The findings of a Connecticut-based systems administrator have sparked alarm in millions of smartphone users, after security researcher Trevor Eckhart published a video showing how a cellphone software company has the ability to log users’ Web searches and keystrokes.

The technology, made by Carrier IQ, is currently deployed on more than 150 million devices worldwide.

Research In Motion and HTC — the maker of the phone targeted in the security demo — have issued statements denying that Carrier IQ is preinstalled on their devices. Meanwhile, U.S. Sen. Al Franken (D-Minn.) has sent a letter to Carrier IQ seeking more information on what the software does.

Carrier IQ has told AllThingsD that while its software has the ability to receive a tremendous amount of information, some of which could be relayed to a carrier for diagnostics purposes, the company doesn’t log keystrokes and the software is not being used to gather intelligence about the phone’s user.

But while we wait for more answers, what’s a smartphone user to do?

Google Android Phones: If you’re wondering whether your Google Android phone might have Carrier IQ installed on it, Eckhart, the researcher behind all of this, points people to a Logging Test app that he claims can be used to verify “what logging is being done on your phone and where the data is going to.” If successfully installed — which we hear may take some finagling, including emailing the app link to yourself to access it, and “rooting” your phone first — the $1 app is meant to detect Carrier IQ and remove it.

According to his blog post, Eckhart has tested this app on the HTC Evo 3D phone; he believes it works on the Sprint Evo 4G and HTC Thunderbolt, as well.

But since the Google Android operating system runs on devices from multiple manufacturers, it is not known at this point which models could be running Carrier IQ and which ones are not.

It should be noted that some manufacturers have denied responsibility for the app; HTC, for example, has put the blame on wireless carriers, and basically advises HTC phone owners to contact their carriers. The company did add it was looking into an option for allowing its customers to opt out of the Carrier IQ application, but no further details were given beyond that.

Sprint has not yet responded to my inquiry as to whether the wireless company was actively involved in the installation of Carrier IQ, or how users might disable such applications on Sprint. AT&T said it uses Carrier IQ solely to improve its network performance; Verizon claims not to use it at all, although my colleague John Paczkowski reports that may not be the case.

RIM BlackBerrys: While RIM hasn’t explicitly pointed to wireless carriers as HTC did, the BlackBerry maker also denies any involvement with Carrier IQ, stating “RIM does not pre-install the CarrierIQ app on BlackBerry smartphones or authorize its carrier partners to install the CarrierIQ app before sales or distribution.”

However, the next part of RIM’s statement on the BlackBerry developers forum indicates that it’s possible Carrier IQ could live on a BlackBerry device.

According to BlackBerry Development Advisor Mark Sohm: “If the Carrier IQ application is present on a BlackBerry smartphone, it does not mean that the Carrier IQ application has ‘hacked’ the BlackBerry platform. It means that either the BlackBerry smartphone user or the user’s BlackBerry Enterprise Server admin explicitly installed the application and authorized it to run.”

In other words, if it’s on your phone, you may have granted it access in some way, shape, form or click of your Qwerty keypad.

Apple iPhones: Apple has issued a statement to AllThingsD declaring that the company stopped supporting Carrier IQ with iOS 5, its latest version of mobile software, and plans to remove it from future mobile software updates, too.

But what if you’re running an earlier version of iOS on your iPhone and are worried about where your data is going? Apparently, you can opt out of having your usage data submitted for diagnostics. To do that, go to to Settings → General → About → Diagnostics & Usage. Select “Don’t Send.”

More info to come as I get it.

Related Posts on Carrier IQ:

• Exclusive Interview: Carrier IQ Gets Transparent About Its Mobile Monitoring
• Carrier IQ: How to Hack Back Your Phone
  
• Carrier IQ Speaks: Our Software Monitors Service Messages, Ignores Other Data
• Apple: We Stopped Supporting Carrier IQ With iOS 5
• RIM, HTC, Google on Carrier IQ: Blame the Carriers
• Carrier IQ Improves My Wireless Service by Logging My Keystrokes? Please Explain.

