The overall chapter of the Carrier IQ saga has yet to be written, but at this juncture, even the rosiest of rose-tinted observers will be hard pressed to locate a silver lining. The threat of federal investigation looms larger by the day. Implicated carriers and manufacturers are washing their hands with Macbethian fury. Al Franken is at the verge of going Al Franken. And on the epicenter of all this sits Carrier IQ — a California-based analytics company that has already gone to great lengths to defend its innocence. First, it sought to discredit Trevor Eckhart’s ostensibly damning research with a cease-and-desist letter. Then, CEO Larry Lenhart flatly denied Eckhart’s findings with an impassioned YouTube address. In recent days, the corporate has markedly softened its stance, arguing that its apps are just designed to satisfy operator demands and to “make your phones better.” Now, Carrier IQ has elaborated upon these arguments with a more detailed breakdown of ways its software functions, and a more substantive defense of its practices. Head past the break to read more.
During a contemporary interview with the Register, Carrier IQ VP of promoting Andrew Coward acknowledged that his company’s mobile software logs keystrokes, intercepts text messages and gathers geographic data, but insisted that the overpowering majority of this data is discarded almost once it is available in, thereby posing virtually no threat to user privacy. For instance his point, Coward likened Carrier IQ’s software to an enormous fishing net:
“We’re on a fishing boat out at sea and we’re catching fish which are too small and that they return in. And so they return in for 2 reasons: One, the holes inside the net don’t catch small fish, i.e. the filtering, and/or the fish is the incorrect type and it gets thrown out of the boat, hopefully while it’s still alive.”
Based on Coward, Carrier IQ only retains text messages or keystroke patterns that carry proprietary tags. These tags identify all transmissions which may be used to populate analytic data, including some that can be considered sensitive. If a user drops a decision, for example, the system will note his or her location, and the numbers of every party. In other cases, the corporate may receive a distinct SMS (or “control message,” as Coward describes it), which supplies Carrier IQ with important diagnostic information (e.g., data on failed SMS transmissions). The corporate collects data at the collection of successfully delivered texts and the telephone numbers of users who send these texts, however the contents of an SMS, Coward insists, are “never stored and not transmitted.”
Key taps, meanwhile, are monitored because certain sequences can trigger responses from the software. If a user is at the line with technical support, let’s say, she or he will be prompted to type in a code which will upload diagnostic data to Carrier IQ’s system. As with text messages, though, only earmarked keystroke sequences are copied. The complete others — including the keystroke patterns displayed in Eckhart’s demo video — are filtered out. In accordance with the Register, Coward’s claims were corroborated by Android security researcher Dan Rosenberg, who reverse engineered Carrier IQ’s software.
Detailed as Coward’s arguments could be, the thrust of his defense rests upon Carrier IQ’s earlier assertions that service providers retain ultimate control over consumer information. “The info that’s being gathered is commissioned by the operators to be gathered,” Coward explained. “It’s under their control, albeit sometimes in our data center, sometimes of their data center. We don’t have any rights to that data.”
For more details, inspect the Register’s full report, linked below.
Everything Everywhere promises ‘small-scale LTE launch’ in UK by the top of 2012
ASUS MWC teaser video hints at possible hi-res tablet display?
