The Bavarian State Authority for Data Protection, a German data regulator, sent a letter to Apple on Friday requesting that the iPhone maker provide more details about the software and its use, according to a Bloomberg interview with the regulator organization’s chief, Thomas Kranig.

Apple said in its statement on the matter that its use of Carrier IQ was limited to diagnostic information and was opt-in only. If you’ve recently set up an iOS 5 device, you may remember the request made during the setup process to allow your device to send diagnostic and usage information to Apple. You can check if you’re sending data by navigating to General > About > Diagnostics & Usage in your iOS device’s Settings app and either opt in or opt out. On this screen, Apple says it uses the information to “improve its products and services.” Apple further stated that Carrier IQ has been removed for most devices in iOS 5 and will be taken out completely in future updates.

Kranig says that “if Apple decided to cease the use [of Carrier IQ], all the better,” but the organization is still seeking more information. Senator Al Franken (D-Minn.) also called (PDF) for Carrier IQ to release details to the public about why exactly its software tracks and records the information that it does. Franken previously pursued Apple and Google for more information about how customers’ personal location information was being gathered and used on iOS and Android devices.

This Carrier IQ situation could result in another round of scrutiny by regulators in the U.S. and abroad, and I doubt that Apple has seen the worst of it yet.

Related research and analysis from GigaOM Pro:
Subscriber content. Sign up for a free trial.

• Connected world: the consumer technology revolution
• Carrier IQ and the continued erosion of operator trust
• Mobile Q2: Smartphone growth surges; iPad’s rule continues

In a statement, the company said:

We stopped supporting CarrierIQ with iOS 5 in most of our products and will remove it completely in a future software update. With any diagnostic data sent to Apple, customers must actively opt-in to share this information, and if they do, the data is sent in an anonymous and encrypted form and does not include any personal information. We never recorded keystrokes, messages or any other personal information for diagnostic data and have no plans to ever do so.

Sprint has admitted to receiving data from CarrierIQ’s software, but it denies using it to track its customers, as has AT&T, which says it uses the information for network management. Verizon, on the other hand, has denied using the software, as has Google on any of the Android phones it makes.

Related research and analysis from GigaOM Pro:
Subscriber content. Sign up for a free trial.

• Connected world: the consumer technology revolution
• Carrier IQ and the continued erosion of operator trust
• Social media reactions to the iPhone 4S

For example, if you were surfing a number of sites in Safari before you quit, those windows will return when you reopen the program. Some windows we may not want to share with others. I’m not talking just “adult” items, but, for example, a job search or dating site. Most Mac OS customers are used to having the more obvious digital debris of their life excised upon quitting an app. Unfortunately, in Lion, any application that supports resume (including most system apps, iWork and many more on the way) could unearth some embarrassing secrets.

There are a few quick solutions. When possible, close the Safari window or tab you’d rather keep private before you quit the application. Additionally, if you hold down the option key while choosing Quit from the application menu, or hold down Command+Option+Q, that will “Quit and Discard Windows” for this particular session.

If you forgot to do that and find yourself needing to close those open windows without launching the app, you can remove this information manually. To do this, first choose “Go to Folder” from the Go menu. Type ~/Library/Saved Application State/ and that will take you to the folder that contains your saved windows. If you want Lion to forget the last windows left open in Safari, look for com.apple.Safari.savedState and then delete that folder. That will remove the last session’s windows and tabs.

If you decide you really don’t like applications automatically remembering previously open windows and tabs, you can turn this feature off system-wide by opening the System Preferences application, and under “General” making sure “Restore windows when quitting and re-opening apps” is unchecked.

So the next time you go shopping for that wedding ring, remember that the next person who opens Safari might see the window and ruin the surprise. These tips should keep you out of hot water. And if you’re surfing for something else on your computer, the next person who has to use or repair it will thank you for keeping your private info private.

Related research and analysis from GigaOM Pro:
Subscriber content. Sign up for a free trial.

