Report: Carrier IQ Installed on Three of Four Carriers' Devices

Over the course of the week and a half since Carrier IQ was demonstrated by security researcher Trevor Eckhart, a great deal has been revealed about the Carrier IQ software installed on a variety of smartphones by a number of carriers.

 Currently, three of the four major carriers (everyone but Verizon Wireless) have installed the software on some of their devices. T-Mobile and AT&T have confirmed this, both saying they use it for troubleshooting network quality issues.

So far, Carrier IQ seems to be used for mostly non-nefarious purposes, and may in fact be used exactly as the carriers say, as InformationWeek’s Matthew Schwartz explains. But there are several problems with the existence of the software that go far beyond what the carriers say it is being used for. First, there’s no way for users to disable or remove the software without violating the warranty on their phone, which is something most companies probably won’t do. The second is that even though the Carrier IQ software currently seems focused on network quality issues, it’s clearly capable of recording and sending much more than that. According to Eckhart’s video, it can record the contents of text messages and e-mails, and may even be able to record phone conversations.

While the software as currently implemented isn’t doing these things, the capability clearly exists. So what’s to keep another piece of software from exploiting this capability and then sending out information beyond what Carrier IQ might normally do? Actually, not much -- it’s entirely possible to develop malware for Android smartphones that simply interfaces with the Carrier IQ software and collects the information whoever planted the software wants.

While it’s possible that security software could detect and block such software, currently it’s not clear anyone’s security software has the capability. The answer right now is to stick with Verizon phones when possible. If you must use a GSM phone because of your travel requirements, use one of the devices that’s NOT on the list of T-Mobile’s Carrier IQ-enabled phones. And if you’re a big enough customer of any carrier, perhaps you can strong-arm it into dropping Carrier IQ from the phones you buy.