Yesterday we reported on a bit of software developed by California based company Carrier IQ that seems to have the capability to snoop on every little thing you do on your mobile phone. Like anything privacy related on the interwebs, the issue has completely blown up and has gotten so bad that even a United States Senator, Al Franken, is asking what the piece of software actually does. Tempers are running high and everyone is getting a bit paranoid (understandably) about the amount of information that the software in question actually sends out. We’re here to try and make sense of the mess, and find out what this means for you.

What is Carrier IQ?

Carrier IQ is a company that specializes in providing information to carriers in regards to their mobile network. Think of it as the Google Analytics of the mobile world. The company boasts that it’s deployed it software in 140 million units, though it’s not clear if that figure represents deployments in the US or around the world. It accomplishes this via software that they developed which, according to Trevor Eckhart, has the ability to grab everything you do and send it to god knows who.

Is this even legal?

That’s the main issue actually. Carriers need a way to find out the performance of their devices, and Carrier IQ does this well. The problem is that the very nature of the software means that it’s possible that it’s breaking a number of laws in the US. In fact, Paul Ohm, a former prosecutor for the Department of Justice and current professor at the University of Colorado Law School has said on Engadget that the software violates several federal wiretapping laws based on its ability to be able to read text messages without the consent of the user. He adds, “In the next days or weeks, someone will sue, and then this company is tangled up in very expensive litigation. It’s almost certain.”

Which manufacturer has Carrier IQ installed?

We reached out to local manufacturers and telcos to find out who has Carrier IQ on board their devices. Here’s what they said:

RIM

“RIM is aware of a recent claim by a security researcher that an application called “CarrierIQ” is installed on mobile devices from multiple vendors without the knowledge or consent of the device users. RIM does not pre-install the CarrierIQ app on BlackBerry smartphones or authorize its carrier partners to install the CarrierIQ app before sales or distribution. RIM also did not develop or commission the development of the CarrierIQ application, and has no involvement in the testing, promotion, or distribution of the app. RIM will continue to investigate reports and speculation related to CarrierIQ.” 

Nokia

“We are aware of inaccurate reports which state that software from Carrier IQ has been found on Nokia devices. Carrier IQ does not ship products for any Nokia devices so these reports are wrong.”

Samsung Electronics Philippines

“SEPCO can confirm that the Carrier IQ software is not installed on Samsung mobile phones sold in the Philippines.
In fact, Carrier IQ is preloaded in selective Samsung mobile phones only in the US , by carrier’s requirements.”

HTC

“Carrier IQ is a device requirement of a number of U.S carriers, so we encourage consumers or media to contact Carrier IQ or their respective carriers with any questions about the practices relating to, or data collected by, Carrier IQ.   

HTC is not a customer or partner of Carrier IQ and does not receive data from the company, its application or carriers who partner with Carrier IQ. HTC is investigating the option to allow consumers to opt-out of the application.”

Smart

Smart has told us that while they do use diagnostic tools, they have never used anything that resides on a consumer’s phone.

We also reached out to LG, Globe and HTC, unfortunately we have yet to hear their comments on this issue (UPDATE: The local PR arm of HTC has contacted us and we have posted their reply above). The US arm of HTC however has gone on record on Engadget saying that “HTC, like most manufacturers, has an opt-in error reporting function built in to our devices. If your phone experiences an error, you have the option of ‘Telling HTC’ so we can make improvements to our phones. Details about this are in our privacy policy on each device and in order for data to be collected, you have to opt-in. If you do opt-in, we protect your privacy by de-identifying and encrypting the data. HTC is committed to protecting your privacy and that means a commitment to clear opt-in/opt-out as the standard for collecting any information we need to serve you better.” Apple also went on the record on The Verge saying that it has stopped supporting Carrier IQ since iOS5. “We stopped supporting CarrierIQ with iOS 5 in most of our products and will remove it completely in a future software update. With any diagnostic data sent to Apple, customers must actively opt-in to share this information, and if they do, the data is sent in an anonymous and encrypted form and does not include any personal information. We never recorded keystrokes, messages or any other personal information for diagnostic data and have no plans to ever do so.”

What does Carrier IQ mean for you?

From what we’ve gathered, no carrier nor manufacturer here in the Philippines use Carrier IQ. Yet. The biggest danger here is for units imported from the US, especially devices from Sprint – The Verge have reported that the US carrier has said that it uses Carrier IQ to  gather “enough information to understand the customer experience with devices on our network,” but that it can’t look at the contents of messages, photos, or videos using Carrier IQ. It’s still unclear on how many devices from the different carriers in the US use the software. The biggest issue here of course is privacy – if you’re comfortable with the fact that someone might be monitoring what you do, right now, then by all means, buy that imported device from the US. But if you’re someone that values privacy over everything else, then it might be a good idea to not import smartphones from the states.

UPDATE: We have received a statement from HTC’s local PR arm and have updated the article to reflect this.

Source: Engadget, The Verge