Electronic Health Record Data Breaches Surge

Most of us have come to the obvious, inevitable realization that we are going to shift (and in fact are doing so right now) what are currently called personal health records from a paper system to an electronic one. Having your medical records computerized and stored electronically promises to reduce medical errors - including prescribing the wrong medications. The National Academy of Sciences' Institute of Medicine estimates between 44,000 and 98,000 people in the United States die each year because of errors such as being prescribed medicine to which they are allergic.

These EHR’S offer an easier way to collect, double-check and complement the information you receive from your physician. At the very least, your records can help you speed through waiting room forms and prompt important conversations with your physicians. If your doctor writes a new prescription, you can use your current medication list to ask about any interactions with the new drug. Or if your records suggest it’s time for a colonoscopy, you might make time to discuss the pros and cons of the procedure.

EHR’S can also allow you to access your health information to prepare for medical appointments. As laid out by Patient Privacy Rights, "It can enable you to communicate better with your healthcare providers about your medical needs. People with chronic health conditions may use them to keep track of such things as how their medications are affecting them, or how they’re feeling from day to day. People with hypertension might want use it to track their blood pressure readings."

Transitioning to a health information exchange will create much more patient data in electronic formats than ever before in history. The privacy threat posed by the interoperability of a national network is a key concern because in order for the records to be readily available and accessible they would have to be linkable and searchable.

If medical records fell into the wrong hands at worst they could be used for a host of purposes unrelated to improving your health: advertisers might flood our email inboxes with even more spam and patients may not feel so comfortable having an honest conversation with their doctor if it could end up for all to see. This treasure trove of personal information would also be a goldmine for insurance companies, drug companies, data mining companies, and software companies.

I give you this backdrop because we are witnessing increasing numbers of data breaches that are exposing - on a mass level - peoples personal health records.

Before I get to the latest news on partly why these breaches are occurring (hospitals skimping on their security costs), let me layout some of the data and its costs we ALREADY knew about:

• More than 11 million consumers have had medical data stolen or inappropriately disclosed since September 2009, and the privacy breaches are expected to rise as more health information is put online, according to the report released today by the New York-based accounting firm’s health research institute.
• While the report didn’t specify how many security thefts were carried out by insiders, 40 percent of surveyed providers reported an incident of improper internal use of protected health information during the past two years. 
• Health organizations notified approximately 5.4 million individuals affected by patient health data breaches in 2010, compared to approximately 2.4 million individuals in 2009.
• HHS' latest report to Congress revealed that in 2010 theft was the most common cause of large breach incidents that affected 500 or more individuals. Among the 207 breaches that covered entities such as healthcare providers, health plans, and healthcare clearinghouses reported last year, 99 incidents involved theft of paper records or electronic media, combined affecting approximately 3 million individuals. 
• In 2010, the second highest number of data breaches involved the loss of electronic media or paper records, with 33 reported cases that affected more than 1 million individuals. There were 31 breaches that involved unauthorized access to, or uses or disclosures of, protected health information that affected approximately 1 million individuals. Other breaches included 19 incidents resulting from human or technological errors that affected approximately 78,663 individuals. Eleven covered entities reported breaches caused by the improper disposal of protected health information that affected approximately 70,000 individuals.

Now that we've gone over just a few of the reasons why this is all so important, and why concerns articulated by privacy advocates that STRICT privacy safeguards, at every step of the transition process must be implemented have been proven true, lets get to some of the reasons WHY such breaches are occurring.

As Business Week reported: 

Data breaches at U.S. health-care providers are increasing as hospitals adopt electronic medical records and mobile technology without spending enough on security to ensure patient privacy, a research group said.

The frequency of data breaches at health organizations jumped 32 percent in 2011 from a year earlier, costing the industry an estimated $6.5 billion, according to a study released today by the Ponemon Institute LLC, a Traverse City, Michigan-based information-security research group.

