ie8 fix

CarrierIQ: Follow the money and it is the carriers behind it

By | December 1, 2011, 6:37am PST

Summary: CarrierIQ is snooping on many smartphone owners in the U. S., and the carriers are likely paying them to do so.

If you follow the mobile tech news you have heard about the CarrierIQ situation. A smart fellow who knows how to snoop inside the workings of smartphones uncovered a service from CarrierIQ that is recording everything you do on your smartphone and passes that on to somewhere in the cloud. This snooping was shown to cover every aspect of use on CarrierIQ-enabled phones, even recording keystrokes in text messages.

A natural outrage followed the uncovering of CarrierIQ and what it is doing behind our backs, especially given the demonstration that it can’t be disabled by the phone owner. Turning off permission to do snooping doesn’t disable what CarrierIQ is doing on the sly. Carriers have been quick to step up and deny using CarrierIQ on their phones to distance themselves from the uproar.

Carriers know that the class-action lawsuits are no doubt going to be filed shortly by outraged customers. There are meetings no doubt happening in glass towers with attorneys champing at the bit to get filing. Customers don’t like any company snooping on them, and the level CarrierIQ is carrying it is even worse than expected.

The coverage of the CarrierIQ debacle is centered around the app that is recording the information, as if that is the culprit. Fact is this is just the vehicle to deliver a service that the CarrierIQ company sells to carriers. That’s right, carriers pay CarrierIQ to record all of this information to help them troubleshoot network problems that might be caused by individual handset model. It is a legitimate service carried far too deeply. According to experts the recording of text messages may even violate U. S. wiretapping laws. We might see some criminal suits in addition to the civil suits getting ready to fly.

Neither CarrierIQ nor the carriers were willing to talk about this mess, but visiting the CarrierIQ web site clearly details what they do and for whom. Their service is aimed directly at the carriers, and it is obvious they don’t provide it for free. That means every carrier with phones using CarrierIQ, and it sound like many of them in the U. S., have a contract with the company to do the snooping for the troubleshooting. If you follow the money it starts with the carrier, and when proof of this leaks out the lawsuits are going to grow teeth.

Everyone in the loop is quick to point out that this deep level snooping is anonymous and can’t compromise individual privacy. This one statement on the CarrierIQ site tends to differ with that claim (emphasis mine):

What’s more, the combination of the MSIP and IQ Insight lets you move seamlessly from broad trend data across many users, through comparative groups down to diagnostic data from individual devices. Now, not only can you identify trends, you have the power to drill down to specific instances, giving you the insight your specialists need to make a difference. That is the power of Mobile Service Intelligence.

I doubt that any company wanted to actually snoop on its customers. Maybe I am naive but the legal exposure to doing so is not in any company’s interest. I envision the engineers at CarrierIQ deciding to record as much user activity as possible so the carrier’s experts would have it just in case. The carrier’s experts probably don’t realize what all of this information recorded by CarrierIQ is, nor do they even look at it.

Ignorance is no excuse, however, and both CarrierIQ and any carrier using its service are now in deep water. This is not going to blow over, as the level of snooping is just too great and folks are already too outraged. That in turn creates the perfect storm for the lawsuits to begin, and federal agencies to begin investigating this whole situation. Then the carriers paying for the service will turn against CarrierIQ to defend themselves, and it is going to get incestuous and nasty. Like the CarrierIQ service, this will end up being all about money. It usually does.

Kick off your day with ZDNet's daily e-mail newsletter. It's the freshest tech news and opinion, served hot. Get it.

Topics

James Kendrick has been using mobile devices since they weighed 30 pounds, and has been sharing his insights on mobile technology for almost that long.

Disclosure

James Kendrick

James Kendrick has no affiliations or relationships that need to be disclosed.

