If you have any decently-modern phone, everything you do is being recorded by hidden software lurking inside. It even circumvents web encryption and grabs everything -- including your passwords and Google queries.
Worse: it's the handset manufacturers and the networks who—in the name of "making your user experience better"—install this software without any way for you to opt-out. This video, recorded by 25-year-old Android developer Trevor Eckhart, shows how it works. This is bad. Really bad.
Fast forward to 9:00 for the damning sequence.
The spying software is developed by a company called Carrier IQ. In their site, the company says they are "the only embedded analytics company to support millions of devices simultaneously, we give Wireless Carriers and Handset Manufacturers unprecedented insight into their customers' mobile experience."
It seems like a good goal and, indeed, most manufacturers and networks agree: according to Eckhart, the spyware is included in most Android phones out there. Carrier IQ software is also included in Blackberry and Nokia smartphones, so it probably works exactly the same in those smartphones as well. It doesn't even matter if your phone was purchased free of networks contracts. As Eckhart shows in this video, it's always there.
The problem is that it does a lot more than log anonymous generic data. It grabs everything.
Carrier IQ's software is installed in your phone at the deepest level. You don't know it's there. You are never warned this is happening. You can't opt-in and you certainly can't opt-out.
The commercial spyware sits between the user and the applications in the phone so, no matter how secure and private your apps are, the spyware intercepts anything you do. From your location to your web browsing addresses and passwords to the content of your text messages.
This even happens using a private Wi-Fi connection instead of the network's 3G connection.
The company denied all this in a public statement (PDF):
While we look at many aspects of a device's performance, we are counting and summarizing performance, not recording keystrokes or providing tracking tools
But the video clearly demonstrates that this is not true: Keystrokes submit unique key codes to Carrier IQ. Even secure connections are intercepted by the spyware, allowing it to record your moves in the open. These connections to the web are encrypted but, since Carrier IQ's spyware sits between the browser and the user, it grabs it and sends it in plain text.
The spyware can even log your location, even if the user declines to allow an app to know where it is. The hidden Carrier IQ app ignores your desires, intercepts the data and gets your location anyway.
But what can you do to avoid this? Unfortunately, not much. The hidden spyware is always running, and there's no option in any of the menus to deactivate it. Unless you're a grade-A blackbelt hacker, you're out of luck. Even Eckhart, who is a developer, finds it difficult to remove:
"Why is this not opt-in and why is it so hard to fully remove?"
It's an excellent question. One that urgently needs an answer, from Carrier IQ, but especially from every handset manufacturer and network involved in this situation. [Android Security Test and Carrier IQ via Threat Level]
Image Credit: Android Spy Software
UPDATE: We're still not 100 per cent sure if Carrier IQ is limited to the US, or affects other phone users around the world. But reading into this some more, it seems rooting your phone is one way to navigate around this issue.
UPDATE 2: Darrell Jones spotted the news that traces of Carrier IQ have been found in iOS, too.
UPDATE 3: Nokia's PR agency gave us the following statement:
"I know you've followed today's news that software from CarrierIQ has been found on Nokia devices. I wanted to quickly reach out following your story to let you know that in fact, CarrierIQ does not ship products for any Nokia devices. Therefore, these reports are inaccurate."