An application that comes pre-installed on a millions of Android (News - Alert) phones is capable of recording nearly all user activity, including calls, text messages and even keystrokes, according to an Android developer who has investigated the software.
The initial findings of researcher Trevor Eckhart were actually presented some time ago, but the main details were unearthed in a 17-minute video posted to YouTube (News - Alert) earlier this week.
In the video, Eckhart shows how Carrier IQ software – which is pre-installed on many HTC, Blackberry and Nokia handsets to assess the quality of the mobile user experience – is able to log detailed personal information.
Eckhart showed how the app recorded his geographical location and his website history, even when he used an encrypted URL and denied permission for Google (News 
- Alert) to track his whereabouts. The video shows that nearly all user activity – including singular keystrokes – is being tracked.
The video is just the latest twist in the battle between Eckhart and Carrier IQ, which began months ago when the developer referred to the software as a "rootkit" on his blog. Rootkit is a term often used to describe a piece of malware, spyware or other malicious software that goes undetected by users.
The initial post led Carrier IQ to issue a cease and desist letter and threaten to sue Eckhart for publishing training materials that were used to uncover the issue. Unfortunately for Carrier IQ, they weren't prepared for the Electronic Frontier Foundation, a digital rights group that backed Eckhart's first amendment rights. Carrier IQ was forced to apologize to Eckhart and withdraw its legal threats soon thereafter.
Without worry of legal retribution, Eckhart took his fight to the next level by posting the video, proof in his mind of the app's recording capabilities. He also used the YouTube video to voice his concern over the lack of disclosure provided to handset owners and the fact that the app is nearly impossible to remove, other than completely wiping the device and installing a new OS.
"Why is this not opt-in and why is it so hard to FULLY remove?" Eckhart listed as one of the questions he would like answered.
Carrier IQ responded in a statement by saying that the app is only "designed to help mobile network providers diagnose critical issues that lead to problems such as dropped calls and battery drain."
The company also said that the app doesn't record keystrokes, geographical information or real-time data, nor does it provide any information to third parties.
It seems clear that Carrier IQ is capable of recording personal data; the question is whether it actually does anything with it.
Beecher Tuttle is a TMCnet contributor. He has extensive experience writing and editing for print publications and online news websites. He has specialized in a variety of industries, including health care technology, politics and education. To read more of his articles, please visit his columnist page.
Edited by Rich Steeves
