Between the Lines

Larry Dignan, Andrew Nusca and Rachel King

Senator demands answers over Carrier IQ mobile phone tracking

By | December 1, 2011, 10:41am PST

Summary: Sen. Al Franken, who was instrumental in bringing location privacy legislation after this year’s “Locationgate” scandal, is seeking answers after mobile phone software was used to track users’ location and collect personal data.

The backlash over phone-tracking firm CarrierIQ has snowballed to Washington, as members of the Senate are demanding answers to discover exactly what the software records.

Senator Al Franken is specifically asking whether the data is transmitted back to the developer company, or handed over to third-parties, and whether the privacy rights of American consumers has been violated.

It would make the location-tracking data ‘bug’ earlier this year look like a raindrop in an ocean.

Earlier this week, a video showed how software embedded in many mobile phone manufacturers’ software, including iPhones and Android devices, collects keystrokes, location, and other deeply personal information of its users.

The furore has angered many consumers, after it was found that the software, deeply embedded within the software of the world’s most popular mobile phone operating systems, was collecting information not limited to:

  • when they turn their phones on;
  • when they turn their phones off;
  • the phone numbers they dial;
  • the contents of text messages they receive;
  • the URLs of the websites they visit; the contents of their online search queries — even when those searches are encrypted;
  • and the location of the customer using the smartphone — even when the customer has expressly denied permission for an app that is currently running to access his or her location.

With the risk that it could have violated federal wiretapping laws, and given the fact that Carrier IQ, the developer of the software, has mysteriously gone silent, Sen. Franken demands to know what, how, and why.

Franken sent an open letter to the company’s president and chief executive Larry Lenhart, with a list of questions about what the company does, and how it conducts itself.

In a statement on his senate.gov website, Franken said:

“Consumers need to know that their safety and privacy are being protected by the companies they trust with their sensitive information.

The revelation that the locations and other sensitive data of millions of Americans are being secretly recorded and possibly transmitted is deeply troubling. This news underscores the need for Congress to act swiftly to protect the location information and private, sensitive information of consumers.

But right now, Carrier IQ has a lot of questions to answer”.

Earlier this year, the Senate introduced the Location Privacy Protection Act, which would oblige companies such as Carrier IQ to obtain explicit permission from its unwitting customers before tracking their location, or sharing such information with third parties.

ZDNet columnist James Kendrick says that mobile carriers will be aware that class-action suits are “no doubt going to be filed shortly by outraged customers”, he foresees that some criminal suits in addition to civil suits could “getting ready to fly”.

The full text of his letter can be found here [PDF].

Related:

Kick off your day with ZDNet's daily e-mail newsletter. It's the freshest tech news and opinion, served hot. Get it.

Topics

Zack Whittaker, a criminologist who studied at the University of Kent, Canterbury, is a journalist, writer and broadcaster.

Disclosure

Zack Whittaker

I worked briefly with Microsoft UK in 2006 but no longer have any connection with the company. Regardless, I remain impartial and unbiased in my views.

I don't hold any stock or shares, investments or industrial secrets in any company, but have signed confidentiality agreements with a number of UK and U.S. organisations, whose names I am not at liberty to disclose.

I was involved with Kent Union, the University of Kent's student union, undertaking voluntary, non-salaried, elected positions between early 2009 and mid-2010.

No other company, body, government department, non-governmental organisation or third sector organisation employs me or pays me a salary in any capacity whatsoever.

As a freelance journalist, whenever expenses are given and taken by a company that is not CBS Interactive, these will be disclosed in each relevant post to ensure transparency.

I currently work with a UK law enforcement unit, but this is an entirely separate position which bears no connection to other work.

(Updated: 23rd October 2011)

Biography

Zack Whittaker

Zack Whittaker, criminologist who studied at the University of Kent, UK, is a journalist, writer and broadcaster.

After studying criminology at university, though still in his early-20's, he has already had a series unconventional work and voluntary positions. He has worked with researchers studying neurological illnesses like Tourette's syndrome (which he suffers from), has given lectures on the nature of disabilities in the public community, and occasionally ends up speaking on television and radio discussing the events of the day.

He first had academic work published at the age of 22, then still an undergraduate, and has been cited by a wide range of publications: from CNN, the Huffington Post, AllThingsDigital, The Atlantic Wire and CBS News.

Related Discussions on TechRepublic

Did you know you can take part in these discussions with your ZDNet membership?
15
Comments

Join the conversation!

