Sprint later disclosed that it had installed Carrier IQ software on 26 million handsets and had been using it since 2006, while AT&T said it had the software running on close to a million devices. Sprint in December announced it would disable the software on its handsets following the lead of Apple, which said it would remove the software from its iPhones.
Carrier IQ itself has maintained from the outset that its software is designed purely to collect information that can help wireless carriers improve network and device performance. The company has denied Eckhart's claims that its software can be used for keylogging purposes and has insisted that claims the software was used for intrusive data gathering are misplaced.
In today's letter, the lawmakers said that several questions remain unanswered.
"What are the data collection, analysis, and transmission capabilities of Carrier IQ and similar software, and what privacy protections are built into the software?" the letter said. "Were Android phones sold with security flaws that could have exacerbated privacy concerns related to Carrier IQ and other software and, if so, have these flaws been addressed? "
The trio also asked for an investigation into the disclosure practices of carriers and device manufacturers and of the security and privacy risks associated with the data collection and transmission enabled by Carrier IQ and similar software tools.
"Before last month, even the most technically savvy customers may not have been aware of the presence of this software and of its capacity for transmitting sensitive information," the lawmakers wrote. Even if they had been aware, they would not have been able to remove the software.
A Carrier IQ spokeswoman today said the company has already provided extensive details on the capabilities of its software to members of Congress and their staff. "We look forward to answering any further questions that may arise," she said.