Forty-nine percent of health organizations said that lost or stolen devices were to blame for breaches, according to the institute, which surveyed 72 hospitals and health providers. The study didn’t name the organizations surveyed.

...

Fifty-three percent of the organizations surveyed said that inadequate funding was the biggest barrier to preventing data breaches, according to the study.

U.S. data-breach notification laws for health organizations are making providers more aware of their security vulnerabilities, Ponemon said. Data breaches affecting more than 500 people must be reported to the Health and Human Services Department, which posts a list of incidents on its website.

Health providers, insurers and their business partners reported 373 breaches affecting almost 18 million individuals between September 2009 and October of this year, according to the list, which is tended by the Health and Human Services Department’s Office of Civil Rights.

In  fact, the Privacy Rights Clearinghouse listed the now notorious Sutter Health data breach as one of the largest of the year. Amber Yoo, the organization's Communications Director recently wrote in the California Progress Report, "Sutter Physicians Services (SPS) and Sutter Medical Foundation (SMF) (Nov. 16) - A company-issued desktop computer was stolen from SMF's administrative offices in Sacramento, California, during the weekend of October 15th. Although the data was password protected, it was not encrypted. Approximately 3.3 million patients whose health care provider is supported by SPS had their names, addresses, dates of birth, phone numbers, email addresses, medical record numbers and health insurance plan name exposed. An additional 934,000 SMF patients had dates of services and description of medical diagnoses and/or procedures used for business operations, bringing the total to 4.2 million patients. At least two lawsuits have been filed against Sutter Health. One class-action suit alleges that Sutter Health was negligent in safeguarding its computers and data, and then did not notify the millions of patients whose data went missing within the time required by state law....The security lapse occurred on two levels: both the data itself (being unencrypted) and the physical location (stored in an unsecure location). Although no Social Security numbers or financial information were apparently exposed, all the data elements needed for medical identity theft were included in the stolen records.

In addition, Amber points out another massive breach, writing, "Nine data servers containing sensitive health information went missing from Health Net's data center in Rancho Cordova, California. The servers contained the personal information of 1.9 million current and former policyholders, compromising their names, addresses, health information, Social Security numbers and financial information. Not only was Health Net the first massive medical breach of the year, but the company waited three months before notifying affected individuals. The servers were discovered missing in January, but policyholders were not notified until March. The breach highlights the importance of timely notification."

The good news, as if there is any in all this, is that California recently implemented one of the strongest data breach notification laws in the country - one we here at the Consumer Federation of California worked hard to pass the legislature and convince Governor Brown to sign. Now, thanks to the law, any breached entity must submit their notice letters to the California Attorney General. The AG's office will then post the letters on its website. In addition, the notifications sent to individual who's private information was breached will be clearer, more detailed, with specific recommendations for what to do no next, including who to call.

As for the larger issue of electronic health records, as these breaking news stories make clear, time is running out, because states across the country, including California, are working to implement such a system, with consumer privacy perhaps the paramount area of dispute.

We know such a system will save money and improve health care (though how significant these improvements and savings will be is still in question), but what remains contentious - and rightly so - is the intrinsic threat a massive electronic database containing our most personal medical records poses to individual privacy and security.

When it comes to the issue of e-health records certainly one question the consumers should ponder is "Where is my data and who has access to it and for what purposes?" Or perhaps even more importantly, "can my private data be traced back to me personally and sold to others?"

But as it stands today, there still aren't uniform standards for electronic medical records. Yes, there are some protections in the Health Insurance Portability and Accountability Act of 1996, as well as some in the stimulus bill. But key protections are still absent, and state laws often conflict with federal ones.

For instance, the federal law on the books only require that patients are notified when their information was disclosed in the course of treatment but not how it was used. As a result, the patient will not know which hospital personnel looked at the information or for what purpose.

Clearly, what is MORE than clear now is that we need MORE attention paid to privacy, not less...and that means taking a bit more time to get this new system up and running...and more care given to the rights of patients...not hospitals, not suppliers, not the government, and not any other interest looking to profit off this transition. We can have BOTH privacy and a more efficient medical records system...there's no need to sacrifice one for the other.

