FBI: Carrier IQ files used for "law enforcement purposes" | Hacker News Reader

FBI: Carrier IQ files used for "law enforcement purposes"

muckrock.com

215 pointsmorisy78 comments

A profile is being generated about you, slowly but surely. It starts out as a vague picture, but the more you communicate, the the more clearly you define yourself. It includes your political affiliations, interests you display online, who your friends are, your every movement, your sexual preferences, close secrets, and anything else that can be gathered about you. These profiles are stored in a government database that allow contractors to test threat-detection algorithms to identify potential threats to national security -- aka, status quo. These reports will be sent to the appropriate LEO to summon and indefinitely detain you. You will be sent to a secret prison. You will not have a court date. Get ready for the New America.

Edit - Yes, the hyperbole is strong in this one.

And all I can think of is.

Holy Shit. Stallman was right.

Prescience is a dangerous gift for ones mental health. I like to think of RMS as driven mad by his vision not seeing vision because of being mad.

While I do appreciate your statement in the larger literary context (great artists and prophets deemed insane), and I don't think RMS is justified in everything he does...

I reject your allusion to his insanity. Neurotic behavior is not the same as out-of-control psychotic.

But do you know what the worst part is?

He is right and he was right on basically every count of batshit crazy IP/privacy "conspiracy" he ever conceived. And as crazy and repugnant as we find him. He probably is right about what is coming but we don't see it yet.

I think the actual "worst part" is that the guy who was right is a guy which most people find repulsive.

That's how it usually is, unfortunately. People don't like being told where dangerous things will lead them.

Except that the reason we find him repulsive is not because of him telling us "where dangerous things will lead them" but because of him as a human being, his behaviours and personal hygiene.

I have great respect for his thoughts and ideas, and his steadfastness in following his own rules/guidelines, but I don't like him. If he were to look more the part I would have an easier time telling people about his ideas and thoughts without having to worry about people asking "Is that the guy that eats stuff he pulls from his feet?". His outward appearance influences the way people see him, the way people treat him and how much they value his ideas and how seriously they take them.

That is unfortunately true for anyone in almost any situation.

I think manners, and not eating dead skin in front of an audience, is not incompatible with having foresight.

But being maladapted in other ways might well be part of being "prophetic". Prescience, it appears, has a price.

Too bad people are shallow enough to regard matters of hygiene and mannerisms on the same level as having the uncanny ability to foretell what will happen. When will people learn to just see through that, ignore that... People can be weird and still have something substantial to say.

This has absolutely nothing to do with rms and his visions. Which are wrong.

Apparently many of you think that being "open" helped Android to avoid troubles with Carrier IQ. Or that rms ir right because… because he is right, I suppose. Or he will be shown to be right in some distant future. Or he is right, because he cannot be wrong.

Guys, did you even stop to think what is he right about? Or if you did stop to think about it, did you also think how do you know that he is right? And if you do indeed observe something seemingly proving that he is right, did you consider other options why that particular phenomenon would take place?

On the other hand, seeing this "two legs is bad, four legs is good" mentality in action is absolutely amazing experience.

>>Yes, the hyperbole is strong in this one.

Considering the link below I'm not so sure:

http://www.huffingtonpost.com/2011/12/12/indefinite-military...

... And you can't 'escape' it. Eventually a lack of data on you will be suspicious in and of itself.

There's an easy way around that, though: speak, act, live and think in a manner that's patently inoffensive to anybody.

* I guess I'm being too subtle with my sarcasm, huh. Well, I'll be Larry Literal from now on.

It wouldn't surprise me if that, in and of itself, was an identifier.

I find myself thinking of coin-flip experiments, where it's trivial to discern who ran some sort of legitimately random test, and who just made up Heads and Tails, because humans are terrible at approximating randomness.

The usual solution to that is automation. While it is obviously nontrivial to automate creating all the data of a normal human life, it's hardly impossible.

Yes, exactly what every corrupt regime likes, people who don't need to be pushed around, but instead get out of the way of their own accord.

People like that invite tyranny upon themselves.

Unless you have an AI living a low key, nonthreatening virtual life for you.

> Get ready for the New World.

FTFY. I'm sure this is happening all over the world.

The most troubling part of this whole story is that Carrier IQ itself may be breaking Federal laws by logging keystrokes without getting consent from the user...and then the FBI uses that data in investigations. Wonderful.

It acts as a keylogger on some android phones, when Carrier IQ is put into a "debug state". The researcher apparently triggered that by accident without knowing. It's not the default log level. Carrier IQ is likely benign and this whole issue seems to be bad tech journalism and sensationalism.

