larvae signpost: AT&T's use of Carrier IQ extends to its own analytics app, not just embedded on phone

Sunday, December 18, 2011

AT&T's use of Carrier IQ extends to its own analytics app, not just embedded on phone

AT&T's responses to questions posed by U.S. Sen. Al Franken, D-Minn., over the use of Carrier IQ analytics software are probably the most interesting we've seen thus far.

AT&T has been using Carrier IQ only since March 2011, with the Motorola Bravo the first device to have it integrated. However, AT&T has had its own analytics tool in use since 2009. Called Mark the Spot, or MTS, it differs from Carrier IQ in that it's a traditional application, downloaded and installed by the consumer and not preloaded onto the device before purchase. The idea is that if you experience a network hiccup -- like a dropped call -- you'd fire up the app and let AT&T know.

Mark the Spot was released for the iPhone in December 2009, and for Android in June 2011. In February 2011, AT&T began packaging Carrier IQ code with the MTS application, first for BlackBerry, and a month later for Android.

Android devices that have Carrier IQ software installed include the Pantech Pocket, LG Thrill 4G, ZTE Avail, Sony Ericsson Xperia Play, Motorola Atrix 2 and the aforementioned Motorola Bravo.

AT&T says only about 900,000 devices -- or about 1 percent of the device on its network -- have Carrier IQ on board, either preloaded or with the MTS app. And of those devices, 575,000 report back to AT&T.

AT&T also says it does not share any of its CIQ data with "any other non-AT&T company." and that it has not shared data with any federal or state law enforcement. It does, however, comply with court orders, subponeas and other legal orders.

Data collected from AT&T devices is inaccessible after 60 days from being uploaded. AT&T says it has "three downstreem systems receiving personally identifiable CIQ data from the AT&T server." One of those servers stores data for just 45 days, another has data from September 2011, and the third data from May 2011.

Like Sprint, AT&T explained that it indeed collects phone numbers "in the ordinary cource of its business" and for "Voice Call Performance and Messaging Performance metrics." It does not collect contents of e-mails, URLs of websites visited, contents of search quereies, names or contact information from address books, and none of its CIQ profiles is set to collet the content of text messages.

More: AT&T's response (pdf)