Federal Probe Of Carrier IQ Launched

For all the background you could ever need on the Carrier IQ controversy check out my recent posts on the subject, starting from earliest to the latest, here, here, and here.

As we know, executives from Carrier IQ — the company whose spying software was secretly installed in as many as 150 million cellphones — went to Washington to answer questions posed by the Federal Trade Commission and the Federal Communications Commission.

As I have written too many times to count on this blog, a lot of this comes down to data ownership and control - as in its OUR data and it should be in OUR control. Clearly, in the case of Carrier IQ and increasing numbers of telecom companies, third party marketers, and many more, we are seeing the invasion of individual privacy on a mass scale, including locational tracking and web search monitoring.

Now to the latest news: The FTC and FCC are looking into this matter closely...but we need and deserve more than just a questioning of Carrier IQ, but an investigation into what companies like AT&T, Sprint and T-Mobile are doing with our data as well.

With that, let's get to the Washington Posts coverage of these new inquiries:

Federal investigators are probing allegations that Carrier IQ software found on about 150 million cellphones tracked user activity and sent the information to cellphone companies without informing consumers, according to government officials...The FTC inquiry was confirmed by officials who spoke on condition of anonymity because it is private. An FTC spokeswoman said she could not confirm or deny whether the agency was investigating Carrier IQ. But a spokesman for Carrier IQ said company executives were cooperating with federal agencies.
...

Carrier IQ has said that its software is not designed to capture keystrokes or the content of messages but that in some cases that might have happened by accident. The data are intended to help improve the user experience with smartphones, the company said.

Woods said Carrier IQ chief executive Larry Lenhart and Coward met with regulators at the FTC and the FCC. The Carrier IQ executives also met with the staffs of three senators — Richard Blumenthal (D-Conn.), Christopher A. Coons (D-Del.) and Al Franken (D-Minn.) — who each had written letters of concern to Lenhart.

Three of the four major cellular providers — AT&T, T-Mobile and Sprint — have said they use the company’s software in line with their own privacy policies. A Verizon spokesman said the program is not on any of the company’s mobile devices. Apple has said it would remove Carrier IQ from i­Phones in a future software update.

Rep. Edward J. Markey (D-Mass.) asked the FTC on Dec. 2 to investigate the practices of Carrier IQ as possibly unfair or deceptive. “I have serious concerns about the Carrier IQ software and whether it is secretly collecting users’ personal information, such as the content of text messages,” said Markey, co-chairman of the Bi-Partisan Congressional Privacy Caucus. “Consumers and families need to understand who is siphoning off and storing their personal information every time they use their smartphone.”
...

While Carrier IQ executives were meeting with federal regulators, another controversy about the company erupted in the blogosphere. A response by the FBI to a reporter sparked rumors that the bureau was using the software for domestic surveillance.

The FBI denied a request for information regarding Carrier IQ filed by a reporter for MuckRock News under the Freedom of Information Act. The reporter had asked for “manuals, documents or other written guidance used to access or analyze data” gathered by any Carrier IQ program. In denying the request, the FBI said it had information but could not disclose it, because it was considered “law enforcement records.”

...

The backlash following Eckhart’s research has prompted several lawsuits against the company, mobile carriers and handset makers, including two class action lawsuits in Illinois. A class-action lawsuit has also been filed against AT&T, Sprint Nextel, Apple, T-Mobile USA, HTC, Samsung, Motorola and Carrier IQ by mobile phone customers in Delaware.

Click here to read more.

There are two particularly important developments here, one, that the FTC and FCC are looking into this controversy and two, the fact that the FBI and its potential use of this technology is being discussed and questioned. From the beginning, when I see the potential "uses" of this kind of tracking technology, in addition to the usual concerns, from stalkers to identity thieves to third party marketers, I worry about law enforcement access.