Do you really think this is logical, or even probable, based on the FBI's past history with abusing "National Security Letters" and other forms of snooping? Note that FBI has a long-term problem with wanting to collect info on legitmate dissenters: http://en.wikipedia.org/wiki/COINTELPRO

I hope they don't confuse me for suspected terrorist A.H. Tuttle.

It is entirely possible that the FBI is investigating Carrier IQ at the request of the Senate and has documents about what they have found regarding how Carrier IQ uses its data. Those documents would be part of an 'ongoing investigation.'

Still I appreciate the attempt at a FOIA dump.

>These reports will be sent to the appropriate LEO to summon and indefinitely detain you. You will be sent to a secret prison.

it may be not the worst what could happen to one. Reading about Kennedy/Oswald/Ruby, i've been wondering how much of a precisely targetted influence one is needed to be made behaving in a specific way. How much of our actions are really "ours"?

It's a bit scary how quickly our brains stop thinking when these topics come up..

If you have infinite knowledge/power over someone, locking them in jail is about the least profitable or fun thing you can do.

I think most of us come from a sort of middle class, well behaved background that prevents us from conceptualizing what it means to be corrupted by power.

>I think most of us come from a sort of middle class, well behaved background that prevents us from conceptualizing what it means to be corrupted by power.

from the background i come from it isn't always "corrupted by power", worst/bloodiest outcomes were result of "to have enough power to change the world [or a chunk of it] to the best [as the one having the power sees it]". The unchecked/unlimited power is the main core of the issue, not the specific intentions/people it is being used for/by.

> A profile is being generated about you, slowly but surely.

In days of old, I would have agreed, but things like Facebook make me question the whole "sinister" aspect of the central database.

Have you noticed how, if the government is the one collecting data, then it's evil? But, give a person the opportunity to share all kinds of private information about themselves on the Internet, they'll do it very quickly and willingly?

Or, we used to worry about those secret chips being implanted in us that could be used to track our location. Well, I don't know about you, but I sure love my location-aware apps that constantly broadcast my location. Cause, of course everyone should where I am all the time! </sarcasm>

If it's the government collecting data, then it's surveillance and evil. But if it's just egocentric self-promotion, it's all good.

We live in a world of our own creation. There is no conspiracy but the one we empower others to create.

And yes, I'm going heavy on the hyperbole here as well, but I'm really sort of sick of people whining and complaining about this stuff all the time. But at the same time, they don't want to pay the very real costs associated with privacy, freedom and security.

The point of most legislation is that people can't always protect themselves. Whether it's from other people, or from large organisations with great power, such as international corporations or the government. Strict privacy laws in more leftist places outside the US protect people from this sort of thing.

The fact is, people don't actually know with whom they're sharing the personal information. They think it's just their friends who can see their status updates / employer / friend network / political affiliation / sexuality. If the CIA called them up and asked them completely straightforwardly to volunteer that information for a national database I'm sure most would immediately refuse outright.

Thank goodness. I was worried that they might be misused. I feel safe now.

Go to sleep, citizens. All is well. All is under control.

Interesting excerpt from CarrierIQ's apology to Eckhart, which exists thanks to the EFF:

We would like to take this opportunity to reiterate the functionality of Carrier IQ’s software, what it does not do and what it does:

Does not record your keystrokes.

Does not provide tracking tools.

Does not inspect or report on the content of your communications, such as the content of emails and SMSs.

Does not provide real-time data reporting to any customer.

Finally, we do not sell Carrier IQ data to third parties.

http://www.carrieriq.com/company/PR.EckhartStatement.pdf

I notice that they don't say that they don't provide Carrier IQ data to third parties, just that they don't sell it.

Which is why it's nice to be in full control of the software/hardware stack you use. Walled gardens may look nice and be convenient in the present, and may even give the illusion of security, but in the end they're inevitably abused.

However, the only documented case of the abuse is on the "most open" hardware stack. Jailbreakers saw no keylogging on the iPhone. (In fact, it's disabled by default on the iPhone).

I'm not sure if you meant for this particular interpretation or not, but the way you invoke "walled garden" makes it sound a lot like you are targeting iOS specifically. This couldn't be further from the truth.

Based on my own reading. Carrier IQ is installed on many Android-based phones, including those from AT&T, Sprint and T-Mobile networks. Apple, HTC and Samsung have all confirmed that Carrier IQ is on their phones. HOWEVER, Apple has also announced that it has stopped supporting CIQ as of iOS 5, and will completely scrub the software from later releases.

