Sprint on Friday confirmed that it has disabled Carrier IQ on its servers and it is no longer actively using the software to collect diagnostic data. ”We have weighed customer concerns and we have disabled use of the tool so that diagnostic information and data is no longer being collected,” a Sprint spokesperson told Mobile Burn. “We are further evaluating options regarding this diagnostic software as well as Sprint’s diagnostic needs.” Sprint revealed in a letter to Senator Al Franken earlier this week that Carrier IQ is currently installed on approximately 26 million Sprint smartphones. Reports from earlier on Friday suggested that Sprint has already begun notifying its vendor partners to remove Carrier IQ software from their handsets, but Sprint did not directly address those claims.
Federal investigators have launched a probe in order to examine Carrier IQ’s smartphone software, which tracks a range of activity and sends certain data to wireless carriers without users’ knowledge. Carrier IQ executives met with officials from both the Federal Trade Commission and the Federal Communications Commuission on Tuesday, The Washington Post reports. “We are complying with all investigations at this time as we have nothing to hide,” said Carrier IQ representative Mira Woods. “We have been completely transparent through this process.”
Allegations that the Federal Bureau of Investigation may also be using Carrier IQ software to spy on smartphone users arose on Tuesday when the FBI denied a Freedom of Information Act request for materials related to the Carrier IQ scandal.
The FBI has denied a Freedom of Information Act (FOIA) request for materials about Carrier IQ, a company that has been in the spotlight recently after a security expert revealed that its software is installed on millions of smartphones. The FOIA request was sent by MuckRock and specifically asked for “manuals, documents or other written guidance used to access or analyze data gathered by programs developed or deployed by Carrier IQ.” FBI section chief David Hardy responded to MuckRock’s request with the following statement:
I have determined that the records responsive to your request are law enforcement records; that there is a pending prospective law enforcement proceeding relevant to these records; and that release of the information contained in these responsive records could reasonably be expected to interfere with the enforcement proceedings.
It is unknown if the FBI is currently working hand-in-hand with Carrier IQ or if Carrier IQ is the subject of an FBI investigation. MuckRock said that it plans to appeal the FBI’s FOIA denial.
Senator Al Franken, chairman of the Senate subcommittee on privacy, technology and law, sent a letter to Carrier IQ on Thursday asking the company to address a number of concerns that have arisen after security expert Trevor Eckhart revealed the software might allow wireless carriers to spy on customers. “I am very concerned by recent reports that your company’s software — preinstalled on smartphones used by millions of Americans — is logging and may be transmitting extraordinarily sensitive information from consumers’ phones,” Senator Franken wrote in his letter. Read on for more.
Franken noted that Carrier IQ has been accused of be keeping track of when users turn their phones on and off, what numbers users dial, message contents and more. He said he understands that carriers need to collect data to run diagnostics but that “it appears Carrier IQ’s software captures a broad swath of extremely sensitive information from users that would appear to have nothing to do with diagnostics.”
Sprint admitted to The Verge on Thursday that it, and other carriers, “use the data to understand device performance so [it] can figure out when issues are occurring,” and that it doesn’t sell the data and can not look at messages, personal photos or other private information.
Carrier IQ provides telemetry to cellular carriers and manufacturers, and according to the company itself, its software is preinstalled on over 141 million phones. Now, a security researcher, Trevor Eckhart, claims that the same software is monitoring every single key you press on your smartphone, reading your SMS, and logging much of the personal data you transmit, too — all with an app that you can't remove.
Eckhart accused the company's software of monitoring vast swathes of user personal data and phoning home to the likes of Verizon, Sprint, Samsung, HTC, Nokia, and more, has posted alleged video evidence of his claims on YouTube. Originally, Carrier IQ sent Eckhart a cease-and-desist letter, then withdrew and apologized for the threat, all the while representing that the service it provides cell phone manufacturers and carriers did not "record your keystrokes" or "inspect or report on the content of your communications, such as the content of emails and SMSs."
Contrary to what Carrier IQ states, Eckhart has posted a video of the software doing just that on a HTC EVO 3D phone. Eckhart's video allegedly shows Carrier IQ's software reading incoming SMS messages even before the phone displays them to you, querying supposedly encrypted HTTPS strings, and logging keypresses, all using an application that the user cannot opt-out of, stop, or remove. The video does not show if the data is transmitted or not however.
So far Verizon and Nokia have denied the software exists on their phones and while the software can be found in Apple's iOS, it appears it is only active in debugging mode. [Verge]
