CarrierIQ Fails At The Internet: Threatens Security Researcher With Copyright Infringement Claim Over His Research [Update]
from the dear-barbra-streisand dept
Last week, we wrote about some research by security researcher Trevor Eckhart, detailing how software from CarrierIQ had all the qualities of a rootkit, was installed on a ton of phones from Verizon Wireless and Sprint, and could potentially reveal all sorts of info about what you do on your phone. Much of Eckhart's report came from a training manual explaining the features of CarrierIQ's system, which he found left free and open on CarrierIQ's website. These kinds of stories show up every so often, and the usual thing is for the company either to admit it wasn't careful enough on security or to deny the specific allegations... and everyone moves on. But CarrierIQ apparently doesn't get how the internet works, has never heard of the Streisand Effect, and decided to not just deny the allegations in the report (we got one of those notices), but to threaten Eckhart with copyright infringement for his posting of their training manual.Oops. Cue Streisand Effect.
Eckhart, via the EFF, has rejected CarrierIQ's requests... and has called a lot more press attention to the original reports (which had died down pretty quickly). CarrierIQ didn't do itself any favors either, by having its marketing manager talk to Wired and stubbornly defend the copyright infringement claim by saying:
“Whatever content we distribute we want to be in control of that,” he said. “I think obviously, any company wants to be responsible for the information that gets distributed.”What "any company wants" and what is the law are often two different things. It might have helped for CarrierIQ employees to familiarize themselves with the law first. Of course, the EFF's letter attempts a quick crash course in the subject:
With respect to your allegations of copyright infringement, Mr. Eckhart’s analysis and publication of Carrier IQ’s training materials is a classic fair use and, therefore, non-infringing. 17 U.S.C. § 107 (“the fair use of a copyrighted work . . . for purposes such as criticism, comment, news reporting . . . or research, is not an infringement of copyright.”). Courts generally consider four factors in a fair use analysis: 1) the purpose and character of the use, 2) the nature of the copyrighted work, 3) the amount and substantiality of the portion used, and 4) the effect of the use on the potential market for the work. Id.; Campbell v. Acuff-Rose Music, 510 U.S. 569, 577 (1994). Each of these factors favors Mr. Eckhart.CarrierIQ is also claiming false allegations (i.e., defamation) over Eckhart's claims of its software being a rootkit. But, once again, the EFF and Eckhart are explaining the details of the law. Just because you don't like someone's opinion of what you do, or you don't like someone describing factually what you do, doesn't mean you get to accuse them of defamation:
You also claim that Mr. Eckhart published “false allegations” that are “without substance,” “untrue,” and that Carrier IQ considers “damaging to [its] reputation and the reputation of [its] customers.” We have repeatedly asked you to specify the statements you believe are actionable. You have failed to do so, and have instead merely repeated your broad accusations. We believe you are not able to substantiate your allegations because Mr. Eckhart’s factual findings are true. If you are able to specify any statement that you believe is false, Mr. Eckhart will be happy to provide you with the documentation of that finding.And, of course, now we get another round of people paying attention to the allegations regarding CarrierIQ.
Moreover, your client is a public figure. Under well-established Supreme Court precedent, commentary and criticism regarding Carrier IQ’s professional activities receive additional protections under the First Amendment, because there is a heightened public interest in facilitating such speech. See, e.g., New York Times Co. v. Sullivan, 376 U.S. 254, 270 (1964); Hustler Magazine v. Falwell, 485 U.S. 46 (1988).
Update: And... commence groveling. Just received the following:
As, of today, we are withdrawing our cease and desist letter to Mr. Trevor Eckhart. We have reached out to Mr. Eckhart and the Electronic Frontier Foundation (EFF) to apologize. Our action was misguided and we are deeply sorry for any concern or trouble that our letter may have caused Mr. Eckhart. We sincerely appreciate and respect EFF’s work on his behalf, and share their commitment to protecting free speech in a rapidly changing technological world.The company also reiterates that its software doesn't track a bunch of stuff and that it's really designed to make networks and phones perform better...
Thank you for reading this Techdirt post. With so many things competing for everyone’s attention these days, we really appreciate you giving us your time. We work hard every day to put quality content out there for our community.
Techdirt is one of the few remaining truly independent media outlets. We do not have a giant corporation behind us, and we rely heavily on our community to support us, in an age when advertisers are increasingly uninterested in sponsoring small, independent sites — especially a site like ours that is unwilling to pull punches in its reporting and analysis.
