrier IQ employees, or even just garden variety hackers)
Regarding the Opt-in or Opt-out aspect, I suppose I must be just paranoid to think that a company diabolical enough to foist a keystroke logging app. on it's users could have a programming back-door to activate it remotely. I guess I need to learn to be more trusting!
For all our sakes, I sincerely hope Al Franken et al follow through on this, Carrier IQ as well as Apple, AT&T, Sprint and anyone else involved need to be slapped hard and quick (in the form of multi-million $ class action suits) as a warning to others who might be thinking about trying anything like it, Opt-in or not. That includes HTC IQAgent, IQRD, and any others I might have missed.
0 Votes
+ -
@Latro, ergo Sum!

Please at least try to know what the software does before you waste people's time making uninformed comments.

More importantly, since the carrier ALREADY knows ALL of this information, by virtue of the fact that you are using THEIR data network to access this data, your analogy is absurd.
But when are they going to release the update? Also are they release an update to all the other older IOS versions and iPhones or iPads? Also carriers may install CarrierIQ or something similar to "allow better service" so how we will be sure that all of this "service enhancing software" is off our phone. I understand the need for "monitoring software" to get better service but we should be able to opt-in or opt-out as we wish.
0 Votes
+ -
RE: Apple: We stopped using Carrier IQ in iOS 5
deusexmachina  Updated - 9th Dec
@phatkat

Why do you ask questions whose answers are readily available?
Apple has already said they are updating iOS4 to remove CarrierIQ. They planned this prior to any of this. And the software on iOS has ALWAYS been opt in.
more like "we stopped using it as soon as we realized the public was going to find out and the lawsuits are gonna drop"
0 Votes
+ -
@rengek'
More like you have no idea what you are talking about and are an useless troll. Apple stopped using CarrierIQ in iOS5, which has been out for months prior to the uproar about this NON issue.
0 Votes
+ -
"The software receives a huge amount of information from the operating system??? But just because it receives it doesn't mean that it's being used to gather intelligence about the user or passed along to the carrier."

So I guess if I got caught illegally tapping my neighbor's telephone calls I could just explain to the Judge that I didn't do anything wrong at all. My defense would be that I didn't get around to listening to the tapes yet, so no crime was committed! Does anyone feel that would constitute a viable defense? At the base level, this isn't much different. Anyone NOT horrified by an unregulated third party having access to their Online Banking ID and password info needs their morning coffee brewed a bit stronger. (Think disgruntled Carrier IQ employees, or even just garden variety hackers)
Regarding the Opt-in or Opt-out aspect, I suppose I must be just paranoid to think that a company diabolical enough to foist a keystroke logging app. on it's users could have a programming back-door to activate it remotely. I guess I need to learn to be more trusting!
For all our sakes, I sincerely hope Al Franken et al follow through on this, Carrier IQ as well as Apple, AT&T, Sprint and anyone else involved need to be slapped hard and quick (in the form of multi-million $ class action suits) as a warning to others who might be thinking about trying anything like it, Opt-in or not. That includes HTC IQAgent, IQRD, and any others I might have missed.
0 Votes
+ -
BLAME APPLE!
warboat Updated - 2nd Dec
'We stopped supporting Carrier IQ with iOS 5 in most of our products and will remove it completely in a future software update.'

read that statement carefully!
if they stopped using it in iOS5 why do they need to remove it completely in future updates?
if iOS5 does not contain CIQ, why don't they say iOS5 does not use CIQ instead of this PR spin of "stopped supporting"?
read it as: "iOS5 contains CIQ, but since most users opt out, we can technically claim we stopped supporting CIQ in most of our products"
Apple is back pedalling HARD.
If it wasn't for Apple supporting CIQ in the first place, maybe CIQ development wouldn't have taken off and be accepted by other phone makers. Apple has admitted to using CIQ, and under the misguise of "LOCATION SERVICES".

Apple set the standard here and the others followed.
If this was a good feature, Apple & fanboys would be claiming Apple invented it.
If you think Apple is not capable of logging all this information, bear in mind they have budgetted at least 5gb for each iOS device just for iCloud. Siri is also cloud based, great datalogging right there! Will Apple come out and deny Siri does not profile user data by logging?
Forget about CIQ. Siri is the best spyware around and that is not going away.
0 Votes
+ -
@warboat

Really?!? Are you really THAT dumb?
First, there is no need to speculate. CarrierIQ a service that the OEMs and carriers PAY FOR. Apple stopped doing so with iOS5. Second, it is not magic. It is code. You can easily verify that that code DOES NOT EXIST in iOS5.
Third, the "remove it completely in a future software update" is about iOS4.
Fourth. It is not a "guise". Location services and diagnostic info is EXACTLY what CarrierIQ IS.

You simply hav no clue what you are talking about.
0 Votes
+ -
CIQ code EXISTS in iOS5
warboat Updated - 6th Dec
@deusexmachina
"...First, there is no need to speculate. CarrierIQ a service that the OEMs and carriers PAY FOR. Apple stopped doing so with iOS5. Second, it is not magic. It is code. You can easily verify that that code DOES NOT EXIST in iOS5..."

Exactly how do you do that?