• How cloud computing plus Facebook might mean the end of personal privacy
• Building a better paywall: strategies for monetizing news content

The lawyer in question, Kim Hyung-suk, won the decision in South Korean court in May, and the funds were reportedly withdrawn from Apple Korea’s bank account by the court after the company refused to voluntarily comply. Kim now has 27,000 signatures on a web-based petition seeking co-complainants for a class-action suit in South Korea designed to “protect privacy” rights, according to the AP. Of that number, 26,691 are now listed as plaintiffs in the civil suit filed by Kim’s firm on Wednesday, and 921 are minors and are seeking parental consent before being added to the list.

The iPhone’s locally stored database of nearby cell towers, along with a bug that continued to gather location information even with location services turned off resulted in both Kim’s successful suit and a three-million-won fine ($2,808 U.S.) from the South Korean communications regulator earlier this month. Apple has since released a software update that resolves the issues cited by Kim and security researchers who discovered the problem.

Even with nearly 27,000 thousand plaintiffs, the total cost of a ruling against Apple would only amount to around $24.6 million, which is barely a dent in the company’s $75.9 billion in cash reserves. But Apple is already facing multiple lawsuits in the U.S., too, and it probably doesn’t want this sort of thing to catch on.

Related research and analysis from GigaOM Pro:
Subscriber content. Sign up for a free trial.

• U.S. Wireless Data Market: Q4 and Year-End 2008

iPad passcode configuration

Even though it isn’t 100 percent foolproof, securing your iPad with a passcode is a good first step for security. On my iPad 2, I configured security to use the longer alphanumeric passcode, and I make sure that it will lock the iPad immediately when the cover is closed by doing the following:

1. Open Preferences and navigate to the General settings.
2. Set Auto-Lock to 2 minutes.
3. Turn the Passcode on and set Require Passcode to “Immediately.”
4. Turn the Simple Passcode off.
5. Turn Erase Data On to wipe the iPad after 10 failed logon attempts.

After you sync your passcode protected iPad with your Mac, you should notice that any user account on that Mac can still access the data on your iPad using any of the following methods. Attach that same iPad to any other Mac that has not accessed any data on that iPad in the past, and you will get an error indicating that the device is protected with a passcode.

Protecting your data in the real world

You may be surprised at how easy it is to access your iPad’s information even after you’ve set up a passcode when it’s connected to a Mac.  If you really don’t want others to have access to your information, there isn’t much you can do short of setting a hands-off policy. You may want to sync your iPad to a dedicated Mac which only you have access to. Anyone with access to both your iPad and the Mac it syncs with can see all of your data. You can avoid potential theft worries by keeping the iPad and Mac in separate cases, and by disabling the guest account on your Mac so that a user has to know your passcode to login.

Related research and analysis from GigaOM Pro:
Subscriber content. Sign up for a free trial.

• Mobile Q1: All Eyes on Tablets, T-Mobile and AT&T
• A Media Tablet Forecast, 2011 – 2015

Legislators put together the hearing, named “Protecting Mobile Privacy: Your Smartphones, Tablets, Cell Phones and Your Privacy,” in response to consumer concerns over the use of data shared via their mobile devices. Apple garnered the most recent attention surrounding the issue when researchers publicized the fact that Apple’s iOS devices were keeping a record of users’ general locations.

Senator Al Franken (D-Minn.) issued a public letter calling for answers regarding the company’s privacy practices surrounding location services, and Apple issued an official response shortly thereafter answering said questions. The Mac-maker also noted that it looked forward to the opportunity to clarify these issues by testifying before lawmakers. Apple then released an update earlier this week that makes location information stored on devices more secure, and also changes the cache size so that less data is stored.

Like Apple, Google also makes use of anonymized location data transmitted from Android devices, the company revealed after Apple’s location storage practices came to light. Google will also testify before the Senate committee, via Google Public Policy Director Alan Davidson.

Also in attendance will be Sen. Franken, who will preside over the hearing, as well as Jessica Rich, deputy director of the FTC’s Bureau of Consumer Protection; and Jason Weinstein, deputy assistant attorney general of the Criminal Division of the U.S. Dept. of Justice, who will act as the hearing’s first panel. Apple and Google will be on the second panel, along with Justin Brookman, director of the Center for Democracy and Technology’s Project on Consumer Privacy; Ashkan Soltani, an independent consultant; and Jonathan Zuck, president of the Association for Competitive Technology.

