11 ms·
Secret app on millions of phones logs key taps
- EwanToo 15y agoThere is no evidence the data is being logged and sent. Accessed yes, logged, well nobody has found the log yet, and sent, nobody has found any network traffic. It's still bad, but the reports seem to be over-hyped by journalists looking for a scoop.
- revscat 15y agoIrrelevant. The issues are: (1) That a vector is there for an untrusted third party to record and report all keystrokes (2) It was put there at the insistence of the carriers, and (3) That there is no way for a user to turn it off without voiding their warranty. edit: (4) This has serious implications for the trustworthiness of Android-based platforms as we attempt to move towards using NFC for financial transactions. Who in their right mind would trust Android (or any smartphone, really) as a debit card after this?
- scott_s 15y agoJwanToo, jgrahamc and tptacek are questioning point 1. That is, they're pointing out reasons why it may not be a vector. We don't have enough information to know.
- funkah 15y agoBefore reading, I guessed that "millions of phones" meant millions of Android phones. Because if this was happening on iPhones, that would merit mention in the headline. Funny how that works.
- roflharrison 15y ago>Funny how that works How what works? I see just as many "Android phones do this naughtiness" headlines as I see "iPhones allow these shenanigans" headlines. The fact that is isn't mentioned in the header lends more credence to the author (and article).
- dignan 15y agoFTA: "Eckhart said he chose the HTC phone purely for demonstration purposes. Blackberrys, other Android-powered handsets, and smartphones from Nokia contain the same snooping software, he claims." It's not "Android" phones alone, it seems like everything but iPhones and Windows phones. Thus, the title is accurate.
- smokinn 15y agoAnd you guessed wrong. It says iphones and blackberrys are equally affected.
- artursapek 15y agoBlackberries possibly, I saw no mention of iOS devices.
- gcb 15y agoIos also collects all that. It's just more difficult to see inside a safe. Remember the js code that showed all the places the phone have been using a mere phone backup data? ios is already worse then all of this
- masklinn 15y ago> Ios also collects all that. Do you have the slightest evidence for your claim? > It's just more difficult to see inside a safe. Anything can be seen on a jailbroken iphone. > Remember the js code that showed all the places the phone have been using a mere phone backup data? This was (explained as) a location cache the developer forgot to clean (most phones will cache the last few locations so it does not have to boot the location circuitry if an application only needing a very rough location estimate needs a fix) which mistakenly existed in a backuped location (note that unless users sent them, those backups never left their machine). And the issue was fixed in the next update (both the backuping and the too-greedy cache). > ios is already worse then all of this I'll go with no until you provide evidence.
- artursapek 15y agoYou made me wonder- is jailbreaking an iPhone the equivalent of rooting an Android phone? It's just about becoming the root user in the Unix system right? I've never played with either.
- gcb 15y ago
- mcritz 15y agoRemember when people were up in arms about how much location data iPhones stored locally? This is 1000 times worse.
- kayzee 15y agoI agree with this (maybe not 1000x worse, but still). Anything Apple does wrong is blown out of proportion. Yes the Apple collected data wasn't encrypted, but now it is. What if this data is compromised at this CIQ company? I hope the data is traceable to an IMEI number ONLY which would make it okay, but still! Why do they need to receive text messages coming in to the phone???
- interlagos 15y agoThe location data concern was that if anyone got possession of your phone or a copy of your backup, they could discern your entire location history. With this finding, if someone got possession of your phone, they could apparently discern...nothing. Instead a subset of data is sent to a company contracted by the carriers (or at least one - Sprint) for the purposes of network monitoring/quality monitoring. Of course the carriers already know your location history through time (just as they know every SMS you sent, picture you sent, data you transmitted, voice call you made, etc), whether you're on a smartphone or dumbphone, and everyone knows and is aware of this. Is this app sending too much data? I guess we'll find out. Is it "1000 times worse" than a forever location log easily exploitable? Not really. EDIT (while sitting at -4 while the hysterics have their fit of vapours): Moderation in this story has demonstrated to me once and for all that HN is largely populated by ignorant bottom-feeders now. It is a sad state of affairs, and this site desperately needs a turn off moderation from dipshits option for users to toggle.
