The Internet is buzzing over a researcher鈥檚 that software from a company called Carrier IQ, installed on more than 140 million smartphones and difficult to detect or remove, collects and reports back to Carrier IQ detailed data on users鈥 activities.
According to researcher Trevor Eckhart, the company鈥檚 software logs keystrokes, text message content, location information, and browsing history 鈥 even when encrypted browsing is turned on. According to Eckhart, the software sends all this data back to the company 鈥 and, does so even when the phone is disconnected from any carrier鈥檚 network and is just using a local WiFi connection.
One researcher has been as casting doubt on the accuracy of Eckhart鈥檚 claims, and Carrier IQ has at what its own product has been found to do. But, Carrier IQ鈥檚 web site says the following:
Q Insight Experience Manager provides a level of visibility into true customer experience that was, previously unavailable in the mobile industry. . . . IQ Insight Experience Manager uses data directly from the mobile phone itself to give a precise view of how users interact with both their phones and the services delivered through them, even if the phone is not communicating with the network. . . . Identify exactly how your customers interact with services and which ones they use. See which content they consume, even offline.
We don鈥檛 know what the carriers or other companies are buying, but it鈥檚 pretty clear what Carrier IQ is selling.
Carrier IQ and its customers 鈥 especially mobile providers 鈥 need to come clean about what information they have or have not been collecting from customers鈥 phones using this product. The carriers have begun to 鈥 Verizon, for example, says it does not use CarrierIQ, while Sprint says it does not look at any content but collects 鈥渆nough information to understand the customer experience with devices on our network.鈥
There鈥檚 enough latitude in that statement 鈥 and in most of the carriers鈥 privacy policies 鈥 to allow for lots of possible privacy-invading practices that the public ought to know about. Mobile providers are not just regular companies 鈥 they run part of the infrastructure of our country, the machinery that people depend upon in their daily lives to an ever greater degree. Yet we can鈥檛 use the Freedom of Information Act to get to the bottom of their practices as we often can with government agencies. We need an investigation of this situation to get to the bottom of what exactly has been going on.
Sen. Al Franken (D-Minn.) has already made a good start toward that end by about what it is doing. We hope that others in Congress and the Obama administration will follow suit. Ultimately, as the questions around this company demonstrate, Congress needs to enact comprehensive privacy legislation that will create stable expectations for all parties about what can and cannot be done with this kind of personal information.
Everyone understands that carriers may need to access certain information in order to run their network on a technical level. But concepts such as 鈥渘etwork management鈥 and 鈥渙ptimization of the user experience鈥 threaten to bleed into excuses for spying on customers for marketing or other purposes. In addition, there is no balancing mechanism in place 鈥 ensuring, for example, that companies don鈥檛 engage in massive invasions of privacy in order to receive relatively slight efficiency gains. (Speaking of massive invasions of privacy, we recently called upon the major carriers to stop routinely retaining tracking data about their customers鈥 locations.)
When we buy a desktop computer, we don鈥檛 expect that Apple, Dell, Sony, or other manufacturers will install software to transmit information about how we use our machines back to some company. Our smartphones are also computers, and it should be no different.
Learn more about privacy: Sign up for breaking news alerts, , and .