Inside Carrier IQ-gate

Computerworld - A scandal erupted this week around the discovery of secret software running on most smartphone handsets in the U.S. that tracks and logs personal activity on the phones.

The software is marketed to carriers and handset makers as a diagnostic tool that can be used to improve phone service. Critics say it's a hard-core violation of privacy. And the critics are right.

A security researcher named Trevor Eckhart posted a video Tuesday showing Carrier IQ software harvesting personal data without permission or even the option to turn it off.

According to the video, Carrier IQ gathers and logs every physical button pressed, phone number dialed, the full text of text messages, and even search data over https connections, which are supposed to be encrypted. The software can capture details about videos watched, apps used and the users' location.

It's unclear whether, when, or to whom this logged data is transmitted, or where it is stored and who has access to it.

Carrier IQ threatened to sue Eckhart, who turned for protection to the Electronic Frontier foundation.

Senator Al Franken wrote a letter to Carrier IQ president Larry Lenhart this week demanding that he specify exactly what's done with user data.

Carrier IQ software is installed on phones available from AT&T, Sprint and T-Mobile. Verizon said it does not use Carrier IQ, nor does Research In Motion or Nokia.

Apple said that iOS 5 doesn't fully use Carrier IQ software, for the most part, and that future versions wouldn't use it at all.

As Carrier IQ customers, carriers and handset makers are able to access data collected by the software. They can even specify "triggers" that when certain events occur, they can be specially logged, and the details of those logs sent to the carrier.

However, the larger risk is the existence of the harvested data. It's stored somewhere, and could be theoretically copied, accessed, hacked, stolen or leaked.

Carrier IQ has more or less admitted that the company could read the text messages of anyone using a phone that's running the software and read other data. But they claim the ability is largely theoretical.

Carrier IQ's VP of marketing, Andrew Coward, told AllThingsD this week that "We don't read SMS messages. We see them come in. We see the phone numbers attached to them. But we are not storing, analyzing or otherwise processing the contents of those messages."

Coward said, in a nutshell, that Carrier IQ is simply providing a service to the carriers, who are themselves only trying to improve service.

The cynical conspiracy to exploit your personal information

The guilty parties in all this are trying to frame the issue as a question over whether or not well-intentioned performance monitoring is an invasion of privacy.