- arunabha 15y agoIf someone got your phone, they could get all the passwords you typed in. Its certainly not 'nothing' that they could discern.
- interlagos 15y ago
- kunle 15y agoThis cant be real right?
- kunle 15y agoThis cant be real right?
- tibbon 15y agoIs there any evidence that any of this is uploaded to a carrier or app maker? Can any app developer access this log from their app? It seemed essentially that the debug logs just kept a super verbose log for debugging.
- deleted 15y ago[deleted]
- runjake 15y agoIt should be noted that there's no evidence (yet) of what is sent to other entities, only what is captured by the software on the device. This is bad enough, though. But, let's keep our head about this and calmly demand an explanation from HTC. Why them? Because they signed the binaries with their certificate, presumably at the request of carriers, but HTC is the first in line. And don't believe the response from CarrierIQ. Just prior to that response, they still had very informative high resolution screenshots of their "Device Analyzer" product which showed a scary level of data mining of end user devices. They were probably great eye candy for their customers (carriers), but creepy for anyone valuing their privacy. I agree that this information is likely for improved QoS, but what can (has) it been mis-used for? Employees can't be trusted, and the government can't be trusted. An end user can't even opt out of it. Edit: According to Google Image Search, others are mirroring some of the prior shots. Note that nothing is anonymized in the least (nevermind that anonymizing data is practically a myth). I'll try and tack the URLs below. http://androidsecuritytest.com/wp-content/uploads/2011/11/ciqdevicelist.png http://androidsecuritytest.com/wp-content/uploads/2011/11/ci... http://www.xda-developers.com/wp-content/uploads/2011/11/metrics.png?139d23 http://www.xda-developers.com/wp-content/uploads/2011/11/met... http://androidsecuritytest.com/wp-content/uploads/2011/11/metric_categories1.png http://androidsecuritytest.com/wp-content/uploads/2011/11/me... http://androidsecuritytest.com/wp-content/uploads/2011/11/trigger_references.png http://androidsecuritytest.com/wp-content/uploads/2011/11/tr... http://androidsecuritytest.com/wp-content/uploads/2011/11/CIQoverview.png http://androidsecuritytest.com/wp-content/uploads/2011/11/CI... http://androidsecuritytest.com/wp-content/uploads/2011/11/singledevice.png http://androidsecuritytest.com/wp-content/uploads/2011/11/si... http://www.carrieriq.com/overview/IQInsightDeviceAnalyzer/DeviceAnalyzer.datasheet.pdf http://www.carrieriq.com/overview/IQInsightDeviceAnalyzer/De... This one doesn't need to be big to get the jist: http://www.carrieriq.com/overview/IQInsightServiceAnalyzer/image001.jpg http://www.carrieriq.com/overview/IQInsightServiceAnalyzer/i...
- revscat 15y agoTo be fair, the response from CarrierIQ implies that this is the case: "In an interview last week, Carrier IQ VP of Marketing Andrew Coward rejected claims the software posed a privacy threat because it never captured key presses. “Our technology is not real time,” he said at the time. "It's not constantly reporting back. It's gathering information up and is usually transmitted in small doses.” Note that last clause there.
- cbs 15y agoIts much easier to invade privacy in the name of providing a better product than to actually figure out what the customer wants. Collecting huge swaths of data allows product to be tweaked to find a local maximum of profitability. Its an easier and safer alternative than to actually understand one's own product from a consumer perspective. I fear this is where we're going in all corners of tech. Even moreso because we're already quickly eroding at any expectation that one should provide privacy to their users. All the while users are ignorant enough about tech in general and have no idea that their privacy can and is flying out the door. Software exists in such a way that the lay user can't ever understand the boundaries or capabilities of software to do things that they are completely unaware of. The numbers of people who do understand what is going on is so small that they are neither a significant portion of the market, nor a "reasonable person" in the eyes of courts. Privacy will be dead before anyone even notices.
