US FTC AND FCC INVESTIGATING CARRIER IQ

Federal investigators have launched a probe in order to examine Carrier IQ’s smartphone software, which tracks a range of activity and sends certain data to wireless carriers without users’ knowledge. Carrier IQ executives met with officials from both the Federal Trade Commission and the Federal Communications Commuission on Tuesday, The Washington Post reports. “We are complying with all investigations at this time as we have nothing to hide,” said Carrier IQ representative Mira Woods. “We have been completely transparent through this process.”

Allegations that the Federal Bureau of Investigation may also be using Carrier IQ software to spy on smartphone users arose on Tuesday when the FBI denied a Freedom of Information Act request for materials related to the Carrier IQ scandal.

CARRIER IQ SOFTWARE TRACKING AND LOGGING CELL PHONE USERS ACTIVITIES

Carrier IQ provides telemetry to cellular carriers and manufacturers, and according to the company itself, its software is preinstalled on over 141 million phones. Now, a security researcher, Trevor Eckhart, claims that the same software is monitoring every single key you press on your smartphone, reading your SMS, and logging much of the personal data you transmit, too — all with an app that you can't remove.

Eckhart accused the company's software of monitoring vast swathes of user personal data and phoning home to the likes of Verizon, Sprint, Samsung, HTC, Nokia, and more, has posted alleged video evidence of his claims on YouTube. Originally, Carrier IQ sent Eckhart a cease-and-desist letter, then withdrew and apologized for the threat, all the while representing that the service it provides cell phone manufacturers and carriers did not "record your keystrokes" or "inspect or report on the content of your communications, such as the content of emails and SMSs."

Contrary to what Carrier IQ states, Eckhart has posted a video of the software doing just that on a HTC EVO 3D phone. Eckhart's video allegedly shows Carrier IQ's software reading incoming SMS messages even before the phone displays them to you, querying supposedly encrypted HTTPS strings, and logging keypresses, all using an application that the user cannot opt-out of, stop, or remove. The video does not show if the data is transmitted or not however.

So far Verizon and Nokia have denied the software exists on their phones and while the software can be found in Apple's iOS, it appears it is only active in debugging mode. [Verge]

MALLS BACK DOWN ON TRACKING SHOPPERS BY CELL PHONES

We reported earlier that the Promenade Temecula in southern California and Short Pump Town Center in Richmond, Va., launched a survey on Black Friday, tracking shoppers' movements by monitoring the signals from their cell phones. The original plan was for those malls to continue the survey through New Year's Day, but after receiving a phone call from Sen. Charles Schumer's office over the weekend, they put the survey on hold.

The technology used antennas set up around the shopping centers to anonymously track shoppers as they moved from store to store. Customers were notified of the survey via small signs, and the only way for them to opt out was to turn their phones off.

In a press conference on Sunday, Sen. Charles Schumer said the malls should have given shoppers the choice to opt-in.
"A shopper's personal cell phone should not be used by a third party as a tracking device by retailers who are seeking to determine holiday shopping patterns," the New York senator said in a statement. "Personal cell phones are just that -- personal. If retailers want to tap into your phone to see what your shopping patterns are, they can ask you for your permission to do so."

While the Cleveland-based mall management company, Forest City Commercial Management confirmed that it tracked shopper data on Black Friday, it said it now plans to pursue an easier opt-out option for consumers.
"We have temporarily suspended further trial of the technology while we work with the system developer on possible enhancements, and in deference to concerns raised by Senator Schumer," the company said. "We look forward to meeting with the senator and his staff, together with the system developer, to further explore his concerns."

JUDGE STRIKES DOWN WARRENTLESS WIRETAPPING; SAYS VIOLATES FOURTH AMENDMENT

A judge in Texas has determined that warrantless cellphone tracking is indeed unconstitutional. In a brief decision issued earlier this month, US District Judge Lynn N. Hughes of the Southern District of Texas argued that seizing cellphone records without a search warrant constitutes a violation of the Fourth Amendment. "The records would show the date, time, called number, and location of the telephone when the call was made," Judge Hughes wrote in the ruling, linked below. "These data are constitutionally protected from this intrusion." The decision comes in response to an earlier ruling issued last year by Magistrate Judge Stephen Smith, also of the Southern District of Texas. In that case, Judge Smith argued against unwarranted wiretapping on similarly constitutional grounds, pointing out that with today's tracking technology, every aspect of a suspect's life could be "imperceptibly captured, compiled, and retrieved from a digital dossier somewhere in a computer cloud."

