FBI Admits That It Uses Carrier IQ For Law Enforcement Purposes; Won't Say How

from the and-then-there's-that... dept

Tue, Dec 13th 2011 12:06pm — Mike Masnick

So remember Carrier IQ? That would be the company that is providing what's been deemed a root kit on a ton of mobile phones. While the company has sought to downplay the security and privacy risks of its software (to the point of threatening the main researcher behind the revelation), further research suggested that the software likely tracked actions down to the keystroke. Again, Carrier IQ has insisted that its only purpose was to help mobile operators get data and information to help out when users are having problems. For example, it notes the ability to highlight when and how users have dropped calls. And if this was all it really does, then the software might be slightly reasonable (though, the fact that it's hidden and almost impossible to remove represents a significant problem no matter how benign the software might be).

However, Michael Morisy over at the site Muckrock, decided he might try a different angle to learn about Carrier IQ and whether it was used for surveillance: he filed a Freedom of Information Act request with the FBI to find out if and how it uses Carrier IQ data. Not too surprisingly, the FBI won't provide him any details, but the way in which it turned him down was actually quite telling. Rather than just saying there were "no responsive documents," it instead said that it did have responsive documents "but they were exempt under a provision that covers materials that, if disclosed, might reasonably interfere with an ongoing investigation." That may imply, contrary to Carrier IQ's suggestions, that its software isn't for monitoring and spying, that the FBI views it quite differently, and already makes use of some Carrier IQ data. Of course, Morisy notes that there is another possible explanation: the FBI could be investigating Carrier IQ itself following these allegations, and it won't reveal the data for fear of compromising that investigation. Either way, it at least raises some significant new questions concerning Carrier IQ and how its data is being used.

Update: Carrier IQ has come out with a response insisting that it has never given out info to the FBI. I would imagine that's true, but it's besides the point. The issue is whether or not the FBI uses Carrier IQ data that it receives via the mobile operators.

Thank you for reading this Techdirt post. With so many things competing for everyone’s attention these days, we really appreciate you giving us your time. We work hard every day to put quality content out there for our community.

Techdirt is one of the few remaining truly independent media outlets. We do not have a giant corporation behind us, and we rely heavily on our community to support us, in an age when advertisers are increasingly uninterested in sponsoring small, independent sites — especially a site like ours that is unwilling to pull punches in its reporting and analysis.

While other websites have resorted to paywalls, registration requirements, and increasingly annoying/intrusive advertising, we have always kept Techdirt open and available to anyone. But in order to continue doing so, we need your support. We offer a variety of ways for our readers to support us, from direct donations to special subscriptions and cool merchandise — and every little bit helps. Thank you.

–The Techdirt Team

Filed Under: fbi, privacy, spying
Companies: carrieriq, sprint, verizon wireless

31 Comments

If you liked this post, you may also be interested in...

Reader Comments

Subscribe: RSS

View by: Time | Thread

:Lobo Santo (profile), 13 Dec 2011 @ 12:13pm

Foreseeable Future
And those documents will continue to be exempt for the foreseeable future, until something replaces Carrier IQ--and then you may see them 60 years after that point.

Bureaucratic corruption at its finest!
[ link to this | view in thread ]
Violated (profile), 13 Dec 2011 @ 12:24pm

Due Process
Should the FBI want to peer into people's phones then they should remember the Fourth Amendment and ensure a warrant is first obtained from a Court.

Why do I have the feeling that is not how the FBI uses this technology and it is more akin to eBay shopping?
[ link to this | view in thread ]
Robert P (profile), 13 Dec 2011 @ 12:53pm

You're a day or so out of date. Apparently, Carrier IQ has already responded to the article you mentioned and said they don't provide data to the FBI.

http://gizmodo.com/5867693/carrier-iq-were-not-working-with-the-fbi

So maybe it's the second option, that the FBI is already looking into them.
[ link to this | view in thread ]
Anonymous Coward, 13 Dec 2011 @ 12:53pm

fbi is probably most upset that Carrier IQ got caught, and is now trying to find a way to distance themselves
[ link to this | view in thread ]
anonymous, 13 Dec 2011 @ 1:04pm

there is no excuse for putting any type of tracking software on anything, without making it known to whoever owns the device and without there being an option to remove that software completely as well!
[ link to this | view in thread ]
heyidiot (profile), 13 Dec 2011 @ 1:07pm

"...we would refer them to the network operators because the diagnostic data collected belongs to them and not Carrier IQ."

So the FBI is collecting the Carrier IQ data from the network operators instead of directly from Carrier IQ.

