Shutterstock/Péter Gudella

One of the agency’s mandates is to make sure that the carriers are securely protecting the information they collect from their customers. For example, phone companies have to protect the databases that store the information on call records and other data.

The question on what steps they must take when it comes to information on devices is a tricker one. The FCC looked into this question back in 2007. At the time, the carriers contended that information stored on phones wasn’t information they were collecting, but rather data being voluntarily entered by consumers.

However, the FCC thinks it might be time to revisit this given revelations last year that there is software, such as that from Carrier IQ, that is preinstalled and collecting information that users are largely unaware of and unable to control.

“Since the Commission last solicited public input on this question five years ago, technologies and business practices have evolved dramatically,” the FCC said in the document seeking comments. “The devices consumers use to access mobile wireless networks have become more sophisticated and powerful, and their expanded capabilities have at times been used by wireless providers to collect information about particular customers’ use of the network — sometimes, it appears, without informing the customer.”

The FCC isn’t taking issue with the collection of such information, but rather is examining what duties the carriers might have to encrypt or protect such information. Carrier IQ doesn’t encrypt the data it collects, but does store it in a binary format not generally accessible to other applications, the company said.

“We haven’t gone to that extent because we haven’t needed to,” Carrier IQ Vice President Andrew Coward told AllThingsD on Friday. “If the industry decided we needed to, then we would take that step.”

Carrier IQ is also taking steps to allow customers to see the information that is being collected about them by their software.

Following the comment period, the FCC could decide to, among other things, take no action, clarify its existing rules or propose new rules.

[Image via Shutterstock / Péter Gudella]

For those who don’t remember, Carrier IQ is a start-up that sells software that tracks various goings-on inside a cellphone to help cellular carriers and device makers better understand problems on the device.

An uproar occurred last November after a report suggested that the company might be logging all of a user’s activities. Even as Carrier IQ clarified what it was and wasn’t doing, concerns over the product remained.

The Mountain View, Calif., start-up didn’t lose any of its major customers entirely, but its software is definitely installed on fewer phones now than it was before the controversy.

But its executives insist that software that resides on the device, like its own, is critical to understanding connection issues, battery drain and other problems that plague today’s smartphones.

“Having us there is really the only way the industry is going to make improvements that are necessary,” VP Andrew Coward said in an interview at the CTIA trade show in Orlando. “Our technology can take 10 minutes off a customer support call.”

Carrier IQ has taken a couple key steps in its effort to change its image.

Earlier this year, Carrier IQ announced plans to create a way for customers to see firsthand some of the data that is being captured on their phones. That process is still ongoing as Carrier IQ works with the cellular firms to suss out which data they want to share and in what forms.

On Tuesday, the company announced it has hired former Verizon lawyer Magnolia Mansourkia Mobley as its new general counsel and chief privacy officer.

Mansourkia Mobley said that the company is looking to be a strong voice in a broader industry discussion around privacy.

“I don’t think this is something that is limited to Carrier IQ,” she said, saying it is an issue affecting the whole online world. “We plan to be an active member of those discussions.”

The solution, she said, isn’t for Carrier IQ and other small companies to do a lot of work creating their own customer Bill of Rights.

“I don’t think that’s an effective way of delivering something that is meaningful to a consumer,” she said.

The company has also shifted some of its attention more globally. For example, while the company had a booth at Mobile World Congress in Barcelona, it opted not to do the same here in New Orleans.

Although it would always love more U.S. business, Coward said the company is already well known here and counts three of the big four U.S. carriers (not Verizon) as its customers, along with Leap Wireless.

“We’re spending a lot of time in Europe right now,” Coward said. “The same issues with handsets exist globally. It’s not just a U.S. issue.”

