That stands in contrast with AT&T and Sprint, which use a deeply embedded version of IQ Agent to perform general diagnostic testing on the health of its network and test the overall performance of its device portfolio. Sprint has by far the largest implementation of Carrier IQ’s software, embedding it in half of all devices, though it said last week it has deactivated the software on all handsets. AT&T only started working with Carrier IQ this year, so IQ Agent is limited to fewer than a million of its devices. But both operators admitted to using the data they collected for more than just troubleshooting individual customer complaints.

As we pointed out in our own analysis of how IQ Agent and its Mobile Service Intelligence Platform (MSIP), operators have the ability at any time to recruit specific devices into the ad hoc network ‘focus groups’ to test different network and device performance issues, effectively turning customers into unwitting lab rats. While both and Sprint and AT&T take advantage of those capabilities, it appears T-Mobile does not.

The Electronic Frontier Foundation shows how IQ Agent works

In its letter, T-Mobile stated it does not track GPS location, URLs, message or web content or keystrokes. Furthermore, the version of IQ Agent it uses is installed in the phone after it leaves the factory so it doesn’t have access to the deep signaling layer information an embedded version of the IQ software could tap.

The diagnostic data it does collect is stored on Carrier IQ’s servers for 30 days, and it’s only accessed by T-Mobile customer care representatives addressing a specific phone problem when a call comes in, T-Mobile said. The operator said it does use the data for marketing purposes, but apparently not even its engineering staff has access to that data, so it can’t be used for network optimization purposes.

As more and more operators cop to working with Carrier IQ, it’s becoming readily apparent some of them have been using IQ Agent much longer and much more extensively than others. Sprint has been using Carrier IQ since 2006, while the first T-Mobile phone with IQ Agent shipped just last August. Depending on how the controversy shakes out, operators may be permanently damaged or the entire issue may be forgotten. In a GigaOM research update (subscription required), Stacey Higginbotham explored the potential fallout.

Motorola also responded to Franken’s query this week, revealing it has installed Carrier IQ at its customers’ request on four devices: The Admiral and Titanium for Sprint and the Atrix 2 and Bravo for AT&T. Here is the list of the T-Mobile smartphones loaded with IQ Agent:

•  HTC Amaze $G
• Samsung Galaxy SII
• Samsung Exhibit II 4G
• T-Mobile MyTouch by LG
• T-Mobile MyTouch Q by LG
• LG DoublePlay
• BlackBerry 9900
• BlackBerry 9360
• BlackBerry 9810

Related research and analysis from GigaOM Pro:
Subscriber content. Sign up for a free trial.

• Carrier IQ and the continued erosion of operator trust
• U.S. Wireless Data Market: Q4 and Year-End 2008
• Mobile Q4: The scramble for spectrum continues

For instance, if an operator wants to see how a new high-profile smartphone is interacting with its network, it can have every one of those devices send back detailed radio signaling data, which an operator could use to fine-tune future versions of the device. Or, if an operator expands an LTE network in a particular market and wants to optimize its coverage, it can order all LTE devices to send back specific logs on cell-to-cell hand-over and dropped data calls.

Those are both examples Carrier IQ provided, but it’s not hard to imagine an operator using IQ Agent’s huge menu of available metrics to gather marketing data on their customers. Carrier IQ readily admits its software can track URLs visited, when applications are activated or deactivated or when IP data sessions begin and end. So if an operator wanted to test the viability of a new social media data plan, it could track how often a subset of its customers access sites or apps like Twitter or Facebook versus communicating via SMS. The operators have a lot of demographic data about their customers, which they could easily marry to the near-real-time device and network information it collects from IQ Agents. There’s a potential market research bonanza buried in that app.

Taking the operators at face value

I’m not saying the operators are collecting this kind of market research on their customers, but the capability is definitely there, and Carrier IQ isn’t throwing up any barriers to accessing that goldmine. Part of the standard kit it provides to every operator is a Market Service Intelligent Platform (MSIP), which gives carriers a fine degree of granularity in determining what data to collect and how to analyze it. If an operator wants to implement a specific case study, it merely has to select the types of customers or devices it wants to gather information on – or even select individual customers – and the MSIP reaches out to devices, updating their IQ Agent profiles to start retrieving the relevant data. Of course, Carrier IQ wipes its hands of any responsibility for how operators use the platform, which to me sounds like a cop-out. It just gave the operators the gun; it didn’t tell them at whom to point it or to pull the trigger.