The federal government appealed Judge Smith's ruling on the grounds that the Fourth Amendment would not apply to cellphone tracking, because "a customer has no privacy interest in business records held by a cell phone provider, as they are not the customer's private papers." Judge Hughes' decision, however, effectively overrules this appeal. "When the government requests records from cellular services, data disclosing the location of the telephone at the time of particular calls may be acquired only by a warrant issued on probable cause," Judge Hughes wrote. "The standard under [today's law] is below that required by the Constitution." The law in question, of course, is the Stored Communications Act -- a law bundled under the Electronic Communications Privacy Act of 1986, which allows investigators to obtain electronic records without a warrant.

ONSTAR ABANDONS PLANS TO TRACK USERS AFTER SERVICE TERMINATION

OnStar found itself at the center of a firestorm after it sent out an e-mail notifying customers that it planned to collect data from vehicles even after service had expired or been terminated. That is, unless the (soon to be former) users specifically opted out. Well, in a statement today, President Linda Marshall changed course and announced the post-subscription data collection would be opt-in only. The company still hoped some departing customers would volunteer to maintain a connection so that it can "provide former customers with urgent information about natural disasters and recalls affecting their vehicles."

FACEBOOK TRIES TO EXPLAIN WHY THEY TRACK USERS EVEN AFTER THEY SIGN OUT

Cookies have been a feature of the web for as long as I can remember. In many cases they are a useful feature to have as they remember your preferences and limit the amount of times you need to login to a service you have signed up for. But there is a dark side to cookie use in the form of them tracking where you go.

The advice to anyone concerned about tracking through cookies is to use a good cookie clean-up utility and log out of sites you believe to be tracking you around the web. But in the case of Facebook it turns out that logging out of your account is not enough–Facebook continues to track you.

This is possible because when you log out of Facebook the associated cookies are not deleted off your machine. So, any site you visit that has a connection to Facebook e.g. the Like button that is now so common, will proceed to check if you have a Facebook cookie. If you do, it can pick up the information and know you’ve visited that site. This logged out tracking was discovered by the Australian writer and hacker Nik Cubrilovic and confirmed logging out is no longer enough.

On Nik’s post where he detailed his findings, Facebook engineer Gregg Stefancik took the time to respond in the comments section. The point he made is that yes, Facebook does track logged out users, but it has good reason to do so. When you log out, the remaining Facebook cookies become a different tool for the social network. Stefancik states they are useful for blocking spammers and phishers, stopping underage users from re-registering with a fake birth date, continuing to keep login approvals and notifications secure, keeping track of shared computer logins, and as a way of helping in the recovery of hacked accounts.

So while Facebook “tracking” when logged out of your account may seem like cause for concern, it in fact turns out to be part of a wider security effort for the social network. Stefancik also states that logging out of Facebook does delete “account-specific cookies” and those that are left do not allow for personal identity tracking. Stefancik’s main point is that Facebook does not share or sell the information it gathers, nor does it use the information for its own advertising or partners. In fact, he states that Facebook does not carry out any tracking at all, at least not in the usual way.

JUDGE RULES USE OF GPS TO TRACK CHEATING SPOUSE LEGAL IN NEW JERSEY

The use of a GPS device to track your whereabouts is not an invasion of privacy in New Jersey, a state appellate court panel ruled today. Based on the battle of a divorcing Gloucester County couple, the decision helps clarify the rules governing a technology increasingly employed by suspicious spouses — many of whom hire private investigators.

“For the appellate division to say that it’s not an invasion of privacy is a wonderful thing for the private investigation business,” said Lisa Reed, owner of LSR Investigations in Flemington. “It’s been something we’ve been haggling over for some period of time.”

No state law governs the use of GPS tracking devices, and the ruling, which does not affect police officers, is the first to address the issue, said Jimmie Mesis, past president of the New Jersey Licensed Private Investigators Association.

The court ruled in the case of Kenneth Villanova, a Gloucester County sheriff’s officer who sued private investigator Richard Leonard of Innovative Investigations Inc., hired by Villanova’s now ex-wife in 2007.

After Villanova evaded Leonard, who was following him, on several occassions, he recommended that Villanova’s wife buy a GPS tracking device. She put it in the glove compartment of the GMC Yukon-Denali, which they both owned but was primarily driven by Villanova, the court papers said. It was in place, undetected, from July 14 to Aug. 24, 2007. Two weeks into the GPS tracking, Leonard found Villanova leaving a driveway in his car with a woman who was not his wife, the decision said.

Villanova initially sued his wife for invasion of privacy and tried to include Leonard in that case as well. Villanova eventually dropped the claim against his wife in the divorce settlement but pursued his suit against Leonard. Villanova claimed the tracking device invaded his privacy and caused him ”substantial and permanent emotional distress,” though the appellate judges noted he sought no medical treatment or advice.