Apple’s representative Bud Tribble has been with Apple since near the very beginning, having helped design the Mac OS and user interface. He left Apple with Jobs and worked at NeXT as VP of Software Development, and returned to Apple in 2002 after spending some time at Sun Microsystems and Eazel. He is arguably the Apple employee with the most history with Jobs.

As is often the case, technology ran ahead of regulation and clearly defined limits when it comes to location services and other mobile private data concerns. This hearing could be the first step in the creation of regulations or legislation that specifically address those concerns. Apple, Google and others in the industry will be keen to participate in the process in order to attempt to allay lawmaker concerns and keep the space as self-regulated as possible.

Related research and analysis from GigaOM Pro:
Subscriber content. Sign up for a free trial.

• Connected Consumer Q1: The Over-the-Top vs. Pay TV Battle Heats Up
• Smart Grid Apps: Six Trends That Will Shape Grid Evolution
• Infrastructure Q1: IaaS Comes Down to Earth; Big Data Takes Flight

• The location database will no longer be backed up to iTunes.
• The location database cache, and thus the number of days logged, will be reduced.
• When Locations Services are off, the database will be deleted.

Related research and analysis from GigaOM Pro:
Subscriber content. Sign up for a free trial.

• A Media Tablet Forecast, 2011 – 2015
• Mobile Q1: All Eyes on Tablets, T-Mobile and AT&T
• A Global Mobile Handset Platform Forecast, 2011 – 2015

I reached out to Apple to confirm the authenticity of the email, but have yet to hear back. Here’s the full text of the alleged email exchange:

Q: Steve,

Could you please explain the necessity of the passive location-tracking tool embedded in my iPhone? It’s kind of unnerving knowing that my exact location is being recorded at all times. Maybe you could shed some light on this for me before I switch to a Droid. They don’t track me.

A: Oh yes they do. We don’t track anyone. The info circulating around is false.

Sent from my iPhone

Google actually addressed concerns of location tracking on Friday, with a spokesman for the company admitting that if a user opts-in to using location services (an option which is on by default when setting up an Android device for first use), anyonymized location data is regularly sent to the company in order to help “provide a better mobile experience on Android devices.”

According to a letter from Apple General Counsel Bruce Sewell last year, Apple collects data for similar purposes, but the assertion in the email above that “we don’t track anyone” would appear to contradict that. It’s probably more in reference to the “consolidated.db” file that stores location info locally. There’s nothing to suggest that the info stored in that file is accessible to outside parties, including Apple, so that’s probably what’s being referred in this case.

Apple’s iOS location tracking file has garnered a lot of attention from U.S. and international press and lawmakers since it was put on display by researchers at the Where 2.0 location services conference last week. We reported that it had actually been public knowledge for a while, but it didn’t catch the attention of the media the way it has now. Whether or not it’s being blown out of proportion, Apple will have to address the issue in some manner soon, since it doesn’t look like it’ll go away on its own at this point.

Related research and analysis from GigaOM Pro:
Subscriber content. Sign up for a free trial.

• A Media Tablet Forecast, 2011 – 2015
• Mobile Q1: All Eyes on Tablets, T-Mobile and AT&T
• A Global Mobile Handset Platform Forecast, 2011 – 2015

Sen. Al Franken (D-Minn.) may be after answers from Steve Jobs

While Sewell doesn’t address the local, unencrypted storage of location information anywhere in his response to Markey and Barton, he does clearly outline Apple’s location data use policy and the methods the company uses to gather said data. So, at least partial answers to a good portion of Franken’s questions are already on record.

Sewell describes Apple’s reasoning behind collecting location data, which is “to enhance and improve the services we can offer to our customers,” and also with whom Apple shares the data. Those parties include only Apple’s application developer licensees (with whom Apple only shares the data once a user has given their explicit consent that it be allowed to do so), and Apple’s external mapping database partners, which are used for location services on older devices. Apple shares only “anonymous, non-identifying location information” with those partners in order to improve service.

Sen. Franken also asked about whether laptops collect location data. Sewell lists explicitly which devices collect location data, and the list includes “Mac computers running Snow Leopard and Windows or Mac computers running Safari 5.”

