Carrier IQ Not Alone: Most Smartphones Will Track You

Security researcher Trevor Eckhart demonstrates how Carrier IQ logs keystrokes on his Android smartphone. (YouTube/Trevor Eckhart)

Cell phone surveillance is all fun and marketing until they start following you -- and we're all being followed to one degree or another by our fancy smartphones.

Tracking is an intrinsic feature of every wireless network and every smartphone today. Programs track your usage and location all the time. If they didn't, you couldn't make a call or find a restaurant near you. The problem arises when someone stores that information and shares it without telling you.

Enter Carrier IQ, whose business it is to store some of that information and share it with wireless carriers such as AT&T and Sprint. The goal is to improve the carriers' service, the company says. It uses firmware (software installed by a phone's manufacturer and hidden from the user's view) to accomplish the task, keeping track of your location, the Web sites you visit, and the applications you use.

What else it does is unclear.

Carrier IQ's business wasn't a secret (and I've got old press releases from the company to prove it), but it wasn't on the public's radar until Trevor Eckhart noticed strange data traffic on a corporate network. He traced it to employee smartphones and then back to Carrier IQ. Then came the howls of horror: Eavesdroppers! Spies! They're on your phone, and you may be paying for their messages!

Rather than being a good corporate citizen and explaining how its work benefited everyone, Carrier IQ threatened Eckhart with legal action. It might as well have waved a red cape in front of every privacy advocate and trial lawyer in the country.

There are now several class-action lawsuits against Carrier IQ brought in California and Delaware accusing every business involved -- from Blackberry's RIM to Motorola and T-Mobile -- of misdeeds. And Minnesota Sen. Al Franken,who heads a government panel on privacy issues, has sent letters asking for more specific information not only to Carrier IQ but also to AT&T and Sprint and handset makers HTC and Samsung.

All this may seem like an over-reaction, but the brouhaha about Carrier IQ could do a lot of good. It could get more consumers to sit up and take notice and force companies to change their policies. It could even prompt the government to address issues that have lingered on the digital back burner for years (okay, probably not).

Many of us -- fearful of sharing an inebriated Facebook moment that might get us fired -- have good reason to worry that details about us could be used against us. Insurance companies constantly scan social networking sites, for example, and employers now comb your FB friends and Google you before they hire. Would it also be acceptable for them to purchase information about you from a company like Carrier IQ?

Drawing the privacy line in cyberspace is no simple matter, but that doesn't mean it shouldn't be drawn. We need to consider, for example, precisely what constitutes private communications. Is the fact that you visited an adult entertainment portal or a gun dealer's site private (never mind what you did when you got there)? Should any company be allowed to sell information about your whereabouts without your permission?

Well, you've probably given them your permission already.

Many smartphone apps cull personal information that they have no legitimate reason to ask for (check the permissions page of the next app you download). The Carrier IQ flap should chasten us to be more careful.

It should also chasten businesses. Given the almost total lack of transparency, companies subjected to these lawsuits have only themselves to blame. If they made it clear to consumers how and what personal information was being used, they wouldn't end up talking to lawyers. Consider how angry consumers get about telemarketing calls; don't these companies realize we'll get even more riled about issues like this?

In its defense, Carrier IQ has somewhat vaguely explain its business and made a statement to the effect that it abides by “the laws of the applicable jurisdiction.” That's disingenuous. It's like saying you promise to abide by the applicable laws governing the proper way to eat spaghetti, realizing full well that there aren't any laws that force you to use a spoon.

Perhaps Sen. Franken and others will finally get to put some teeth into laws governing our digital privacy. But he faces uber-wealthy individuals such as Google's ex-CEO Eric Schmidt who will fight it tooth and lobbyist all the way.

The best solution may be to take matters into your own hands. To find out if you're being followed, security firm Bitdefender is offering a free tool to scan Android phones for the software -- it won't remove or disable Carrier IQ's program, however. For that, you should call your carrier and complain.

As a consumer, you should also use only programs that promise not to share your information. Although, increasingly, such promises are few and far between.