So no, this has absolutely nothing to do with whether or not your phone exists in a closed ecosystem. The problem is that companies are incentivized to get away with as much of this kind of information collection as it possibly can. And just because I have to jailbreak my iPhone if I want to install unvetted software, doesn't mean Apple is thumbing their noses at legitimate customer complaints and concerns.

Carrier IQ is in iOS 5. It is, however, disabled by default. It is also buried in the second or third level down in Preferences, so its very unlikely a user will enable it by accident -- and will probably only do so upon the instruction of an Apple Store Support Rep.

There's no way to send a remote message to enable it?

Unknown.

However, the FBI can send a remote message to ANY phone to turn on its microphone and essentially use it as a wiretap. That's been built into every phone in the USA for something like 10 years now. It's why you have to surrender a cell phone in secure locations and military bases.

That's old news. Said wiretaps have actually been used against organized crime in America in the past and is likely used with more success now.

Oh, and you do know that everything you SEND through a cellular network -- texts, pics, urls visited are logged, right?

The only way to have a private network is to own the network. And know your netsec.

>However, the FBI can send a remote message to ANY phone to turn on its microphone and essentially use it as a wiretap. That's been built into every phone in the USA for something like 10 years now. It's why you have to surrender a cell phone in secure locations and military bases.

Really? When a phone is off, it's off, I don't believe the FBI can make a phone that has been hard powered off come up and start recording. The hardware just isn't capable of doing anything when it's hard powered off (evidenced by the fact that most phones need a signal to establish what time it is when you power them on.)

So how many cell phones do you know that a powered off with a hard switch. You know, flip the switch like you do on your living room light. Or how many people do you know that take their battery out when the power their phone off. Well there is your answer.

When the phone is powered off it is physically incapable of receiving a wake-up request over the radio.

Again, how do you know the phone is powered off unless you have a flip switch connected to the battery, take the battery out (and at the same time assume there is other smaller battery in there) ?

Said wiretaps have been used against the Olympic Committee: googling "Athens Affair" yields a nice story, http://spectrum.ieee.org/telecom/security/the-athens-affair There are rumors of the FBI's "Carnivore" (A.K.A. "DCS-3000" and "DCS-6000" getting used the same way in the USA.

I've been hearing that story about the FBI remotely activating cellphone microphones for several years now, but do you have a credible source for it?

source: http://www.zdnet.com/news/fbi-taps-cell-phone-mic-as-eavesdr...

But the deeper you dig, the spottier the evidence really gets, with people confusing and jumbling a whole variety of facts together. For instance, the zdnet article cites "A BBC article from 2004 reported that intelligence agencies routinely employ the remote-activiation method."

Here's that article: http://news.bbc.co.uk/2/hi/uk_news/magazine/3522137.stm

It mostly seems to be talking about a physically bugged phone, except for the parts about decrypting conversations over the air. And the lasers.

All people have to go on is the words "roving bug" in a court opinion which has somehow morphed into "all phones contain SMS activated spy microphones."

Yes.

Any briefing involving a secure area will mention that phones can be triggered this way, and that your customer (military, intel, DoD, or DOE) forbids their access for the very reason.

Are such briefings classified, or is there some chance of a citable reference?

I wouldn't be at liberty to comment either way. Talk to your friendly, neighborhood defense contractor.

I've got some questions on that first claim. Where's this done? I was under the opinion that you'd need system support for that to work --- the GSM radio's not directly plugged into the mic. I'd expect an android hacker to have found it there, if it's being injected in from the carriers.

For secure locations, you have to surrender just about every electronic device you have, because they could be used to transport data outside the secure location. The same rule applies to USB sticks, hard drives, PDAs, ipods, etc.

I'm invoking "walled garden", speaking of closed, controlled hardware environments in general, whether that be Apple or phone carriers or laptop manufacturers or the like. Once the controllers of that environment gain power, the human tendency to abuse and extend that power is only a matter of time.

The only way to ensure that you can trust the hardware and software you use is if it is 100% transparent. And while that is not always possible, the ability to control what runs on your own hardware goes a long way towards mitigating the risk of a betrayed trust.

Why should the government run massive data centers to crawl your every move when they can get you to run a hidden app to do the pre-filtering for them (and give them keystroke/touch-level access on demand in realtime)

This unfolding Carrier IQ scandal is a really huge deal in my opinion. It just shows how our phones are used by both companies and law enforcement to track us, and that probably for a decade with software like this.

Anybody knows if there is a website that tracks this incident, affected phones, related news, ...?

Wait, you're just figuring out now that anything that travels through a cell phone network could be monitored?

A lot of people wonder whether this is tracking theories are for real. Now at least one very popular way of how its currently being done is exposed.