Appellate Judge Joseph Lisa, Jack Sabatino and Carmen Alvarez said Villanova had no right to expect privacy because the GPS tracked his movements on public streets. “There is no direct evidence in this record to establish that during the approximately 40 days the GPS was in the ... glove compartment the device captured a movement of plaintiff into a secluded location that was not in public view, and, if so, that such information was passed along by Mrs. Villanova to (Leonard),” Lisa wrote.

DISABLING LOCATION SERVICES DOESN'T STOP iPHONE FROM TRACKING YOUR LOCATION

The recent rediscovery that Apple’s iPhone is tracking and storing users’ locations, after users all agreed to let Apple track, store and use their locations, of course, has caused quite an uproar. Unlike the last time this was discovered, the ordeal continues to make news nearly a week later instead of being forgotten immediately.

In this latest round of outrage, The Wall Street Journal has revealed that Apple’s iPhone continues to collect and store users’ locations even when location services are disabled. The Journal believes that the data is collected using data from cell towers and Wi-Fi hotspots as the iPhone communicates with them. This, too, is well within Apple’s rights, and the rights of other cell phone providers, but the revelation is still likely to result in a new round of chatter.

Additional reports reveal that government bodies in several countries including South Korea, France and Germany are investigating Apple’s location-tracking practices, and they will likely make formal inquiries once they have enough information to do so.

APPLE DOESN'T TRACK ANYONE ACCORDING TO STEVE JOBS

In what is purported to be an email exchange with Apple CEO Steve Jobs, a MacRumors reader sent in the following:

Q: Steve,
Could you please explain the necessity of the passive location-tracking tool embedded in my iPhone? It’s kind of unnerving knowing that my exact location is being recorded at all times. Maybe you could shed some light on this for me before I switch to a Droid. They don’t track me.

A: Oh yes they do. We don’t track anyone. The info circulating around is false.

Sent from my iPhone

What’s not clear is whether or not Jobs was indicating that stored location data isn’t actually being sent back to Apple, and is instead only stored locally on the device and in iOS backup files created by iTunes. What is clear according to Jobs, however, is that Android is tracking customer’s location (and more) right out of the box. There are reports that the location recording issue in iOS 4 will be fixed in a software update and was a bug as opposed to a deliberate attempt to collect data.

COPENHAGEN AIRPORT TRACKS VISITORS USING WIFI

According to the New York Times, Copenhagen International Airport is currently testing a new program that monitors passengers based on WiFi data emitted from devices like laptops and smartphones. Airport officials observe travelers from a remote computer, and can tell, within 10 feet of accuracy, where they spend their time -- those arriving and departing are represented by different colored dots. The program, created by Geneva-based SITA, also gives visitors the option to download an iPhone app that provides location-based information, like promotions from nearby restaurants. SITA's VP said the software isn't intrusive, as it follows devices, not individuals.

MOZILLA OFFERS DO-NOT-TRACK TOOL

According to CNet, Mozilla, acting on a U.S. Federal Trade Commission proposal, has offered a detailed mechanism by which Firefox and other Web browsers could prevent Web pages from tracking people's online behavior for advertising purposes.
With Mozilla's do-not-track technology, network data packets from the browser would signal to a Web site that a person doesn't wished to be tracked. Then comes the tricky part: getting Web site operators to cooperate.
Alex Fowler, Mozilla's global privacy and public policy leader, said that with the mechanism, the browser would alert a Web site during basic communications that use the Web's Hypertext Transfer Protocol (HTTP). He also acknowledged that getting Web sites to cooperate is a crucial difficulty in getting the system to work:

As the first of many steps, we are proposing a feature that allows users to set a browser preference that will broadcast their desire to opt-out of third party, advertising-based tracking by transmitting a Do Not Track HTTP header with every click or page view in Firefox. When the feature is enabled and users turn it on, Web sites will be told by Firefox that a user would like to opt-out of OBA [online behavioral advertising]. We believe the header-based approach has the potential to be better for the Web in the long run because it is a clearer and more universal opt-out mechanism than cookies or blacklists...
The advantages to the header technique are that it is less complex and simple to locate and use, it is more persistent than cookie-based solutions, and it doesn't rely on user's finding and loading lists of ad networks and advertisers to work...
The challenge with adding this to the header is that it requires both browsers and sites to implement it to be fully effective. Mozilla recognizes the chicken and egg problem and we are taking the step of proposing that this feature be considered for upcoming releases of Firefox.

Mozilla doesn't appear to be acting alone. Today, "Google is expected to announced a privacy tool called 'Keep My Opt-Outs' that enables users to permanently opt out of ad -targeting from dozens of companies," The Wall Street Journal reported yesterday, citing an unnamed source.