Blog Post

Is Carrier IQ making you your operator’s lab rat?

Stay on Top of Enterprise Technology Trends

Get updates impacting your industry from our GigaOm Research Community
Join the Community!

Late Monday, Carrier IQ began circulating a document (PDF) it claimed would answer all outstanding questions about the company, its monitoring software and its relationship with the operators. While the doc didn’t answer every question about Carrier IQ and the growing controversy surrounding its operator customers, it did go into detail about how its software, IQ Agent, works, even revealing a few surprises. Notably, the company revealed operators aren’t receiving the same generic performance and network metrics from every device. Every operator has the ability to tailor what information a phone sends on the fly, allowing it to set up ad hoc test cases targeting different groups of devices or consumers. In other words, an operator can shanghai your phone into a kind of virtual focus group to test a new product launch and possibly even research the viability of new services.

For instance, if an operator wants to see how a new high-profile smartphone is interacting with its network, it can have every one of those devices send back detailed radio signaling data, which an operator could use to fine-tune future versions of the device. Or, if an operator expands an LTE network in a particular market and wants to optimize its coverage, it can order all LTE devices to send back specific logs on cell-to-cell hand-over and dropped data calls.

Those are both examples Carrier IQ provided, but it’s not hard to imagine an operator using IQ Agent’s huge menu of available metrics to gather marketing data on their customers. Carrier IQ readily admits its software can track URLs visited, when applications are activated or deactivated or when IP data sessions begin and end. So if an operator wanted to test the viability of a new social media data plan, it could track how often a subset of its customers access sites or apps like Twitter or Facebook versus communicating via SMS. The operators have a lot of demographic data about their customers, which they could easily marry to the near-real-time device and network information it collects from IQ Agents. There’s a potential market research bonanza buried in that app.

Taking the operators at face value

I’m not saying the operators are collecting this kind of market research on their customers, but the capability is definitely there, and Carrier IQ isn’t throwing up any barriers to accessing that goldmine. Part of the standard kit it provides to every operator is a Market Service Intelligent Platform (MSIP), which gives carriers a fine degree of granularity in determining what data to collect and how to analyze it. If an operator wants to implement a specific case study, it merely has to select the types of customers or devices it wants to gather information on – or even select individual customers – and the MSIP reaches out to devices, updating their IQ Agent profiles to start retrieving the relevant data. Of course, Carrier IQ wipes its hands of any responsibility for how operators use the platform, which to me sounds like a cop-out. It just gave the operators the gun; it didn’t tell them at whom to point it or to pull the trigger.

In the U.S., AT&T(s T), Sprint(s S) and T-Mobile have all admitted to using Carrier IQ (Verizon(s vz)(s vod) does not), but all have stated they use IQ Agent solely for diagnostic and troubleshooting purposes. If we take them at face value, you could construe this kind of targeted monitoring as harmless. Carrier IQ gives operators the ability to collect hundreds of individual metrics from every device. But rather than sending massive batches of data from every device, they only need to collect the information pertinent to a specific optimization or diagnostic issue. Why fill up databases with billions of useless data points if you only need a few specific metrics?

But these types of targeted analytics do escalate the creep factor of the Carrier IQ controversy. I’m already uncomfortable with the idea of my operator collecting data from my device without my knowledge, even if it is only for diagnostic purposes. If my operator is “activating” my phone at random intervals to serve in one of its ad hoc focus groups, then I would be doubly freaked out. I suppose I could accept this if my operator were more upfront about it and gave me the option to opt out. But if my operator is using all of Carrier’s IQ capabilities to turn me into an unwitting guinea pig for mobile market research, well, then it’s time to switch to Verizon, MetroPCS(s PCS) or any other operator that disavows Carrier IQ.

What else Carrier IQ is saying (and not saying)

There’s one other item in the Carrier IQ document worth noting: The company acknowledged it actually was sending some tex- message content back to the operators, but this was due to a bug in the software. When IQ Agent is set to track signaling data, it sometimes accidentally captures SMS messages, which are also transmitted over the over the network’s signaling channel. This only happened when an SMS was sent or received during a data session or voice call. In any case, the content of the SMS is still encrypted in the signaling log. Carrier IQ said it’s fixing this bug, but it’s a moot point really. If operators really wanted to read your text messages, they’d just intercept them as they passed through their own SMS routing infrastructure.

While Carrier IQ’s document was highly detailed, it still didn’t address the issue of its non-operator relationships. Carrier IQ hinted at other business models in the document, but it didn’t come out and say whether it was distributing its IQ Agent at the behest of any handset vendors or independent research firms. Carrier IQ did say it wasn’t selling or sharing the operators’ data to any other entity, though it hosts some of that data on its own servers. But that still doesn’t answer the question of whether Carrier IQ is collecting information independently for other companies.

Apple(s aapl) has already admitted to using Carrier IQ on the iPhone, and Nielsen (s nlsn) has some sort of data sharing partnership with the company. There’s also evidence Carrier IQ has shopped its platform to other research firms. The Yankee Group told us it considered buying Carrier IQ metrics at one point, but ultimately decided against it. While Carrier IQ is being transparent about the carrier side of the business, there’s still a big aspect of its business model that remains opaque.