- jgrahamc 15y agoDoes it really? http://blog.jgc.org/2011/11/getting-little-tired-of-security.html http://blog.jgc.org/2011/11/getting-little-tired-of-security... There's no evidence that it sends this information to the company and no evidence that it actually logs it. Only that APIs are called containing it.
- law 15y agoThe part about logging/transmitting personal info is a red herring. The real issue is failing to provide an opportunity for users to assent to the installation of this software on their device. It makes no difference to me whether data is being logged or transmitted over a network. However, I'm terrified that a phone manufacturer would install a very hidden program with root-like privileges, offering a single point of failure. A malicious user could potentially exploit this program's vulnerabilities to access everything on your phone.
- Fluxx 15y agoIMO, this is a slippery slope argument. The actual phone OS, which is certainly "logging key presses" is also an opportunity for exploitation via vulnerabilities. I fail to see how software is a special case? Additionally, the carriers are certainly storing and tracking your movement and location, and storing your SMS (how else do you suddenly get them when you turn your phone on after your plane lands?) I think the subtle difference here is that we as consumers have a implicit understanding that the OS and the carriers must store and handle our data in order to provide the services to us that they do. We must trust them if we use their devices and networks. That trust is given because the data sensitivity is proportional to the disclosure and scrutiny of the providers. The phone, its OS and who provides the network inherently have access to all your data, a huge responsibility, so no attempts are made to hide or obfuscate who those companies are and what they're doing. You know Samsung makes your phone, it runs on android and you use the Verizon network. CarrierIQ seems to have access to all the same data your OS and carrier has, yet their presence is not made transparent/known to the user of the phone. That said, it's not clear to me what CarrierIQ's integration is like? Is it purely a software framework Android uses to log and store metrics for the carriers? Is it a 3rd party app installed by the carrier to help them store user metrics? How antonymous is CarrierIQ with the data? Do CarrierIQ engineers see your data or is it just for the carriers? Until that's clear, it's anyone's guess.
- qqqqqq 15y agoI am surprised the internet took this long to respond, considering that the HN discussion on this was started almost a week ago[1][2]. That said, after watching the video I'm all kinds of sceptical about the dude's claim. [1] http://news.ycombinator.com/item?id=3263955 http://news.ycombinator.com/item?id=3263955 [2] http://news.ycombinator.com/item?id=3273416 http://news.ycombinator.com/item?id=3273416
- DevX101 15y agoThere are a handful of comments here giving CarrierIQ the benefit of the doubt, because the video did not show CarrierIQ sending the logged data over the network. If you're still inclined to give them the benefit of the doubt, just read the CarrierIQ website. Their ENTIRE BUSINESS MODEL is based on collecting data about mobile phone users!! Here's a choice excerptI found on their website after browsing their site for 30 seconds[1]: Carrier IQ's Mobile Service Intelligence Platform (MSIP)...receives raw data (known as Metrics) from phones and converts them into reliable, repeatable Measures which feed into analytic applications. Or you can read this comment from a discussion last week where a CarrierIQ recruiter told an HN member that they collect 10s of gigabytes of data PER DAY.[2] These guys are indeed collecting RAW DATA from actions on your phone. There are tremendous opportunities for abuse here, should CarrierIQ decide to do so. CarrierIQ in blatant violation of privacy norms and could do enormous damage to national security of many countries, conduct corporate espionage, or simply violate the citizens' expectation of privacy when using their phone. This is dangerous and should be stopped immediately. 1. http://www.carrieriq.com/overview/mobileservice/index.htm http://www.carrieriq.com/overview/mobileservice/index.htm 2. http://news.ycombinator.com/item?id=3264264 http://news.ycombinator.com/item?id=3264264
- EwanToo 15y agoThey are collecting data, but I'm pretty sure it's not keystroke data - that kind of volume would be 10s of TB per day, not GB. From your link to the recruiter: Each handset collects and reports 100's of metrics of device and user behavior in real time. That's data like phone location, applications used, etc. Very bad yes, keylogger reporting your password, no.