Sewell’s letter also explains how the data is generated and when. Wi-Fi access point, cell tower and GPS information are all used to determine location, and data from each is collected when apps approved to use said data are actively running. Anonymous data “may also be collected when an iPhone is using GPS to search for a cellular network,” writes Sewell.

As I mentioned, the letter does not address those questions Sen. Franken asked that specifically involve the local, unencrypted storage of location data. For instance, Franken asked “Why is this data not encrypted? What steps will Apple take to encrypt the data?” Apple also hasn’t specifically addressed the question of why consumers aren’t informed about local data storage, or asked for consent for that particular type of location information usage.

Turns out I was wrong when I wrote earlier that “there are no definite answers” to Franken’s questions. Just goes to show how quickly information can get lost or forgotten in the age of the Internet. You can read the letter from Sewell in full below.

Related research and analysis from GigaOM Pro:
Subscriber content. Sign up for a free trial.

• Why the Mobile App Industry Needs to Address Privacy — Now
• Privacy Legislation’s Potential Impact on Online Media
• A Media Tablet Forecast, 2011 – 2015

As Bobbie reported earlier, the iPhone’s location data logging actually isn’t a new thing. Law enforcement has been using the data for quite a while, according to researcher Alex Levinson, who told GigaOM that the iPhone’s location tracking file isn’t new to iOS 4 (it just changed file locations) and it has been public knowledge in security circles for quite some time now.

That law enforcement knows how and where to access this info may provide partial answers to some of Sen. Franken’s questions. For example, he asks first “Why does Apple collect and compile this location data? Why did Apple choose to initiate tracking this data in its iOS 4 operating system?” Well, first we now know that this isn’t new to iOS 4 thanks to Levinson. And second, if legal authorities are making use of the data for forensic investigation purposes, isn’t it possible that might be one of the reasons behind its inclusion?

While it’s possible, I doubt actually Apple intended the location data log as a breadcrumb trail for use by the authorities, but the fact that it can be used in that capacity will no doubt be troubling to many, especially since the data is relatively easy to access without a court order, which is required when canvassing carriers for similar information.

Even though there’s no evidence to suggest that the location data is being transmitted to or used by any other party, including Apple itself, Franken clearly isn’t content to just let that assumption lie. Citing the fact that “[i]t is … entirely conceivable that malicious persons may create viruses to access this data from customers’ iPhones, iPads, and desktop and laptop computers,” he presses Jobs for more info about the nature and purpose behind the preservation of this sensitive information. Here’s the full list of all nine questions, in the order presented by Franken:

1. Why does Apple collect and compile this location data? Why did Apple choose to initiate tracking this data in its iOS 4 operating system?
2. Does Apple collect and compile this location data for laptops?
3. How is this data generated? (GPS, cell tower triangulation, Wi-Fi triangulation, etc.)
4. How frequently is a user’s location recorded? What triggers the creation of a record of someone’s location?
5. How precise is this location data? Can it track the user’s location to 50 m, 100 m, etc.?
6. Why is this data not encrypted? What steps will Apple take to encrypt the data?
7. Why were Apple consumers never affirmatively informed of the collection and retention of their location data in this manner? Why did Apple not seek affirmative consent before doing so?
8. Does Apple believe that this conduct is permissible under the terms of its privacy policy?
9. To whom, if anyone, including Apple, has this data been disclosed? When and why were these disclosures made?

Apple has yet to make any statement regarding the iPhone and iPad’s location tracking practice. And there are, as of yet, no definite answers to the questions above, beyond the one provided by Levinson regarding the file’s presence prior to iOS 4 mentioned above. I’m curious as to the answers, and I’m sure many others are, too.

Related research and analysis from GigaOM Pro:
Subscriber content. Sign up for a free trial.

• Privacy Legislation’s Potential Impact on Online Media
• Why the Mobile App Industry Needs to Address Privacy — Now
• 5 NewNet Milestones That Won’t Happen in 2011

The file that does the tracking is called “consolidated.db,” which contains latitude and longitude coordinates attached to a timestamp. It’s not clear exactly what triggers your device to record a location, since the recording appears to vary considerably in terms of frequency. Allan and Warden suspect that the logging may be triggered by travelling between cell towers, which aid in location determination, or by activity on the phone, like using apps. It isn’t clear why Apple began storing this info in iOS 4, but Allan and Warden are convinced the effort is intentional.

