It doesn’t.

While CIQ might “listen”* to a smartphone’s keyboard, it’s listening for very specific information. Company executives insist it doesn’t log or understand keystrokes. It’s simply looking for numeric sequences that trigger a diagnostic cue within the software. If it hears that cue, it transmits diagnostics to the carrier.

So, for example, if during a support call a technician asks a customer to enter a short code, CIQ will be listening for it; when it’s entered, CIQ will relay the appropriate diagnostic information to the carrier. Any keystrokes beyond that are ignored.

“The software receives a huge amount of information from the operating system,” Andrew Coward, Carrier IQ’s VP of marketing, told AllThingsD. “But just because it receives it doesn’t mean that it’s being used to gather intelligence about the user or passed along to the carrier.”

So what are we really seeing in security researcher Trevor Eckhart’s video, which shows Carrier IQ collecting all sorts of information about how a phone is being used and where?

“What the Eckhart video demonstrates is that there’s a great deal of information available on a handset,” says Coward. “What it doesn’t show is that all information is processed, stored, or forwarded out of the device.”

Okay. Then what information is being captured and passed along to the carriers who use Carrier IQ? Data related to call quality, battery life, device crashes — everything you’d expect, really.

“If there’s a dropped call, the carriers want to know about it,” says Coward. “So we record where you were when the call dropped, and the location of the tower being used. … Similarly, if you send an SMS to me and it doesn’t go through, the carriers want to know that, too. And they want to know why — if it’s a problem with your handset or the network.”

And Coward is quick to point out that CIQ isn’t doing anything nefarious with our text messages, either.

“We don’t read SMS messages. We see them come in. We see the phone numbers attached to them. But we are not storing, analyzing or otherwise processing the contents of those messages.”

The same is true of Web site URLs. CIQ has the ability to capture them, but not the associated content. So it might note a device having trouble accessing Facebook, but not the content on Facebook itself.

Which is reassuring. That said, CIQ still has the ability to capture a wide variety of user data. So who is determining what exactly is being collected?

The carriers. They decide what’s to be collected and how long it’s stored — typically about 30 days. And according to Carrier IQ, the data is in their control the whole time.

“It’s the operator that determines what data is collected,” says Carrier IQ CEO Larry Lenhart. “They make that decision based on their privacy standards and their agreement with their users, and we implement it.”

On this point, Lenhart is particularly emphatic. “We capture only the data they specify, and provide it to them,” he reiterates. “We don’t capture more than that.”

Which sounds a bit like “we only do what they asked us to,” but, as Coward reminds us, the carriers’ behavior is governed by their contract with customers.

“What’s actually gathered, stored and transmitted to the carrier is determined by its end-user agreement,” he says. “And, as I’m sure you’re aware, the carriers are highly sensitive about what data they’re allowed to capture and what they’re not allowed to capture.”

One last question: Does Carrier IQ share the data it collects with other third parties beyond the carriers? A vehement no from Lenhart. “The data is the consumer’s data,” he says. “We would never take that data and distrubute it to a third party. We are prohibited from doing that by our agreements.”

Trevor Eckhart did not respond to a request for comment.

(*Handy euphemism for “pattern match filtering.”)

Here’s a freshly released Carrier IQ statement:

MOUNTAIN VIEW, Calif., Dec 01, 2011 (BUSINESS WIRE) — To clarify misinformation on the functionality of Carrier IQ software, the company is updating its statement from November 23rd 2011 as follows:

We measure and summarize performance of the device to assist Operators in delivering better service.

While a few individuals have identified that there is a great deal of information available to the Carrier IQ software inside the handset, our software does not record, store or transmit the contents of SMS messages, email, photographs, audio or video. For example, we understand whether an SMS was sent accurately, but do not record or transmit the content of the SMS. We know which applications are draining your battery, but do not capture the screen.

“Having examined the Carrier IQ implementation it is my opinion that allegations of keystroke collection or other surveillance of mobile device user’s content are erroneous,” asserts Rebecca Bace of Infidel Inc. a respected security expert.

Privacy is protected. Consumers have a trusted relationship with Operators and expect their personal information and privacy to be respected. As a condition of its contracts with Operators, CIQ operates exclusively within that framework and under the laws of the applicable jurisdiction. The data we gather is transmitted over an encrypted channel and secured within our customers’ networks or in our audited and customer-approved facilities.

Carrier IQ is aware of various commentators alleging Carrier IQ has violated wiretap laws and we vigorously disagree with these assertions.

Our software makes your phone better by delivering intelligence on the performance of mobile devices and networks to help the Operators provide optimal service efficiency. We are deployed by leading Operators to monitor and analyze the performance of their services and mobile devices to ensure the system (network and handsets) works to optimal efficiency. Operators want to provide better service to their customers, and information from the device and about the network is critical for them to do this. While in-network tools deliver information such as the location of calls and call quality, they do not provide information on the most important aspect of the service – the mobile device itself.

Carrier IQ acts as an agent for the Operators. Each implementation is different and the diagnostic information actually gathered is determined by our customers — the mobile Operators. Carrier IQ does not gather any other data from devices.