- drivebyacct2 15y agoDid you read any of the articles or watch the video? The guy shows `adb logcat` running and showing CarrierIQ logging keystrokes with their ASCII codes. (edit: I make no claims about the transmission of data. I merely took "collection" and assumed that if the app was recording (even if not persistently) keystrokes on my phone that it counted as collection. Further, the fact that it can is enough to piss me off, especially since it seems like makers of this type of software have piss-poor track records for their app security)
- kevin_jacobs 15y agoAs a WP7 user, I emailed HTC yesterday asking whether or not this software (or similar products) are used on their WP7 devices. Here's the response I got: "Dear Kevin Jacobs, I understand you would like more information about the Carrier IQ software, or any software of this nature on your device. I understand your concerns about this issue and protecting my privacy is definitely one of my top priorities as well. We have not had any reports of any kind of software like this on any Windows Phone 7 device. This type of software has been used on Android devices, but since Microsoft developed this operating system I am sure they did not include any software of this kind. Let me know if I have successfully answered your question, please click here to complete this. To send a reply to this message, please click here. Sincerely, Kathleen HTC"
- code_duck 15y agoThat's a very non-reassuring answer, as her 'sure' statement doesn't sound very sure. The original report at http://androidsecuritytest.com/features/logs-and-services/loggers/carrieriq/ http://androidsecuritytest.com/features/logs-and-services/lo... states "Devices supported include android phones, Blackberries, Nokias, Tablet devices and more."
- freehunter 15y ago>I am sure they did not include any software of this kind. While I am a WP7 owner, I find this to be a little presumptuous. Microsoft may not have included _this specific_ software, but how does HTC know they didn't include anything like it? I don't believe Microsoft gives handset makers the source code for the software. I know they don't allow them to customize it. Perhaps HTC has not installed anything like it or been allowed to install anything like it, but how would HTC know if MS did it themselves?
- ugh 15y agoIf they knew they wouldn’t be hedging. They don’t know, they just think it’s very unlikely. What this tells you is that HTC (claims they) didn’t do anything with WP7 phones.
- babebridou 15y agoI just checked on my Motorola Atrix. I didn't see any CarrierIQ process, but the Blur framework is logging tons of stuff on ADB, such as all key inputs for the autocompletion software or every swipe movement on the home screen, but no https query appear to be logged at first glance. "Search Intent" terms on the other hand are logged. I never really trusted Blur because until the latest few versions of the ADT the LogCat console was messed up with debug messages from EON & Blur and it was a pain to keep it somewhat static and readable for my own devs, but these couple reports on keylogging frameworks make me look twice at my own phone now. I'd like to run wireshark to check out what's really going out of my phone when I'm on the wifi - I'm a bit of a novice in that area (network monitoring), does anyone have any pointers of things to look for?
- adolph 15y agoI think in this instance the application Charles would be more helpful than Wireshark. See the below article for how someone analyzed wifi traffic from iPad: http://waxy.org/2011/02/how_i_indexed_the_daily/ http://waxy.org/2011/02/how_i_indexed_the_daily/
- babebridou 15y agoThanks for the useful link. Now to enable proxy settings on the Atrix... Alright. So for now I don't see much "phone-home trouble" but I'm far from the security expert around here. There are a few http queries (both GET and POST) made using some plain text OAUTH tokens to the MotoBLUR servers, but as far as I could notice nothing was really sending much information. Then again, the first thing you do when you launch blur for the first time is giving it your twitter/facebook/gmail account login&passwords, so... I'll get what I deserve here :P The only "tracking/keylogging" queries I could find were done to data.flurry.com, and were only tracking (in plain text) my inputs on the Winamp App, so I call it fair play. I'm a bit relieved here, thanks again for the tip with Charles. Let's hope someone with a better expertise than me will definitely rule Motorola out of that CarrierIQ logging thing, but so far, so good.
- dangerboysteve 15y agothree words. MASSIVE CLASS ACTION Lawyers fire up your infomercials.