Full Carrier IQ Coverage »

Ready, aim, fire — at Google at the Senate Judiciary Committee’s antitrust subcommittee hearing happening right now in Washington, D.C.

It is titled: “The Power of Google: Serving Consumers or Threatening Competition?”

Here we go:

11:04 am: As usual in D.C., the Senators on the committee get to pontificate first.

Oh, joy! (I used to live there and cover Congress stuff for the Washington Post from time to time and I am having bad déjà vu right now.)

A quick cut to Google Executive Chairman Eric Schmidt, who is appearing alone. He looks a little peaked, especially as the pols begin to describe the scary behemoth the search giant is.

And also that it is trying to force users to its other products.

Rut-roh.

11:07 am: Sen. Mike Lee, the Republican from Utah, who is a Google critic, is talking on about the search giant’s power, reading from his testimony in a dullish style.

I thought this dude was a Tea Party firebrand!

“The primary focus should be consumer welfare,” he says, blah, blah, blaaaaaaah.

11:09 am: Now, the subcommittee’s dour chairman, Sen. Herb Kohl from Wisconsin, is introing Schmidt, who is actually being introed by California Sen. Dianne Feinstein.

She is an Eric fan, obvi, praising his accomplishments at Google. But she also gives props to Jeffrey Katz, CEO of Nextag, who is testifying against Google later. Also, let her add, is the fabulous CEO of Yelp, Jeremy Stoppelman, another anti-Google speaker to come.

“I hope they tango rather than tangle,” says Feinstein inexplicably about those called to testify. Hey, white geeks can’t dance, although wrestling would also be hard for them too.

In any case, gotta love these everybody-loving pols!

11:14 am: Finally, Schmidt, who — of course — starts off invoking the last big tech giant who was here getting spanked by Congress.

Schmidt does not name Microsoft — classy, by which I mean not at all — but is referring to the software giant.

“We get it,” he says about the lessons Google has learned from Microsoft’s own antitrust troubles back in the day.

11:18 am: Schmidt is talking about Google and saying he welcomes the competition.

“Today it’s Google turn in the spotlight,” he says, still not uttering the word “Microsoft,” much as Microsoft execs have often not been able to say Google. “One company’s past [should] not be another company’s future.”

Now, the senators can have at him. Kohl is up first.

11:20 am: The first question is if Google is favoring its own products, via search.

Schmidt harkens back to what he calls early Google lore that it is just trying hard to get consumers stuff quicker.

The need for speed!

“Is really trusting Google to do the right thing sufficient?,” asks Kohl, who quotes former President Ronald Reagan’s famous line: “Trust but verify.”

That gives Schmidt the chance to talk about how quickly Google could lose out to competitors and then is onto how hard it is to do what Google does.

It takes extra-smart smartypants. Trust us, he says, as we are smartier!

11:24 am: Kohl comes back with a damning quote from Google’s famous Marissa Mayer, who apparently has said that the company favors its own products and why not?

Schmidt says he was not there when she allegedly said this, but that its own testing and intuition tells Google if consumers want a Google map or whatever tout de suite!

Kohl repeats the Mayer quote again: “We do all the work for the search page, so we put [a Google Maps link] in first.”

“I will let Marissa speak for herself,” says Schmidt, now too deep in the weeds of her verbal faux pas. Get out, Eric!

11:28 am: Sen. Lee is up, not taking any of this speedy, we-know-best business.

And he has a chart! I love a good chart. It shows Google info always ranks first in listings versus other sites it competes with.

Schmidt has not seen this poll, but thinks it is not accurate.

11:31 am: Let me note that Schmidt’s grey suit is fantastic looking. And right behind him, you can see Google’s top lawyer, the always nattily dressed David Drummond.

Back to the chart!

Lee wants to know why, according to his chart, that Google seems to come up first.

“Either way, you’ve cooked it,” claims Lee.

“Senator, I can assure you we have not cooked anything,” counters Schmidt.

(Note: Google does have an excellent cafeteria in Silicon Valley, complete with organic arugula and Kombucha for all.)