RELATED POSTS:

• With No Apple or Amazon at CTIA, iPad Rivals Free to Sling Arrows
• Sprint, Verizon, AT&T and T-Mobile CEOs Square Off in New Orleans
• Remember Carrier IQ? Well, It’s Still Around and Kicking.
• Sprint Product Exec: Launching LTE Devices Before Network Just Makes Sense
• FCC Chairman: Rejection of AT&T’s T-Mobile Deal Isn’t Causing Higher Prices
• Boingo Adds VPN and Crowdsource Hotspot Data to Its Wi-Fi Software
• T-Mobile CTO: Network Should be Ready for iPhone Users by Q4
• Interview: AT&T’s Glenn Lurie on Being the New Sheriff in Town
• Another Day, Another PayPal-esque Digital Wallet: Here’s MasterCard’s High-Tech Billfold
• CTIA Gets Down to Business in the Big Easy
• AT&T Aims to Break Into the Home-Security Business
• Interview: CTIA Boss Steve Largent Aims To Keep Conference From Being Lost in the Shuffle

Massachusetts Democrat Ed Markey said on Monday that he had drafted a bill requiring device makers and others to inform consumers of what software is installed or added to their phones.

The move comes after last year’s uproar surrounding Carrier IQ software installed on various devices on behalf of cellular providers.

“Consumers have the right to know and to say no to the presence of software on their mobile devices that can collect and transmit their personal and sensitive information,” Markey said in a statement.

A number of carriers and device makers have backed away from supporting or using Carrier IQ, including Apple and Sprint. Carrier IQ has also defended its practices.

As drafted, the bill would require consumers to be notified when they buy a device about what monitoring software is installed; and to be told if the device maker, carrier or operating-system provider later installs such software, or if a downloaded app also includes tracking software.

Consumers would be told what type of information is collected, how it will be used and to whom it is provided. Cellphone owners would have to give consent, and any parties getting the information would be required to have policies in place to protect the information.

I’ve sent notes to the major carriers, device makers and mobile operating system vendors to see if they have anything to say about the new bill. A representative of the CTIA, a cellphone industry trade association, said the group had no position or comment.

“People have a fundamental right to control their private information,” Franken said in a statement posted to his Web site. “After reading the companies’ responses, I’m still concerned that this right is not being respected.”

Franken said he is concerned that the average user of a phone running Carrier IQ’s software has no idea what information is being collected and who is getting it, or even the fact the software is running at all.

“I’m also bothered by the software’s ability to capture the contents of our online searches — even when users wish to encrypt them,” Franken said. “So there are still many questions to be answered here and things that need to be fixed.”

In addition to his statements, Franken’s office also released the responses from Carrier IQ, AT&T, Sprint, Samsung, and HTC. The senator says he still hopes to hear from T-Mobile and Motorola by Tuesday.

Sprint, for example, said it began installing the software on devices in 2006 and has put it on about 26 million devices, though only 5 percent of those phones are being asked to send data at any given time. AT&T said the software is installed on about 1 percent of its devices, or 900,000 phones, with 575,000 of those reporting data at any given time.

The carrier noted it has not used the software to profile customers or deliver ads but only to certify devices prior to launch and to review performance of the device and network after launch.

There’s a lot of other interesting bits of data in the response letters, each of which is posted as a PDF on Franken’s site.

Carrier IQ, which sent a response letter to Franken, has also tried to clear the air in interviews and in meetings with both the Federal Trade Commission and the Federal Communications Commission.

Update: Sprint said on Friday that it has decided to stop collecting data using the software.

“We have weighed customer concerns and we have disabled use of the tool so that diagnostic information and data is no longer being collected,” Sprint said in a statement. “At Sprint, we work hard to earn the trust of our customers and believe this course of action is in the best interest of our business and customers.”

That’s Carrier IQ’s claim, anyway.

Responding to a Washington Post report claiming that the company is the subject of an official FTC investigation, Carrier IQ said this is not the case. While it is meeting with federal regulators, the company says it is doing so proactively. It wasn’t summoned to Washington as part of a formal inquiry.

“This week CarrierIQ sought meetings with the FTC and FCC to educate the two agencies about the functionality of its software and answer any and all questions,” the company said in a statement given to AllThingsD. “Although Congressman Edward J. Markey (D-Mass.), co-Chairman of the Bi-Partisan Congressional Privacy Caucus, has asked the Federal Trade Commission to investigate the practices of Carrier IQ, we are not aware of an official investigation into Carrier IQ at this time.”

In other words, there could be an official inquiry — the company just doesn’t know about it yet. And that may yet prove to be the case. The Washington Post says anonymous federal officials have confirmed the investigation, and the Post doesn’t often make such claims unless they’re bulletproof. So expect to hear more about this in the days ahead.

