First off, Carrier IQ can deny any involvement with federal authorities with impunity, since they have specific instructions to do so. This is true of any government contractor who is engaged in "sensitive or secret aspects" of government affairs as described by 32 C.F.R. 2001 and Executive Order 13526.
But the more important thing to understand is that there are several different agreements with the telecoms and the Feds, many of them started under the CALEA act and extended through the Patriot Act and other national security legislation. The US government actually subsidizes some of these tools, although it never quite shows up that way on the books.
But to me the issue wasn't really about government monitoring, since I've been aware of different methods of doing it for many years. It is the issue that Carrier IQ uses fairly insecure systems that could expose the data to hackers or others who intend to use passwords and account numbers for fraud and identity theft.
A Freedom of Information Act request submitted by MuckRock to the FBI regarding Carrier IQ results in an interesting twist.
The request to the Federal Bureau of Investigation was made for “manuals, documents or other written guidance used to access or analyze data gathered by programs developed or deployed by Carrier IQ.” The FBI refused, quoting exemption 7(A):
… records or information compiled for law enforcement purposes, but only to the extent that production of such law enforcement records or information . . . could reasonably be expected to interfere with enforcement proceedings.
Three possibilities come from this:
- The G Men already use information collected by Carrier IQ (an activity which Carrier IQ itself vigorously denies any involvement in)
- The Feds realize that there might be a treasure trove of information here, and are planning to make use of it
- Carrier IQ itself is under investigation
This is MuckRock’s take on the matter:
What is still unclear is whether the FBI used Carrier IQ’s software in its own investigations, whether it is currently investigating Carrier IQ, or whether it is some combination of both - not unlikely given the recent uproar over the practice coupled with the U.S. intelligence communities reliance on third-party vendors. The response would seem to indicate at least the former, since the request was specifically for documents related directly to accessing and analyzing Carrier IQ data.
Whatever the reason for the refusal, it is bound to add more fuel to the argument that collecting information without user opt-in raises some serious privacy concerns.
Related:
- So, there’s a rootkit hidden in millions of cellphones
- Carrier IQ patent outlines keylogging and ability to target individual devices
- Android bloatware results in serious security flaws
- Check your Android handset for Carrier IQ rootkit
- How to disable the Carrier IQ ‘rootkit’ on your iPhone
- CarrierIQ: Follow the money and it is the carriers behind it
- Finding and cleaning out your smartphone’s Carrier IQ poison
- Which phones, networks run Carrier IQ mobile tracking software?
