Carrier IQ

I don't know if it's the winter that makes people so jumpy, but here comes the second big media spin about a story that is, all things considered, pretty mundane.

Someone (Trevor Eckhart) found the CarrierIQ software installed on Android. An investigation concluded that most smartphones (Android, iPhone, BlackBerry) may carry this software. It is closely tied to the cellular carriers (the Carrier in Carrier IQ), and the phone manufacturers (operating system vendors would be more accurate) merely comply with the carriers' requests by installing CarrierIQ (on closed systems like iPhone and BlackBerry), or it is installed by the carriers themselves (Android). This software reportedly has access very close to the Android kernel, which would give it full access to the system and, according to some people, let it intercept keystrokes. How deeply it is integrated with iOS is less certain… and even less is known on the BlackBerry side.

In the iPhone world, Apple rushed (it's surreal to see Apple rushing to answer the media) to announce that CarrierIQ's presence in iOS5 is marginal and that it is being removed from iOS entirely. The very architecture of iOS suggests that CarrierIQ has access to very little of the system, and according to one analysis (Grant Paul) that is confirmed.

Where it gets surreal is that US senators, European governments and a civil lawsuit are all taking an interest in this issue.

I'm amazed to see people surprised to learn that cellular carriers collect information, among other things to improve their network. It's even more amazing to see people outraged about it. By their very nature, cell phones tell the carrier where we are at all times (triangulation by all the cell towers in a given area), and carriers know very well where their towers are. The content of communications (SMS, calls, Internet) is entirely visible to the carrier. Carriers would have no reason to install software to spy on users, since they can spy on them by analyzing the content of the phone owner's communications, and that's not limited to smartphones. In fact, all carriers, wired and wireless, control the content of their network. All the information and metadata (the contents of the envelope, such as source, destination, timestamps) is available, and even recorded, by the carriers. In some cases, such as content, its retention and interception are governed by laws like the Criminal Code (in Canada at least; I don't know the subtleties of American and European law).

As for the keystroke logging part, it seems the software uses key presses to detect activity on the phone, with the goal of limiting battery usage.

Based on the demonstrations available on the Internet, there is no tangible evidence that sensitive information is sent to the vendor or anyone else. It would be more worthwhile to look at the apps that send your location to their developers. On that front, Android is the biggest culprit… And Apple has made the greatest efforts to limit third parties' ability to collect location information without the user's consent.

The only interesting thing about this smartphone revolution is that it exposes the cellular carriers' operating model to a wide audience. Some aspects may be less clean, and bringing them into the light of day has the advantage of chasing away the less desirable ones.

A few sources, in no particular order:

Now it's Google's turn to condemn Carrier IQ

8 companies hit with lawsuit over Carrier IQ software

European regulators start investigating Carrier IQ

Carrier IQ Admits Holding ‘Treasure Trove’ of Consumer Data, But No Keystrokes