Carrier IQ, the provider of Mobile Service Intelligence Solutions for the whole of the wireless industry, is engulfed in a good bit of controversy ever since Trevor Eckhart, an Android app developer, presented evidence that Carrier IQ software listens in on your web activity, even when connected on Wi-Fi networks, as well as keeping a keystroke log.

The Defense

Carrier IQ answered Eckhart’s allegations in an interview with AllThingsD clarifying that what was shown was proof that the software receives a huge amount of information, but his findings did not actually show signs that gathered information were being processed, stored or forwarded.  Also, the data collected is actually used by carriers to determine consumer behavior or know if consumers are encountering some service problems.

“If there’s a dropped call, the carriers want to know about it,” said Carrier IQ’s VP of marketing Andrew Coward. “So we record where you were when the call dropped, and the location of the tower being used. … Similarly, if you send an SMS to me and it doesn’t go through, the carriers want to know that, too. And they want to know why — if it’s a problem with your handset or the network.”

Coward also added that they do not read SMS messages but he admits that they see the messages come in, as well as the number attached to the messages but they assure consumers that they do not store, analyze or process the content of messages.

Carrier IQ CEO Larry Lenhart pointed out that they only do what the carriers ask,  since they are the ones to determine  what data will be collected.  He also defended carriers, stating that they are bound by their contracts with their customers.

“What’s actually gathered, stored and transmitted to the carrier is determined by its end-user agreement,” he says. “And, as I’m sure you’re aware, the carriers are highly sensitive about what data they’re allowed to capture and what they’re not allowed to capture.”

The Users And Non-users

According to Eckhart’s findings, mobile manufacturers such as HTC and Samsung, as well as network carriers such as Verizon and Sprint, make use of Carrier IQ’s software.  But with Eckhart’s statement rattling the tech world, carriers and phone manufacturers feel the need to clear their names.

• T-Mobile spokesman Troy Edwards also issued the following statement: “T-Mobile does not use this diagnostic tool to obtain the content of text, email or voice messages, or the specific destinations of a customers’ internet activity, nor is the tool used for marketing purposes.”
• AT&T spokesman Mark Siegel stated that, “In-line with our privacy policy, we solely use CIQ software data to improve wireless network and service performance.”
• Sprint spokeswoman Stephanie Vinge-Walsh, “Carrier IQ provides information that allows Sprint, and other major carriers that use it, to analyze our network performance and identify where we should be improving service.  Carrier IQ is an integral part of the Sprint service. Sprint relies on Carrier IQ to help maintain our network performance.”
• Nokia also stated that they also not use the software in their devices.
• Verizon spokesman Jeffrey Nelson said in his Twitter account that they do not use Carrier IQ in their devices.
• Google’s latest pet device, the Samsung Galaxy Nexus and the original Xoom are said to be Carrier IQ-free as reported by the Verge though no statement has yet been issued by Samsung.
• Apple stated that they have used and supported Carrier IQ’s software in their products but clarified that it is a user opt-in service but they have removed it in iOS 5 devices as well as most of their other devices and will soon be removed from all of their devices.

The Government

Since this is a matter of the public’s security and privacy, you can bet your ass that the government is looking into the matter.  DFL Sen. Al Franken, chair of the Senate subcommittee that deals with digital privacy issues, sent a letter to Lenhart which contains a detailed list of questions regarding how their software’s capabilities.  Franken expects a response not later than December 14.

“The revelation that the locations and other sensitive data of millions of Americans are being secretly recorded and possibly transmitted is deeply troubling,” said Franken in a written statement. “This news underscores the need for Congress to act swiftly to protect the location information and private, sensitive information of consumers.”

The Detractors

As with any issue, there will always be someone disproving anyone’s claim.  According to Dan Rosenberg, a senior consultant at Virtual Security Research, what Eckhart claims is not true and supports Carrir IQ’s claims stating that the evidence presented only showed diagnostic information and there was no evidence that Carrier IQ store or tamper gathered information.

“I’ve reverse engineered the software myself at a fairly good level of detail,” Rosenberg said. “They’re not recording keystroke information, they’re using keystroke events as part of the application.”

Jon Oberheide, a co-founder of Duo Security, also stated that what Eckhart showed in his video when he pressed keys were not recordings but “debugging messages” which are informational feedback meant to help smartphone programmers verify that their applications are working correctly.

“It’s just spitting debug messages to the internal Android log service,” said Oberheide. “It appears that Carrier IQ is indeed collecting some metrics, but I have not seen any evidence that keystrokes, SMS messages or Web browsing session content are being transferred off the device.”