Preventing Another Carrier IQ: Introducing the Mobile Device Privacy Act 60
MrSeb writes "Lawmakers in Washington have turned their sights on mobile device tracking, proposing legislation aimed at making it much harder for companies to track you without consent. The Mobile Device Privacy Act (PDF) makes it illegal for companies to monitor device users without their expressed consent. The bill was introduced Thursday by Massachusetts Democrat Representative Edward Markey, co-Chair of the Bi-Partisan Congressional Privacy Caucus. Much of the impetus for the bill came from last year's Carrier IQ debacle, where it emerged that the company's software was found to exist on both iOS and Android devices on AT&T and Sprint's networks. While the company denied any wrongdoing, the software captured keystrokes and sent the details of your device usage back to the carriers. If passed, the legislation would require the disclosure of including tracking software at the time of the purchase of the phone, or during ownership if a software update or app would add such software to the device, and the consumer gains the right to refuse to be tracked. This disclosure must include what types of information is collected, who it is transmitted to, and how it will be used."
need a technical solution, too (Score:3, Interesting)
A legal solution is fine, but it isn't sufficient by itself. It's like trying to legalize that I don't receive spam. Well, the law can't really do that (it's tried). I can only do that myself, by being careful with who I give my email to.
So this seems like the same idea. Such a law doesn't hurt, but it isn't enough, by itself. What's needed is a technical infrastructure where the people who buy mobile products fully control them, from the hardware on up, rather than some phone carrier controlling them. Then I can blow away whatever crapware comes with the device by installing my own operating system and only running software I trust.
As long as the device is secured against the people who buy them, there can be no trust that we have any privacy.
If they wanted to pass a better law, they'd have passed one like that: carriers cannot secure phones against who buys the phones.
disclosure (Score:4, Interesting)
Disclosure is pointless. Firstly, it doesn't prevent the carrier from installing spyware on your device. Secondly, it's often worded in a way which leaves the customer clueless:
"..In agreeing to these terms, you authorize
Sprint to collect the necessary data needed to improve
and maintain equipment, networks, and customer service.
At no time will Sprint share this information with unaffiliated
third-parties, or individuals"
People just "meh" at shit like this and click through it. The lawyers know it too. I say, If you're going to raise hell about CarrierIQ, make a policy that requires the individual to Opt-in.