When a Connecticut programmer revealed that Carrier IQ, a hidden program on many smartphones, had the power to transmit information about the user’s location, web searches and text messages, the blogosphere erupted with commentary. Senator Al Franken of Minnesota sent a letter to Carrier IQ, Inc., asserting that the use of the software without the consumer’s consent could violate the federal wiretap statute.
But the Carrier IQ incident is just the tip of the iceberg of surreptitious collection of information about us using key features of our smartphones — their cameras, their microphones and their ability to connect to the Internet. And our legal protections are far less secure than Franken thinks.
(MORE: Top 10 Gadgets of 2011)
It’s not surprising that we’re being tracked on our cell phones — data tracking on computers through browsers and Internet service providers has been going on for years, and what are our phones but mini-computers? But the information our phones convey is more revealing and intimate than data from our PCs, including our movements from place to place in real time and our conversations as well as our emails, status updates and web searches.
Some tracking programs, such as Carrier IQ, are installed without your permission. For others, you may intentionally download the smartphone app but not be aware of its full capabilities. Still other apps cannot be easily uninstalled if you decide to try to stop the privacy invasion.
The potential surveillance technologies for phones just keep expanding. Certain apps use the microphone on the phone — so that, in the case of the Shopkick app, a store knows you’re there by sending out and receiving sounds and can offer you a deal, or in the case of the IntoNow app, an analysis can be made about what television show you’re watching to send you information and products related to the show. But enabling remote access to the microphone could also enable marketing companies to discern sensitive personal information such as whether you are alone, eating a meal or having sex.
What Carrier IQ is actually collecting — and for whom — is still an open question. But virtually every feature of a smartphone can be hijacked by data aggregators without running afoul of existing law.
The federal Wiretap Act makes it illegal to intercept communications and intentionally disclose or use them. That law seems to be the perfect avenue for thwarting the companies that surreptitiously collect information from smartphones. But the Wiretap Act also contains a major loophole. Courts have held that if only one party consents to the wiretapping, then it’s legal. So if your wireless carrier says that it’s okay for a marketing company to collect and transmit your personal information, your consent is not required. Laws pending in Congress deal only with narrow slices of the problem by placing limits on monitoring of phones’ GPS data (Senate bills 1212 and 1223) or expanding the Federal Trade Commission’s power to go after data aggregators that surreptitiously collect personal information about people (Senate bill 913). But even if piecemeal laws were passed, there’s no guarantee that judges would give sufficient weight to digital privacy in interpreting them. In 2010, a New York judge likened digital communications (in that case, an email) to “postcards” that anyone could see — thus gutting privacy protections altogether.
If someone broke into your home and copied your documents, he’d be guilty of trespass and invasion of privacy. If the cops wanted to wiretap your conversation, they’d generally need a warrant. With smartphones, the information is just as sensitive. The harms are just as real. But the law is not as protective.
On Dec. 1, four consumers filed a class action lawsuit against Carrier IQ under the wiretap statute. Now’s the time for a judge to get it right and hold that a smartphone tracking requires the consent of the person whose personal information is being collected — not the consent of the entity profiting from that surreptitious activity. We need smart law to go with our smartphone.