In the U.S., AT&T, Sprint and T-Mobile have all admitted to using Carrier IQ (Verizon does not), but all have stated they use IQ Agent solely for diagnostic and troubleshooting purposes. If we take them at face value, you could construe this kind of targeted monitoring as harmless. Carrier IQ gives operators the ability to collect hundreds of individual metrics from every device. But rather than sending massive batches of data from every device, they only need to collect the information pertinent to a specific optimization or diagnostic issue. Why fill up databases with billions of useless data points if you only need a few specific metrics?

But these types of targeted analytics do escalate the creep factor of the Carrier IQ controversy. I’m already uncomfortable with the idea of my operator collecting data from my device without my knowledge, even if it is only for diagnostic purposes. If my operator is “activating” my phone at random intervals to serve in one of its ad hoc focus groups, then I would be doubly freaked out. I suppose I could accept this if my operator were more upfront about it and gave me the option to opt out. But if my operator is using all of Carrier’s IQ capabilities to turn me into an unwitting guinea pig for mobile market research, well, then it’s time to switch to Verizon, MetroPCS or any other operator that disavows Carrier IQ.

What else Carrier IQ is saying (and not saying)

There’s one other item in the Carrier IQ document worth noting: The company acknowledged it actually was sending some tex- message content back to the operators, but this was due to a bug in the software. When IQ Agent is set to track signaling data, it sometimes accidentally captures SMS messages, which are also transmitted over the over the network’s signaling channel. This only happened when an SMS was sent or received during a data session or voice call. In any case, the content of the SMS is still encrypted in the signaling log. Carrier IQ said it’s fixing this bug, but it’s a moot point really. If operators really wanted to read your text messages, they’d just intercept them as they passed through their own SMS routing infrastructure.

While Carrier IQ’s document was highly detailed, it still didn’t address the issue of its non-operator relationships. Carrier IQ hinted at other business models in the document, but it didn’t come out and say whether it was distributing its IQ Agent at the behest of any handset vendors or independent research firms. Carrier IQ did say it wasn’t selling or sharing the operators’ data to any other entity, though it hosts some of that data on its own servers. But that still doesn’t answer the question of whether Carrier IQ is collecting information independently for other companies.

Apple has already admitted to using Carrier IQ on the iPhone, and Nielsen has some sort of data sharing partnership with the company. There’s also evidence Carrier IQ has shopped its platform to other research firms. The Yankee Group told us it considered buying Carrier IQ metrics at one point, but ultimately decided against it. While Carrier IQ is being transparent about the carrier side of the business, there’s still a big aspect of its business model that remains opaque.

Image courtesy of Flickr user jurvetson

Related research and analysis from GigaOM Pro:
Subscriber content. Sign up for a free trial.

• Carrier IQ and the continued erosion of operator trust
• Sprint’s tightrope walk: finding a balance for its network modernization plan
• Mobile 2011: Data Consumption Will Explode

Yankee Group research director Sheryl Kingstone concluded that Carrier IQ and its partners did a horrible job when it came to the public implementation of its diagnostic platform, but she found that there was no nefarious intent behind it. The report also states that keystroke-logging tool found rooted in the depths of Trevor Eckhart’s HTC smartphone was not Carrier IQ’s phone performance monitoring software, but rather a factory testing app that HTC failed to deactivate before shipping.

If Carrier IQ had done a better job at educating customers about the presence and purpose of its app, it might have been welcomed by the public, rather than sued, Kingstone said. The Yankee Group’s consumer survey found that 85 percent of mobile phone using respondents wanted their operators to have access to detailed information about their device’s performance when they contacted a call center with a problem.

Yankee also asked what consumers’ expectations were when they called their operator with a problem. The top three answers were: 1) fixing the problem immediately, 2) remotely diagnosing the problem, and 3) empowering the call center agent to remotely fix it. If you go by Yankee’s data, consumers don’t just want their operators to know what’s going inside their phones, they want them to actively poke around inside whenever there’s a problem. Here’s what Kingstone said on Yankee’s mobile blog:

“It’s an issue of transparency, not malicious intent. Carriers — and especially consumers — want the best possible customer experience, and Carrier IQ’s software aims to do just that. Where it, and device vendors and carriers, erred was in their lack of transparency and failing to enable end-users to opt out of the service. If they had taken the opposite tack, revealing the existence of the software to end-users and providing them a potential option to opt in to ensure a better level of care, there would be no controversy, just better customer service. And that would be a win-win for all involved.”

Carrier IQ needs to be honest about its business model

I agree with Kingstone’s conclusions, so long as Carrier IQ is used only as a diagnostic tool. Networks are complicated things that require endless fine tuning, and on-device performance testing would be critical tool for optimizing those networks. I’d prefer my operator to let me know it’s recording actions on my phone, and then give me a chance to opt out, but the truth of the matter is my operator already knows plenty about me even without software like Carrier IQ’s. It knows where I am, where I’ve been, every SMS I’ve ever sent and every person I’ve ever called. We consumers have no problem with this, otherwise we would have freaked out the first time we ever saw our highly detailed phone bills.