Back in March, a German politician working with German newspaper Die Zeit sued Deutsche Telekom to get access to his own location data from his mobile phone, and put together a visualization of where he’d been for six months. Carriers do have this data, but it requires a court order to get it from them. Using the iOS 4 location tracking file (which is stored on any computer where you’ve synced your device) and a free, open source application developed by Allan and Warden, anyone can now do the same in about two minutes with virtually no technical expertise.

Allen and Warden warn that the info can be easily accessed on the device itself, in addition being in backups on computers you’ve synced with. Users who want to protect themselves can encrypt their backups through iTunes, but that doesn’t stop information on the device itself from being accessible. We’ve reached out to Apple about the issue and will let you know if they provide any additional info about how to ensure your data remains private.

As you can tell from the screenshot of my location data included in this article, I’m not particularly concerned about this data being out there, but I tend to lean towards the open and trusting end of the scale when it comes to information sharing. Then again, that probably makes me a prime candidate for things like Please Rob Me, and many others will likely not be so comfortable knowing their iPhone or iPad has a relatively accurate record of their whereabouts over the past year or so. Is this disturbing to you, or just a neat visualization trick you can show your friends?

Related research and analysis from GigaOM Pro:
Subscriber content. Sign up for a free trial.

• A Media Tablet Forecast, 2011 – 2015
• The Future of Workplaces
• Why the Mobile App Industry Needs to Address Privacy — Now

The suit was filed on Dec. 23 in federal court in San Jose, Calif. and seeks class action status, though it was initially filed on behalf of Jonathan Lalo. The complaint accuses Apple and applications like Pandora, Paper Toss, the Weather Channel and Dictionary.com of transmitting personal information to advertising networks for tracking purposes. In the suit, Apple is accused of violating its own policy of not allowing apps to transmit data without customer consent.

If class action status is granted, there could potentially be a massive defendant pool, since anyone who downloaded an app on either iPhone, iPad or iPod touch between Dec. 1, 2008 and last week.

The suit stems from a Wall Street Journal investigation that found that of 101 apps tested, 56 transmitted some personal data to third-party advertising agencies, and that many did so without notifying the user that any information was being shared. The WSJ report also found Android apps were just as likely to share data, but Android users know that you can see exactly what kind of data your apps have access to in the applications management setting. Apple doesn’t offer a similar breakdown.

Apple couldn’t be reached for comment as of this writing. What do you think? Overreaction, or a fair response to somewhat shady information sharing practices?

Related content from GigaOM Pro (sub req’d):

• Mobile App Developer Survey: Profiles, Platforms and Monetization
• App Developers: Are You Ready for HTML5 and Metered Data?
• How to Market Your iPhone App: A Developer’s Guide

The WSJ tested 101 popular apps for iPhone and Android, and found that 56 transmitted the device’s unique identifier to companies that weren’t the app’s developer or publisher without asking consent first; 47 apps transmitted location data without permission; and five sent age, gender and other personal info without notification or request for consent.

The iPhone apps in the test overall transmitted more information than the Android apps transmitted. The Android market might not be a curated software selling platform like the App Store, but apparently that doesn’t mean that iOS apps can still leak data while not technically violating any of Apple’s rules.

Some big names were among the apps tested. For example, Pandora sent age, gender, location and UDID data to various ad networks. TextPlus 4 (free text messaging app) sent the UDID to eight ad companies, and zip code, user age and gender to two more. In one of the worst cases, an iPhone game called Pumpkin Maker transmits live location data to an ad network without even asking a user permission to use locations services, in clear violation of Apple’s rules, yet it remains available for sale.

In fact, according to Apple’s stated policy, iPhone apps are not allowed to “transmit data about a user without obtaining the user’s prior permission and providing the user with access to information about how and where the data will be used.” Yet many of the apps tested by the WSJ appear to violate this rule, and Apple declined to discuss its understanding of what the rule means in practice.