- gyardley 15y agoThe usual suspects are almost certainly going to file a class-action lawsuit or two over this, but it won't be 'massive' since this isn't a clear and easy win. (The hardest part about this type of suit is showing real, concrete harm to actual people - and not just hypothetical potential harm. So Carrier IQ knows you play Angry Birds - so what? How'd that demonstrably hurt you?) No, instead the lawyers responsible for offering the class action will be willing to settle for a) a rather nice profit for them, b) a pittance for the handful of individuals they round up to be plaintiffs, and c) some symbolic genuflecting in the direction of privacy, maybe in the form of a charitable donation to a non-profit. The sum total cost of a) through c) will be carefully calculated - high, but not too high, or Carrier IQ (and their clients, who will also get sued) will decide to fight back and possibly win. Certainly nothing infomerical-worthy - that's reserved for cases where winning is pretty much guaranteed.
- seanp2k2 15y agoSince their business model is based around selling data collected without user knowledge/consent, I feel like digging into their financial would reveal a pretty strong case against them.
- thedjpetersen 15y agoFirst of all, it is excellent to see this type of hacking and reverse engineering. This is rather brash. I am surprised to see this on a such an open platform as Android. Even as some of the comments are suggesting they are not sending the data in non crash situations, keeping it logged is rather brazen. On the flip side though, I have to wonder how would one determine crash behavior before the phone crashes? It seems to me that the phone would need to preemptively log some behavior that would then be indicative as to what caused the crash.
- ksadeghi 15y agoIs this comment i'm typing on my phone being sent to CarrierIQ? :-S
- DrManhattan 15y agoFrom a Wired article on this: "it cannot be turned off without rooting the phone and replacing the operating system. And even if you stop paying for wireless service from your carrier and decide to just use Wi-Fi, your device still reports to Carrier IQ."
- PLejeck 15y agoI'm so glad that my iPhone only lets Apple spy on me.
- Apple-Guy 15y agoApple doesn't spy on you. There is no comparable keylogger on iOS.
- 1010100101 15y agoI do not want a "smartphone". I want a "blank slate". With the right specs and form factor.
- salimmadjd 15y agoThe issue is not how many bit or bytes this is sending. The fact that you have never given permission to this and you can't switch it off tells me something about Google and their priorities. Steve Jobs fought hard to prevent any carrier pre-install apps on the iPhone. No such a leadership from google!
- killnine 15y agoWhy is this whole company and all of it's employees not indicted for trespassing, breaking and entering, burglary, etc????? How is stealing the most sensitive of data off my phone without my knowledge/consent ANY different then walking into my house and taking my passport??
- cookiecaper 15y agoI think this is a good case study in support of "never trust an internet-connected electronic device directly from a vendor". There should be a universal policy to unlock, root, or blow away any software that exists and replace it with "known good" software, like CyanogenMod, Ubuntu, or a new copy of Windows.
- dredmorbius 15y agoTwo out of three ain't bad.
- hamoid 15y agoI used to think I better avoid installing a custom ROM in my phone because it might contain software exactly like this one. This really upsets me. Time to check CyanogenMod out.
- ck2 15y agoThis guy needs prison time for lies like these - or at least hauled before congress: Carrier IQ VP of Marketing Andrew Coward rejected claims the software posed a privacy threat because it never captured key presses. “Our technology is not real time,” he said at the time. "It's not constantly reporting back. It's gathering information up and is usually transmitted in small doses.” Coward say[s] that Carrier IQ was a diagnostic tool designed to give network carriers and device manufacturers detailed information about the causes of dropped calls and other performance issues.
- 1010100101 15y agoIs it unreasonable for a consumer to want complete control over a device from the moment she powers on? Is there a certain level beneath which it is not reasonable to give consumers (optional) access? (Should consumers be prevented from "rooting" devices? Should we allow companies to maintain control over devices, e.g. having them "phone home", after they sell them?) If yes, why? Maybe a rootkit should just be viewed just like the crapware that comes pre-installed on a PC. Sure it will help some company and perhaps the consumer herself, if she decides to use it. But it's _optional_. Maybe they could give consumers an easy way to opt-out.
- runjake 15y agoIf you're worried about Carrier IQ intercepting SMS messages. Don't be. The carriers have been doing this for a number of years and even share them with government agencies: http://www.schneier.com/blog/archives/2009/11/leaked_911_text.html http://www.schneier.com/blog/archives/2009/11/leaked_911_tex...