Biography

James Kendrick

James Kendrick has been using mobile devices since they weighed 30 pounds, and has been sharing his insights on mobile technology for almost that long. Prior to joining ZDNet, James was the Founding Editor of jkOnTheRun, a CNET Top 100 Tech Blog that was acquired by GigaOM in 2008 and is now part of that prestigious tech network. James' writing has appeared in many print publications: Smartphone and Pocket PC Magazine, Information Week and Laptop Magazine to name a few. James' coverage of the mobile technology sector has regularly appeared in the New York Times, Salon.com and CNN/ Fortune online. Not just a writer, James has filmed numerous video reviews and how-tos that have garnered well over a million viewers. He has appeared on local news segments and been interviewed by the Associated Press on mobile technology topics. Additionally, James has been podcasting about mobile technology for years.

45
Comments

Join the conversation!

Just In

RE: CarrierIQ: Follow the money and it is the carriers behind it
daftkey 2nd Dec
@YetAnotherBob

Listening into voice conversations is one thing - and I agree we're not quite there in terms of computing power needed to parse every single conversation that may be going on at a given time.. right now.. Remember, though, this is really only a question of "when" computers become powerful enough, not "if".

As for the other stuff - the stuff that CarrierIQ is ACTUALLY tracking - most people have enough power sitting on their desks to parse through the kind of structured data that is being collected. Texts, emails, passwords, phone numbers, geolocation data, email addresses, web sites, etc. Relatively inexpensive hardware and relatively inexpensive software is all you need to build a data warehouse where you can slice-dice-analyze and mine this data to your hearts content - and still get a frightening level of speed, accuracy and detail.

It is only the sheer volume of the information that would require more expensive hardware, but the tools themselves (including the software - Oracle's off-the-shelf Dataminer would be enough) are readily available and quite cheap, when you're talking about mainly text-based data (and structured data, for that matter).
0 Votes
+ -
"I doubt that any company wanted to actually snoop on its customers."

Then why the strong threats and demands against the reporter when he reported his discovery? Why not just say "yeah, it's there, but its not for snooping it's for support and enhancements" like they're claiming now? Sounds like a cover-up, and there's no need to cover up legit business practices.
@I like coffee.
+a trillion.
@Rama.NET: ... "support and enhancements".

So they decided to cover-up by threatening the guy, rather than try to admit to this severe crime.
@Rama.NET And you still think Google and no one else is snooping? Time to wake up.
@I like coffee. Because the class action lawsuits will cost the carriers millions of dollars in lawyer fees and costs associated with the de rigueur issuance of '$4 off your next phone' coupons to the aggrieved customers.
"I doubt that any company wanted to actually snoop on its customers." YES, you are naive for thinking that. Google has been doing this for years (perhaps not to the level of CarrierIQ) but Google collects too much data in the name of targeted advertising. When did we become so complacent to allow these companies to invade our privacy at will. When did our so-called representatives become pawns for corporations and pushing corporate agendas ahead of what best for America and the American People?

Thomas Jefferson said when the government no longer functions it's time for a revolution. I say that time has come!!
@I like coffee. I agree completely, if they had nothing to hide they wouldnt threaten a lawsuit to try to cover it up.
@I like coffee.

Every Lawyers first impulse is to threaten. If it can be easily squelched without having to actually file anything, they the client wins.

Sometimes it backfires. That's what happened here.
Now you know how the Carriers can find out if you are tethering without a tethering plan. Now you know that the carrier can actually tell if you are actually having problems with your phone. Now you know and guess what. It is nothing new.
0 Votes
+ -
I'd still be interested...
wright_is 1st Dec
To see exactly what information it is sending back home.

The videos I've seen just use USB Debug mode and don't monitor the data sent out "to the cloud" - heck the phone was in Flight mode, when it was supposed to transmitting its data! It is a shame such a tool is spreading this misinformation. I hope somebody who actually knows what they are doing will clarify the situation.
0 Votes
+ -
@wright_is
And it uses my data plan to do that? I want some of that money back!
Phone diagnostics to help get crash reports is fine. The way CarrierIQ implemented this is the worst possible way to do it. This should have been an opt-in software for people with phone issues. If their phone is constantly crashing then enable it for diagnostic data and have it record some information. Take it to the local carrier so they can download the data and analyze. They do not need to record txt messages or browser links. That is just wrong.
@Loverock Davidson- Lovey, this is the first time I've been able to respond to a post of yours w/o calling BS.
Congrats - I knrw you could do it!
0 Votes
+ -
Depending on how this unfolds....
consumerESQ 1st Dec
wright_is is right on point.

