Transmissions

by Dragorn

Law enforcement have always loved cell phones.  What better way to get your suspect (apparently, all of us) to carry around a tracking device 24/7?

But now it seems like corporate greed loves cell phones even more, and for much of the same reasons.  Ask all of your customers to carry around tracking devices and they'll never agree to it.  Give them a free app on a smartphone and they'll not only carry around the tracking device, but they'll give you all of their info while they're at it.

Cell phone tracking works on the carrier level because the cell phone companies know what towers you're connected to.  The same model that gives your phone an approximate location without turning on the GPS lets the cell phone companies track where you are (well, approximately).  The granularity of the non-GPS assisted location increases as the population density increases - more users require more cell towers, which means each tower covers a smaller physical area.

Tracking from the carrier is relatively simple, but only the carrier benefits (and anyone with a subpoena, or depending on the state, no subpoena at all.  Looking at you, California).  Retailers in the U.S. (well, two... so far) have started rolling out a system which passively monitors cell phones to track users.  By placing antennas in each store and at common gathering areas of the mall, and monitoring cell phone traffic, the movement of individual users can be tracked.

The system is designed to only reveal the "cell phone identifier."  The actual information being tracked is not disclosed, but most likely it is the IMEI, which identifies the phone, and not the IMSI, which identifies the subscriber.  It is claimed that no personally identifiable information is tracked, which is plausible since there should be no link between the IMEI and the phone number or user billing data.

How does one opt out of tracking?

By turning off your phone, obviously.  In a crowded shopping area.  During the busiest shopping season of the year.  When customers are least likely to want to, or be able to, turn off their phones.  Still, they'd never be able to correlate security footage, purchases, and phone identifiers to constantly profile customers, right?

This may be the first time for trying to track cell phones as cell phones, but the technology to track Wi-Fi devices (like Kismet) or Bluetooth devices (at least the discoverable ones) has been around for quite a while, and been deployed in customer tracking and advertising.  So far, neither has been a major focus for advertisers, and the Bluetooth-enabled cardboard stand-up sign pushing to discoverable devices has been replaced with QR or Microsoft tags.  But a cell phone set to use Wi-Fi will continually look for networks nearby, and can be tracked as it moves around a shopping area.

Of course, waiting for your revenue stream (sorry, customers) to go to the mall is for chumps.  It would be so much more convenient, and profitable, to sell their usage data, location, and so on directly.

Enter "Carrier IQ," a software package which has been getting a lot of attention lately, and not the good kind that you want.  Originally designed as a tool to help carriers measure metrics like problem applications, user traffic levels, and so on, it's been modified and turned into a multi-carrier tool for snooping on user behavior.

Hidden on multiple phone operating systems (Android, BlackBerry, and Nokia) and on multiple carriers (Sprint, Verizon, maybe others), CIQ collects a combination of innocuous (battery, signal level, crashes, reboots) data, and very personal data (applications run, URLs visited, keystrokes, numbers dialed, SMS messages received, location, phone calls received).

And it runs as root!

Not only can you not detect it or terminate it from a standard phone account/user, but if any vulnerability is discovered in the CIQ software in the future, all phones running it will be vulnerable, and, if arbitrary execution is part of the bug, they'll be vulnerable to an unstoppable root-level exploit, potentially exposing all data on the phone and opening the door to additional malware or Trojans on the phone.

"But," I imagine you say, for the convenience of a straw man argument to knock down, "the carrier already knows what phone calls I get and what URLs I visit."  And you're right - they do, at least when you're on cell data they do.  CIQ exposes URLs from Wi-Fi as well (including search terms since those are in the GET string), and may bypass wiretap laws because the data is gathered by an agent on the phone, not from the network layer.

What reason would the carrier have to record this data?  Marketing, of course!

Not only do they use it for their own marketing, but now they'll sell your web browsing history to other companies!  What other companies?  Anyone who has the money, apparently.  Verizon has already modified the terms of service to allow them to sell location, application installs and usage, URL history, demographics, and phone feature usage.  And, of course, you don't have to opt-in; they've already included you for your convenience, and their profit.  (If you're a Verizon customer and haven't already opted out, you can do so at verizonwireless.com/myprivacy but only if you're the account holder, and don't forget to opt out of all three categories!)

Once discovered and reported on, CIQ opted for the most mediapathic response possible: Send the developers reporting its capabilities a cease and desist and try to squelch discussion about the depth of privacy invasion that is being hidden from users.

Once the EFF got involved, there was some rapid backpedaling and retractions (remember, go donate to the EFF, they really do make a difference), and by all accounts the researchers are now unmolested in their continued research.  Lawyering up is the default response of any company, so it's difficult to read much into the situation, but any hopes of open discussion about the capabilities and reasons behind it are pretty doubtful.

The real kicker, of course, isn't just that every company which has half a chance to do so is selling out your data while raising your bills.  The real kicker is that once this data is collected, once the possibility to flip a switch and track every move exists, that information is no longer under your control.

It's only a subpoena away - or less, if you're in California, or any other jurisdiction which decides you don't need to prove just cause or document reasons for collecting location data or attaching GPS trackers to citizens.