Carrier IQ exists in iOS5. Whether it operates as before or not is questionable.
The references to CIQ are certainly there in iOS5.
I'm not making it up!
Search the iOS5 firmware for IP4 and you will find the following:
/var/wireless/Library/Logs/IQAgent/
/tmp/com.apple.iqagent.server
N22CIQAgentImplementation13AgentTaskListE
N21CIQForthMetricFilters18ForthMetricHandlerE
30CIQTransactionElementOperators
9CIQObject
16CIQByteStreamOut
15CIQByteStreamIn
18CIQPacketStreamOut
14CIQListElement
16CIQMetricHandler
26CIQKeycodeElementOperators
19CIQElementOperators
27CIQTransactionNetworkLookup
17CIQTargetSocketIf
collector.sky.carrieriq.com:7001/collector/c?cm_sl=5
N20CIQConnectionManager28CIQTransactionNetworkHoldoffE
N20CIQConnectionManager26HoldoffTransactionCallbackE
11CIQCallback
18CIQTargetNetworkIf
27CIQTransactionNetworkStatus
30CIQTransactionNetworkOpenClose
N9IQNetwork15NetworkCallbackE
28CIQUploadTransactionProvider
N13CIQUploadHttp32NetworkLookupTransactionCallbackE
26CIQSocketSecureTransaction
27CIQSocketReceiveTransaction
24CIQSocketSendTransaction
20CIQSocketTransaction
N9CIQSocket25SocketTransactionCallbackE
15CIQTargetFileIf
N14IQ_HttpRequest19StreamSocketHandlerE
18CIQ_ISocketHandler
32CIQMetricArchiveCompressedWriter
22CIQMetricArchiveWriter

OK, that's just SOME of the references to CIQ in iOS5 firmware. The list of CIQ references runs into triple figures. If CIQ doesn't exist in iOS5, what is all this doing in the firmware?
The references about removing it completely is talking about removing CIQ from iOS5, not iOS4.
Like I said, Apple PR spin to distance itself from the heat and the iSheep read "stopped supporting" as though it doesn't exist in iOS5. Maybe it's not activated by default, and this technicality is enough for Apple to claim they don't support it on most of their devices. Apple is back pedalling, no doubt about it.
0 Votes
+ -
@warboat

The references to CarrierIQ in OS5 are legacy, and are NOT maintained in the code. In actual use, the primary reference to the /var/wireless/Library/Logs/IQAgent/ folder where most of there files reside has now been replaced by /var/wireless/Library/Logs/awd.
0 Votes
+ -
Watergate was nearly 40yrs ago. Isn't it about time journo's came up with something new or original, rather than bringing out the dead "gate" horse to flog yet again.?
"gate" this or, "gate" that has gotten to the point of being totally ludicrous. I mean, seriously, how many people even remember Watergate or, (probably for a large number of this site's readers) were even born when it happened?
What is it with you Americans and adding "gate" to whatever issue it at hand? Us Aussies can barely remember Nixon...how many of you Americans reading this article remember him either? Please, can you be a little more imaginative when it comes to naming any future controversies?
0 Votes
+ -
@Jason D. O'Grady

You ought to be ashamed of yourself.
This piece is so full of inaccurate information, and outright lies, as well as blatant fear mongering, that it borders on criminal. It certainly does NOT qualify as responsible journalism.
First, NOTHING in the CarrierIQ service can even REMOTELY be defined as a rootkit. Do you even know what the word means?!? Clearly you do not.
The word means software that allows on demand privileged escalation on a computer, doing so while employing subterfuge to disguise its presence from administrators, often by bypassing or subverting standard operating system functionality.
in NO way, shape or form is that what it going on here.

Second, Apple did not "was their hands of this today", implying that they did so under pressure due to this faux "scandal." The move to stop using CarrierIQ was made over a year ago. Your implications to the contrary are simply flat out lies.

Lastly, considering that Zack Whittaker can not write two consecutive sentences that are free from grammar, spelling, usage, or logical errors (this is not an exaggeration. He often writes pieces where EVERY sentence is grammatically incorrect) there is no way to classify anything he writes as "excellent".
0 Votes
+ -
welcome to Siri
warboat 6th Dec
@deusexmachina????
"First, NOTHING in the CarrierIQ service can even REMOTELY be defined as a rootkit. Do you even know what the word means?!? Clearly you do not.
The word means software that allows on demand privileged escalation on a computer, doing so while employing subterfuge to disguise its presence from administrators, often by bypassing or subverting standard operating system functionality."

Forget about CIQ, Siri can do all this and more
0 Votes
+ -
@warboat

Which is an even DUMBER statement.

Join the conversation!

Formatting +
BB Codes - Note: HTML is not supported in forums
  • [b] Bold [/b]
  • [i] Italic [/i]
  • [u] Underline [/u]
  • [s] Strikethrough [/s]
  • [q] "Quote" [/q]
  • [ol][*] 1. Ordered List [/ol]
  • [ul][*] · Unordered List [/ul]
  • [pre] Preformat [/pre]
  • [quote] "Blockquote" [/quote]
ie8 fix

The best of ZDNet, delivered

ZDNet Newsletters

Get the best of ZDNet delivered straight to your inbox

Facebook Activity

White Papers, Webcasts, & Resources
ie8 fix
ie8 fix