I offer a hat tip to Gizmodo, which has put together a list of smartphones that have Carrier IQ. The company disclosed the information as part of a US Senate inquiry. Sprint subscribers are the most likely to have the spyware installed -- 26 million, or nearly half of them. Verizon: None. The information is also available in a statement from Sen. Al Franken (D-Minn.), just not as quickly scannable.
But not all phones where Carrier IQ is installed have it active. Android developer Trevor Eckhart uncovered Carrier IQ last month, offering detailed explanation how the rootkit-like software works. I followed his instructions to see if the software was active on my Samsung Galaxy S II Skyrocket, and it appeared not to be. Days later I installed Carrier IQ detectors from BitDefender and LookOut Labs, which found the software but didn't indicate its status. Apparently, Skyrocket is one of the phones where Carrier IQ is installed but not active. Same is true of HTC Vivid, AT&T's other LTE phone.
The problem with Carrier IQ: The tracking software that behaves every bit like a keylogger -- installed at a low-level like a rootkit would be. Carriers and Carrier IQ receive data without end user's explicit consent and, like a rootkit, is nearly impossible to remove without harming the operating system. Phone manufacturers install the software before cellular carriers receive the handsets. Carrier IQ claims it only collects information that carriers need to improve network performance and customer service.
"I'm still very troubled by what's going on", Franken says. "People have a fundamental right to control their private information. After reading the companies' responses, I'm still concerned that this right is not being respected. The average user of any device equipped with Carrier IQ software has no way of knowing that this software is running, what information it is getting, and who it is giving it to-and that's a problem".
Carrier IQ has been on the defensive since Eckhart's investigation revealed apparent keylogger, activity the company only indirectly denied. The material submitted as part of Franken's Senate investigations renews concerns keystrokes are captured and transmitted to somebody.
"It appears that Carrier IQ has been receiving the contents of a number of text messages -- even though they had told the public that they did not", Franken says. AT&T confirms this behavior, which includes SMS messages, in its letter to Franken.
"I'm also bothered by the software's ability to capture the contents of our online searches-even when users wish to encrypt them," the Minnesota senator chides. "So there are still many questions to be answered here and things that need to be fixed".
Apparently, this tracking has gone on for some time. Samsung says it has installed Carrier IQ on its phones since November 2007. The chart below lists model numbers (the Giz story gives product names; we want to praise their good work rather than aggregate or re-report it -- Jesus Diaz deserves your click through).
Other manufacturers haven't installed the software for as long as Samsung. From HTC's letter to Franken:
The Carrier IQ software was first integrated on the Hero, which became available to customers through Sprint on October 2009. Other HTC devices that use the integrated Carrier IQ software and the date of their availability in the U.S. market are listed below:
- Snap (Sprint) ± June 2009
- Touch Pro 2 (Sprint) ± September 2009
- Hero (Sprint) ± October 2009
- Evo 4G (Sprint) ± June 2010
- Evo Shift 4G (Sprint)± January 2011
- Evo 3D (Sprint) ± June 2011
- Evo Design (Sprint) ± October 2011
- Amaze 4G (T-Mobile) ± October 2011
- Vivid (AT&T) ± November 2011
Installed doesn't mean active, as aforementioned for the Vivid. HTC says Carrier IQ is active on 6.3 million of its handsets. Samsung has distributed 25 million phones with the software in the United States but didn't explicitly indicate whether or not it's active.
This drama isn't over by a long shot.
Photo Credit: fredredhat/Shutterstock