11:33 am: Hoo boy! But Lee’s time has expired, so Schmidt gets a break in the form of New York’s Sen. Charles Schumer.

I like the way he says “ee-no-vation” for innovation.

He does an expected plug for New York, of course. Somehow it is No. 1 in tech. Not so much, but brag on, Chuck!

11:38 am: Schumer is still talking about New York and its fab entrepreneurs.

Apparently, he has done a lot of jawboning with start-up dudes (likely over Kombucha) and they think Google is a positive force.

“Google is actually pretty good, we don’t see them as rapacious,” Schumer says the New York nerds tell him.

Is “rapacious” the criteria here?

Schumer is running out of time and has yet to ask a question and now is trying to get Schmidt to test Google’s broadband project in the Hudson Valley.

Now that’s rapacious!

Is there going to be an actual question here?

Yes: Oh please tell us, genius boy, what could Google do better?

Really.

11:42 am: Now, Sen. John Cornyn from Texas is on and asking about the prescription controversy Google was embroiled in recently.

Oops, I missed a bit when someone called me about the CEO mess at Hewlett-Packard I reported on earlier.

Onto Senator Amy Klobuchar from Minnesota. She is cleverly using an article about the Vikings football team to ask about how Google’s super-secret-sauce algorithm works and how it ranks results.

“Do you think companies should have a lot more certainty in how they are ranked?,” she asks.

11:51 am: Schmidt is not really answering, except to say Google is not perfect.

“We don’t know how to do it with more certainty,” he says, which is odd for a company that is perhaps the most irksomely certain group of geeks ever assembled on the planet.

Klobuchar moves to copyright issues. “There’s a real problem here,” agrees Schmidt.

Yes, and some media companies think Google is the problem and has not done enough to fix the problem.

“It’s difficult,” says Schmidt. Well, isn’t Google smartier?

“We’re under great pressure to resolve this,” he says.

11:55 am: Klobuchar is still worried about the small businesses, but she wants Google to come to Duluth.

Good lord, it’s a shakedown in plain sight. Maybe Google isn’t the scary one here! These pols seem pretty frightening.

Now Iowa Sen. Charles Grassley is saying he will attend some Google event in his state.

Of course!

Grassley makes a wishy-wishy statement, and we get to hear from Iowans on both sides.

Some are apparently concerned that Google is a troublemaker and some aren’t.

Iowans, like a lot of folks, are torn.

“We are happy to be judged,” says Schmidt.

12:00 pm: Now it is time for Sen. Al Franken from Minnesota.

“First let me say, I love Google,” he says.

Otay. I wonder if Franken knows that Google is a giant scary computer.

But, as a citizen of San Francisco, I say he should love whoever he wants!

Franken is also concerned about his love’s behavior and is taken aback by one of Schmidt’s previous answers.

It’s that irksome Marissa Mayer quote again.

When asked if the algo was unbiased, Schmidt apparently was not as sure as shootin’!

Now, it is onto Yelp and the fiery quotes from Stoppelman about how Google nefariously blocks the review site’s content.

Eric “generally” disagrees with Jeremy.

At one point Google tried to buy Yelp, so this is a fraught situation.

Does Franken know about the previous Google-Yelp hookup?

Drama!

Schmidt says it is Yelp’s fault for asking to be removed from the algo. Actually, Yelp only asked Google to stop jacking its fare.

12:11 pm: Oh noz, another pol? This time Sen. Richard Blumenthal from Connecticut.

He is super-smiley, while calling Google a “behemoth.” I like that word a lot and use it for the company often, although I always like to use a qualifier like “thuggish” or “freaky.”

Back to the blabby Blumenthal, who cannot seem to get out a question.

Wait! He asks if Google can suggest some fixes to “avoid government regulation.”

I. Kid. You. Not.

12:21 pm: Kohl is back and giving Google a little more slap-a-doo.

I like the whole Kohl thang of looking over his glasses down at Schmidt.

He asks: Should we trust Google? Should we?

In my opinion: If your mother says she loves you, you should check it.

So, no!

Schmidt assures him: “We make mistakes.”

