Carrier IQ, the company that has been accused of installing surveillance software on smartphones, clarified what its program does in an updated statement to the press late Thursday.
“We measure and summarize performance of the device to assist Operators in delivering better service,” the statement read. “While a few individuals have identified that there is a great deal of information available to the Carrier IQ software inside the handset, our software does not record, store or transmit the contents of SMS messages, email, photographs, audio or video.”
While Carrier IQ can tell if, for example, a text message was sent correctly, the company said it does not record or transmit the contents of those messages. Offering another example, the company said that while it monitors what apps are the most taxing to a smartphone battery, it doesn’t take screen-captures of the users’ phones.
Verizon Wireless said that it does not use Carrier IQ in its devices. Research in Motion, HTC and Nokia have also said they are not involved in installing the program on their devices.
Answering questions about its security, Carrier IQ said that it transmits all customer data over encrypted and secured channels. The company also “vigorously disagrees” with suggestions that it could be violating wiretapping laws.
Security researcher Trevor Eckhart thrust the company into the spotlight earlier this month after posting research showing that the Carrier IQ program registers each key press and many other activities on cellphones. His research drew the scrutiny of the press, and the attention of Sen. Al Franken (D-Minn.), who sent a letter Thursday asking the company to more fully explain its practices. The Electronic Frontier Foundation has backed Eckhart’s research— going so far as to help him fight a now-retracted cease-and-desist order from Carrier IQ — saying that it “raises substantial privacy concerns.” Another security researcher, Grant Paul, said that he found references to Carrier IQ on the iPhone, but later updated his assessment to confirm Apple’s statement that customers must opt-in to share data collected from the program and that it was removing Carrier IQ from its iOS 5 devices in a later update.
Other security researchers weighing in on the issue have been less sure of the software’s privacy impact. Dan Rosenberg, a consultant at Virtual Security Research, told the Los Angeles Times that Eckhart’s video doesn’t show evidence that keystrokes are being stored or sent to the company. In a post on the Web site Pastebin, Rosenberg said that while CarrierIQ has some disturbing potential, he hasn’t seen evidence that the company has collected anything more than anonymized metrics data. Though he called for the company to be more transparent about the data it collects, he said he doesn’t believe that the company is keeping tabs on users’ every move. “Based on what I’ve seen, there is no code in CarrierIQ that actually records keystrokes for data collection purposes,” he wrote.