Someone should investigate and report what information - if any - is actually leaving the phone.

IF the information in the video is being transmitted to Carrier IQ and the cellular carriers, then the privacy lawsuits will have legs. Carrier IQ will be hit the hardest and may not survive... though the cellular carriers may be most at fault, they will escape the class actions under their mandatory arbitration provisions (you can thank the US supreme court for that).

and the next news story will be the class action lawsuits filed today...
And you have to wonder how much of that data is being shared with 3-letter agencies... AT&T's previous willingness to collaborate with the NSA isn't a good omen.
@roger@...
+5000 and give the man a cigar!
This will allow Congress and it's PIPA and SOPA to hurt everybody.
@roger@...
The "Patriot Act" gives the US Federal Government the right to monitor anything passing over the internet so no "collaboration" is required. I also have to wonder how long it will take divorce attorneys to subpoena message content and GPS tracking data from specific phones.
@Smedley54
The "Patriot Act", is, of course, only US local law. Where does the USA get off monitoring international phone traffic? How bloody arrogant!
0 Votes
+ -
you bet!
pgit 2nd Dec
@roger@... no doubt feeding all this data to the national security state apparatus is the primary use of this information. I bet if you look into the original funding of this "service" you'll find CIA and/or NSA fingerprints all over it. One dead giveaway would be "Sequoia Capital" or John Doer and his cronies. Pure CIA.
@roger@... This would give the intelligence agencies only what they already have. We've know for a decade that the CIA listens to ALL the cell phone calls in the world, except for those in the US. Britain listens in the US, then the US and Britain trade information. They have a couple of supercomputers doing the actual listening, except for cases where they have a clear court order, then it is recorded and a human listens in also.

Russia and China probably have similar systems. It is after all ten year old technology.

The news here isn't the Government, it's that corporations are doing it too.
0 Votes
+ -
it seems Verizon phones don't have this.

I'm wondering if that makes them the only carrier with the foresight to consider:
"Imagine what happens if people discover this breach of privacy, and the potential risk to Verizon when that inevitably happens? Is the benefit worth it?"

I don't have Verizon (unfortunately, from this), but it makes them seem like the smart guys now.

All this negative press and potential legal and fiscal trouble just to try to, what, save a couple bucks by denying what probably amounts to a small number of customers trying to file warranty claims that the carriers might have been able to deny claims on? Not worth it - greed loses out in the end. Thank god for examples like this.
@geolemon Exactly who does have this? I have a T-Mobile MyTouch 4G that tested negative.
0 Votes
+ -
I am so glad that i use cyanogen mod 7 on my phone... CM does NOT include the IQ service...
Often I feel like lawsuits are frivolous, but when the class-action suites get going for this, TELL ME WHERE TO SIGN! I am in the data services industry, so I can understand the purpose and the great benefit of a service like this (as it is described), but the fact that they are knowingly collecting more data than is outlined in their terms, and obviously more than the carriers were aware, just shows a blatant disregard on the side of CarrierIQ for the privacy of consumers, and a complete lack of awareness and responsibility from the carriers for software that they are paying for! I take issues of personal privacy very seriously, and an example NEEDS to be made of this company and the carriers supporting it.

If I were this guy that discovered the IQ service, I would publish the IP address of the CarrierIQ hosts where all this data is getting sent on one of Anonymous' forums... Hacker community, I'm looking at you. Give us some justice like you did with Sony.
0 Votes
+ -
Cool yer jets
Robert Hahn 1st Dec
    knowingly collecting more data... blatant disregard... a complete lack of awareness and responsibility

Do you suppose we could get you to sit on that for 24 or 48 hours while people try to figure out how much of the data we saw in the video actually left the phone? Everybody is going off half-cocked here, when there are huge gaps in the available facts. Let's remember that this is an opportunity for "news" sites to draw clicks and sell ads. Outrage is their stock in trade.

As humans we have the capacity for rational thought. Let's use it, and not be stampeded by people with bullhorns.
0 Votes
+ -
Plus one
use_what_works_4_U 1st Dec
@Robert Hahn
... several hundred times over.