Lee is then back, asking if Google gives preference to its own products in search?

Exactly the point and a question that is still not answered properly.

12:24 pm: Lee remains troubled by Schmidt’s testimony.

He uses terms like “leverage its natural dominance” and “significant market share to disadvantage” competitors.

Sounds like, um, Microsoft. And then it is back to that niggling Marissa Mayer quote. (Memo to the voluble exec, who apparently never met a microphone she didn’t want to talk into: You might want to take a day off today at the Googleplex.)

Google-luvin’ Franken is back and he is asking about mobile search.

Where Google is dominant again! (Jellllllo, Al, we in Silicon Valley know that one already!)

He asks if all Android devices come pre-loaded with Google products. Schmidt thinks two-thirds come with it, but handset makers can choose.

12:31 pm: Back to all-smiles Blumenthal, who says he has come to no conclusion.

But lo! He is not as silly as he seems and goes into an interesting racetrack analogy about how Google owns the track and now has horses and now those horses are winning.

Hmmmm…

Schmidt disagrees, natch!

He thinks the Internet is the platform and Google is the GPS.

Metaphor contest!

I think Google is a big tasty banana cream pie we can’t stop eating, although we know it’s bad for us.

That or an alien wearing an expensive suit who will soon eat us all.

Franken comes in with a doping horses joke. Remember when he was funny on “Saturday Night Live”?

Me neither.

It goes on without a lot of really good discussion. Klobuchar asks something, but I forget it immediately. My bad!

She has a last question about advertisers and privacy. Softball!

Let me write this for Schmidt before he inevitably spits it out: Of course, Google wants to protect privacy.

12:37 pm: Finally, the second panel of critics. Sadly, I must go to an appointment in Silicon Valley to visit one of its rapacious companies.

Oops, I meant ee-no-vative.

But, no worries, John Paczkowski will take over from here once it gets going again after the break.

12:47 pm: The panel’s back in session. The first critic to take a shot at Google, Thomas Barnett, a lawyer for Expedia.

12:51 pm: Riffing on Schmidt’s earlier “We know, we get it” comment, Barnett argues the opposite.

“Google doesn’t get it,” he says, adding that the company’s ever-expanding market power is troubling.

12:54 pm: Google is a monopoly, Barnett continues, and it has a duty not to abuse that position. He concludes by saying antitrust enforcement can and should play a role in maintaining competition in the markets in which it does business.

12:57 pm: Moving on now to Nextag CEO Katz, who has some tough words for the search giant. “Today Google doesn’t play fair,” he says.

He argues that Google rigs its results to drive consumers to Google Product Search when they search for information to inform their purchases.

1:00 pm: Next: Stoppelman of Yelp, who wonders if it’s even possible to create a company like Yelp today because of Google’s massive market power.

1:04 pm: Google’s outside lawyer, Susan Creighton, takes the mic next. Having trouble with the video stream from the Senate, but as best I can tell she talked broadly about the competitive landscape and reiterated Schmidt’s “competition is just a click away” narrative.

1:08 pm: She concludes by saying government oversight of Google’s search results rankings would put the company at a disadvantage and turn its search service into something akin to a “regulated utility.”

1:09 pm: Interesting. Creighton says she doesn’t believe Google has monopoly power.

1:10 pm: “Each of you right now can test whether or not you like Google’s search results and if you don’t like them it’s free and instantaneous to try someone else.”

1:22 pm: Apologies, the Senate video feed has gone from bad to worse.

1:23 pm: Franken asks Yelp’s Stoppelman and Nextag’s Katz if they could start their companies today given Google’s market power.

Both say that’s unlikely.

1:26 pm: Terse exchange between Franken and Creighton about whether Google paid Apple to be the default search engine on its iOS devices. Lots of back and forth, but Creighton finally concedes that there’s some sort of financial deal between the two companies.

1:39 pm: Sen. Lee asks what Google might do to “level the playing field.” Stoppelman suggests separating search from its other properties. Pipe dream.

1:40 pm: Well, it looks like it may be getting near the end of the session, which is a good thing because we get it to by now.