These concerns are especially resonant with me because two major battles over smart phone privacy are being fought in the courts and the California legislature as we speak: one being whether law enforcement can track individuals locations in real time without a warrant, and two, whether law enforcement can search someones smart phone, also without a warrant. Its not much of a leap to also suspect they'd want access to the treasure trove of information being collected by a technology like Carrier IQ.

As I detailed last post, there is debate now over whether Carrier IQ actually collects every keystroke, and therefore the contents of text messages and emails.  However, The Electronic Frontier Foundation has just released a technical report on Carrier IQ that concluded that "keystrokes, text message content and other very sensitive information is in fact being transmitted from some phones on which Carrier IQ is installed to third parties."

As CNET reported, "This is most likely inadvertent and "happens when crash reporting tools collect copies of the system logs for debugging purposes," Peter Eckersley, technology projects director for the EFF, wrote in the report.

"Our software does not communicate with Android and does not transmit any files up to Google or anybody else," Coward said today. "Our implementation, the only thing we are sending out is metrics ... if other information is going out of the device to Google or anyone else it has nothing to do with Carrier IQ."

"There should not be personal information written into the Android log files. Applications can get ahold of them, on the one hand, which is not good," he continued. "We've implemented a new procedure as we qualify our software on devices (and) we check that...We saw the Android log file may be receiving messages from our software but ... also from other applications too. So it's a generic issue here with regard to Android log files that the industry needs to address and we point that out in the report." 

Clearly there are a lot more questions in need of answers. 

As the Free Press noted in a recent action alert, "Mobile phones are the new frontlines in the battle over our right to communicate." As for next steps, I'm also in agreement with Free Press in that its time Congress takes a closer look at the role of companies like AT&T, T-Mobile, and Sprint - particularly as it relates to what's being done with our data.

Does Carrier IQ Record Text Messages and Emails?

There are now conflicting analyses regarding whether Carrier IQ's software (that was kept secret from consumers) goes as far, and captures as much, information as initially suspected. Now, this is NOT to say there aren't all kinds of questions that remain unanswered, nor is this to say that there still aren't deeply disturbing components to this story (See my past two posts for a complete detailing of this continually evolving story).

But, we now have heard from Carrier IQ's Vice President and a Linux kernel hacker who just completed his own analysis of the software, and they say its incapable of recording keystrokes or "perusing SMS messages and e-mail correspondence."

These assertions contradict the initial claims made by Android developer Trevor Eckhart (and demonstrated on video). Before I get to them, let's be clear on some of the real concerns and questions that remain, including: what the company does with all the data they've been collecting (even if they can't read emails and texts...they still know your searches, location, and app purchases...and more), what kinds of data it collects, why the software was buried so deep within the operating system and without consumer knowledge (or choice), what devices have this code installed, what carriers are aware of it (and what they might be doing with it, if anything), whether government/law enforcement has had any role in this process (including requests for access to data), and many more.

With that said, let's get to the latest analysis of this code from Cnet:

He found that contrary to what a slew of initial -- and erroneous -- reports claimed, the Carrier IQ software is not a keylogger and "cannot" be configured as one. "CarrierIQ cannot record SMS text bodies, web page contents, or email content even if carriers and handset manufacturers wished to abuse it to do so," Rosenberg concludes. "There is simply no metric that contains this
information."

...

Rosenberg determined that Carrier IQ can, as a YouTube video by Trevor Eckhart indicated, record what digits are pressed in the dialer application. But it "cannot record any other keystrokes besides those that occur using the dialer," wrote Rosenberg, who says he has no affiliation or relationship with Carrier IQ.

...

Rosenberg suggested that carriers need to let consumers "opt out of any sort of data collection," that there should be "more transparency on the part of carriers in terms of what data is being collected from users," and that there "needs to be third-party oversight on what data is collected to prevent abuse." 

...