I will sign up with the class actions *if* my privacy has been violated. Having said that, it is too early to make that determination. Just like with the Apple "locationgate" - once the data was analyzed it became apparent that Apple wasn't tracking you, it was tracking tower coverage. Let's get some facts and then decide how to respond.
We know that the carriers work in tandem with intelligence agencies to spy on communications, so is it a huge leap to think that it could be spooks that are really behind this? The NSA or some other agency could strong arm the carriers to include the product, and then either pay them or pay the CarrierIQ directly.

In any case, the spooks no doubt knew of this snooping capability and took advantage of it. But even if lives were somehow saved it would not be worth the trampling of liberties.
0 Votes
+ -
Yes it is a huge leap
use_what_works_4_U 1st Dec
@ceb1970
By virtue of where I live, I know many people who work for several 3 letter agencies. They don't have the resources or the desire to track this kind of data on the scale you are theorizing. If the "spooks" knew about this then we would have seen warrants for such data long ago. Loosen your tinfoil.
@macadam

..to think that a government agency (especially one as heavily funded as the various anti-terrorist organizations in your country are) doesn't have the resources to do what ordinary corporations do every day (and generally with off-the-shelf software) is pretty ridiculous.

In exactly what capacity do your acquaintances work for these agencies? Janitor? Mail-room?
0 Votes
+ -
No it really isn't a leap
ceb1970 2nd Dec
@macadam Sorry, but you sound a bit naive. We actually know for a fact that there was snooping on pretty much all communications in the US, because a telco employee blew the whistle on it. Several members of congress who serve on security advisory committees have also said that the agencies are taking a very broad view on what they are allowed to snoop, and they've blatantly hinted that the snooping is widespread.
0 Votes
+ -
@daftkey.

The government does listen in everywhere. But, the problem is FINDING the information. There are after all close to a billion conversations going on at any one time. The Government uses supercomputers to listen for certain words. But that is still not a truly effective system. Often, they only find out about things after the fact, or they find it through old fashioned investigation, then can confirm it with phone records.

If you live in a country that is allied with the US, or with Russia or China, then your government probably gets the same information from one of these as a 'friendly service'.

If you are a 'person of interest', or if you are accessing sites or calling numbers that are on 'the list', then yes, they will pay closer attention to you, but reality is that most of us are just not worth the effort.
@YetAnotherBob

Listening into voice conversations is one thing - and I agree we're not quite there in terms of computing power needed to parse every single conversation that may be going on at a given time.. right now.. Remember, though, this is really only a question of "when" computers become powerful enough, not "if".

As for the other stuff - the stuff that CarrierIQ is ACTUALLY tracking - most people have enough power sitting on their desks to parse through the kind of structured data that is being collected. Texts, emails, passwords, phone numbers, geolocation data, email addresses, web sites, etc. Relatively inexpensive hardware and relatively inexpensive software is all you need to build a data warehouse where you can slice-dice-analyze and mine this data to your hearts content - and still get a frightening level of speed, accuracy and detail.

It is only the sheer volume of the information that would require more expensive hardware, but the tools themselves (including the software - Oracle's off-the-shelf Dataminer would be enough) are readily available and quite cheap, when you're talking about mainly text-based data (and structured data, for that matter).
Java never had this problem that Android, and IOS are having.
I have an HTC sensation 4G that i flashed back to stock and I couldn't find their software on my phone. I was pleasantly surprised.
0 Votes
+ -
Theft by carriers
ngukurr2 1st Dec
Same old, same old - Apple has been doing this for a while (snooping) - they say as much in their Privacy declaration - now we find pretty well most of the Telcos are doing it. Time for stiff and severe regulation, methinks - thanks for an enlightening article - and they want us to turn our phones into virtual wallets? Yeah, right. Not in Australia, mate, they must have a Kangaroo loose in the top paddock if they think they can pull that stunt here!
This may just go away.
Back in the early 2003 timeframe I attended several Microsoft DoD Summit meetings. At that time Microsoft was going to mandate a death switch in all computers running Windows 7. It was to be used only by compitent watchdogs to control hacking and spamming. If a paticular user was found to be hacking/spamming that motherboard could be killed via incomming software. It was a strong response and had DoD backing. But in the end, legal folks won out and it wasn't incorporated.
So now we have devices recording tons of data and "sending" it off to the "Cloud". The biggest threat in this is that HTTPS data is being colected in native format, not incrypted. That means passwords, usernames etc is going out in plain text.
Sounds like part of Patroit Act data collection to foil terrorists. You never heard it from me, but how eals can Homeland folks track and defeat terrorist acts? Collect the data, use data mining to find key words and you can locate, track and destroy terrorists, hackers, spammers etc. John Q Public has to be exposed to make America Safer. Now you heard the rest of the news.
0 Votes
+ -
It all makes sense now!
tkejlboom 1st Dec
This is how they knew if people were tethering! They want to know if you're accessing music. They want to know if you're streaming video. AT&T has, in every field in which they are represented, deliberately tried to define exactly what you may do with your bandwidth.