Image courtesy of Flickr user jurvetson

15 Responses to “Is Carrier IQ making you your operator’s lab rat?”

  1. Miguel Angel Cueto

    Hello Guys! I already comment on some points about carriers position on this. I would like to comment on CIQ itself. Since CIQ provide software to Carriers in order to “troubleshoot or diagnostic” network-specific problems. Everybody is raising questions like, is it really collecting my personal data??. Are they really using this data to what they said they are using it for?? Are they giving this data to Law enforcement institutions?? And so forth… Well i think everybody is missing the right question here!! From my point of view, the right question to CIQ could be. Are the software u made, and sold to the carriers, capable of getting the info users are afraid of(keystrokes, passwords etc…), if it is setup to do so??? If so, well, they are guilty as hell!! It doesnot matter either they collected or not the data, it doesnot matter if they sent or not the data. What matter is that the software is capable of doing so, if it is setup for that propose. That will make the CIQ a rootkit troyan. And looking at the position Eric Schmidt took, this seems like CIQ software its really capable of getting your keystrokes and so…

    • Kevin Fitchard

      Hi Miguel, thanks again for your comments.

      To me, Carrier IQ has presented enough evidence to show that don’t track keystrokes, though they do track a lot of other information. I’m with you on the moral equivalency, though. If it is shown that the operators have done wrong than all parties should be held accountable.

  2. “I’m not saying the operators are collecting this kind of market research on their customers, but the capability is definitely there, and Carrier IQ isn’t throwing up any barriers to accessing that goldmine.”

    Kevin, I have a great deal of respect for your posts but I really think you’re making much ado about nothing here.

    Here’s why: 1) In order to transform the unprecedented amounts of data which the operators could conceivably collect into actionable insights, the operators would need to hire legions of data scientists to make sense of it all, and 2) while any resulting advertising revenue might be a “goldmine” for the likes of Google, it certainly isn’t meaningful for operators who generate US$ billions in annual turnover.

    I think if you consider this for a moment — in light of the fact that mobile advertising hasn’t become a priority for operators after many years of hype — you’ll realize the operators just aren’t interested in marketing their subscribers’ data to third parties.

    In between industry M&A, net neutrality, spectrum issues, etc., I quite think the operators have their collective hands full. :)

    • Kevin Fitchard

      Thanks David, I’m glad reasonable people can disagree. :)

      I definitely agree with you that operators aren’t selling the data to 3rd parties, but I don’t think that precludes them from using the data they collect to fine tune their own services and plans. They already do this with the data they collect from the network.

      I also agree with you about the huge volumes of data that they would have store if every device collected ever IQ Agent metric. The sheer amount of data points would be overwhelming. But Carrier IQ’s ability to set up profiles where operators could target a subset of devices with specific tests would allow operators to get much more manageable data sets if they so choose.

      Maybe you’re right — we in the media are blowing this out of proportion. I thinkI’ve tried to keep the worst of the conspiracy theories out of my reporting. But I do believe Carrier IQ has built a very powerful application that gives operators and its other customers the ability to peer deeply into the inner-workings of your phone. That’s a scary concept to any reasonable person. I think we need to explore all of the possibilities especially since the entire industry wasn’t exactly forthcoming about the application’s presence.

      • “I don’t think that precludes them from using the data they collect to fine tune their own services and plans. They already do this with the data they collect from the network.”

        Ok, but that’s just smart business…improving your products for your customers. Isn’t this what virtually all software companies do already?

        In any event, I’m also glad that reasonable people can disagree.

        Although, “reasonable” may not be fitting in my case. :)

      • Kevin Fitchard

        Yep, but aren’t they supposed to ask permission first? There’s a difference in collecting info from asset you own (the network) and collecting info from a device your customer owns (the smartphone). Perhaps the end result is the same: The carrier can track URLs visited and texts sent from the network just as easily. But I still think the difference between phone and network matters. This is my phone. I paid for it. I have a relationship with my operator to buy time on its network, but it has NO business creeping up that pipe into the device itself — not unless I give it explicit permission. At least that’s the way I see it. I know not everyone else feels the same (and they’ve all told me …) :)

  3. Vladimir Rodionov

    “… Why fill up databases with billions of useless data points if you only need a few specific metrics?”

    Kevin, where the hell you got this information from? No one is interesting in keeping useless data, believe me.
    Can I remind you your American famous: “Guns do not kill people, people do” So why are you not blaming gun manufactures for killing innocent people? This is about your “co -responsibility” CIQ and Carriers. So you are not comfortable with being remotely “monitored” by your Carrier – its your right and you should demand opt-in for the service, but not from CIQ, of course.

    As usual, too much propaganda and unreasonable doubts.

    • Kevin Fitchard

      Hi Vladimir, as always thanks for commenting. You’ve been on top of this story, and I know we disagree on this particular issue.

      Well, to your point, not everyone here in the U.S. believes the “Guns don’t kill…” maxim. I agree carriers are ultimately where the buck stops and we as consumers should hold them accountable. But I don’t think CIQ should be given a pass. There whole business model seems to built around the idea of allowing carriers to secretly siphon data from their customers’ phones. I don’t think that excuses them entirely of responsibility.

  4. The FBI has all but admitted it uses CarrierIQ (http://gizmodo.com/5867427/the-fbi-is-using-carrier-iq-information and others) and this makes sense. I can’t see a carrier paying CarrierIQ to develop software that would hide on phones and watch everything. OTOH, I can see a US Intelligence Agency (more NSA than FBI) contracting with CarrierIQ to program such software with the understanding that the software would respond to requests from the government. CarrierIQ would have been given the rights to sell the finished product to as many carriers as they could so the government would have a 9 figure installed base to spy on.

    • Kevin Fitchard

      Hi HJN. Actually the FBI has admitted to no such thing except that it has information in investigative files that it cannot release. Chances are this has to do with the Congressional inquiry that Sen. Al Franken initiated. Senators start asking questions, the FBI notices. Carrier IQ has said bluntly that it doesn’t provide info to the FBI and other law enforcement. While I’m not convinced of CIQ’s honesty on all things, that would be a pretty blatant lie.