In his press release, Franken declared, "Consumers need to know that their safety and privacy are being protected by the companies they trust with their sensitive information. The revelation that the locations and other sensitive data of millions of Americans are being secretly recorded and possibly transmitted is deeply troubling. This news underscores the need for Congress to act swiftly to protect the location information and private, sensitive information of consumers. But right now, Carrier IQ has a lot of questions to answer."
The "revelation" to which Franken refers is a pair of recent blogposts and a YouTube video by a Connecticut systems administrator, Trevor Eckhart. He, and an array of bloggers, hackers and pundits who have accepted his analysis, allege that Carrier IQ can, and is, collecting a range of detailed personal information, including the text of SMS messages, and even individual keypad and keyboard touches.
But others are saying Eckhart actually has not yet shown that Carrier IQ is collecting this information on the phone, or transmitting it. "At no point does he enter a debugger and look inside the Carrier IQ application, and at no point does he run a network sniffer and look at what data is being transmitted to Carrier IQ," says John Graham-Cumming, programmer, author, and VP of engineering at software vendor Causata, in a post on his personal blog. "And I don't understand why. It would be a huge story if millions of smartphones worldwide were secretly sending the content of text messages to a US-based company. But that's not the story here because the 'security researcher' does not appear to have tried to find out."
Carrier IQ initially had a different response to Eckhart's posts: It slapped him with a cease-and-desist letter. A few days later, however, the company withdrew the letter and apologized after he turned for help to the Electronic Freedom Foundation (EFF). The company has consistently said that its software is "not recording keystrokes or providing tracking tools," most recently in a "media alert" on its website.
Yet the company has so far declined all requests, including one from Network World, to explain in detail what data the application captures and how the application works. It apparently plans to do so in an upcoming meeting with representatives of the EFF.
In his letter to Lenhart, Franken said he was "very concerned" by reports that the Carrier IQ software "is logging and may be transmitting extraordinarily sensitive information from consumers' phones."