Here's an example, you can watch AT&T's IP based TV, U-Verse, 24/7. It's not restricted. However, if you stream from another service, your bandwidth is capped.

Here's another. You can purchase 10GB of data from AT&T, but if you want to tether, you're charged extra, not because laptop bits are larger or have higher priority, but because AT&T wants to maximize profits.
0 Votes
+ -
Questions that need to be answered:

1. What info is leaving the phone? I can understand the broad keystroke collection simply because you can't choose what to leave out and what to send until you know what there is.

2. Is the choice of data being sent out built into the phone? An option filterable by the user? Manipulatable upstream? (That is, can someone send a signal to your phone and modify the filters monitoring what is sent out?)

3. Who gets the data and under what statutes? If it's Homeland Security, then they probably have a broad-sweeping secret warrant that allows the scrutiny. Anyone else, however, and civil rights comes into play. If there are multiple collectors, are they sent the same data as each other or does each player have different filters applied?

4. Can the integrity of the data be compromised? If someone is going to make a judgement about you based on your keystrokes, it had at least better be your keystrokes. Can your "signature" be counterfeited or tapped in some manner that what appears to be your usage is actually someone else's? It used to said that phone numbers could be hijacked like that, so what about keystroke signatures?

5. Are we paying for the data overload? Data size can vary from minimal to immense, given that every keystroke could potentially be sent out. Such delivery could and probably would include duplication of image and sound files and attachments.
Yet another reason why the US model of carrier-subsidized cell phone sales is anti-consumer. I don't think manufacturer-unlocked phones sold outside the US would EVER have issues such as this. It's sad that in 2011 US consumers must still buy handsets that are locked to a particular carrier, or pay several Franklins for an unlocked import.
So how long will it be before someone comes up with a tool that removes CarrierIQ? Anyone working on it?
"Ignorance is no excuse, "
There is a legal term called Mens Rea. IANAL, but basically means if you think that what you are doing is wrong, then it is!
CarrierIQ did *NOT* publish their app. They did *NOT* give the user a specific terms and conditions for their app. They do *NOT* give the user the ability to stop the application. In fact, they secretly hid the application from the user in the hopes that nobody would find it...If what they are doing is on the up and up, why hide? The fact that they saw fit to hide their actions indicates that they are guilty...If you are doing nothing wrong, why hide?
So how do we remove this from our Android phones?
So how do we remove this from our Android phones?
Im glad I'm on the Windows Phone bandwagon... with andriod, apple etc all in this thing, windows phones are the only OS not haing this spying rootkit installed..

Join the conversation!

Formatting +
BB Codes - Note: HTML is not supported in forums
  • [b] Bold [/b]
  • [i] Italic [/i]
  • [u] Underline [/u]
  • [s] Strikethrough [/s]
  • [q] "Quote" [/q]
  • [ol][*] 1. Ordered List [/ol]
  • [ul][*] · Unordered List [/ul]
  • [pre] Preformat [/pre]
  • [quote] "Blockquote" [/quote]
ie8 fix

The best of ZDNet, delivered

ZDNet Newsletters

Get the best of ZDNet delivered straight to your inbox

Facebook Activity

White Papers, Webcasts, & Resources
ie8 fix