Just In

RE: Senator demands answers over Carrier IQ mobile phone tracking
88Fan 7th Dec
My question is still privacy related, but more on the legal compliance side... How many phones or devices with CarrierIQ are in hospitals being used by staff to transmit PHI (Protected/Private Health Information) to central servers. My thoughts on this are now in line with the idea that any device with CIQ on it results in the need to report to USHHS/OCR a breach of privacy and security caused by a third party. Quite possibly the same for other privacy regulations, how does this affect Sarbanes-Oxley? I see a lot of problems popping up for anyone that has allowed "bring your own device" to flourish in any company. Until devices are able to be completely imaged and controlled by corporate IT depts, they have no business in business.
When you state that "deeply embedded within the software of the world???s most popular mobile phone operating systems" I think you are misinforming your readers.
Does Linus Torvalds know this is in the Kernel. Of course not because it is not. this is vendor added not part of the system. If CarrierIQ created the software then I doubt that Google's Android nor Apple's I OS has it deeply embedded in the "Operating System" Place the blame on the carriers where it belongs.
@phil9x It isn't embedded in the OS, but it certainly is of "rootkit" level where it can record everything prior to Apps or OS handling things.
@phil9x

No, I disagree...Apple and Google made the OS. They have control of what can and can't be done by the carriers or 3rd party vendors. Microsoft Windows Phone DOES NOT HAVE THIS ISSUE! That's because MS has greater control over its OS! Google's Android is an OS nightmare....so many flavors and versions in the last 3 years it will make your head spin but that's what you'd expect from a company that launches Beta products at best. They have to keep on tweaking the crap because it wasn't ready from day 1! Apple is just Apple and thinks it's untouchable! I remember when MS thought the same way and it blew up in their face! This is the sort of crap that should have consumers outgraged! Don't protect Google or Apple because you were foolish and bought into their hype! Own up to it, post your phone on ebay and make the move to Windows Phone!
I want to know if OEMs knew of this behavior before hand.
@Cylon Centurion They did, because the carriers requested that they install the software on handsets for their service.

The European Androids I've looked at, both carrier branded and unbranded, don't have the software installed.
0 Votes
+ -
Pot. Grill. Kettle.
Robert Hahn 1st Dec
I want to know if I'm the only one laughing out loud at the prospect of U.S. Government officials coming to rescue us from invasions of privacy.
0 Votes
+ -
Of course...
John L. Ries Updated - 1st Dec
@Robert Hahn
...because enlightened captains of industry focused solely on profit understand that betraying the interests of the customers who pay them will result in instant bankruptcy, unless they don't get caught, most customers don't understand the issue, or all of the other vendors are doing exactly the same thing.
0 Votes
+ -
RE: Pot. Grill. Kettle.
GregGold 1st Dec
@Robert Hahn

Nope...you are definitely not the only one. Pitiful, isn't it.
@Robert Hahn
Senators have smart phones too and they probably have more reason than most to keep what is on them private...
Don't worry the Stupidlicans will defend the carriers right to your personal info...especially if they are sharing it with the government whenever asked... After all it's business...it creates jobs
0 Votes
+ -
Pretty stupid...
adornoe@... 1st Dec
"Don't worry the Stupidlicans will defend the carriers right to your personal info...""

Yet, it's the democrats who benefit the most by spying on the habits and data of all Americans, for, they are the ones who want to control everything people do, from cradle to grave. It's the communism which is inherent in their progressive, aka: communist, ideology.

Wake up and learn the facts.
0 Votes
+ -
Privacy is scarce
sboverie 1st Dec
Privacy is scarce but it is still important. This is more than data gathering for use by a vendor or cell carrier; I would be interested in knowing if a tabloid reporter can access this information or if a sex predator can intercept information to stalk a victim. I do not find it acceptable for my phone to be used against me for non legal purposes.
In a related story, the price of "dumb" phones that are 10 years old has just skyrocketed.
My question is still privacy related, but more on the legal compliance side... How many phones or devices with CarrierIQ are in hospitals being used by staff to transmit PHI (Protected/Private Health Information) to central servers. My thoughts on this are now in line with the idea that any device with CIQ on it results in the need to report to USHHS/OCR a breach of privacy and security caused by a third party. Quite possibly the same for other privacy regulations, how does this affect Sarbanes-Oxley? I see a lot of problems popping up for anyone that has allowed "bring your own device" to flourish in any company. Until devices are able to be completely imaged and controlled by corporate IT depts, they have no business in business.

Join the conversation!

Formatting +
BB Codes - Note: HTML is not supported in forums
  • [b] Bold [/b]
  • [i] Italic [/i]
  • [u] Underline [/u]
  • [s] Strikethrough [/s]
  • [q] "Quote" [/q]
  • [ol][*] 1. Ordered List [/ol]
  • [ul][*] · Unordered List [/ul]
  • [pre] Preformat [/pre]
  • [quote] "Blockquote" [/quote]
ie8 fix

The best of ZDNet, delivered

ZDNet Newsletters

Get the best of ZDNet delivered straight to your inbox

Facebook Activity

White Papers, Webcasts, & Resources
ie8 fix