Carrier IQ faces lawsuits over controversial tracking software

Last week, a furor was caused by software developer Carrier IQ, who develop software used to track mobile phone usage in diagnostic and network monitoring purposes. A researcher, Trevor Eckhart, reverse-engineered his HTC Evo Android phone and found that Carrier IQ’s software tracked his keystrokes, search queries and text messages with no ability to turn it off. He posted his results in a YouTube video showing ostensibly how his information was recorded and transmitted to carriers in the background on his phone. The video attracted massive attention, gathering 1.5 million hits in a week, and evoked a cease-and-desist letter from Carrier IQ’s legal team which they subsequently withdrew and apologized for after the Electronic Frontier Foundation stepped in.

However, the unwanted attention did not stop there. Carrier IQ, which operated in the background and had been relatively unknown until last week, drew ire from U.S. congressman Edward Markey, who asked the Federal Trade Commission to investigate whether Carrier IQ violated privacy rights of mobile phone users. Senator Al Franken, who is the Chair of the U.S. Senate’s Privacy, Technology and the Law committee, joined the fray and requested that Carrier IQ disclose the types of data that it collected from users.

Manufacturers rushed to deny any wrongdoing – RIM and Nokia stated that they have never installed any Carrier IQ software, while HTC and Samsung deflected blame onto carriers, stating that installation of CIQ software happened only when carriers requested it. Apple was already in the process of phasing out CIQ, although it was still active on some iPhone 4 devices (even when running the updated iOS 5).

American carriers AT&T and Sprint both used the software, but denied that they recorded any private data, saying that all data was transmitted anonymously and that information was only used for improving network service and diagnostics. The “big three” Canadian carriers, Rogers, Bell, and Telus all denied any use of Carrier IQ software.

Meanwhile, multiple class-action lawsuits were filed against Carrier IQ on Friday.

One lawsuit, filed in the U.S. District Court for the Northern District of California, alleged that the company violated the Federal Wiretap Act and California’s Unfair Business Practice Act. This suit, headed by the firm Hagens Berman, asked for damages and an injunction to stop companies from including such software in future phones. Another suit alleged similar complaints and also on privacy grounds, and was filed in the U.S. District Court for the Eastern District of Missouri.

Under the U.S. Federal Wiretap Act, breach of its provisions can lead to significant damages (including punitive damages):

[T]he court may assess as damages whichever is the greater of – (A) the sum of the actual damages suffered by the plaintiff and any profits made by the violator as a result of the violation; or (b) statutory damages of whichever is the greater of $100 a day for each violation for $10,000.

Any case based on this act with a chance of success may settle for millions, as the number of smart phone users has grown exponentially in the past few years. It is unclear whether any of these claims will succeed, and whether they will be settled.

For its part, Carrier IQ has defended its practices, and denied that it collected or recorded and private information. In a press release, Carrier IQ stated that all data is “transmitted over an encrypted channel and secured within our customers’ [network carriers] networks or in our audited and customer-approved facilities”. They further clarified or example, that they could know “whether an SMS was sent accurately, but do not record or transmit the content of the SMS.”

Meanwhile, the debate among smartphone users still rages on Twitter (#CIQ).