Related Posts on Carrier IQ:

• Exclusive Interview: Carrier IQ Gets Transparent About Its Mobile Monitoring
• Carrier IQ: How to Hack Back Your Phone
  
• Carrier IQ Speaks: Our Software Monitors Service Messages, Ignores Other Data
• Apple: We Stopped Supporting Carrier IQ With iOS 5
• RIM, HTC, Google on Carrier IQ: Blame the Carriers
• Carrier IQ Improves My Wireless Service by Logging My Keystrokes? Please Explain.

Full Carrier IQ Coverage »

Now, as the company prepares to answer the questions put to it by the U.S. Senate Judiciary Committee, it’s hoping to set the record straight, once and for all, by publishing a definitive report (embedded below) on the functionality of its software, including an in-depth analysis of the video that inspired the allegations against it.

In an exclusive interview with AllThingsD, Carrier IQ CEO Larry Lenhart, and Andrew Coward, the company’s VP of marketing, discuss that report, why its software isn’t opt-in, and how it handles law enforcement requests.

John Paczkowski: Tell me about the new document you’re publishing. This is your third official statement on this debacle. Why is it necessary?

Larry Lenhart: I think over the last few weeks we’ve learned a lot about transparency. And we’ve spent a lot of time thinking about it, how we can reach out to everyone — consumers and carriers — and help them understand in more depth what we do and how our software works. This is an ongoing document. It took a lot of time and effort, based on meetings with industry experts, security experts, and Trevor Eckhart, who published the video that brought this issue to everyone’s attention. Of course, we also knew that we were going to have some conversations on Capitol Hill, and drafting the answers to the questions that were asked of us helped inform the document, as well.

Andrew Coward: Well, from our perspective, some of what was shown in the video was erroneous and wrongly attributed to Carrier IQ, so we obviously wanted to correct those misperceptions, and that took some effort. And, of course, there’s been a continuing clamor for understanding more about what Carrier IQ does. So we thought we’d put together a definitive document that says “Look, this is what we do, and we do want you to understand it and how we do it.”

You folks have been relatively transparent about this whole thing, once it blew up in the press. Your carrier partners have not. Do you feel the carriers have done you a disservice by not clearly disclosing their relationship with you to their customers?

Coward: Many of our customers have gone out on the record and described how they use our technology, and we have worked on this document with our carrier customers.

You say your software doesn’t keep a log of location, keylog and SMS information, yet Trevor Eckhart’s video appeared to show that. What was going on there?

Coward: What he was looking at there was an Android log file. And to be blunt, there was information there that shouldn’t have been. In order for Carrier IQ to get information off a device, we work with the manufacturers to deliver that information through an API. That information shouldn’t show up in an Android log file. We don’t read from Android log files; we don’t see Android log files. That info just shouldn’t be there. And, ultimately, what goes in that log file is up to the manufacturer.

So that’s not your log file in the video?

Coward: No. It’s just an Android system log file. And one of the problems with that video, and something we’ve been working to clear up, is that, while you could see that information had been passed to Carrier IQ, there was no video of what happened to that information afterwards. Was it actually captured by Carrier IQ; was it stored or taken off the device? No. And that’s really what we’re trying to clarify with the document we’re publishing.

The document you’re releasing today says that a bug in your software may have caused some SMS messages to be unintentionally collected. Can you talk about this a bit? Should we worry?

Coward: As we went and did a deep dive into our technology to prove to consumers that there is nothing untoward in it, we found a bug. We found that if an SMS was sent simultaneously while a user is on the phone, the SMS would be captured by our software. Obviously, this is something that doesn’t happen very often, but we discovered that it could happen, and we caught it. Now, that information was never used. It wasn’t decoded. It sat on a server in encoded format, and no one could really get to it.

Lenhart: We didn’t even know the data was being captured. The actual information is in nonreadable format. And our customers didn’t know it was there. So it was never looked at. Over the past few weeks, we worked with our customers to resolve the issue.