Wired broke the stories about the NSA monitoring something like 25% of all domestic cell phone traffic. The fact that all investigations into it have been stopped citing "National Security", and the former President Bush defended the tactic all are pretty good signs pointing to "YES".

There's a big difference between carriers knowing where you are and ad companies/law enforcement knowing without a warrant.

And all the FOIA request simply states is that something like

A) We are investigating Carrier IQ.

B) We have physically recovered phones as evidence and extracted Carrier IQ data.

I want to believe that Big Brother is watching, really, I do, but this isn't a convincing argument.

Not only law enforcement, but general intelligence and especially marketers and advertisers. They will soon know you better than you know yourself http://danielmillsap.com/blog/technology-news/carrier-iq-the...

It's a shame really that we don't have access to the same data for self-discovery. Imagine if everyone had their own data and people could communicate with algorithms. Greenpeace could have a little thing that you run on your data to get tips for improving your shopping habits, etc. Unions could have a way to help you avoid bad products. Or your phone could learn when you need a nudge one way or the other to improve your health.

Excellent, remove the fault from the corporations and give even more power. Whatever happened to warrants?

Where did the article indicate that Law Enforcement didn't need a warrant to access the Carrier IQ data?

I remember a time when they had to get a warrant before logging your information. Now with Carrier ID and Google and Facebook, the information is already collected, and they only need a warrant to access the years and years of detailed historical information. It's quite a big difference.

Carrier IQ isn't used by all carriers (Verizon opts out, I believe) and the data transmitted is anonymous. I admit there is a risk with the data profiles being assembled, and being done so with ease not seen before, but the carrier IQ findings seem to be bad tech reporting and fear mongering. It really seems to be "not a big deal".

I am all for advocating privacy and a discussion about user's rights -- but I would like it if both sides left their hysteria at the door.

anonymous data does not exist

whether or not they opt out, its detected on my vz device using the carrier iq detector app.

Carrier IQ is very much like wire tapping. Wire tapping requires a warrant[1]. What about warrant for Carrier IQ?

That was my point.

[1] Not sure, but I think it did at one point or still does. Maybe some bill or act made that void, not sure.

A play on the Ben Franklin quote about giving-up freedom for security:

Those Who Sacrifice The Right To Privacy For Convenience Deserve Neither.

Anyone shocked?

I am shocked! SHOCKED!

...well not THAT shocked.

Gotta love the paranoid nutjobs jumping straight to "the FBI is using Carrier IQ to spy on us" when an equally likely explanation buried in paragraph three is that if the FBI is conducting an investigation of Carrier IQ for possible violation of federal wiretap laws then the same data would be withheld. Let's see now... Al Franken, who recently made some loud noises about Carrier IQ and sent a public letter to the company asking for information about what they are doing, sits on the Senate Judiciary committee. The committee that has direct oversight of the FBI would be? Anyone? Bueller?

It's far more likely it was for the CIA since phones are exported with that code in place.

The warrantless domestic spying is just a bonus for them.

phones are exported with that code in place

They are? (I hadn't been following this that closely but...) My understanding was that the issue was American carriers customising the OEM software and selling that kit to their own users.

See, for example, "So far, all of the major British providers have denied using the tool on their handsets" -- http://www.engadget.com/2011/12/05/european-regulators-set-s...

denied using, not denied shipping. Most likely the software is there, but non-US vendors (and law enforcement agencies -- not everyone is as clued up and as resourceful as the FBI) simply don't exploit it.

"Most likely the software is there".

Do you have any actual evidence for this? Or do you just enjoy throwing around wild accusations?

Not quite sure it's "paranoid" to think the FBI is, in some cases, using Carrier IQ software to gather information given recent U.S. history. Also, since the request was specifically for manuals used to gather information using Carrier IQ, and not just for any information on Carrier IQ, when they say they have responsive documents to the request I would imagine it refers to manuals or guides in their possession.

If the FBI is conducting an investigation into possible criminal activity by Carrier IQ then the manuals and guides are direct evidence showing what the company intended the software to do, making it evidence in an ongoing investigation.

Not discounting the possibility of that (I specifically stated it in the article), but I'd bet even odds FBI has some knowledge of accessing Carrier IQ data.

The FBI have professional phone forensics/evidence labs around the country. They work with handset manufacturers and special purpose vendors to extract and analyze every bit of data that exists in the phone.

It's inconceivable that CarrierIQ would store unencrypted data on a large number of phones and the FBI would not know how to access it. More than likely, CIQ sells them the tool to do it, or at least provides documentation.

Reply on news.ycombinator.com