This is a bad one. It's hard-coded into the iPhones and Sprint and AT&T use it on their Android phones. Verizon does not; whether it uses an equivalent is not yet apparent.
Sprint's corporate line (and Carrier IQ's) is that it is used strictly for diagnostics to help troubleshoot phone problems, that no one there reads the sensitive material, and that none of it has been or will be sold to anyone else. Unfortunately the scope of the information available to be gathered was demonstrated to be quite a bit beyond any diagnostic excuse: full text of SMS pages, key logging, etc, etc. There is absolutely no guarantee that any of this isn't being gathered.
Apple has stated that they intend to remove the thing in their next major software upgrade. No one else has, so far, made any such commitment.
Yes, every time you click a URL on the Internet the IP addresses go into a log somewhere, but not the keystrokes you make (passwords, bank numbers) or the actual traffic itself. This is far, far beyond anything kept by ISPs.
And you can't get rid of the thing - it is, in that sense, a root kit, although on my phone it shows up as a named process. If you turn it off it turns itself back on when you open a browser. The only way to get it off the phone I have - a Galaxy S2 - is to (1) root the phone, that is, wipe the OS; (2) flash the ROM with an alternate set of firmware, (3) re-install a fresh, non-corporate Android OS. Naturally all of this is strictly forbidden by the vendor as a terms of service violation. Were they equally scrupulous about keeping up their own end we wouldn't be having this conversation.
Lawsuits are, naturally, flying. According to my reading of the privacy text inside my contract (I'm not an attorney) what is capable of being gathered is a blatant violation. The trick is going to be proving who, if anyone, is doing so. But I am ready to dump my carrier regardless, and if they want to charge me for premature cancellation of the contract they are welcome to speak with my attorney.
Thanks. Sounds like a slippery slope that could really be abused in the wrong hands (Gov’t).
The first class action lawsuit was filed a couple days ago against Sprint.