But Carrier IQ is doing more than just selling network diagnostic info to operators, it’s selling — or at least trying to sell — to marketing analytics companies, which don’t own networks to diagnosis. Nielsen is working with Carrier IQ to integrate its device performance data with its own mobile metrics, though it will only to do so only on an opt-in basis, just as it recruits participants for all of its other measurement panels.

And Carrier IQ is definitely shopping its service around to other marketing and analysis companies. Kingstone said the Yankee Group last year investigated the possibility of buying data from Carrier IQ and other network measurement firms, but ultimately decided against it — the data was too technical to be of any much use while privacy concerns would have required Yankee to seek explicit permission from each consumer involved, she said. (The Yankee Group said that it has no current or former relationship with Carrier IQ.)

When Carrier IQ says it’s only selling data to the operators it’s either straight-up lying about the full extent of its business model or its misleading the public about its future intentions. It’s very possible this side business is innocuous, requiring explicit permission from the owner of any phone Carrier IQ tracks. Even if that’s the case, Carrier IQ needs to be upfront about that business model. Hopefully we’ll know more next week, when Carrier IQ is expected to respond to U.S. Senator Al Franken’s (D- Minn.) very detailed questionnaire about its activities.

Who else will get caught in the fallout?

Meanwhile, the voices calling for Carrier IQ’s head are growing deafening. On Friday Google CEO Eric Schmidt condemned the company at a conference in the Hague, saying that Google not only disapproved of Carrier IQ’s implementation into Android – it can not be uninstalled or de-activated – or the company’s methods, which he described as keylogging, the Telegraph reported.

Carrier IQ will most likely become a casualty of its own controversy, but whom else will it drag down? In a GigaOM Pro report, Stacey Higginbotham examines what other entities would suffer (subscription required) if Carrier IQ’s monitoring software winds up being more than it claims to be. Operators’ already fragile reputations are on the line, but Stacey concludes that consumers could wind up being the biggest losers. As faith in the operator and handset vendor erodes, consumers will be less likely to embrace new technologies and services that require a degree of trust to function. Emerging industry like mobile payment and finance as well as telemedicine could be the first casualties.

Related research and analysis from GigaOM Pro:
Subscriber content. Sign up for a free trial.

• Carrier IQ and the continued erosion of operator trust
• Opportunities and challenges for mobile deals
• LTE-Advanced: what it is and isn’t

Media-measurement company Nielsen is tapping into that information pipeline as well, which raises the questions of how many other companies may be buying information from Carrier IQ. Providing a carrier with anonymous performance metrics is one thing, but selling compiled customer data to a third-party with no relationship to the customer or the network Carrier IQ is monitoring is another altogether. Carrier IQ claims to be offering a service to the operators to help them optimize their networks, but it may well be a big data mercenary selling information on all kinds of mobile consumer behavior to the highest bidder. It might even be playing both sides.

The story so far

AT&T and T-Mobile USA are just the latest to admit they received data from Carrier IQ on the behavior of their customers’ smartphones. However, like Sprint, they claimed it used that information solely for network optimization purposes. Verizon is the only major U.S. operator untarnished. Apple copped to installing Carrier IQ’s software on all its iPhones before the release of iOS 5. HTC and Samsung acknowledged implementing Carrier IQ, but only at the behest of their carrier customers, which didn’t prevent them from getting slapped with class action lawsuits.

Lawyers have compared Carrier IQ’s covert digital snooping to illegal wiretapping. Carrier IQ has even attracted the attention of Congress. U.S. Senator Al Franken (D-Minn.), who chairs the Senate subcommittee on Privacy, Technology and the Law, sent a letter Thursday to Carrier IQ President and CEO Larry Lenhart asking some poignant questions about how and for whom Carrier IQ collects its data.

Taking a cue from Franken, let’s ask some of those same questions. Moving beyond what data Carrier IQ is collecting, which has been covered extensively by Eckhart and subsequent stories, lets’ explore why Carrier IQ is collecting information from millions of smartphones and more importantly who its selling that data to.

A bizarre big-data triangle

Based on the patterns of admissions and denials we’re seeing around the industry, as well as some background conversations with some industry sources, it looks like Carrier IQ is two-headed beast: one head being its covert handset software and the other being its measurement and analytics service. Certain handset makers, like HTC and Samsung, are installing the app on many, if not all, of their smartphones at the root layer, but those handsets aren’t necessarily the customers for the analytics service. In fact, both HTC and Samsung deny they receive any of the data collected.

