Carrier IQ - FBI using the data from it.

[odie]

Not sure if this is the right place for this, but this made me all warm and fuzzy inside.

http://boingboing.net/2011/12/12/fbi...ier-iq-fo.html

By Rob Beschizza at 12:42 pm Monday, Dec 12
The FBI disclosed this weekend that it uses data gathered by Carrier IQ software for "law enforcement purposes", but refused to give any details of exactly how it has done so.

Responding to a Freedom of Information Act request filed by Muckrock, the FBI said that it held relevant records but that their release could interfere with pending or prospective law enforcement proceedings.

The request asked for "manuals, documents or other written guidance used to access or analyze data gathered by programs developed or deployed by Carrier IQ."

Muckrock's Michael Morisy says he plans to appeal the FBI's decision: "What is still unclear is whether the FBI used Carrier IQ's software in its own investigations, whether it is currently investigating Carrier IQ, or whether it is some combination of both."

Carrier IQ came to public attention after threatening a security researcher who reported on the functionality of its software, which is installed on cellphones by some carriers and handset manufacturers. The software, described by Google chairman Eric Schmidt as a "keylogger", is capable of logging and transmitting everything typed by users, though Carrier IQ insists that it does not do so.

The researcher, Trevor Eckhart, spotted suspicious logging activity and demonstrated how the software reacts when users interacted with their cellphones. Sprint, T-Mobile, and AT&T all acknowledge using Carrier IQ for diagnostic purposes, but say that they do not use it to maintain records of individual users' activity.

Read the request and the FBI denial: FBI: Carrier IQ files used for "law enforcement purposes"

[odie]

And more! http://gizmodo.com/5867427/the-fbi-i...iq-information This is where I found out about the FBI taking the info.

http://www.muckrock.com/news/archive...ment-purposes/

by Michael Morisy on Dec. 12, 2011, 2:30 p.m.
FOI Request: Manuals or Documentation Regarding Accessing Carrier IQ Data (FBI)

A recent FOIA request to the Federal Bureau of Investigation for "manuals, documents or other written guidance used to access or analyze data gathered by programs developed or deployed by Carrier IQ" was met with a telling denial. In it, the FBI stated it did have responsive documents - but they were exempt under a provision that covers materials that, if disclosed, might reasonably interfere with an ongoing investigation.

Carrier IQ came under fire after a security researcher demonstrated that the previously little-known company had software installed on a variety of phones on a variety of networks that could track user locations, keystrokes, encrypted Internet traffic and more, some of which was or could be sent back to either the cell phone owner's service provider or Carrier IQ's own servers.

What is still unclear is whether the FBI used Carrier IQ's software to in its own investigations, whether it is currently investigating Carrier IQ, or whether it is some combination of both - not unlikely given the recent uproar over the practice coupled with the U.S. intelligence communities reliance on third-party vendors. The response would seem to indicate at least the former, since the request was specifically for documents related directly to accessing and analyzing Carrier IQ data.

I plan to appeal the blanket denial in hopes of answering that question.

Here is the full denial of the request: (PDF is suppose to be here)

[odie]

PC mag just did an article on it.
http://www.pcmag.com/article2/0,2817,2397554,00.asp

The FBI has denied a request for more details about how the agency might be using Carrier IQ, according to a blogger who filed a Freedom of Information Act (FOIA) request for data.
Carrier IQ, meanwhile, released a lengthy FAQ today in which it explained its technology and once again denied logging keystrokes or improperly collecting user data.

For those who need a refresher, Carrier IQ made headlines in recent weeks after a researcher, Trevor Eckhart, suggested that the technology is secretly embedded on many popular phones and can gather personal data about users. Carrier IQ said its technology is used for diagnostic purposes and denied logging keystrokes or being able to read the content of emails, text messages, or Web sites.

In the wake of the controversy surrounding the company, Michael Morisy of Muckrock News filed a FOIA request for "manuals, documents or other written guidance used to access or analyze data gathered by programs developed or deployed by Carrier IQ." But on Dec. 7, the FBI denied that request, arguing that the records in question were related to "a pending or prospective law enforcement proceeding," and their release might "interfere with the enforcement proceedings."
When asked about the FBI, a Carrier IQ spokeswoman said the company "has never provided any data to the FBI."
"If approached by a law enforcement agency, we would refer them to the network operators because the diagnostic data collected belongs to them and not Carrier IQ," she continued. "Carrier IQ's data is not designed to address the special needs of law enforcement. The diagnostic data that we capture is mostly historical and won't reveal where somebody is and what they are doing on a real-time basis."

The Next Web was more skeptical about the FBI's use of Carrier IQ. Quoting attorney and contributor Jeff Cormier, the blog pointed to the fact that Congress has asked the Federal Trade Commission to investigate the Carrier IQ issue. "That is the likely reason why information is being withheld," Cormier said. "It's completely inaccurate to state there is an 'ongoing investigation.'"

Carrier IQ Responds
Separate from the FBI issue, Carrier IQ on Tuesday released a 19-page document dubbed "Understanding Carrier IQ," which delves into the company's technology.
Among the issues addressed are the video produced by Eckhart, which showed an Android-based HTC device accessing private details from a user's phone, including Google search terms. Carrier IQ said today that the data was displayed because of software settings unrelated to Carrier IQ.

"Our investigation of Trevor Eckhart's video indicates that location, key presses, SMS and other information appears in log files as a result of debug messages from pre-production handset manufacturer software," Carrier IQ said. "Specifically it appears that the handset manufacturer software's debug capabilities remained 'switched on' in devices sold to consumers."
Carrier IQ software, known as an IQ Agent, "does not use the Android log files to acquire or output metrics," the company said.

Carrier IQ said it is working with handset manufacturers to get them to turn off debug messages with personal data "to prevent them from being written into log files."
The company did, however, admit to a bug that allowed for the collection of radio messages in which text messages were embedded. Carrier IQ said these messages "were not decoded or made available in human readable form to Carrier IQ, its customers or any third party."

"Upon discovering the bug, Carrier IQ and its customers took immediate steps to remedy the bug and Carrier IQ customers are no longer uploading such data," the company said.

To collect its data, meanwhile, Carrier IQ said information is transmitted on a regular schedule, but there is a specific, numeric key code that can be punched into a phone to trigger data collection.
"Carrier IQ has never intentionally captured or transmitted keystrokes and is not aware of any circumstances where this has occurred," the company said. "Carrier IQ is not a keylogger and no customer has asked Carrier IQ to capture key strokes."