> why does it run if the cellular antenna is disabled? That's easy; they can't reliably tell between disabled cellular service and broken cellular service, and

> why does it run if the cellular antenna is disabled? That's easy; they can't reliably tell between disabled cellular service and broken cellular service, and the carriers really want to know about the latter. Well, they probably could figure out whether service is supposed to be disabled, but the mechanisms that control whether service is enabled are, themselves, one of the things that CarrierIQ would be used to detect problems with.