While other websites have resorted to paywalls, registration requirements, and increasingly annoying/intrusive advertising, we have always kept Techdirt open and available to anyone. But in order to continue doing so, we need your support. We offer a variety of ways for our readers to support us, from direct donations to special subscriptions and cool merchandise — and every little bit helps. Thank you.
–The Techdirt Team
Filed Under: research, rootkit, streisand effect, trevor eckhart
Companies: carrieriq
Reader Comments
Subscribe: RSS
View by: Time | Thread
Is it a Root Kit?
--Is this really a "root kit"
--How do you detect/remove it from cell phones
--Will the phone manufacturers, carriers, CarrierIQ, or perhaps all three retain any liability? Will they be served with class action suits?
[ link to this | view in thread ]
Re: Is it a Root Kit?
This thing is as bad as Sony's attack on freedom last decade with its rootkit.
[ link to this | view in thread ]
Re: Is it a Root Kit?
I don't know if it qualifies as a "rootkit", but I know that:
- It is well hidden in the bowls of the operating system
- It is hard to detect and remove
- It has the capability of gathering usage data and sending it back home without the user's consent
- It has access to your contacts, your browser history, your calls, etc., etc., etc.
- People don't want it
So, it might not be a "rootkit", but it certainly qualifies as spyware (or maybe even malware).
[ link to this | view in thread ]
Re: Is it a Root Kit?
It can be removed but doing so requires a degree of proficiency which most users do not possess.
Haven't not spent much time researching this, I cannot answers simply if it is a rootkit--however, it IS the mother-of-all spyware, recording every little detail about your phone use and reporting it to anybody who knows the right "mother may I" questions to ask.
And it's in your phone by default--your carrier/manufacturer put it there.
[ link to this | view in thread ]
Re: Is it a Root Kit?
[ link to this | view in thread ]
sdf
I'd be curious to see if there is anything being done maliciously by the carriers who are requesting this to be on the phones.
Dont you have to sign some type of agreement for that type of data to be harvested by a program running on the phone?
Im pretty sure any PC manufacturer would be burned at the stake if they tried this on a windows box.
[ link to this | view in thread ]
[ link to this | view in thread ]
Re: Is it a Root Kit?
[ link to this | view in thread ]
Re: sdf
https://email.vzwshop.com/servlet/website/ResponseForm?OSPECC_9_0_9hg_eLnHs_uhmpJLE
This includes selling the data to third parties.
[ link to this | view in thread ]
Does Vodaphone UK use it?
[ link to this | view in thread ]
Really?
Whatever content my Adroid devices distribute I want to be in control of that. I think obviously, any individual wants to be responsible for the information that gets distributed.
I'll make a deal with you. You give me back my phone and I'll give you back your manuals.
[ link to this | view in thread ]
Re:
I have AT&T. Looking at my backups for my Samsung Captivate from AT&T, CarrierIQ is listed as an application installed on their stock image. Not sure whether they were using it, but its there. Now that I am using CTMod, CarrierIQ is not installed (though when I originally installed CTMod, I tried to load CarrierIQ back on the phone as I had no idea what it was, but it said my phones OS was incompatible (as did quite a bit of the other stock applications.)
I also checked my blackberry app backups and it was on one of the two Blackberries I owned before I bought my Captivate.
However, I am not sure if AT&T was actually using it, or if they just bought it from the vendor that way. AT&T called me after I loaded the updated code for blackberry from the RIM website and asked me if my phone was working properly because they weren't getting updates...not sure if this is related. They never called me when I rooted my Samsung, but I figure they already knew I "was one of those guys" based on my discussion with them after updating my blackberry.
[ link to this | view in thread ]
Re: Re: Is it a Root Kit?
Talk about childish... "We've been caught, so we're taking our toys (documentation) and going home!!"
[ link to this | view in thread ]
Whoops!
[ link to this | view in thread ]
Hoo Boy!
[ link to this | view in thread ]
Data Access Charges
[ link to this | view in thread ]
Definitely possible to remove/get rid of
I know there are a lot of people who just want to buy a smart device and have it work, but if you value your privacy, you can remove unwanted bloatware/spyware from your devices with relative ease. There are numerous sites, blogs, forums with instructions for rooting, hacking and reloading your Android device. This does include a solid majority of current and legacy units. Even devices that have a "locked" boot loader(Motorola comes to mind) have been cracked for loading custom ROMs.
Best part, most include instructions and Binaries to reset the unit back to OEM stock with all crap reinstalled.
[ link to this | view in thread ]