US Senator demands answers from Carrier IQ
Al Franken calls smartphone tracker on the carpet
Senator and former late-night funnyman Al Franken has called on Carrier IQ to explain why its diagnostic software, buried in the bowels of 141 million smartphones, isn't a massive violation of US wiretap laws.
In a letter sent to Larry Lenhart, CEO and president of the Mountain View, California-based software maker, Franken expressed concern the software may run afoul of the Electronic Communications Privacy Act, which forbids the monitoring of communications without the users’ consent, and the Computer Fraud and Abuse Act. The letter was sent after a 25-year-old Android app developer published evidence that Carrier IQ software may secretly log end users' key taps and text messages.
“It appears that this software runs automatically every time you turn your phone on,” wrote Franken, who is the chairman of the Subcommittee on Privacy Technology and the Law. “It appears that an average user would have no way to know that this software is running – and that when that user finds out, he or she will have no reasonable means to remove or stop it.”
Prior to the posting of a YouTube video by developer Trevor Eckhart, Carrier IQ representatives said their software didn't log specific key strokes or read the contents of messages. They have yet to square those claims against Eckhart's demonstration, in which he used
a packet sniffer debugging logs to show the software monitoring every alphanumeric key pressed on his HTC EVO handset, even when entered into webpages encrypted with the SSL, or secure sockets layer, protocol.
The Register has asked Carrier IQ representatives for additional comment, and the request still stands. In the meantime, here's Franken's letter:
- Black Hat
- Common Vulnerability Scoring System
- Cybersecurity and Infrastructure Security Agency
- Cybersecurity Information Sharing Act
- Data Breach
- Data Protection
- Data Theft
- Digital certificate
- Identity Theft
- Kenna Security
- Palo Alto Networks
- Privacy Sandbox
- Samsung Galaxy Ace
- Trusted Platform Module
- Zero trust