Secret app on millions of phones logs key taps

After looking at the screenshots of the carrier-side it seemed to me that the Carrier IQ system allows much more interaction/control from the carrier side. Pending patent applications sometimes can tell you a lot about where a company is heading.

Here are a couple of quotes from Carrier IQ's pending U.S. 20090207749 USER-INITIATED REPORTING OF MOBILE COMMUNICATION SYSTEM ERRORS:

"...This configuration enables the system 200 to dynamically generate and download to a population of wireless devices rule-based data collection profiles. Data collection profiles may be generated manually by a network administrator, a software developer or other personnel involved in the operation of the network (hereinafter referred to as "network administrators"), created offline as a portion of a data analysis solution, or automatically generated based on network parameters or other events. Profiles define what information is to be collected on the devices in response to which conditions and events, as well as the conditions and events that cause the device to upload the collected information.

[0038] Conditions or events include any occurrence in the network or on the device that the device can sense, such as a call dropping or a user pressing a button on the device. Conditions and events also include the passage of time, or a request from a network administrator that the device report information back to the server. Conditions and events which cause a device to collect information or upload the collected information may generally be referred to as "triggers." "

and:

"[0080] In the exemplary embodiment, triggers may be included in the data collection directives of a data collection profile, and their inclusion causes the client to initiate, abort, and terminate data collection activity as appropriate when the associated trigger condition is invoked by the wireless device 400. A trigger invocation that matches the initiating trigger causes data collection activity to begin. A match of the terminating trigger causes the data collection activity to end, and a metrics package is then prepared for uploading. An abort trigger causes data collection activity to cease, and a metrics package is not prepared or is not uploaded. In the example used earlier, launching an application caused the client to be invoked with an "application launched" trigger event, which is matched against triggers in downloaded profiles and causes data collection activity to begin on a user's device. The user's entering of a particular key sequence, pressing of a dedicated button, or selection of a particular menu option while the application is running would cause another trigger to be activated, and the SQC would match the event to a terminating trigger in the profile, cause data collection to stop and a metrics package to be prepared and uploaded. As can be seen, the inclusion of a trigger in a profile effectively selects the condition under which a specific action associated with that profile is to be executed. The trigger is not strictly within the profile, rather it associates specific profile actions (start, stop, abort) with a specific event on the device. "

And the claims from their pending "USING MOBILE DEVICE TO CREATE ACTIVITY RECORD" application No. 20090210516 is quite interesting to browse:

1. In a communication system, a method for creating an activity record, the method comprising: recording data at a device, the data including one or more events and event-related data that describe activities of a user; uploading the data to a server, wherein the server organizes the data based the event related data; and generating an activity record using the data that can be presented to a user, wherein the activity record represents at least a partial log of the activities of the user.

2. The method of claim 1, wherein event-related data comprise one or more of: a time an event occurs; a date the event occurs; a location of the device when the event occurs; a filename of an event object associated with the event; a mobile device number (MDN); and a contact name.

3. The method of claim 2, wherein generating an activity record using the data comprises creating an entry for each of the one or more events describing where and when an event occurred.

4. The method of claim 3, further comprising presenting the activity record on a website, wherein the website is accessed by the device or using another device.

5. The method of claim 3, wherein the one or more events comprise at least one of: making or receiving a phone call; sending or receiving a message; taking a photograph; recording a device location; receiving and playing a broadcast; connecting to an 802.11 or Bluetooth access point; and using a device application.

6. The method of claim 5, wherein the location of the mobile device is recorded periodically and independently of other events. ....

Having reviewed your other comments in this discussion, I must say that I do not see the point in continuing this.

Are you a Carrier IQ shill or something?

Neither drivebyacct2 nor the video claims the data is stored. Carrier IQ is collecting keystroke data, which you said they were not doing. The video clearly shows, when the user presses the "1" key:

  com.htc.android.iqagent.action.ui01
  actionUI01:49,0

where 49 is the keycode for the "1" key. This means the Carrier IQ code is called to collect and process this event information.

We just don't know what the code is doing with this information. Perhaps it is simply updating statistics and discarding it. So I guess your argument with drivebyacct2 is on the definition of "collecting"...

He can't be.

He's one of the people who has been on HN forever. He's often a bit contrarian, but I don't doubt that he believes what he says, even when I strongly disagree with it. And if you scroll up, you'll see that I've already made clear my disagreements on this one.