Then who does? AT&T, T-Mobile and Sprint are three, as was Apple, but another is Nielsen. In October, Nielsen signed on as a Carrier IQ partner saying it would use the company’s technology to help “measure the performance of mobile services, networks, and devices” and “gather actionable intelligence on the performance of mobile devices and networks.”

That sounds very much like what both AT&T and Sprint are saying. We reached out to Nielsen to ask what exactly they’re doing with Carrier IQ data. Here’s the email response from VP of Global Communications Marivi Lerdo de Tejada:

“Nielsen and Carrier IQ announced an alliance in October 2011 to explore potential ways to measure mobile services, networks and devices, exclusively using opt-in panels and in accordance with Nielsen’s stringent privacy standards. To date, we continue to explore these opportunities, with neither any work for clients initiated, nor any panels created.”

If Nielsen sticks with its opt-in policies, it won’t get into the trouble the carriers and handset vendors appear to be in, but are there other market research companies that might not be so scrupulous? Carrier IQ has no qualms with selling carriers their own customers’ data without those customers’ permission. Could it sell the data it collects from AT&T, Sprint and T-Mobile’s customers to another market analytics firms. Could it sell AT&T’s data to Sprint and vice versa?

Late Thursday, Carrier IQ broke its silence, putting out a statement explaining what data it collects and what it does with it. Here are some excerpts:

“While a few individuals have identified that there is a great deal of information available to the Carrier IQ software inside the handset, our software does not record, store or transmit the contents of SMS messages, email, photographs, audio or video. For example, we understand whether an SMS was sent accurately, but do not record or transmit the content of the SMS. We know which applications are draining your battery, but do not capture the screen.

“… Carrier IQ acts as an agent for the Operators. Each implementation is different and the diagnostic information actually gathered is determined by our customers – the mobile Operators. Carrier IQ does not gather any other data from devices.”

Carrier IQ claims to count the frequency of actions, not the content of the actions themselves, and say whatever data it sends back to is servers is encrypted and personal information is protected. But Carrier IQ isn’t being quite so honest about who its customers or potential customers are. Right there on its home page, Carrier IQ says it gives handset manufacturers as well as wireless operators “unprecedented insight into their customers’ mobile experience.” Nielsen certainly isn’t a wireless operator.

This isn’t just about a few carriers keeping tabs on their customers. This is big data for the mobile world – massive databases of consumer behavior delving into when, how and in what manner we use our devices. By Carrier IQ’s own admission, its software is embedded in more than 150 million handsets. There are plenty of companies that would find that information enormously useful. The problem is Carrier IQ never got permission from all these smartphone users to collect that data, never told them it was gathering it, and never provided a way of opting out.

Who gave Carrier IQ permission?

Carrier IQ couldn’t just do this on its own, covertly installing rootkit software into millions of phones without anyone’s knowledge. It had to have the cooperation of operators like Sprint and AT&T and of the handset manufacturers that built their devices. HTC and Samsung are pointing fingers directly at the operators. Take the statement circulating from HTC, which we first saw on Bright Side of the News:

“Carrier IQ is required on devices by a number of U.S carriers so if consumers or media have any questions about the practices relating to, or data collected by, Carrier IQ we’d advise them to contact their carrier. It is important to note that HTC is not a customer or partner of Carrier IQ and does not receive data from the application, the company, or carriers that partner with Carrier IQ. HTC is investigating the option to allow consumers to opt-out of data collection by the Carrier IQ application.”

But if the operators are entirely to blame, how is that Nokia, Google and RIM can claim they don’t use Carrier IQ’s software? It may have been harder to drill down into Nokia and RIMs’ operating system, sure, but Carrier IQ was able to work with Apple to embed its software deep into the iPhone. Plus, if RIM and Nokia can turn down Sprint and AT&T, why can’t HTC and Samsung? It’s not as if Nokia market share is so strong in the U.S. it can casually deny a software customization request from AT&T, one of the world’s largest GSM operators. And though RIM claims to be Carrier IQ-free, that hasn’t stopped AT&T, T-Mobile and Sprint from selling plenty of BlackBerry devices.

I’m not fully convinced Carrier IQ’s intent is as evil as the deluge of recent coverage makes it out to be, though its methods are both suspect and scary. But if it’s a conspiracy you’re looking for, then there are plenty of possible conspirators. Carrier IQ didn’t do this alone. To drill this far down into the habits of mobile consumers, companies up and down the wireless value needed to be complicit.

Image courtesy of  flickr user alancleaver

Related research and analysis from GigaOM Pro:
Subscriber content. Sign up for a free trial.

• Carrier IQ and the continued erosion of operator trust
• Consumer privacy in the mobile advertising era
• A near-term outlook for big data