It's true that carriers already know what URLs you're visiting when you use their network--meaning that, in many cases, Carrier IQ can be configured to send them data they already have. Privacy concerns arise when a list of URLs is stored on the device and accessible to forensic analysis, when a list of URLs visited on a Wi-Fi network is transmitted, or when encrypted HTTPS URLs are leaked.

Sprint and AT&T, which have acknowledged they use Carrier IQ, have not elaborated on what options they have chosen to enable, except to indicate that the use is consistent with their privacy policies. 

Click here to read more.

Network World has a lot more:

In his blogpost, a table lists the metric ID, the metric itself, the data sent, and the "situation" that triggers the metric:

* browser page render event

* location event, which can use GPS or other location data
* HTTP request sent, or response received (the URL, request type, content length, and so on but not page contents)

* network state changes, sending an "internal identifier"

* a range of telephony and radio events (such as a dropped call,  service issues, and so on)

* hardware event, sending data such as voltage, temperature, battery level

* key presses, but only in the phone dialer application

* miscellaneous GUI state changes, such as battery state

* starting or receiving a call or a failed call, which sends CallerID, state, and phone number

* application events such as a stopped app, or a new app, sending the application name

* questionnaire event, used when Carrier IQ is configured to present the user with a service questionnaire

* SMS message received or sent, which includes message  length, phone, number, status, but no text from the body of the message.

...

HTC's failure to disable the display of the debug statements constitutes a legitimate potential security threat to user information. These are a "risk to privacy," Rosenberg says, and HTC should mitigate that risk by disabling these debugging messages. But it's not a risk created by the CIQ software or the data it is able to collect.

In his blogpost, Rosenberg spells out what the deconstruction of the CIQ code reveals about how the application actually works, as revealed by the metrics enabled for his Samsung phone. 

"Taking this information into account, all of the data that is potentially being collected supports Carrier IQ's claims that its data is used for diagnosing and fixing network, application, and hardware failures," Rosenberg concludes. "Every metric in the above table has potential benefits
for improving the user experience on a cell phone network. If carriers want to improve coverage, they need to know when and where calls are dropped. If handset manufacturers want to improve battery life on phones, knowledge of which applications consume the most battery life is essential."

...

Nonetheless, Rosenberg is critical of the way the Carrier IQ application has been implemented in the carrier-manufacturer relationship. End-users should be able to opt out of any sort of data collection; carriers should be clearer and plainer about what data is being collected from the phone, and why; and "there needs to be third-party oversight on what data is collected to prevent abuse."

Finally, he says, the "legality of gathering full URLs with query parameters and other data of this nature should be examined."

Click here to read more.

Due to time constraints, I'm going to have to discuss the interview with the VP of Carrier IQ in a future post, but you can check it out here...its very comprehensive. What I will include is the conclusion reached by reporter Sean Hollister after conducting the interview (who's been all over this story from the outset):

Carrier IQ claims that it is not the source of the insecure log files discovered on HTC devices. Other technical details — including how exactly Carrier IQ stores and transmits its data and how carriers utilize it — are both comforting and disquieting by turns. Although more secure and less nefarious than originally feared, there may still be ample opportunity for malware to access its data. At the very least, how Carrier IQ’s software is implemented on various devices needs wider scrutiny from both security experts and regulators.

...the biggest takeaways are that Carrier IQ and its client operators have logical reasons for taking most of the information they do — and mind you, many forms of personal data, like the contents of SMS and emails, aren’t being tracked at all, and no data is tracked in real time — but by the same token, it feels like there may be a lack of oversight when it comes to mobile privacy.

We are slowly beginning to see a clearer picture of what this all means and what the potential threats to privacy really are...at this point, I think its safe to say that the Carrier IQ software isn't as outwardly nefarious as initially suspected, and perhaps erroneously claimed by Mr. Eckhardt. On the other hand, this in no way should dissuade anyone from demanding more questions be answered - particularly how this code, with this kind of tracking capabilities, EVER could have been slipped into these products without the consumer's knowledge or ability to opt-out (let alone opt-in). This, in itself, is a dangerous precedent.