- narrator 15y agoWhich is why I use the ACS third party ROM, which has CarrierIQ removed, on my Sprint phone . It also runs MUCH faster than the normal Sprint ROM.
- throwaway30 15y agoThere are one disturbing thing here: A handful of comments are saying that is ok because CarrierIQ is probably not sending all data (probably not in Europe, but probably they do in Saudi Arabia). This is disturbing because people making these kind of comments are entrepreneurs and in general great people. It seems like we are loosing our moral compas in Silly Valley. Fuck. Please please don't do things like this.
- vm 15y agoCarrierIQ provides a valuable service for all us. They relay data that optimizes carrier networks, so that we can call, text, get data, etc more reliably. The problem this thread highlights is poor marketing and transparency. No one at CarrierIQ gives a damn what we text. Breaking those basic privacy tenants would destroy their business, which seems to be going nicely if their software is on >100M devices. The company just does a crappy job explaining what their technology does and how it helps consumers. Uncertainty around our private information spooks people, which leads to distrust and conspiracy theories. Let this be a valuable lesson for entrepreneurs who touch consumer data, even B2B solutions. Gmail and Bluekai provide excellent counter-examples of ways to squash these concerns: -Gmail -remember the ruckus about Google reading your email for ads? Google publicly explained this and now no one cares. -Bluekai -the company tracks data for online ads. Touch subject. But they're transparent and lay everything out on their website, including an opt-out: http://bluekai.com/consumers.php http://bluekai.com/consumers.php CarrierIQ clearly needs to address these issues. Let's call on them to do that. In the meantime, take a moment to imagine how much more we'd hate carriers if reception was even spottier (cough...AT&T iphone...)
- seanp2k2 15y ago>"CarrierIQ provides a valuable service for all us. They relay data that optimizes carrier networks, so that we can call, text, get data, etc more reliably." Considering how crappy call quality and SMS (which was designed to be used to send control messages to phones) reliability are and how expensive data is, it seems like they're doing a pretty bad job of it. Also, there is no reason to do this client-side since this can all be done at the carrier infrastructure level -- and already is. >"The problem this thread highlights is poor marketing and transparency. No one at CarrierIQ gives a damn what we text." Warrantless wiretapping is illegal. I'm not sure what more to say here. >"Breaking those basic privacy tenants would destroy their business, which seems to be going nicely if their software is on >100M devices." unless you can't [as a non-techie] remove their software or opt out, which you can't. >"The company just does a crappy job explaining what their technology does and how it helps consumers. Uncertainty around our private information spooks people, which leads to distrust and conspiracy theories." http://www.echelon2.org/wiki/Palantir http://www.echelon2.org/wiki/Palantir OK. I don't believe you since there are lots of documented reasons to not trust anyone with data like this. Also, why did they send a CnD letter to the guy and threaten him if they're not doing anything bad? >"Let this be a valuable lesson for entrepreneurs who touch consumer data, even B2B solutions." Yes, installing rootkits on hundreds of millions of devices without user consent, then trying to gag the security researcher who outs you is pretty damn bad form. >"CarrierIQ clearly needs to address these issues. Let's call on them to do that. In the meantime, take a moment to imagine how much more we'd hate carriers if reception was even spottier (cough...AT&T iphone...)" No, people already hate carriers, and there is no explanation that will make installing keyloggers on hundreds of millions of cellphones acceptable, ever. As I already said, carriers have had the power to gather the data they need to improve their networks at the infrastructure level (towers record MEIDs / EIDs / IMEIs already and this data would be easier to collect there) for years, and they already do use that to "improve" their networks. Not to spout conspiracy theories everywhere here, but have you /seen/ the FCC press release about the ATT / T-Mobile merger and how badly ATT misrepresented facts? http://www.theverge.com/2011/11/30/2599466/fcc-report-att-proposal-t-mobile-highlights http://www.theverge.com/2011/11/30/2599466/fcc-report-att-pr... give this a read and then honestly tell me you think that carriers have all the best intentions. Companies are supposed to make profits for shareholders, not protect your privacy or be nice to you. If they can make money by selling your personal data, they will and they're probably doing just that right now.
