So this is the story eating my week: Carrier IQ.
If you haven't heard of it yet, you will. Short version: there's a piece of software called Carrier IQ that's apparently sitting on something like 150 million phones, and a security researcher named Trevor Eckhart put out a video a couple weeks back showing it logging basically everything you do on your phone. Keystrokes. Text messages before they're encrypted. Which apps you open. Even URLs you type when you're on wifi, not just cell data. He called it a rootkit and the company's first move was to threaten him with a cease-and-desist instead of, you know, explaining themselves. That's never a good sign. When your legal response to "here's a video showing what your software does" is a lawyer letter instead of a rebuttal, you've basically already lost the argument.
Carrier IQ backed off the threat after the EFF got involved, which is good, but the damage was done. Now everyone's phone is a suspect.
What gets me is how sneaky the whole setup is. This isn't some app you downloaded and half-read the permissions on before tapping Accept (guilty, we've all done that). It's baked in at the carrier level, pre-installed, and there's no toggle to turn it off. You didn't choose it. It's just there, watching, and the only reason anyone knows about it at all is because one guy decided to actually dig into what his Android phone was doing under the hood instead of trusting the little "diagnostic and usage" checkbox nobody reads.
Sprint, AT&T, T-Mobile — reports are pointing at all of them having Carrier IQ on various devices. HTC and Samsung phones both seem to be affected, and there's chatter it might touch some other manufacturers too, though nobody's got the full list nailed down yet. Nobody's saying "yeah we read your texts," and I actually believe most of what gets logged is intended for network diagnostics, dropped call data, that kind of boring telecom stuff carriers genuinely do need. But intent and capability are two very different things, and right now the capability is: this software can see your keystrokes. That's not a rumor, that's in Eckhart's video, logging happening in real time on his own device.
I'll say the obvious thing everyone's typing this week: this is exactly why "just trust us" doesn't cut it anymore. Nobody at Sprint owes me an explanation of every background process running on a phone I bought with my own money, except actually they kind of do, because I bought the phone.
Little side rant while I'm here: I've been poking at a Galaxy Nexus at a friend's place the last few days, first phone shipping with Ice Cream Sandwich, and it's genuinely nice, the whole software keyboard redesign alone is a big step up. But now every time it buffers for half a second after I type something I catch myself wondering if that's just Android being Android or if something's phoning home in the background. That's a miserable way to feel about your own phone. A week ago I wasn't even thinking about it.
The bigger question nobody's answered yet is what happens to the data after it's collected. Does it sit on the device, does it get shipped off to the carrier, is any of it stored somewhere with your name attached. Carrier IQ's line so far is that it's for improving network performance and they don't sell the data, but "we don't sell it" and "we don't have it" are not the same sentence, and I noticed they didn't say the second one.
I don't think this is going away quietly. There's already talk of it getting attention in Washington, and honestly it should. A phone is about as personal as a device gets at this point, it's your calls, your texts, your browsing, sitting in your pocket all day. Finding out there's an undocumented layer underneath all of it logging keystrokes is the kind of thing that should make people uncomfortable, not just tech blog readers like the three of you.
Going to go dig through my own phone's settings menu now and see if I can even tell whether Carrier IQ's on there. Wish me luck.