The info passed along by these apps is used by advertisers to build a user profile for the purposes of targeted advertising and marketing campaigns. For many of the services involved in the apps mentioned, you actually agree to provide your info to third-party companies when you initially sign up (in that lengthy user agreement you scrolled right through without reading). Chances are, if an app requests use of your location, or wants you to provide your age, gender, etc., it isn’t just out of curiosity, especially if it’s a free app, in which case data farming may be the only way the app gathers revenue.

I know why companies don’t make this practice clear to users. If you foreground the fact that you’re gathering info just to it share with many others, then people will be far less likely to use your app, even if you explain that info won’t be used to identify or target you personally, but will instead help paint a picture of a general category of customer. That’s hard to explain in an alert dialog box.

Still, in this case, Apple seems to be selectively fulfilling its role of stewardship with regard to iPhone software. If the company feels it has a responsibility to monitor the apps it provides through its storefront for questionable and inappropriate content, then it should also provide fair warning that some of these apps want to collect and distribute more of your data than you feel comfortable sharing.

Related content from GigaOM Pro (sub req’d):

• Mobile App Developer Survey: Profiles, Platforms and Monetization
• App Developers: Are You Ready for HTML5 and Metered Data?
• How to Market Your iPhone App: A Developer’s Guide

To make sure users only see ads which might interest them, Apple studies the data from their iPhones to see what the user does and doesn’t like. According to Rachel Pasqua, who is an agent working with Apple on iAds for her clients:

Apple knows what you’ve downloaded, how much time you spend interacting with applications and knows even what you’ve downloaded, don’t like and deleted.

While this is clever on Apple’s part, there are more than a few iPhone users who are bound to be worried about the safety of their information, especially after the hacking fiasco earlier this week. Luckily, Apple has provided a way to opt-out of this data collection.

As detailed in Apple’s Knowledge Base article, to opt-out, all you have to do is point your iPhone to http://oo.apple.com. You should see a “successful opt-out” message and a few bullet points giving you some information about the opt-out service. If not, Apple’s advice is to “wait a few hours and try again.”

This only works for devices running iOS 4 — you can’t opt-out on an iPad or on a desktop computer for example — and if you own more than one device, you have to opt-out on every device individually. Also note that opting-out doesn’t stop you from seeing any ads, it just stops Apple from collecting data about how you use your iPhone.

Despite being an avid OS X user, there are deficiencies in this great OS of ours and many of the ones I focus on center — unsurprisingly — around security.

In the plethora of accurate claims of superiority in Apple’s “I’m a Mac” ads, one counter-example is the ability within Windows to encrypt individual folders. While Microsoft’s EFS is no panacea of security and usability, it does work and there has been no practical parallel yet within OS X. Until now.

A Twitter post early Thursday morning from the legendary Matt Gemmell quietly announced Espionage from Tao Effect software (Greg Slepak & John Ashenden). This $14.95 utility (for OS X 10.5+) uses some interesting tricks to bring folder-level encryption and/or privacy to your workstation. Read on to see what’s going on under the covers and to find out if Espionage is the right solution for you.

Encryption Choices on OS X

Without bringing in additional tools, such as TrueCrypt into the mix, Apple offers two ways to secure your information. The first is with FileVault (which has some security and usability issues of it’s own) where you can choose to encrypt your entire home folder — but only your home folder — to keep prying eyes away.

The second is to use Disk Utility to create an encrypted disk image and then mount that whenever you need to store or retrieve data. This is a cumbersome, but effective, process and is ultimately what FileVault is doing under the covers to work it’s magic.

If only there was a way to associate these secure disk images with folders and have the mounting be handled automatically…

A Peek Behind the Curtain

Normally, the inner- and inter-workings of an application are either too-intricate (e.g. Photoshop) or too mundane (e.g. TextEdit) to cover during an app-review. However, when it comes to security, very few details are insignificant and one of the prime uses of Espionage is to secure your data and control the access to it.

Espionage has two basic features, enabling general encrypted folders (using the same “trick” as FileVault) and providing a way to “lock” folders and require a password to access them.