- sdizdar 15y agoCan somebody clarify this story for me? What are the facts here? * Did they implemented key-logger? Yes/No * Do they write keys into some local log? Yes/No * If they have key-logger, then why do they have key-logger? (Company statement - please) * If they write key strokes to some log file, is that log file related to logs which are send to "mother ship"?
- deleted 15y ago[deleted]
- alkimie 15y agoAfter looking at the screenshots of the carrier-side it seemed to me that the Carrier IQ system allows much more interaction/control from the carrier side. Pending patent applications sometimes can tell you a lot about where a company is heading. Here are a couple of quotes from Carrier IQ's pending U.S. 20090207749 USER-INITIATED REPORTING OF MOBILE COMMUNICATION SYSTEM ERRORS: "...This configuration enables the system 200 to dynamically generate and download to a population of wireless devices rule-based data collection profiles. Data collection profiles may be generated manually by a network administrator, a software developer or other personnel involved in the operation of the network (hereinafter referred to as "network administrators"), created offline as a portion of a data analysis solution, or automatically generated based on network parameters or other events. Profiles define what information is to be collected on the devices in response to which conditions and events, as well as the conditions and events that cause the device to upload the collected information. [0038] Conditions or events include any occurrence in the network or on the device that the device can sense, such as a call dropping or a user pressing a button on the device. Conditions and events also include the passage of time, or a request from a network administrator that the device report information back to the server. Conditions and events which cause a device to collect information or upload the collected information may generally be referred to as "triggers." " and: "[0080] In the exemplary embodiment, triggers may be included in the data collection directives of a data collection profile, and their inclusion causes the client to initiate, abort, and terminate data collection activity as appropriate when the associated trigger condition is invoked by the wireless device 400. A trigger invocation that matches the initiating trigger causes data collection activity to begin. A match of the terminating trigger causes the data collection activity to end, and a metrics package is then prepared for uploading. An abort trigger causes data collection activity to cease, and a metrics package is not prepared or is not uploaded. In the example used earlier, launching an application caused the client to be invoked with an "application launched" trigger event, which is matched against triggers in downloaded profiles and causes data collection activity to begin on a user's device. The user's entering of a particular key sequence, pressing of a dedicated button, or selection of a particular menu option while the application is running would cause another trigger to be activated, and the SQC would match the event to a terminating trigger in the profile, cause data collection to stop and a metrics package to be prepared and uploaded. As can be seen, the inclusion of a trigger in a profile effectively selects the condition under which a specific action associated with that profile is to be executed. The trigger is not strictly within the profile, rather it associates specific profile actions (start, stop, abort) with a specific event on the device. " And the claims from their pending "USING MOBILE DEVICE TO CREATE ACTIVITY RECORD" application No. 20090210516 is quite interesting to browse: 1. In a communication system, a method for creating an activity record, the method comprising: recording data at a device, the data including one or more events and event-related data that describe activities of a user; uploading the data to a server, wherein the server organizes the data based the event related data; and generating an activity record using the data that can be presented to a user, wherein the activity record represents at least a partial log of the activities of the user. 2. The method of claim 1, wherein event-related data comprise one or more of: a time an event occurs; a date the event occurs; a location of the device when the event occurs; a filename of an event object associated with the event; a mobile device number (MDN); and a contact name. 3. The method of claim 2, wherein generating an activity record using the data comprises creating an entry for each of the one or more events describing where and when an event occurred. 4. The method of claim 3, further comprising presenting the activity record on a website, wherein the website is accessed by the device or using another device. 5. The method of claim 3, wherein the one or more events comprise at least one of: making or receiving a phone call; sending or receiving a message; taking a photograph; recording a device location; receiving and playing a broadcast; connecting to an 802.11 or Bluetooth access point; and using a device application. 6. The method of claim 5, wherein the location of the mobile device is recorded periodically and independently of other events. ....
- salem 15y agoI'm not a lawyer, but unless there is some fine print in the notifications sent to subscribers, it is quite possible that they have broken the laws regarding the interception of communication. This sounds a lot like what killed phorm in the US.