5 ms·

Based on what I've read, none of the investigations actually looked at what data was reported back. My money is on Carrier IQ providing a valuable service in a

Based on what I've read, none of the investigations actually looked at what data was reported back. My money is on Carrier IQ providing a valuable service in a somewhat sub-optimal way with regards to privacy, and carriers probably doing a really shoddy job of integrating it into the phones they distribute.

ghshephard 15y ago
I don't think any claims were made that data was being reported back. The mere fact that this third-party utility is monitoring keystrokes, SMS data, Web URLs is what has everyone concerned. If it's discovered that the data is being stored _locally_ on the phone - that would turn out to be a scandal. I suspect laws would be broken if any of this data was actually being reported _off_ of the device.
- tptacek 15y ago
  That seems like a really unfair argument. Discussion about CIQ has been rife with people talking about CIQ collecting and reporting keystrokes. The supposition has clearly been that CIQ or the carriers are centrally logging private data. Given that the carriers already have all your SMS data and phone usage history, I think you're probably wrong on the legal front, too.
tptacek 15y ago
I'm more or less convinced that you're right about this. CarrierIQ brought some of this on themselves by reacting terribly to a security researcher's claims regarding their software. Trevor Eckhart claimed CIQ was a "rootkit", and they freaked out and threatened to sue him. Naturally, everyone now assumes that CarrierIQ is evil, since suing security researchers is almost invariably an evil thing to do. People are paying less attention to the fact that CarrierIQ subsequently issued a formal apology to Trevor (from experience: companies stung by security researchers virtually never do this; they just back off quietly), and that nobody has really refuted CIQ's claims about what their software does. The "there's this evil big brother company nobody has ever heard of that a security researcher found out and got sued over" narrative is a lot more fun than the banal reality, so that's what we're all going to run with. It's also a little amusing to see people wigging out over the privacy of their SMS messages. Their SMS messages have no privacy. The carriers see and log all of them. Lord only knows what other tools they have on their network explicitly for the purpose of mining data out of those messages.
- shiven 15y ago
  I guess CIQ just happens to be the outrage-flavor-of-the-week. This looks so much like a public pile-on whenever Facebook screws people over with sneaky settings changes. The classic cycle plays: breaking news, genuine anger, hipster outrage, slow smoldering disinterest, and finally apathy and collective amnesia ... until the next outrage-of-the-week comes along. The Zuck was right: "dumb fucks". If anyone is really all that outraged, what concrete steps have they taken to make sure this crap gets sorted out? Oh and BTW, do you have a link confirming the _formal apology_ ? Couldn't find it with a simple DDG search. Maybe my search vector was wrong.
  - tptacek 15y ago
    It's on their website.
  - TeMPOraL 15y ago
    It's in http://www.carrieriq.com/company/news.htm http://www.carrieriq.com/company/news.htm.
- bdonlan 15y ago
  I think the real problem here is there's no visibility in what CIQ is actually sending, and so no way to verify their claims. Additionally, even if they don't intentionally send all that excess data up to their servers, it's still getting logged, and will be sent with crash and ANR reports to _Google_; sending all that kind of personal information to a third-party is not a good thing, either.
codezero 15y ago
That's all well and good, but if I don't want to participate in their services, I shouldn't have to, no matter how accountable and trustworthy they are.
- georgieporgie 15y ago
  I agree with you in principle, but I also feel for the company. As I understand it, they are logging information relevant to communication quality, and using that to improve the network. If you give people the opportunity to opt-out of providing data, many of them will, which means you have much less data to analyze in order to improve services.

ghshephard 15y ago

I don't think any claims were made that data was being reported back. The mere fact that this third-party utility is monitoring keystrokes, SMS data, Web URLs is what has everyone concerned. If it's discovered that the data is being stored _locally_ on the phone - that would turn out to be a scandal. I suspect laws would be broken if any of this data was actually being reported _off_ of the device.

tptacek 15y ago
That seems like a really unfair argument. Discussion about CIQ has been rife with people talking about CIQ collecting and reporting keystrokes. The supposition has clearly been that CIQ or the carriers are centrally logging private data. Given that the carriers already have all your SMS data and phone usage history, I think you're probably wrong on the legal front, too.

tptacek 15y ago

I'm more or less convinced that you're right about this. CarrierIQ brought some of this on themselves by reacting terribly to a security researcher's claims regarding their software. Trevor Eckhart claimed CIQ was a "rootkit", and they freaked out and threatened to sue him. Naturally, everyone now assumes that CarrierIQ is evil, since suing security researchers is almost invariably an evil thing to do. People are paying less attention to the fact that CarrierIQ subsequently issued a formal apology to Trevor (from experience: companies stung by security researchers virtually never do this; they just back off quietly), and that nobody has really refuted CIQ's claims about what their software does. The "there's this evil big brother company nobody has ever heard of that a security researcher found out and got sued over" narrative is a lot more fun than the banal reality, so that's what we're all going to run with. It's also a little amusing to see people wigging out over the privacy of their SMS messages. Their SMS messages have no privacy. The carriers see and log all of them. Lord only knows what other tools they have on their network explicitly for the purpose of mining data out of those messages.

shiven 15y ago
I guess CIQ just happens to be the outrage-flavor-of-the-week. This looks so much like a public pile-on whenever Facebook screws people over with sneaky settings changes. The classic cycle plays: breaking news, genuine anger, hipster outrage, slow smoldering disinterest, and finally apathy and collective amnesia ... until the next outrage-of-the-week comes along. The Zuck was right: "dumb fucks". If anyone is really all that outraged, what concrete steps have they taken to make sure this crap gets sorted out? Oh and BTW, do you have a link confirming the _formal apology_ ? Couldn't find it with a simple DDG search. Maybe my search vector was wrong.
- tptacek 15y ago
  It's on their website.
- TeMPOraL 15y ago
  It's in http://www.carrieriq.com/company/news.htm http://www.carrieriq.com/company/news.htm.
bdonlan 15y ago
I think the real problem here is there's no visibility in what CIQ is actually sending, and so no way to verify their claims. Additionally, even if they don't intentionally send all that excess data up to their servers, it's still getting logged, and will be sent with crash and ANR reports to _Google_; sending all that kind of personal information to a third-party is not a good thing, either.

codezero 15y ago

That's all well and good, but if I don't want to participate in their services, I shouldn't have to, no matter how accountable and trustworthy they are.

georgieporgie 15y ago
I agree with you in principle, but I also feel for the company. As I understand it, they are logging information relevant to communication quality, and using that to improve the network. If you give people the opportunity to opt-out of providing data, many of them will, which means you have much less data to analyze in order to improve services.