Inside Google

Rep. Ed Markey, D-Mass., Sen. Al Franken D-Minn., and Consumer Watchdog are asking federal regulators to investigate whether mobile software firm Carrier IQ’s practices violate consumer privacy rights. And groups like the Center for Digital Democracy

are calling for federal privacy legislation. The company came under fire after reports that its software, installed on many major carriers’ smartphones, collects and transmits potentially sensitive data about device users. Carriers using Carrier IQ claimed they solely use the service to improve and maintain network performance.

Surreptitiously tracking smartphone users’ activities “appears to be a flagrant violation of wiretap laws,” said John Simpson, director of Consumer Watchdog’s Privacy Project, in letters to Attorney General Eric Holder and FCC Chairman Julius Genachowski. He noted that Trevor Eckhart, a system administrator in Connecticut, recently demonstrated that software from Carrier IQ installed on more than 140 million smartphones is “surreptitiously” tracking user activities. The probe should extend beyond Carrier IQ, and include operating system developers like Google and Apple, as well as carriers and device manufacturers, Consumer Watchdog said.

Markey, co-chair of the Congressional Privacy Caucus, asked the FTC to investigate the tracking software. The Carrier IQ software “raises a number of privacy concerns for Android, Blackberry, and Nokia users,” Markey said in a letter Friday to Chairman Jon Leibowitz. “Consumers neither have knowledge of this data collection, nor what Carrier IQ intends to do with this information.” The FTC has authority to investigate under its mandate to protect consumers from “unfair or deceptive acts or practices,” said Markey.

Use of the Carrier IQ software “may violate federal privacy laws,” Franken, chairman of the Senate Privacy Subcommittee, said in a letter Thursday to the CEOs of AT&T, Sprint Nextel, Samsung and HTC. Franken wants the companies to answer 13 questions by Dec. 14 about what information they obtain about consumers with the software, whether they share it with third parties, how long the information is stored and how securely it’s kept. Franken asked if the companies believed their actions complied with the Electronic Communications Privacy Act or the Computer Fraud and Abuse Act. He also asked if they believe their customers are aware of the tracking software on their devices.

The Electronic Frontier Foundation declined to comment because it took on Eckhart as a client after Carrier IQ filed a cease-and-desist demand claiming Eckhart infringed the company’s copyrights and made “false allegations” about its software, an EFF spokeswoman said. Eckhart’s research and commentary is protected by fair use and the First Amendment, EFF said in a letter to Carrier IQ. Carrier IQ later withdrew the demand and apologized to Eckhart, according to a company statement. The company emphasized its software doesn’t record keystrokes or provide tracking tools. The software doesn’t inspect or report on the content of the communications and doesn’t provide real-time data reporting to any customer, the company said. It doesn’t sell data to third-parties, it said. The software is designed to help carriers diagnose network problems and improve use, it said.

“This should be a wake-up call for federal regulators,” said Jeff Chester, executive director with the Center for Digital Democracy. It’s time for the FCC and the FTC to step up and protect consumer privacy and security, he said. The issue of privacy and security violation in the mobile industry is prevalent, he said, also calling for an investigation into Carrier IQ’s practices. Carrier IQ’s approach models the mobile marketing business practices that privacy groups have long been concerned about, he said.

In line with AT&T’s privacy policy, the company solely uses Carrier IQ software data to improve wireless network and service performance, an AT&T spokesman said. Sprint is researching reports on this issue, a Sprint spokeswoman said. Carrier IQ provides information that allows Sprint, and other carriers that use it, to analyze network performance and identify areas for improvement, the Sprint spokeswoman said. Sprint also uses the data to understand device performance, she said. The carrier doesn’t look at the content of communications, she said. The information collected is not sold and “we don’t provide a direct feed of this data to anyone outside of Sprint.”

T-Mobile uses the Carrier IQ diagnostic tool to troubleshoot device and network performance, a spokeswoman said. T-Mobile doesn’t use this diagnostic tool to obtain the content of text, email or voice messages, or the specific destinations of a customer’s Internet activity, nor is the tool used for marketing purposes, she said. Verizon Wireless doesn’t use Carrier IQ, nor other similar software, on its devices, a spokeswoman said. C Spire also doesn’t use Carrier IQ’s services, a spokesman said. Research In Motion said it does not install or authorize its carrier partners to install Carrier IQ’s software on its BlackBerry smartphones. Nokia also said its phones do not use the software. Apple does use the software. The company had no comment.

Meanwhile, Carrier IQ, Samsung and HTC were hit with lawsuits seeking class action status. One lawsuits was filed in the U.S. District Court for the Eastern District of Missouri, accusing Carrier IQ and HTC of unlawfully intercepting communications from private mobile phones, smartphones and handsets. The other lawsuit, filed in the U.S. District Court for the Northern District of California, accused Carrier IQ, Samsung and HTC of violating the federal Wiretap Act and the California Unfair Business Practice Act. The companies didn’t comment Friday.