In the document you’re publishing today, you describe three scenarios for how your software gets on user’s phones: Preloading, where manufacturers install it on devices prior to shipment at the carrier’s request, and it has access to no more data than any other app on the device; aftermarket, where the consumer downloads and installs it at the carrier’s request; and embedded, which requires actual integration work by a device manufacturer, again at the carrier’s request. You say carriers more often than not choose the embedded option over the others you provide. Why do you think that is?

Coward: Really, it’s because embedded was the first option we offered. We’ve only added the others this year.

Why isn’t Carrier IQ opt-in? Shouldn’t it be?

Lenhart: Our technology is defined to do either opt-in or opt-out. But it’s the carrier’s call on whether or not they’re implemented.

Okay. But shouldn’t they be implemented?

Lenhart: Well, the carriers have the privacy relationships with the end user. But we’re certainly supportive on the dialogue going on around this issue.

Coward: We think there’s a quid pro quo between consumers and operators. Consumers expect their phones to work. They expect that if they have problems with their phones, the carriers will do something about them. They also expect that if they call in for help, the carrier will actually have a clue about why their phone is crashing or their calls are dropping. So there’s an implicit understanding that the carrier knows enough to be able fix the problem.

But wouldn’t it be better to just ask consumers to agree to that quid pro quo right up front?

Coward: Well, that’s a good question for the industry. Should there be opt-in/opt-out? And if there is, what does that mean for customer service; what does that mean for the end-user experience?

Why do the carriers need you? Couldn’t they capture a lot of this information themselves?

Coward: Certainly, the network provides a huge amount of information. But the network can’t tell you why your battery won’t hold a charge or an application is crashing. So there’s a missing piece here in the diagnostic puzzle, and that’s what we provide. And what you need to understand is that this is a technology that’s hard to implement. If you’re a handset manufacturer, it’s much easier to work with an industry player like Carrier IQ.

Who decides what your software does and does not track?

Coward: We work with the carrier to determine that. There is a line in the sand between what we would collect and what we would not collect. And we draw that line at content. We absolutely do not intend to capture content from subscribers. We collect information about their mobile phone experience, and about what happens.

Have you been asked to collect content?

Coward: We’ve not been asked, nor would we do it if we were.

How does Carrier IQ handle the usernames, passwords and other personal information that is embedded in an HTTP’s URLs?

Coward: We’re investigating that issue at the moment. And we recognize that it’s a sensitive one. It is not our intention to capture information that might be confidential.

So you have about two more days before you have to answer the questions put to you by Al Franken and the Senate privacy panel. Can you give me an idea of what you’re going to say?

Lenhart: Well, if you read the document we’re publishing, I think you’ll find answers to most of the questions that Senator Franken asked. … We’re actually in Washington right now, and we’ll be meeting with the folks that have asked for information about Carrier IQ over the next few days.

Are people right to be concerned about Carrier IQ? Could your software be misused?

Lenhart: No. We’re a diagnostic software company. We love diagnostic information. We are not interested in content. And that’s where we draw the line. We don’t want content, and we don’t have the ability to capture it. Remember, the information that’s captured off a user’s device is determined by the carrier, according to their privacy agreement.

You say you are not permitted to analyze, resell or reuse any of the information gathered for your own purposes, or to pass it to any third party, unless required by law. Do you know if law enforcement uses Carrier IQ data, and in what manner?

Lenhart: We have been approached by law enforcement about using our technology, and every time it’s happened, we’ve determined that that’s not an appropriate use of it. A lot of data that we capture is historical, so if you really want to find out where somebody is and what they’re doing, our technology isn’t going to give you that. Remember, this is diagnostic data. And we don’t share it with anyone.

But you do say that you would hand over data if required by law.

Lenhart: We would refer them to the carriers, because the diagnostic data collected belongs to the network operators, not Carrier IQ.

How damaging has this whole ordeal been to Carrier IQ? Or has it been damaging at all? Certainly, a lot more people know who you are today than did a few weeks ago.

Lenhart: Our world has been turned upside down. We love what we do, and we have a lot of passion for it. And to see it misunderstood like this has been painful. We want to make sure people really understand who we are and what we’re doing.

