Lawmakers seek hearing on Carrier IQ privacy issues
Rep. Henry Waxman, two other lawmakers still have questions
Computerworld - The Carrier IQ privacy controversy shows little signs of letting up, as three lawmakers today called for a Congressional hearing on the implications raised by the use of the company's software by wireless carriers.
Reps. Henry Waxman (D-CA), G.K Butterfield (D-NC) and Diana DeGette (D-CO) sent an open letter (download PDF) to Rep. Fred Upton (R-MI), chairman of the House Energy and Commerce Committee, asking for an investigation of the data collection and transmission capabilities of Carrier IQ's software and similar products.
The letter, sent to Upton and two other subcommittee chairs, also asked Congress to find out whether Android phones were sold with security problems that would have exacerbated the problems caused by Carrier IQ's software.
"Data collection and transmission by Carrier IQ and similar software is widespread, and consumers appear to have little knowledge and even less control over the practice," the three lawmakers wrote. "There continue to be many unanswered questions about the handling of this data and the extent to which its collection, analysis, and transmission pose legitimate privacy concerns for the American public."
The Carrier IQ controversy erupted in late November, after independent security researcher Trevor Eckhart published a report showing how Carrier IQ's software could be used by wireless carriers to capture detailed information from Android-powered mobile devices, iPhones and other smartphones.
Eckhart's disclosure ignited a firestorm of concern and criticism from multiple quarters -- especially when it became clear that the software had been quietly installed on millions of handsets, had been collecting information without notice and was hard to remove.
Several wireless service providers and handset makers, including AT&T, Sprint, Apple, HTC and Samsung admitted to installing the software in their mobile devices and were promptly hit with lawsuits alleging violation of federal wiretap laws.
Sprint later disclosed that it had installed Carrier IQ software on 26 million handsets and had been using it since 2006, while AT&T said it had the software running on close to a million devices. Sprint in December announced it would disable the software on its handsets following the lead of Apple, which said it would remove the software from its iPhones.
Carrier IQ itself has maintained from the outset that its software is designed purely to collect information that can help wireless carriers improve network and device performance. The company has denied Eckhart's claims that its software can be used for keylogging purposes and has insisted that claims the software was used for intrusive data gathering are misplaced.
In today's letter, the lawmakers said that several questions remain unanswered.
"What are the data collection, analysis, and transmission capabilities of Carrier IQ and similar software, and what privacy protections are built into the software?" the letter said. "Were Android phones sold with security flaws that could have exacerbated privacy concerns related to Carrier IQ and other software and, if so, have these flaws been addressed? "
The trio also asked for an investigation into the disclosure practices of carriers and device manufacturers and of the security and privacy risks associated with the data collection and transmission enabled by Carrier IQ and similar software tools.
"Before last month, even the most technically savvy customers may not have been aware of the presence of this software and of its capacity for transmitting sensitive information," the lawmakers wrote. Even if they had been aware, they would not have been able to remove the software.
A Carrier IQ spokeswoman today said the company has already provided extensive details on the capabilities of its software to members of Congress and their staff. "We look forward to answering any further questions that may arise," she said.
Jaikumar Vijayan covers data security and privacy issues, financial services security and e-voting for Computerworld. Follow Jaikumar on Twitter at @jaivijayan or subscribe to Jaikumar's RSS feed . His e-mail address is firstname.lastname@example.org.
- Franken presses Ford on location data collection practices
- Justices let stand appeals court decision on border searches of laptops
- California lawmakers move to bar state help to NSA
- Appeals court again nixes Google's bid to overturn Street View case
- Older Mac webcams can spy without activating warning light
- Update: Judge rules NSA spy efforts may be unconstitutional
- Perspective: Privacy concerns could keep Amazon delivery drones grounded
- NSA collects data from millions of cellphones daily
- Perspective: Curbing data use is key to reining in NSA
- Lavabit-DOJ dispute zeroes in on encryption key ownership
Read more about Privacy in Computerworld's Privacy Topic Center.
- 15 Non-Certified IT Skills Growing in Demand
- How 19 Tech Titans Target Healthcare
- Twitter Suffering From Growing Pains (and Facebook Comparisons)
- Agile Comes to Data Integration
- Slideshow: 7 security mistakes people make with their mobile device
- iOS vs. Android: Which is more secure?
- 11 sure signs you've been hacked
- Is Your Big Data Solution Production-Ready? Read "Is Your Big Data Solution Production-Ready?" now, and discover best practices and actionable steps to implementing a production-ready big data solution.
- Pay-as-you-Grow Data Protection: IBM Tivoli's Full-featured Data Protection Suite for Small to Medium Businesses IBM Tivoli Storage Manager Suite for Unified Recovery gives small and medium businesses the opportunity to start out with only the individual solutions...
- Streamline Data Protection with IBM Tivoli Storage Manager Operations Center IBM Tivoli Storage Manager (TSM) has been an industry-standard data protection solution for two decades. But, where most competitors focus exclusively on Backup...
- Simplify and Consolidate Data Protection for Better Business Results Learn about IBM® Tivoli® Storage Manager Operations Center, which provides advanced visualization, built-in analytics and integrated workflow automation features that leapfrog traditional backup...
- Data Protection and Disaster Recovery with iSCSI and VMware Get this on demand webcast now
- Webinar: Building a Big Data solution that's production-ready Big data solutions are no longer just a nice-to-have. All Privacy White Papers | Webcasts