The problem, Mr. Coward said, is that carriers are collecting the sensitive data in a log file and passing it on.
“When a piece of information is sent to us from the operation system, we do not need it to go through that log file,” Mr. Coward told The Verge. “There is no value to us in reading a keylog file, that’s not how our software works.”
Carrier IQ: It’s not our fault
Carrier IQ came under fire when Trevor Eckhart showed that the software was logging all of the keystrokes on his Android-based phone. The company denied the accusation, and sued Mr. Eckhart over the claims.
Apple’s iOS was shown to include references to Carrier IQ, although the company has since said it stopped using the software with the release of iOS 5, and that users were given the option to opt-in when sharing diagnostic data. The opt-in data Apple was collecting was anonymous and never included keystrokes from customer’s activities.
Carrier IQ gave phone makers and carriers an API so they can feed information into the application, and it seems companies may be using their own log files that are also collecting keystrokes.
“What should be happening, is [the phone] should just be giving [data] to us through the API,” Mr. Coward said. “What appears to be happening is that it’s giving it to us and making a copy of what it gave to us in the log file.”
In other words, it’s the carrier’s fault.
Senator Al Franken asked Carrier IQ last week to detail how and why it collects phone user’s data. He stated in a letter to the company, “It appears that this software runs automatically every time you turn your phone on. It also appears that an average user would have no way to know that this software is running — and that when that user finds out, he or she will have no reasonable means to remove or stop it.”
Congressman Edward J. Markey followed up by asking the Federal Trade Commission to look into Carrier IQ’s practices.
“This software raises a number of privacy concerns for Android, Blackberry, and Nokia users,” he said. “Consumers neither have knowledge of this data collection, nor what Carier IQ intends to do with this information. As a co-Chair of the Congressional Bi-Partisan Privacy Caucus, I am a concerned that this practice violates the privacy rights of consumers.”
Despite Mr. Coward’s claims that carriers are to blame for the data logging, Carrier IQ’s software is still monitoring keystrokes and SMS messages. The reason being, he said, is to listen for carrier “short codes” that issue system commands.
For now, there are more questions than answers surrounding Carrier IQ and its software. With politicians showing a focused interest in the company, however, we’ll probably know more about what’s being collected and stored soon.