An increasingly besieged Carrier IQ (CIQ) yesterday insisted that its software is designed only to help wireless carriers diagnose operational problems on networks and mobile devices. But its own marketing material for one of the products raises doubts about that claim.
The IQ Insight Experience Manager is one in a suite of five similar products sold by CIQ. An online datasheet describes it as customer experience profiling software that gives carriers detailed views of how consumers interact with their phones at "any level of granularity from the entire population, to comparative groups, down to individual users, all at the touch of a button."
The datasheet explains how the software can give carriers a "precise view" of customer interaction -- even when the phone is not communicating with the network.
Users of Carrier IQ's Insight Experience Manager can capture a "vast array" of data including screen transitions, button presses and service interactions, according to the material. Carriers can "task" phones dynamically over the air to optimize data selection. That data can be updated in real-time and aggregated in the company's Mobile Service Intelligence Platform.
In the datasheet, CIQ describes Insight Experience Manager as revenue-boosting technology that carriers can use to "view application and device feature usage, such as camera, music, messaging, browser and TV." It also describes how the product can help carriers identify how users respond to mobile advertising.
That description appears to be at odds with the company's depictions of its products after security researcher Trevor Eckhart published a report disclosing how Carrier IQ's software could be used by carriers and device makers to conduct surreptitious and highly intrusive tracking of Android and other smartphone users.
Eckhart described the software as a hard-to-detect -- and equally hard-to-remove -- rootkit that could be used by carriers and phone makers to collect almost any kind of data from a mobile phone without the user's knowledge. Eckhart said his research showed that Carrier IQ's software was often enabled to run by default on several mobile devices, including those from Samsung, HTC, RIM and others.
After his report was published, AT&T, Sprint and T-Mobile confirmed their use of the software but insisted it was only to improve wireless network and device performance.
On Thursday, Carrier IQ released an updated version of a statement it had made earlier. That statement described CIQ software as something that can be used to "measure and summarize" device performance to help carriers deliver better service.
The company insisted that its software does not record, store or transmit the actual content of emails, SMS messages, photographs, audio or video back to the carriers. "For example, we understand whether an SMS was sent accurately, but do not record or transmit the content of the SMS. We know which applications are draining your battery, but do not capture the screen."
The comments appear to be in response to a YouTube video posted by Eckhart in which he showed how browser data was being read and an SMS message sent to his handset was logged word for word by CIQ's software before it was even displayed on his screen.
The demo did not make clear, though, whether CIQ software actually stored the data, or was capable of transmitting it back to the carriers.
The company said that it was trying to clarify misinformation about its products and reiterated earlier statements about the technology being a tool for wireless operators to improve service efficiencies.
A statement posted Nov. 23 (download PDF) categorically stated that CIQ's technologies do not record keystrokes, provide real-time data reporting to carriers or inspect or report on the content of communications.
Despite requests for comment, the company did not make anyone available immediately to clarify why its datasheet for Insight Experience Manager describes the software as being able to "capture" button presses and screen transitions, why usage information would be captured while a phone was not connected to the network or what sorts of data views it enables at an individual user level.
Another question still unanswered relates to the data-reporting capabilities of CIQ's software. In recent statements, the company has maintained that its software does not provide any real-time data reporting for customers. However, the datasheet for Experience Manager talks about the software being able to update and aggregate data in real-time.
A spokeswoman promised to make a company executive available early today, but as of noon ET had not done so.
Jaikumar Vijayan covers data security and privacy issues, financial services security and e-voting for Computerworld. Follow Jaikumar on Twitter at @jaivijayan or subscribe to Jaikumar's RSS feed. His e-mail address is email@example.com.