Read Carrier IQ’s report on the functionality of its software:

Understanding Carrier IQ technology final 12 12 11 –

Related Posts on Carrier IQ:

• Exclusive Interview: Carrier IQ Gets Transparent About Its Mobile Monitoring
• Carrier IQ: How to Hack Back Your Phone
  
• Carrier IQ Speaks: Our Software Monitors Service Messages, Ignores Other Data
• Apple: We Stopped Supporting Carrier IQ With iOS 5
• RIM, HTC, Google on Carrier IQ: Blame the Carriers
• Carrier IQ Improves My Wireless Service by Logging My Keystrokes? Please Explain.

Full Carrier IQ Coverage »

The findings of a Connecticut-based systems administrator have sparked alarm in millions of smartphone users, after security researcher Trevor Eckhart published a video showing how a cellphone software company has the ability to log users’ Web searches and keystrokes.

The technology, made by Carrier IQ, is currently deployed on more than 150 million devices worldwide.

Research In Motion and HTC — the maker of the phone targeted in the security demo — have issued statements denying that Carrier IQ is preinstalled on their devices. Meanwhile, U.S. Sen. Al Franken (D-Minn.) has sent a letter to Carrier IQ seeking more information on what the software does.

Carrier IQ has told AllThingsD that while its software has the ability to receive a tremendous amount of information, some of which could be relayed to a carrier for diagnostics purposes, the company doesn’t log keystrokes and the software is not being used to gather intelligence about the phone’s user.

But while we wait for more answers, what’s a smartphone user to do?

Google Android Phones: If you’re wondering whether your Google Android phone might have Carrier IQ installed on it, Eckhart, the researcher behind all of this, points people to a Logging Test app that he claims can be used to verify “what logging is being done on your phone and where the data is going to.” If successfully installed — which we hear may take some finagling, including emailing the app link to yourself to access it, and “rooting” your phone first — the $1 app is meant to detect Carrier IQ and remove it.

According to his blog post, Eckhart has tested this app on the HTC Evo 3D phone; he believes it works on the Sprint Evo 4G and HTC Thunderbolt, as well.

But since the Google Android operating system runs on devices from multiple manufacturers, it is not known at this point which models could be running Carrier IQ and which ones are not.

It should be noted that some manufacturers have denied responsibility for the app; HTC, for example, has put the blame on wireless carriers, and basically advises HTC phone owners to contact their carriers. The company did add it was looking into an option for allowing its customers to opt out of the Carrier IQ application, but no further details were given beyond that.

Sprint has not yet responded to my inquiry as to whether the wireless company was actively involved in the installation of Carrier IQ, or how users might disable such applications on Sprint. AT&T said it uses Carrier IQ solely to improve its network performance; Verizon claims not to use it at all, although my colleague John Paczkowski reports that may not be the case.

RIM BlackBerrys: While RIM hasn’t explicitly pointed to wireless carriers as HTC did, the BlackBerry maker also denies any involvement with Carrier IQ, stating “RIM does not pre-install the CarrierIQ app on BlackBerry smartphones or authorize its carrier partners to install the CarrierIQ app before sales or distribution.”

However, the next part of RIM’s statement on the BlackBerry developers forum indicates that it’s possible Carrier IQ could live on a BlackBerry device.

According to BlackBerry Development Advisor Mark Sohm: “If the Carrier IQ application is present on a BlackBerry smartphone, it does not mean that the Carrier IQ application has ‘hacked’ the BlackBerry platform. It means that either the BlackBerry smartphone user or the user’s BlackBerry Enterprise Server admin explicitly installed the application and authorized it to run.”

In other words, if it’s on your phone, you may have granted it access in some way, shape, form or click of your Qwerty keypad.

Apple iPhones: Apple has issued a statement to AllThingsD declaring that the company stopped supporting Carrier IQ with iOS 5, its latest version of mobile software, and plans to remove it from future mobile software updates, too.

But what if you’re running an earlier version of iOS on your iPhone and are worried about where your data is going? Apparently, you can opt out of having your usage data submitted for diagnostics. To do that, go to to Settings → General → About → Diagnostics & Usage. Select “Don’t Send.”

More info to come as I get it.