And that is: Nothing significant is going to get said here.

In a letter to the Federal Communications Commission and attorney general Tuesday, Franken said the deal would lead to “an effective duopoly” in the national wireless market and inevitably lead to both higher prices and job losses.

“My examination of this transaction has led me to conclude that AT&T’s acquisition of T-Mobile would substantially lessen competition in the already highly concentrated wireless communications market,” Franken said in the filing. “In addition to my antitrust concerns, I am convinced that this type of horizontal consolidation does not serve the public interest.”

Franken’s objections follow that of Wisconsin Democrat Herb Kohl, who went public with his opposition to the deal last week.

The deal needs the blessing of both the FCC and the Department of Justice. Sprint has vocally opposed the deal, along with a handful of public interest groups and smaller carriers, while AT&T has won backing from a number of high-tech firms, labor groups and others. AT&T said in its earnings call last week that it remains confident it will win approval for the deal.

Two bills introduced in the House and Senate would limit how the government and private companies can use information about your location, the latest signs of growing concern among lawmakers. The bills are among multiple efforts in Washington to update digital-privacy laws, particularly as they relate to location.

One bill, by Democratic Sens. Al Franken of Minnesota and Richard Blumenthal of Connecticut, would require companies like Apple and Google, as well as the makers of applications that run on their devices, to get a user’s consent before sharing information with outsiders about the location of a mobile device.

At a hearing last month, Franken said he had “serious doubts” that cellphone users’ privacy was being protected. He convened the hearing after security researchers and The Wall Street Journal disclosed how iPhones and Android devices leave trails of electronic breadcrumbs revealing where they’ve been. The Journal also reported last year that 47 of 101 popular smartphone apps transmitted location data to outside companies without users’ knowledge.

Read the rest of this post on the original site »

“If the companies agree to this request, consumers who purchase apps from Apple or Google’s app stores would have a clearer understanding of what information is being collected about them and with whom it’s being shared,” Franken wrote. “Apple and Google have each said time and again that they are committed to protecting users’ privacy. This is an easy opportunity for your companies to put that commitment into action.”

In other words, if you’re willing to impose privacy limits on yourselves, you should be willing to to impose them on developers. Concede to the first and the second should follow.

“At a minimum,” Franken said, “all location-aware applications in your app stores [should] provide privacy policies that clearly specify what kind of location information is gathered from users, how that information is used, and how it is shared with third parties.”

Franken chairs the subcommittee on privacy, and says he wants to explore the situation, which could be the first hint that he wants to hold hearings.

He’s not the only person in Congress making noise about it. Sen. Richard Blumenthal, a Democrat from Connecticut, has asked Attorney General Eric Holder to investigate Epsilon for “possible civil and criminal liability.” There’s also talk of hearings on the matter in the House. On top of that, state attorney generals in Rhode Island, Iowa, Nevada and Oregon have started warning consumers in their state about the dangers of clicking links in suspicious emails that may emerge in the coming days. I’ve pasted Blumenthal’s letter below.

Shares in Epsilon parent Alliance Data Systems rose more than one percent today as concern among investors around the business unit that was responsible for 22 percent of its revenue last year seems to have abated for the moment. The company will report quarterly earnings on April 21, and we’re hoping management takes the opportunity to be forthcoming with more details about how the breach happened.

April 6, 2011

The Honorable Eric H. Holder, Jr.
Attorney General of the United States
United States Department of Justice
950 Pennsylvania Avenue, NW
Washington, DC 20530-0001

Dear Mr. Attorney General:

I am writing to formally request an expedited investigation into possible civil and criminal liability, and to highlight key issues to consider in the course of that investigation, concerning recent reports of a major data security breach involving Epsilon, an internet email marketing firm.

On April 1, 2011, Epsilon reported that it had experienced a security breach of its database of customer names and email addresses which it collects from various companies, including many retail and financial firms. The company has not specified how many consumers have been affected by the security breach. Epsilon has not provided a list of companies affected. While some of Epsilon’s client companies have notified their customers of the breach, other consumers may be unaware that their names, email addresses and other potentially identifying information may be at risk.