I think its also important to point out that even the VP of Carrier IQ and the Linux hacker were clear in their support for a consumers right to opt-in to such tracking, as well as their dismay they weren't even given this choice, and the code was kept secret.

Clearly, this entire episode, with its many questions still unanswered, points to the need for GREATER consumer control over data, which could be achieved, at least partially, through a Do Not Track mechanism. Another takeaway from this whole controversy is the need for improved transparency.

Jonathan Zittrain, Harvard Law School professor and cofounder of the Berkman Center for Internet and Society, has an idea for addressing this concern, stating, "It would be good to have some form of auditing function built into our devices. The auditing function can be implemented by Apple and by handset makers through Android. Make it part of the 'About' tab. And it would show with whom the phone has been communicating and the sorts of things it has been sending."

I will continue to follow this story here...

Latest Carrier IQ Revelations: Franken Steps Up, 141 Million "Products" Have Code

This story is moving fast so I want to get you the latest news regarding the revelations that a secret code (Carrier IQ) was discovered that allows your smart phone (and who knows what else) to not only be tracked at all times, but in fact, every key stroke made is monitored and stored – including the content of text messages. And perhaps most incredible, the ability to opt-out, let alone opt-in, of this kind of “super surveillance” was not made available, as the fact that this code even existed, or was being utilized, wasn’t even shared or made known to the consumer.

Now we discover that since the Carrier IQ story broke last week, we’ve learned that the company’s spying technology is present on 141 million phones, including Androids and iPhones and possibly models made by BlackBerry, Nokia and other manufacturers.

As I touched on last post, this data collected by Carrier IQ represents a virtual treasure trove of information for those seeking to access it, particularly advertisers and the government. And we know how willing the telecom industry was to give up such private information to the government in the past, just as we know how the government used the Patriot Act, not to track and catch terrorists, but rather, to target peace protesters (think Occupy) and suspected drug users/dealers.

But government desire to access this data aside, what about the likelihood that a corporate entity is tracking/recording EVERYTHING you do (i.e. where you shop, when you shop, while you shop, what you search for on the internet, who you talk and text, and what you say and write), then turning that information into a detailed digital profile (98% of Google's profits come from advertising) that they can then sell – for huge profits - to third party advertisers so they can market their products to you more effectively??? 

Thankfully it didn’t take long for privacy stalwart, Senator Al Franken, to demand answers, stating, “Consumers need to know that their safety and privacy are being protected by the companies they trust with their sensitive information. The revelation that the locations and other sensitive data of millions of Americans are being secretly recorded and possibly transmitted is deeply troubling. This news underscores the need for Congress to act swiftly to protect the location information and private, sensitive information of consumers. But right now, Carrier IQ has a lot of questions to answer.” 

In his letter to Carrier IQ President and CEO Larry Lenhart, he writes, “I am very concerned by recent reports that your company’s software—pre-installed on smartphones used by millions of Americans—is logging and may be transmitting extraordinarily sensitive information from consumers’ phones, including:

•           when they turn their phones on;
•           when they turn their phones off;
•           the phone numbers they dial;
•           the contents of text messages they receive;
•           the URLs of the websites they visit;
•           the contents of their online search queries—even when those searches are encrypted; and
•           the location of the customer using the smartphone—even when the customer has expressly denied permission for an app that is currently running to access his or her location.

It appears that this software runs automatically every time you turn your phone on.  It also appears that an average user would have no way to know that this software is running—and that when that user finds out, he or she will have no reasonable means to remove or stop it. 

He goes on to ask a series of pointed questions in which he demands answers by December 14th, including (among many), “Is that data transmitted to Carrier IQ?  Is it transmitted to smartphone manufacturers, operating system providers, or carriers?  Is it transmitted to any other third parties? If Carrier IQ receives this data, does it subsequently share it with third parties? With whom does it share this data?  What data is shared?”