Related Posts on Carrier IQ:

• Exclusive Interview: Carrier IQ Gets Transparent About Its Mobile Monitoring
• Carrier IQ: How to Hack Back Your Phone
  
• Carrier IQ Speaks: Our Software Monitors Service Messages, Ignores Other Data
• Apple: We Stopped Supporting Carrier IQ With iOS 5
• RIM, HTC, Google on Carrier IQ: Blame the Carriers
• Carrier IQ Improves My Wireless Service by Logging My Keystrokes? Please Explain.

Full Carrier IQ Coverage »

It doesn’t.

While CIQ might “listen”* to a smartphone’s keyboard, it’s listening for very specific information. Company executives insist it doesn’t log or understand keystrokes. It’s simply looking for numeric sequences that trigger a diagnostic cue within the software. If it hears that cue, it transmits diagnostics to the carrier.

So, for example, if during a support call a technician asks a customer to enter a short code, CIQ will be listening for it; when it’s entered, CIQ will relay the appropriate diagnostic information to the carrier. Any keystrokes beyond that are ignored.

“The software receives a huge amount of information from the operating system,” Andrew Coward, Carrier IQ’s VP of marketing, told AllThingsD. “But just because it receives it doesn’t mean that it’s being used to gather intelligence about the user or passed along to the carrier.”

So what are we really seeing in security researcher Trevor Eckhart’s video, which shows Carrier IQ collecting all sorts of information about how a phone is being used and where?

“What the Eckhart video demonstrates is that there’s a great deal of information available on a handset,” says Coward. “What it doesn’t show is that all information is processed, stored, or forwarded out of the device.”

Okay. Then what information is being captured and passed along to the carriers who use Carrier IQ? Data related to call quality, battery life, device crashes — everything you’d expect, really.

“If there’s a dropped call, the carriers want to know about it,” says Coward. “So we record where you were when the call dropped, and the location of the tower being used. … Similarly, if you send an SMS to me and it doesn’t go through, the carriers want to know that, too. And they want to know why — if it’s a problem with your handset or the network.”

And Coward is quick to point out that CIQ isn’t doing anything nefarious with our text messages, either.

“We don’t read SMS messages. We see them come in. We see the phone numbers attached to them. But we are not storing, analyzing or otherwise processing the contents of those messages.”

The same is true of Web site URLs. CIQ has the ability to capture them, but not the associated content. So it might note a device having trouble accessing Facebook, but not the content on Facebook itself.

Which is reassuring. That said, CIQ still has the ability to capture a wide variety of user data. So who is determining what exactly is being collected?

The carriers. They decide what’s to be collected and how long it’s stored — typically about 30 days. And according to Carrier IQ, the data is in their control the whole time.

“It’s the operator that determines what data is collected,” says Carrier IQ CEO Larry Lenhart. “They make that decision based on their privacy standards and their agreement with their users, and we implement it.”

On this point, Lenhart is particularly emphatic. “We capture only the data they specify, and provide it to them,” he reiterates. “We don’t capture more than that.”

Which sounds a bit like “we only do what they asked us to,” but, as Coward reminds us, the carriers’ behavior is governed by their contract with customers.

“What’s actually gathered, stored and transmitted to the carrier is determined by its end-user agreement,” he says. “And, as I’m sure you’re aware, the carriers are highly sensitive about what data they’re allowed to capture and what they’re not allowed to capture.”

One last question: Does Carrier IQ share the data it collects with other third parties beyond the carriers? A vehement no from Lenhart. “The data is the consumer’s data,” he says. “We would never take that data and distrubute it to a third party. We are prohibited from doing that by our agreements.”

Trevor Eckhart did not respond to a request for comment.

(*Handy euphemism for “pattern match filtering.”)

Here’s a freshly released Carrier IQ statement:

MOUNTAIN VIEW, Calif., Dec 01, 2011 (BUSINESS WIRE) — To clarify misinformation on the functionality of Carrier IQ software, the company is updating its statement from November 23rd 2011 as follows:

We measure and summarize performance of the device to assist Operators in delivering better service.

While a few individuals have identified that there is a great deal of information available to the Carrier IQ software inside the handset, our software does not record, store or transmit the contents of SMS messages, email, photographs, audio or video. For example, we understand whether an SMS was sent accurately, but do not record or transmit the content of the SMS. We know which applications are draining your battery, but do not capture the screen.

