from the answers-we-may-never-get dept
The story so far: security researcher Trevor Eckhart exposed some very disturbing
information about the “Carrier IQ” application
This set off a
which quickly got much bigger when
Carrier IQ responded by attempting to
bully and threaten
him into silence. This
did not go over well.
After he refused to back down, they
retracted the threats
Eckhart followed up by posting
part two of his research,
demonstrating some of his findings on video. Considerable discussion of that demonstration
ensued, for example
Some critics of Eckhart’s research have opined that it’s
not rigorous enough.
suggests that the problem could well be worse than we currently know.
Stephen Wicker of Cornell
University has explored some of the implications, and his comments seem especially apropos given that
Carrier IQ has publicly admitted
holding a treasure trove of data.
Dan Rosenberg has done further
in-depth research on the detailed
workings of Carrier IQ, leading to rather a lot of discussion about
Carrier IQ’s capabilities — there’s some disagreement among researchers
over what Carrier IQ is doing versus what it could be doing, e.g.:
Is Carrier IQ’s Data-Logging Phone Software Helpful or a Hacker’s Goldmine?
the scandal grew,
questions were raised about whether it
violated federal wiretap laws,
a least one
US Senator noticed,
and Carrier IQ issued an
inept press release.
Phone vendors and carriers have been begun backing away from Carrier IQ as quickly as possible;
there were denials from
posted internal and external quick guides about Carrier IQ.
Some of the denials were
more credible than others.
There has been some
skepticism about Carrier IQ’s statements, given
their own marketing claims
non-answers to some questions.
There’s also been discussion about the claims made in
Carrier IQ’s patent.
Attempts to figure out
which phones are infected with Carrier IQ are ongoing.
For example, the
Google Nexus Android phones and original Xoom tablet seem to not be infected, nor do phones
used on UK-based mobile networks, but traces of are present
in some versions of iOS, although their function
isn’t entirely clear.
that tries to detect it is now available.
removing it have been discussed.
A Freedom of Information Act request’s response has indicated (per the FBI) that
Carrier IQ files have been used for “law enforcement purposes”,
but Carrier IQ has denied this.
And there seems to be a growing realization that all of this has somehow
become standard practice;
as Dennis Fisher astutely observes,
With Mobile Devices, Users Are the Product, Not the Buyer.
Those are the details; now what about the implications?
Debate continues about whether Carrier’s IQ is a rootkit and/or spyware.
Some have observed that if it’s a rootkit, it’s a rather poorly-concealed one.
But it’s been made unkillable, and it harvests keystrokes — two properties
most often associated with malicious software. And there’s no question that
Carrier IQ really did attempt to suppress Eckhart’s publication of his
But even if we grant, for the purpose of argument, that it’s not a rootkit
and not spyware, it still has an impact on the aggregate system security
of the phone: it provides a good deal of pre-existing functionality that
any attacker can leverage. In other words, intruding malware doesn’t need
to implement the vast array of functions that Carrier IQ already has;
it just has to activate and tap into them.
Which brings me to a set of questions that probably should have
been publicly debated and answered before software like this was installed
on an estimated 150 million phones. I’m not talking about the questions
that involve the details of Carrier IQ — because I think we’ll get
answers to those from researchers and from legal proceedings.
I’m talking about larger questions that apply to all phones — indeed,
to all mobile devices — such as:
What kind of debugging or performance-monitoring software should be
- Who should be responsible for that software’s installation? Its maintenance?
Should the source code for that software be published so that we can
all see exactly what it does?
Should device owners be allowed to turn it off/deinstall it —
or, should they be asked for permission to install it/turn it on?
Will carriers or manufacturers pay the bandwidth charges for users
whose devices transmit this data?
Should carriers or manufacturers pay phone owners for access to
the device owners’ data?
Where’s the dividing line between performance-measuring data that
can be used to assess and improve services, and personal data?
Is there such a dividing line?
- Will data transmission be encrypted? How?
Will data be anonymized or stripped or otherwise made less
personally-identifiable? Will this be done before or
after transmission or both? Will this process be
full-documented and available for public review?
What data will be sent — and will device owners be able to exert
some fine-grained control over what and when?
- Who is is responsible for the security of the data gathered?
- Who will have access to that data?
- When will that data be destroyed?
- Who will be accountable if/when security on the data repository is breached?
- What are the privacy implications of such a large collection of diverse data?
Will it be available to law enforcement agencies?
(Actually, I think I can answer that one: “yes”. I think it’s a
given that any such collection of data will be targeted for acquisition
by every law enforcement agency in every country. Some of them
are bound to get it. See “FBI”, above, for a case in point.)
Lots of questions, I know. Perhaps I could summarize that list by
asking these three instead: (1) Who owns your mobile device?
(2) Who owns the software installed on your mobile device?
and (3) Who owns your data?