I believe that immediate notification to all customers is vital to protect them – and enable them to protect themselves – from identity theft. Despite claims by Epsilon that only the names and email addresses of individuals may have been compromised by this security breach, I ask that your review of this incident determine whether individually identifiable financial information has been compromised. Names and email addresses would allow unscrupulous actors to send emails to consumers – ostensibly from the retailers which whom the consumer does business – seeking private financial information such as credit card numbers or checking or banking accounts.

I believe that affected individuals should be notified and provided with financial data security services, including free access to credit reporting services, for two years, the costs of which should be borne by Epsilon or its affected clients. I believe it is also necessary to provide every affected individual with sufficient insurance to protect them against possible financial consequences of identity theft.

Consumers deserve more complete information on the data breach, as well as the assurance that their personal financial information will be securely maintained. If personal financial information has been compromised as a result of this incident, Epsilon should be required to provide written notification of the breach, specific information about the data that may have been improperly accessed by third parties, and personal information security protection, including free access to credit reporting services, and insurance for two years.

Thank you for your attention to this important issue and for your continued work on behalf of the American public.

Sincerely,

Richard Blumenthal
United States Senate

The senators in particular criticized the way Facebook rolled out its instant personalization feature, which currently gives three sites access to Facebook users’ data when the person visits the site and is logged in to Facebook, so that the sites can customize the visit.

“Although we are pleased that Facebook allows users to opt-out of sharing private data, many users are unaware of this option and, moreover, find it complicated and confusing to navigate,” the Democratic senators–New York’s Charles Schumer, Colorado’s Michael Bennet, Mark Begich of Alaska and Al Franken of Minnesota–wrote in the letter. They asked Facebook to make instant personalization an opt-in feature instead.

Read the rest of this post on the original site

Franken turned to the contentious issue of net neutrality, or rules that would require cable and phone companies to treat legal Internet traffic equally and would prevent the creation of a two-tiered system that would allow speedier deliver of premium services.

Public interest groups have pressed Congress to pass explicit rules requiring net neutrality since it’s not entirely clear the FCC has authority to prevent Internet providers from blocking or delaying some Internet traffic.

Read the rest of this post on the original site

The answer’s obvious isn’t it? Salesforce.com CEO Marc Benioff.

Why? Because he says so, that’s why.

Speaking at the company’s DreamForce Europe event, Benioff said that Web 3.0 will be the Platform-as-a-Service (PaaS) era. A fascinating definition–convenient too, since this is precisely the sort of business Salesforce.com (CRM) is in. “We think Web 3.0 is now upon us. It’s the era of platforms,” said Benioff. “New platforms are coming right out of the cloud. It’s time to make a choice. You can continue to build your applications in the software model or you can move your applications to the new model of cloud computing. There is a new way to build your applications.”

So Web 3.0 is not, as Tim Berners-Lee, inventor of the World Wide Web, once suggested, the semantic Web–”day-to-day mechanisms of trade, bureaucracy and our daily lives handled by machines talking to machines.” Rather, it’s Web 2.0 with another 1.0’s worth of marketing BS. The “Whatever-I-Say-It-Is Web”–the “Al Franken Decade” of the Internet age.

Well, the “me” decade is almost over, and good riddance, and far as I’m concerned. … That’s right. I believe we’re entering what I like to call the Al Franken Decade. Oh, for me, Al Franken, the ’80s will be pretty much the same as the ’70s. I’ll still be thinking of me, Al Franken. But for you, you’ll be thinking more about how things affect me, Al Franken. When you see a news report, you’ll be thinking, ‘I wonder what Al Franken thinks about this thing?’, ‘I wonder how this inflation thing is hurting Al Franken?’ And you women will be thinking, ‘What can I wear that will please Al Franken?’, or ‘What can I not wear?’ You know, I know a lot of you out there are thinking, ‘Why Al Franken?’ Well, because I thought of it, and I’m on TV, so I’ve already gotten the jump on you.”