“Having examined the Carrier IQ implementation it is my opinion that allegations of keystroke collection or other surveillance of mobile device user’s content are erroneous,” asserts Rebecca Bace of Infidel Inc. a respected security expert.

Privacy is protected. Consumers have a trusted relationship with Operators and expect their personal information and privacy to be respected. As a condition of its contracts with Operators, CIQ operates exclusively within that framework and under the laws of the applicable jurisdiction. The data we gather is transmitted over an encrypted channel and secured within our customers’ networks or in our audited and customer-approved facilities.

Carrier IQ is aware of various commentators alleging Carrier IQ has violated wiretap laws and we vigorously disagree with these assertions.

Our software makes your phone better by delivering intelligence on the performance of mobile devices and networks to help the Operators provide optimal service efficiency. We are deployed by leading Operators to monitor and analyze the performance of their services and mobile devices to ensure the system (network and handsets) works to optimal efficiency. Operators want to provide better service to their customers, and information from the device and about the network is critical for them to do this. While in-network tools deliver information such as the location of calls and call quality, they do not provide information on the most important aspect of the service – the mobile device itself.

Carrier IQ acts as an agent for the Operators. Each implementation is different and the diagnostic information actually gathered is determined by our customers — the mobile Operators. Carrier IQ does not gather any other data from devices.

CIQ is the consumer advocate to the mobile operator, explaining what works and what does not work. Three of the main complaints we hear from mobile device users are (1) dropped calls, (2) poor customer service, and (3) having to constantly recharge the device. Our software allows Operators to figure out why problems are occurring, why calls are dropped, and how to extend the life of the battery. When a user calls to complain about a problem, our software helps Operators’ customer service more quickly identify the specific issue with the phone.

Related Posts on Carrier IQ:

• Exclusive Interview: Carrier IQ Gets Transparent About Its Mobile Monitoring
• Carrier IQ: How to Hack Back Your Phone
  
• Carrier IQ Speaks: Our Software Monitors Service Messages, Ignores Other Data
• Apple: We Stopped Supporting Carrier IQ With iOS 5
• RIM, HTC, Google on Carrier IQ: Blame the Carriers
• Carrier IQ Improves My Wireless Service by Logging My Keystrokes? Please Explain.

Full Carrier IQ Coverage »

Apple’s statement in full, below:

“We stopped supporting Carrier IQ with iOS 5 in most of our products and will remove it completely in a future software update. With any diagnostic data sent to Apple, customers must actively opt-in to share this information, and if they do, the data is sent in an anonymous and encrypted form and does not include any personal information. We never recorded keystrokes, messages or any other personal information for diagnostic data and have no plans to ever do so.”

Related Posts on Carrier IQ:

• Exclusive Interview: Carrier IQ Gets Transparent About Its Mobile Monitoring
• Carrier IQ: How to Hack Back Your Phone
  
• Carrier IQ Speaks: Our Software Monitors Service Messages, Ignores Other Data
• Apple: We Stopped Supporting Carrier IQ With iOS 5
• RIM, HTC, Google on Carrier IQ: Blame the Carriers
• Carrier IQ Improves My Wireless Service by Logging My Keystrokes? Please Explain.

Full Carrier IQ Coverage »

Smartphone manufacturers are fast lining up to distance themselves from the Carrier IQ privacy debacle. Responding to reports that Carrier IQ’s smartphone diagnostics software has been found on their handsets, Research In Motion and HTC issued statements today denying responsibility for it, and Google said it had no control over the matter.

None of them admitted to installing or authorizing their carrier partners to install the software which security researchers have shown to log essentially every keystroke made on devices on which it is running.

RIM claimed to have nothing to do with Carrier IQ on its devices.

“RIM is aware of a recent claim by a security researcher that an application called ‘CarrierIQ’ is installed on mobile devices from multiple vendors without the knowledge or consent of the device users,” the company said in a statement. “RIM does not pre-install the CarrierIQ app on BlackBerry smartphones or authorize its carrier partners to install the CarrierIQ app before sales or distribution. RIM also did not develop or commission the development of the CarrierIQ application, and has no involvement in the testing, promotion, or distribution of the app. RIM will continue to investigate reports and speculation related to CarrierIQ.”