CIQ is the consumer advocate to the mobile operator, explaining what works and what does not work. Three of the main complaints we hear from mobile device users are (1) dropped calls, (2) poor customer service, and (3) having to constantly recharge the device. Our software allows Operators to figure out why problems are occurring, why calls are dropped, and how to extend the life of the battery. When a user calls to complain about a problem, our software helps Operators’ customer service more quickly identify the specific issue with the phone.

Related Posts on Carrier IQ:

• Exclusive Interview: Carrier IQ Gets Transparent About Its Mobile Monitoring
• Carrier IQ: How to Hack Back Your Phone
  
• Carrier IQ Speaks: Our Software Monitors Service Messages, Ignores Other Data
• Apple: We Stopped Supporting Carrier IQ With iOS 5
• RIM, HTC, Google on Carrier IQ: Blame the Carriers
• Carrier IQ Improves My Wireless Service by Logging My Keystrokes? Please Explain.

Full Carrier IQ Coverage »

In an 18-minute video clip posted to YouTube, Eckhart demonstrates Carrier IQ’s software as it records virtually all keystrokes made on an HTC Evo 3D. Worse still, it’s shown logging encrypted Web searches, text messages and, well, you name it. In other words, it’s entirely possible that the wireless carriers who install Carrier IQ’s software on cellphones are able to watch what their subscribers are doing on their phones as they do it. Says Eckhart, “So, instead of seeing dropped calls in California, they now know ‘Joe Anyone’s’ location at any given time, what he is running on his device, keys being pressed, applications being used.”

Disconcerting to say the least. More so since Carrier IQ claims its “Mobile Intelligence platform” is currently deployed on more than 150 million devices worldwide, generally installed by the carrier. Eckhart says he’s found it on Android and BlackBerry devices, and others have found evidence of it on iOS, though it does appear to be disabled by default (if it is enabled, it can be turned off pretty simply).

As privacy violations go, this one seems particularly outrageous, though Carrier IQ would likely describe that characterization as an overreaction. It claims it doesn’t track keystrokes, nor does it sell information to third parties.

“While we look at many aspects of a device’s performance, we are counting and summarizing performance, not recording keystrokes or providing tracking tools,” the company said in a statement. “The metrics and tools we derive are not designed to deliver such information, nor do we have any intention of developing such tools.”

That’s great, but it doesn’t really explain what we see in the video above, in which the application is very clearly logging keystrokes.

If Carrier IQ isn’t recording keystrokes, why is it logging them?

That’s a question U.S. Sen. Al Franken (D-Minn.) would like answered. In a letter to Carrier IQ President and CEO Larry Lenhart today, Franken called on the exec to explain exactly what information the software records, whether that information is transmitted to Carrier IQ or to other companies, and whether that information is shared with anyone else.

“… It appears that Carrier IQ’s software captures a broad swath of extremely sensitive information from users that would appear to have nothing to do with diagnostics—including who they are calling, the contents of the texts they are receiving, the contents of their searches, and the websites they visit,” Franken wrote. “These actions may violate federal privacy laws, including the Electronic Communications Privacy Act and the Computer Fraud and Abuse Act. This is potentially a very serious matter.”

Related Posts on Carrier IQ:

• Exclusive Interview: Carrier IQ Gets Transparent About Its Mobile Monitoring
• Carrier IQ: How to Hack Back Your Phone
  
• Carrier IQ Speaks: Our Software Monitors Service Messages, Ignores Other Data
• Apple: We Stopped Supporting Carrier IQ With iOS 5
• RIM, HTC, Google on Carrier IQ: Blame the Carriers
• Carrier IQ Improves My Wireless Service by Logging My Keystrokes? Please Explain.

Full Carrier IQ Coverage »

In 2000, his team dropped the hammer on the Hack SDMI challenge by demonstrating how easy it was to crack the decidedly mediocre Secure Digital Music Initiative.

Dragged into the Sony BMG CD copy-protection scandal in 2005, he discovered that Sony’s “fix” for the Digital Rights Management rootkit it used to protect some new music CDs furthered inflamed an already bad situation.

And then, of course, there were Felten’s various investigations into electronic voting machines, the most notorious being the one that revealed Diebold’s machines could be opened with a standard office furniture key. “The access panel door on a Diebold AccuVote-TS voting machine–the door that protects the memory card that stores the votes, and is the main barrier to the injection of a virus–can be opened with a standard key that is widely available on the Internet,” Felten wrote at the time. “The exact same key is used widely in office furniture, electronic equipment, jukeboxes, and hotel minibars.”

Thank God for Felten, right?

And thank God the FTC has seen fit to hire him. There’s a lot of good he can do there. As Felten described it, “My main job will be to advise the FTC leadership on technology policy issues. My goals are use my technical expertise and knowledge of the tech world to help the FTC make the best decisions on tech topics, and to contribute to building up the agency’s technical capabilities.”

Said FTC Chairman Jon Leibowitz, “Ed is extraordinarily respected in the technology community, and his background and knowledge make him an outstanding choice to serve as the agency’s first Chief Technologist. He’s going to add unparalleled expertise on high-technology markets and computer security.”