It performs the latter through a kernel extension named “iSpy” that is installed upon first run of the application and can be seen by dropping into the Terminal and issuing the following command:

$ kextfind -case-insensitive -bundle-id -substring 'com.taoeffect.' -print
/System/Library/Extensions/iSpy.kext

“Protected” folders show the typical “restricted access” icon when locked:

And prompt you for an access password (which you create when “securing” the folder):

Because it operates at such a low-level, this “protection” exists even when using command-line utilities to access files in the folder. That is, even attempting an “ls” from the Terminal will bring up the access prompt (provided you have not already unlocked the folder). This “protection” only works on the system the folder was “protected” on and requires the kernel extension to be running. If you disable/unload the extension or just boot in target disk mode, you will be able to access the data. The Tao Effect developers make no claims of security with this method of protection and even go out of their way to warn you.

But, What About Encrypted Folders?!

Ah, yes. The main reason you will want to use Espionage is to take advantage of the encrypted folders. As I have indicated, they use the same slight-of-hand that FileVault uses and create a hidden, encrypted sparse disk image that then is mounted and linked with the folder you specify. For existing folders, it creates this disk image, copies the files and folders from your target selection into the new disk image and sets up the linkage behind the scenes after deleting your old files. I should warn you that it did not do a secure delete of the “expenses” directory and I was able to find it and the contents therein in the “Trash”. This could easily be recovered and is a pretty serious oversight in an attempt to make your digital life more secure.

As part of the magic, you will see that there is a new folder in your “Volumes” directory (this is where all mounted disks get placed by default) where Espionage keeps mount points for all these sparse images.

And, you can also see just where Espionage stores these sparse disk images via the Terminal or through Disk Utility.

Since it is just a disk image “hack”, Espionage also provides a way to specify the default size and filesystem type:

So, What’s The Verdict?

Espionage does have some very interesting capabilities and I was impressed that the installer (which puts the kernel extension into place) includes full details as to what it is doing.

The application also includes other niceties such as support for Growl notifications and the ability to always enable or block application access to a particular folder under the watch of iSpy — and, you will need to make use this feature if you plan on utilizing any type of automated backup solution that will include that folder in the source path list.

However, due to the deficiencies with the way it initially creates encrypted folders and also some quirks during the operation – especially when performing multiple operations on the test “expenses” folder — I, personally, will have to continue to use my existing methods of securing data. As you saw from the FileVault screen capture, I do not use FileVault, but I do use secure disk images locally, on USB sticks, fileshares and when I am backing up sensitive data to my offsite provider. I also use TrueCrypt when I need to ensure my disks are fully protected.

I strongly suggest, however, that you do watch for future updates to Espionage as the developers will no doubt work the kinks out of this initial release and provide a very solid solution to fill the gap left by Apple. Since I am not aware of any features of Snow Leopard that will obsolete the functionality of Espionage, it should continue to fill this gap through the next release of Apple’s desktop operating system.

Related research and analysis from GigaOM Pro:
Subscriber content. Sign up for a free trial.

• Why iPad 2 Will Lead Consumers Into the Post-PC Era
• The Near-Term Evolution of Social Commerce
• Content Farms: The Players, The Benefits, The Risks

That is why I was excited when Steve Jobs announced at the keynote that iPhone 3G would allow enterprise users to remote wipe their devices. I think that is a great idea, especially for enterprise users.

AppleInsider is reporting that the software update for iPhone 2.0 (and presumably iPod Touch) will allow users to securely delete all their files like you securely delete your trash on your Mac. You will be able to get to the secure delete function the same way you get to the “Erase all content ad settings” now: Settings > General > Reset > Erase All Contents and Settings.

According to Apple, the software that will allow this will be released with the new iPhone on July 11th.

It will take you longer to secure wipe your phone, about an hour. It will securely delete your data, so if you are upgrading to an iPhone 3G, make sure that you upgrade after the software update to securely delete everything from your phone.

Related research and analysis from GigaOM Pro:
Subscriber content. Sign up for a free trial.

• How to Market Your iPhone App: A Developer’s Guide
• Transient Apps: The Consumer Influence on Enterprise Mobility, Part 2