They don't (and can't) say the FBI isn't getting it, just that Carrier IQ isn't giving it to them...
[ link to this | view in thread ]
Anonymous Coward, 13 Dec 2011 @ 1:17pm

Re: Due Process
Oh wait. The Supreme Court has held that non-content information (i.e. location information, call time, routing information, phone numbers etc.) are not protected by the 4th amendment. Civil rights are dead homie.
[ link to this | view in thread ]
Anonymous Coward, 13 Dec 2011 @ 1:17pm

Re: Due Process
Oh wait. The Supreme Court has held that non-content information (i.e. location information, call time, routing information, phone numbers etc.) are not protected by the 4th amendment. Civil rights are dead homie.
[ link to this | view in thread ]
David Liu, 13 Dec 2011 @ 1:19pm

Re:
Carrier IQ just provides the software anyways. I don't think there'd be any reason for Carrier IQ to have the actual data in the first place.
[ link to this | view in thread ]
Anonymous Coward, 13 Dec 2011 @ 1:20pm

Re: Due Process
Right :) What country do you think you're living in?
[ link to this | view in thread ]
Nathan F (profile), 13 Dec 2011 @ 1:24pm

Re:
Hrm... The Secret Service should be getting in on the hunt. Doesn't the President use a smartphone.. one of the Blackberry models?
[ link to this | view in thread ]
Anonymous Coward, 13 Dec 2011 @ 1:26pm

Re:
Which is probably an important distinction. The carrier probably has consent from the subscriber via the contract that was signed (okay, arguable, but at least colorable.) CIQ has absolutely no relationship with the person it is tracking.
[ link to this | view in thread ]
Anonymous Coward, 13 Dec 2011 @ 1:29pm

This underscores why data collection such as this should illegal. It's not that I give a rat's ass if my carrier sees how many times I have launched Angry Birds, it's that I'd such data exists, and thanks to the Patriot Act, it's never just for carriers because the fucking Feds will strong-arm their way into the data.
[ link to this | view in thread ]
The eejit (profile), 13 Dec 2011 @ 1:52pm

Re:
I'm more worriede about the possibility of a Carrier IQ master key being available.
[ link to this | view in thread ]
Bob, 13 Dec 2011 @ 3:45pm

What about
What about the NSA, CIA, TSA and so on? If I were running Carrier IQ and I found my company in this firestorm, I'd not have stopped at mentioning the FBI.

Furthermore, all they claim is that they haven't provided data to the FBI and not that they haven't provided the FBI with the means to independently use the carrier iq software to gather their own data.
[ link to this | view in thread ]
TtfnJohn (profile), 13 Dec 2011 @ 3:51pm

I'm not at all surprised. Nor would it surprise me to find out that law enforcement agencies have had access to the data collected by CarrierIQ whether directly from them or not.

Then, I want to know if said agencies have actually been using it for a legitimate investigation of to go fishing.

The FBI loves to fish. So, in fairness, does the RCMP.

Sigh.
[ link to this | view in thread ]
Caged Ideas, 13 Dec 2011 @ 4:38pm

Every Cell Phone Is Tracked
We have spent years researching this whole problem and it's not just because of the type of phone you have, the software installed on it, or who's operating system controls your phone, the core of the problem is in the way the cellular networks function. All cell phones are tracked real time, and all of them can be compromised allowing your devices microphone, camera, or GPS to be used by unauthorized persons without your knowledge. In addition the contents of your entire phone including the text messages, emails, phone book, confidential log in information etc can be accessed with or without the phone being connected to any network.

After realizing the extent of the problem we set out to create a device which would allow the owners of these devices to control when, where and by whom the device is accessed as of this month we are making this device available to you, me and everyone else concerned about their privacy. See us at www.thecaseforprivacy.com for more information.
[ link to this | view in thread ]
abc gum, 13 Dec 2011 @ 6:50pm

Re: Re:
and Iran is able to control it remotely
[ link to this | view in thread ]
abc gum, 13 Dec 2011 @ 6:55pm

Re: Every Cell Phone Is Tracked
Would it be possible to spell out a little message for them by turning the phone on / off at key points whilst while driving about town?

