Technology bloggers are asking if our cellphones are spying on us after a security researcher said a piece of software hidden on millions of phones was recording virtually everything people do with them.
Amid a broad outcry, Sen. Al Franken (D- Minn.) is calling for an investigation. A class-action lawsuit has been filed against the software’s maker, Carrier IQ Inc. of Mountain View, Calif.
The software, which Carrier IQ says is used on some 150 million mobile devices, appears relatively innocuous. It does watch what owners of Sprint Nextel Corp. and AT&T Inc. smartphones do with them, including what people type and the numbers they dial. But it doesn’t seem to transmit every keystroke to the company. Instead, it kicks into action when there’s a problem, like a call that doesn’t go through, and it lets the phone company know.
“It is software that is developed in partnership with carriers with the intent to improve network performance. As far as we can tell, it meets this description in execution,” said Tim Wyatt, principal engineer at Lookout, a cellphone security company.
AT&T Inc. (NYSE: T), Sprint Nextel Corp. (NYSE: S), Apple Inc. (Nasdaq: AAPL) and T-Mobile USA also have been sued by mobile phone customers who claim that Carrier IQ tracking software violates U.S. wiretapping and computer fraud laws.
The lawsuit cites a YouTube report by a technology blogger that purported to show that Carrier IQ software collects information on phone users’ locations, applications and Web browsing and even the keys they press. Four consumers filed a complaint yesterday in federal court in Wilmington, Delaware, seeking to block the carriers and phone makers from using the software.
Carrier IQ software logs user activity and runs in the background of mobile devices. After the YouTube report, the U.S. Senate Judiciary Committee contacted the company seeking information and alleging that the software may violate federal privacy laws, according to a copy of the complaint supplied by David Straite, an attorney for the plaintiffs. The filing of the lawsuit couldn’t be confirmed Friday through electronic court records.
AT&T and Sprint, the second- and third-largest U.S. wireless providers, said in e-mailed statements on Dec. 1 that the software data is used to improve service performance.
“In line with our privacy policy, we solely use CIQ software data to improve wireless network and service performance,” AT&T said.
Apple stopped supporting Carrier IQ in most products and will remove it completely in a future software update, Natalie Harrison, an Apple spokeswoman, said in a Dec. 1 e-mail.
The customers who sued seek compensatory and punitive damages on behalf of all others whose devices contain the so-called rootkit software from Carrier IQ, which is also named as a defendant in the suit.
Violations of the federal wiretap laws, which prohibit willful interception of wire or electronic communication, can result in damages of $100 a day per violation, according to the complaint.
Carol Roos, a spokeswoman for Dallas-based AT&T, declined to comment on the lawsuit.
Tom Neumayr, a spokesman for Cupertino, California-based Apple; Leigh Horner, a spokeswoman for Overland Park, Kansas- based Sprint Nextel; and T-Mobile USA representatives didn’t immediately return calls seeking comment after regular business hours yesterday. Carrier IQ spokeswoman Mira Woods didn’t immediately respond to an e-mailed request for comment.
In a statement Nov. 16, Carrier IQ said its software is designed to improve user experience and is embedded in devices by manufacturers along with other diagnostic tools. The company also says it doesn’t sell personal subscriber information to third parties.
(Bloomberg news and The Associated Press contributed to this report.)
