Updated with a response from Carrier IQ.
Want to know if Carrier IQ, the dialer- and location-sniffing software installed in millions of phones, is being used by the FBI for law enforcement investigations? The FBI won't reveal much about the controversial application. And why not? Because, the Bureau says, doing so might interfere with law enforcement investigations.
That's the strange and potentially revealing logic the FBI used earlier this month to deny a Freedom of Information request filed by Michael Morisy, a blogger for the website Muckrock.com. After a video surfaced that seemed to show the software logging keystrokes and monitoring data traffic on the more than 140 million phones on it's installed by default, Morisy had asked the Bureau for any "manuals, documents or other written guidance used to access or analyze data gathered by programs developed or deployed by Carrier IQ."
The FBI responded that the material couldn't be provided, and cited an exemption to the Freedom of Information law for situations in which handing over documents "could reasonably be expected to interfere with law enforcement proceedings."
Taken on its face, that would seem like exactly the confirmation of privacy advocates' worst fears about Carrier IQ: that the program is used as spyware in millions of handsets for law enforcement tracking. But in fact, the FBI could also merely be considering using Carrier IQ in an investigation, or even investigating Carrier itself, which has been accused of potentially breaking federal wiretap laws in millions of cases. Or, given the Bureau's bureaucratic adherence to secrecy by default, it's also possible that the FBI simply saw that Morisy was asking about a piece of hidden software that might be used for investigations and denied his request without even determining whether it has used or plans to use Carrier IQ.
I've put in a call to the FBI and will update this post if I receive a response.
Update: Carrier IQ has responded in a statement that it has "never provided any data to the FBI. If approached by a law enforcement agency, we would refer them to the network operators because the diagnostic data collected belongs to them and not Carrier IQ." It adds that its "data is not designed to address the special needs of law enforcement. The diagnostic data that we capture is mostly historical and won't reveal where somebody is and what they are doing on a real-time basis."
The company has also issued a lengthy document outlining exactly what data it does and doesn't capture, with a new admission that the software does capture and send some text message data to its carrier customers.
Since Carrier IQ was first revealed by 25-year old systems administrator Trevor Eckhart, the firm has been at the center of a growing scandal that has also included the carriers and handset manufacturers it counts as customers including Apple, HTC, Samsung, Sprint and AT&T. All those companies have all been hit with class action lawsuits, and Senator Al Franken has sent strongly-worded letters demanding to know the extent of the information Carrier IQ gathers.
Carrier IQ, for its part, has denied collecting information like text messages and web-surfing records from phones. "While we look at many aspects of a device’s performance, we are counting and summarizing performance, not recording keystrokes or providing tracking tools," the company wrote to me in a statement earlier this month. Security researcher Dan Rosenberg has performed a detailed analysis of the software that shows it doesn't in fact log texts or any keystrokes other than the phone's dialer, and that it reads only the URLs a user enters, not the content of the user's web page. It can also read the user's GPS location.
Though the company's privacy violations may have been initially exaggerated, Carrier IQ fanned the flames by attempting to quash Eckhart's research, which instead drew more attention to the scandal.
Whether or not the software is used by law enforcement for spying on users' phones, the FBI's denial of Morisy's Freedom of Information request is also likely to backfire just as the company's legal bullying of Eckhart did. By explicitly refusing to answer questions while implying that Carrier IQ can in fact be used as Big Brother spyware, the government just poured gas on the privacy fire Carrier IQ has been desperately trying to put out.
[Hat tip to Boing Boing.]