Read the whole list of questions...impressive...disturbing. So let's all mark our calendars...as I'm eagerly awaiting answers to them.

As I also pointed out last post, these revelations reaffirm the need for an opt-in, Do-Not-Track mechanism available to all consumers, whether online or using something like a smart phone. I would also encourage readers to sign and send the Free Press's action alert: “Tell Congress and the Department of Justice: My mobile phone is mine, and I have the right to be free from being spied on. “    

New Smart Phone Privacy Revelations Uncovered

I wasn't planning on following up my last post entitled "Smart Phones and Privacy" with yet another post about the technology and some of its privacy implications. But, after reading this headline "Your Smartphone Is Spying on You"- on the front page of Yahoo no less -  I feel I have little choice.

I'm not going to go over what I just did in my last post, but suffice it to say, I detailed a number of concerns with the technology, including government/law enforcement locational tracking without a warrant or even probable cause as well as law enforcement searching peoples smart phones (also without a warrant).

The context, particularly in light of growing Occupy protests, is important here. We should be wary of giving up more and more information - including location, text messages, and internet searches, to ANYONE, let alone when considering it could fall into the hands of forces that may be seeking to stifle dissent and intimidate (as well as break the law and violate the constitution).

But this article takes the cake!! I know this sounds incredibly Orwellian, but a secret code (Carrier IQ) has been discovered that allows your smart phone to not only track you, but take and keep every keystroke you make - even the content of your text messages. And perhaps most incredible, the consumer is not even given the ability to opt-out, let alone opt-in!). In fact, the consumer doesn't even know this code is in the phone. 

Such information represents a treasure trove of information for all kinds of interests desiring access to it, particularly advertisers and the government. And of course, we know how willing and ready the telecom industry has been to do anything our government wants despite the rights and desires of their customers.

But government aside, what about the basic right to not have EVERYTHING you do recorded (i.e. where you shop, when you shop, while you shop, what you search for on the internet, who you talk and text, and what you say and write), and then have that information turned into a detailed digital profile of you (98% of Google's profits come from advertising), and then have that profile sold on the market for HUGE profits to advertisers so they can market their products to you more effectively??? Its more than our right to privacy that is being violated...its the very idea that we "own" our own private information...and that others can't take it and profit off it without our consent.

So there are two VERY disturbing aspects of this story, from the treasure trove of personal data it offers to a law enforcement, surveillance state apparatus that is becoming increasingly authoritarian, to the "commodity" we, and what we do, has become - but without our control or right to privacy.

If these revelations don't demand an opt-in, Do-Not-Track mechanism available to all consumers, whether online or using something like a smart phone I don't know what does. We should be looking for Congress, and state houses to take this issue up, and start MANDATING that such mechanisms are provided. Perhaps in that sense, this discovery will help this important cause, and legislation that will take it on.

So let's get straight to the article in the Atlantic Wire because I'm practically speechless. Adam Clark Estes reports:

The reason for this invasive Android app seems reasonable enough at face value. Even though it's on most Android, BlackBerry and Nokia devices, most users would never know that Carrier IQ is running in the background, and that's sort of the point. Described on the company's website as software to gain "unprecedented insight into their customers' mobile experience," Carrier IQ is ostensibly supposed to help mobile carriers and device manufacturers gather data in order to improve their products. Tons of applications do this, and you're probably used to those boxes that pop up on your screen and ask if you want to help the company by sending your data back to them. If you're concerned about your privacy, you just tap no and go about your merry computing way. As security-conscious Android developer Trevor Eckhart realized, however, Carrier IQ does not give you this option, and unless you were code-savvy and looking for it, you'd never know it was there. And based on how aggressive the company has been in trying to keep Eckhart quiet about his discovery, it seems like Carrier IQ doesn't want you to know it's there either. … 

This week, Eckhart fired back with a 17-minute long video showing in painstaking detail how much data CarrierIQ collects, effectively undercutting the company's denial. It was even logging contents of text messages! Wired posted the video on Tuesday night and cemented CarrierIQ's status "as one of nine reasons to wear a tinfoil hat." The magazine explains how CarrierIQ even undercuts other companies' security measures...