The music company improperly accepted registrations on its music websites from users who were under 13, without obtaining consent from their parents, according to the lawsuit filed in U.S. District Court in Manhattan.

The civil suit, which seeks unspecified monetary penalties, said Sony Music was in violation of the Children’s Online Privacy Protection Rule, which is enforced by the Federal Trade Commission. The case was brought by the U.S. Attorney’s Office in Manhattan.

A Sony BMG executive told Reuters that the litigation is in the process of being resolved, with the company agreeing to pay a fine of $1 million, to put in place a screening process that complies with the FTC rules and hire a Web compliance officer to monitor the issue.

The executive declined to be identified, saying the news of the settlement was to be officially announced by the government as early as Thursday.”

Before the blogosphere makes the synaptic leap between Sony + music + online + lawsuit and yells “ROOTKIT!,” some context: Sony isn’t the only record label to run afoul of COPPA, the 1998 law that is supposed to protect the privacy and safety of children–Universal Music Group paid a $400,000 fine in a similar case in 2004. Nor is it the only big company, period: Other culprits include Hershey’s and Mrs. Fields.

I’m not quite sure how they ran afoul, mind you–from what I can tell, COPPA pretty much requires sites that may collect personal information from kids to stick a link to a privacy policy somewhere on the page. Can someone please explain how a company could screw that up–or how such a link actually helps protect kids?

This morning, Sony BMG became the second record label to jump on board the Finnish phone giant’s Comes With Music offering, which–when it launches in the second half of 2008, will package mobile phones with a year of unlimited access to music. There are, however, certain caveats to that value proposition, as I pointed out last December:

Though Comes With Music does indeed permit owners of certain Nokia cellphones to download as many songs as humanly possible in one year (with no per-song data charges), transfer them to a PC and keep them at the end of that time, they must pay a per-song usage fee to burn them to CD. What’s more, the songs are wrapped in Microsoft’s (MSFT) ironically named ‘Plays for Sure’ digital-rights management scheme, which prevents them from being played on the iPod, Zune, etc. Finally, another 12 months access to the music catalog requires the purchase of a brand new phone.”

Clearly, Sony, like Universal (VIV.PA) before it, doesn’t see these issues as off-putting to consumers. “When you give consumers the key to the candy store without any limitations, there’s a lot more opportunity for discovering music that you might not have found before,” said Thomas Hesse, president of global digital business and U.S. sales for Sony BMG Music Entertainment. “We think this will energize the discovery of music.”

It might energize Sony BMG’s bottom line a bit as well. When Universal first signed up for Comes with Music, sources close to the company said that Nokia would pay the label up to $35 for every phone that offers access to its library. Nokia subsequently denied it was paying that amount, but it’s definitely paying something–to Universal, Sony and whatever other labels it manages to line up for the service.

This morning, Sony BMG became the second record label to jump on board the Finnish phone giant’s Comes With Music offering, which–when it launches in the second half of 2008, will package mobile phones with a year of unlimited access to music. There are, however, certain caveats to that value proposition, as I pointed out last December:

Though Comes With Music does indeed permit owners of certain Nokia cellphones to download as many songs as humanly possible in one year (with no per-song data charges), transfer them to a PC and keep them at the end of that time, they must pay a per-song usage fee to burn them to CD. What’s more, the songs are wrapped in Microsoft’s (MSFT) ironically named ‘Plays for Sure’ digital-rights management scheme, which prevents them from being played on the iPod, Zune, etc. Finally, another 12 months access to the music catalog requires the purchase of a brand new phone.”

Clearly, Sony, like Universal (VIV.PA) before it, doesn’t see these issues as off-putting to consumers. “When you give consumers the key to the candy store without any limitations, there’s a lot more opportunity for discovering music that you might not have found before,” said Thomas Hesse, president of global digital business and U.S. sales for Sony BMG Music Entertainment. “We think this will energize the discovery of music.”

It might energize Sony BMG’s bottom line a bit as well. When Universal first signed up for Comes with Music, sources close to the company said that Nokia would pay the label up to $35 for every phone that offers access to its library. Nokia subsequently denied it was paying that amount, but it’s definitely paying something–to Universal, Sony and whatever other labels it manages to line up for the service.

Interesting that Sony would accuse Amergence of failure to meet its specifications now. After all, you’d think that’s an issue it would have taken up with the company two years ago, after its own engineers presumably reviewed the software and, if not then, perhaps on Oct. 4, 2005–the day Finnish security outfit F-Secure warned it that the software posed a serious security risk. “If [Sony] had woken up and smelled the coffee when we told them there was a problem, they could have avoided this trouble,” Mikko Hypponen, F-Secure’s director of antivirus research, told BusinessWeek at the time.

“We told them it was a major security risk,” added Santeri Kangas, F-Secure’s director of research. “They thought we were silly. They wanted to keep the problem quiet.”

That’s certainly what it looked like at the time. What with Thomas Hesse, president of Sony BMG’s global digital business division, telling NPR that “most people don’t even know what a rootkit is, so why should they care about it?” ‘Course you tend to forget about those things when you’re busy redistributing blame, right?