American mobile software company in hot water

The controversy surrounding Carrier IQ (a Californian-based mobile software company) continues to rumble on now that it has emerged that federal investigators are looking into the allegations that the company’s software monitors mobile users’ activities without their knowledge or consent.  On December 14th representatives from Carrier IQ met with officials from the Federal Communication Commission (FCC) and Federal Trade Commission (FTC).  The aim of the meeting was to discuss and explain how their product works and what it is designed to do, and I assume that the regulators wanted to establish potential problems regarding security breaches and concerns about mobile user privacy.

This meeting is just the latest twist in this controversy which stems from an allegation by Trevor Eckhart, an Android researcher, that Carrier IQ's diagnostic tools could be a security risk as they tracked personal mobile phone data.  It seems that while he was researching  part of Carrier IQ's software for smartphones he found that one element of it monitored every key press and SMS message that was typed, and sent this usage data on to the network operator.  According to Eckhart, the software collected information such as the phone's location, which URLs the user visited, as well as data on SMS messages and phone calls, and forwarded it to the carrier—all worrying stuff as far as security and privacy are concerned.

Now Carrier IQ insists that their software (which is usually embedded on to American mobile phones by the network operators) is designed to give the carriers information about their network’s performance so they can identify where they can make improvements--that is it.  However, the telecommunication software company hasn’t been upfront about collecting this type of sensitive and highly private information and it is this failure to inform and/or get permission to monitor this type of data that seems to be the real crux of the issue.  Given that this could lead to security and privacy issues, at the very least you expect mobile users to be able to opt out of this data collection if they want.  But this is easier said than done, and more often than not users can’t easily turn it off…which again sets off alarm bells.

Given all the controversy (not to mention a "cease-and-desist" order and lawsuits that have been flying around the US courts) it is important to note that Carrier IQ has stated that its software is not designed to capture keystrokes or the content of SMS messages,  though in some cases this may be what mistakenly happens.  According to Carrier IQ some of the most troublesome breaches of privacy were caused by poor coding and bad practises from its network operators and original manufacturing partners.  No doubt it will be working hard to rectify these problems post haste.

It will be interesting to see just how this story unfolds during the coming months, and whether the regulators will take steps to protect mobile users by controlling what information can and cannot be gathered from mobile phone users in the name of better service.   While we all want a first-rate mobile network service, we may not be willing to abandon our privacy in order to get it…and at the very least we should be given a choice.