…

Tracking is creepy. In an Orwellian kind of way, it makes people nervous -- especially Americans -- that the government or the corporations or the system is closing in on them and stealing their freedom. Of course, not everybody feels so strongly about privacy, but as long as you can opt out, it should be fine. This seems be where privacy agnostics as well as advocates both get concerned. Some people don't mind being tracked, but nobody wants to be tricked. Last week, Sen. Charles Schumer spoke out about a program at some malls in Virginia and Southern California that were anonymously tracking shoppers' movements by tracking their cell phone signals, and the only way to opt was by not going to the mall. Schumer did not approve. "Personal cell phones are just that -- personal," the New York senator said in a statement. "If retailers want to tap into your phone to see what your shopping patterns are, they can ask you for your permission to do so." The CarrierIQ software is not dissimilar to the shopper tracking program. In fact, it's arguably worse since it follows you everywhere. In the age of social media, everybody is becoming increasingly aware of and often angry about the amount of private data companies are scooping up with or without their consent. 

This week, the Federal Trade Commission and Facebook came to an agreement that the social network must make all of their new programs opt-in so as not to break the law by violating users' privacy. Even Mark Zuckerberg admitted in a sincere-sounding blog post that his company had "made a bunch of mistakes" on the privacy front in the past. He went on to detail how "offering people control over the information they share online" was a top priority. This is Mark "Privacy Is Over" Zuckerberg we're talking about here. With Facebook reportedly building its own mobile phone platform, wouldn't it be super ironic if people started defecting from the Android army and switching to the Facebook phone in the name of privacy? 

Your move, Google.

Here's the video:

So what to do? Thankfully, it didn't take long for the Free Press's "Save the Internet" campaign to jump on this today and provide us with an opportunity to let Congress and the Justice Department know that we don't appreciate being spied on. Here's some of the language from the action alert (I'll skip the stuff that repeats what I've already included in today's post), with the link to the action page...interestingly, their experts ALSO made the connection I did this reeks of like "wiretapping".

Free Press: Tell Justice Department and Congress You Don't Want to Be Spied On!

Are you being watched? A researcher just discovered a hidden application that records what millions of people write, view and search for on their mobile phones. It sends all of that data to a company no one’s ever heard of. And we have no idea what that company is doing with our information.1

Sounds like 1984. But it’s happening in 2011. Earlier today, Sen. Al Franken demanded answers from the company, Carrier IQ, calling its technology "deeply troubling." We now need a full investigation.2

Tell Congress and the Department of Justice: My mobile phone is mine, and I have the right to be free from being spied on. 

The fact that one company is secretly storing away the data of millions of mobile phone users — without our knowledge, and with no way for us to opt out — is just incredible. You’d expect this sort of thing from the Chinese government — not from a company operating in the present-day U.S.

Take action now to stand up for your mobile freedoms.

This is not only a privacy problem. It’s a democracy problem. Mobile phones have become the ultimate democracy devices. Activists from Cairo to New York City to Los Angeles have used their phones to broadcast images of pepper-spraying cops, handcuffed journalists and squares full of protesters. We must ensure that the most important movements of our time aren’t compromised by data spies with little regard for our free speech or privacy.

Tell Congress and the Department of Justice: Protect mobile phone users from data spies. Investigate Carrier IQ. 

Law professor and former Department of Justice attorney Paul Ohm says that Carrier IQ’s snoopware “is very likely a federal wiretap,” which means that the company could be prosecuted for breaking federal law.4 “Consumers need to know that their safety and privacy are being protected by the companies they trust with their sensitive information,” Sen. Franken said. “ … Carrier IQ has a lot of questions to answer.”

We agree. Let’s get some answers.