HTC went one step further, fingering the carriers outright. “Carrier IQ is required on devices by a number of U.S carriers so if consumers or media have any questions about the practices relating to, or data collected by, Carrier IQ we’d advise them to contact their carrier,” the company said, stressing that it is not a customer or partner of Carrier IQ. “HTC is investigating the option to allow consumers to opt-out of data collection by the Carrier IQ application,” it added.

Google also disclaimed any connection, saying, “We do not have an affiliation with CarrierIQ. Android is an open source effort and we do not control how carriers or OEMs customize their devices.” 

Carrier IQ and Sprint haven’t yet returned requests for comment. AT&T said simply, “In line with our privacy policy, we solely use CIQ software data to improve wireless network and service performance.”

Verizon claims not to use Carrier IQ, though telecom industry sources tell me it almost certainly uses something similar to it.

Related Posts on Carrier IQ:

• Exclusive Interview: Carrier IQ Gets Transparent About Its Mobile Monitoring
• Carrier IQ: How to Hack Back Your Phone
  
• Carrier IQ Speaks: Our Software Monitors Service Messages, Ignores Other Data
• Apple: We Stopped Supporting Carrier IQ With iOS 5
• RIM, HTC, Google on Carrier IQ: Blame the Carriers
• Carrier IQ Improves My Wireless Service by Logging My Keystrokes? Please Explain.

Full Carrier IQ Coverage »

In an 18-minute video clip posted to YouTube, Eckhart demonstrates Carrier IQ’s software as it records virtually all keystrokes made on an HTC Evo 3D. Worse still, it’s shown logging encrypted Web searches, text messages and, well, you name it. In other words, it’s entirely possible that the wireless carriers who install Carrier IQ’s software on cellphones are able to watch what their subscribers are doing on their phones as they do it. Says Eckhart, “So, instead of seeing dropped calls in California, they now know ‘Joe Anyone’s’ location at any given time, what he is running on his device, keys being pressed, applications being used.”

Disconcerting to say the least. More so since Carrier IQ claims its “Mobile Intelligence platform” is currently deployed on more than 150 million devices worldwide, generally installed by the carrier. Eckhart says he’s found it on Android and BlackBerry devices, and others have found evidence of it on iOS, though it does appear to be disabled by default (if it is enabled, it can be turned off pretty simply).

As privacy violations go, this one seems particularly outrageous, though Carrier IQ would likely describe that characterization as an overreaction. It claims it doesn’t track keystrokes, nor does it sell information to third parties.

“While we look at many aspects of a device’s performance, we are counting and summarizing performance, not recording keystrokes or providing tracking tools,” the company said in a statement. “The metrics and tools we derive are not designed to deliver such information, nor do we have any intention of developing such tools.”

That’s great, but it doesn’t really explain what we see in the video above, in which the application is very clearly logging keystrokes.

If Carrier IQ isn’t recording keystrokes, why is it logging them?

That’s a question U.S. Sen. Al Franken (D-Minn.) would like answered. In a letter to Carrier IQ President and CEO Larry Lenhart today, Franken called on the exec to explain exactly what information the software records, whether that information is transmitted to Carrier IQ or to other companies, and whether that information is shared with anyone else.

“… It appears that Carrier IQ’s software captures a broad swath of extremely sensitive information from users that would appear to have nothing to do with diagnostics—including who they are calling, the contents of the texts they are receiving, the contents of their searches, and the websites they visit,” Franken wrote. “These actions may violate federal privacy laws, including the Electronic Communications Privacy Act and the Computer Fraud and Abuse Act. This is potentially a very serious matter.”

Related Posts on Carrier IQ:

• Exclusive Interview: Carrier IQ Gets Transparent About Its Mobile Monitoring
• Carrier IQ: How to Hack Back Your Phone
  
• Carrier IQ Speaks: Our Software Monitors Service Messages, Ignores Other Data
• Apple: We Stopped Supporting Carrier IQ With iOS 5
• RIM, HTC, Google on Carrier IQ: Blame the Carriers
• Carrier IQ Improves My Wireless Service by Logging My Keystrokes? Please Explain.

Full Carrier IQ Coverage »