If so - that would be awesome.
[ link to this | view in thread ]
Anonymous Coward, 13 Dec 2011 @ 11:15pm

Re: Re: Due Process
Not until the last encryption is broken.
[ link to this | view in thread ]
snidely (profile), 14 Dec 2011 @ 1:26am

Re:
Exactly. Just because Carrier IQ didn't give the data doesn't mean the FBI doesn't have it. The app stores data on your phone and occasionally transmits the data to your operator. How hard would it be for the FBI to find that storage location and crack whatever pathetic encryption Carrier IQ is using? The FBI definitely has some serious encryption-cracking software and plenty of nerds to figure out how to get info off of a phone.
[ link to this | view in thread ]
hmm (profile), 14 Dec 2011 @ 6:45am

Carrier IQ saying it never gave info to the FBI kinda proves the FBI is investigating this shady organization, because god KNOWS what personal info they've been selling to scam artists, the chinese government and others.

(Saying Chinese government might seem a stretch but if someone is working in the tech industry, wouldn't YOU want to know if they were unhappy at work and would be ripe for headhunting?)
[ link to this | view in thread ]
hmm (profile), 14 Dec 2011 @ 6:46am

Carrier IQ saying it never gave info to the FBI kinda proves the FBI is investigating this shady organization, because god KNOWS what personal info they've been selling to scam artists, the chinese government and others.

(Saying Chinese government might seem a stretch but if someone is working in the tech industry, wouldn't YOU want to know if they were unhappy at work and would be ripe for headhunting?)
[ link to this | view in thread ]
hmm (profile), 14 Dec 2011 @ 6:47am

well
Carrier IQ saying it never gave info to the FBI kinda proves the FBI is investigating this shady organization, because god KNOWS what personal info they've been selling to scam artists, the chinese government and others.

(Saying Chinese government might seem a stretch but if someone is working in the tech industry, wouldn't YOU want to know if they were unhappy at work and would be ripe for headhunting?)
[ link to this | view in thread ]
hmm (profile), 14 Dec 2011 @ 6:47am

well
Carrier IQ saying it never gave info to the FBI kinda proves the FBI is investigating this shady organization, because god KNOWS what personal info they've been selling to scam artists, the chinese government and others.

(Saying Chinese government might seem a stretch but if someone is working in the tech industry, wouldn't YOU want to know if they were unhappy at work and would be ripe for headhunting?)
[ link to this | view in thread ]
hmm (profile), 14 Dec 2011 @ 6:50am

bugged post
sorry for the bugged post, stupid internet crashed and its submitted it several times when 're-trying' the send automatically :(
[ link to this | view in thread ]
Anon, 14 Dec 2011 @ 8:15am

more information
Please see http://www.carrieriq.com/company/PR.20111212.pdf
It is an in depth look at what it does and does not do.

I don't think the FBI uses the metrics data because there is nothing there to begin with. To top that off it isn't Carrier IQ's data it is the carriers.
Any request for anything is given to the carriers, from law enforcement following a warrant for information.
How and what information is given from the carrier to law enforcement, Carrier IQ has nothing to do with it whats so ever.
[ link to this | view in thread ]
Anonymous Coward, 14 Dec 2011 @ 9:40am

Re: Re: Re: Due Process
FBI doesnt need to break encryption since the telecoms give them a back-door entry into the data.
[ link to this | view in thread ]
The Case For Privacy, 14 Dec 2011 @ 10:50am

Every phone is tracked and all can be comprimised with a laptop and an antenna.
We have spent years researching this whole problem and it's not just because of the type of phone you have, the software installed on it, or who's operating system controls your phone, the core of the problem is in the way the cellular networks function. All cell phones are tracked real time, and all of them can be compromised allowing your devices microphone, camera, or GPS to be used by unauthorized persons without your knowledge. In addition the contents of your entire phone including the text messages, emails, phone book, confidential log in information etc can be accessed with or without the phone being connected to any network.

After realizing the extent of the problem we set out to create a device which would allow the owners of these devices to control when, where and by whom the device is accessed as of this month we are making this device available to you, me and everyone else concerned about their privacy. See us at www.thecaseforprivacy.com/blogs/news for more information.
[ link to this | view in thread ]
S, 14 Dec 2011 @ 12:29pm

You can do better, Mike
I agree that this whole Carrier IQ thing is a menace, and that the FBI can't be assumed innocent, but your headline is just plain sensationalist (and misleading) -- while it technically does not claim that the FBI uses Carrier IQ data for law enforcement purposes, the phrasing, "Uses Carrier IQ for Law Enforcement Purposes," is very hard to read in any other way.
[ link to this | view in thread ]
helloword, 13 Mar 2012 @ 4:54pm

The company says that its software is deployed in over 150 million devices worldwide. On November 12, 2011, Trevor Eckhart published a report indicating that Carrier IQ software was capable of recording user keystrokes. What fo you think about that?

Removals to Spain
[ link to this | view in thread ]