A detailed examination of HTC’s more recent Android 2.3.4 update has raised alarms that it might be tracking far more information about individual phones and users than it has before or should. A new tool that runs in RAM, Carrier IQ, is creating logs of data both on what apps and other commands they used as well as how long they spent in each area. HTC’s own terms, as checked by InfectedROM, suggest it’s not only forwarding over location and carrier information but statistics and the IMEI number, figures that could be attached to a particular phone or even individual user.
The behavior information is being uploaded by a reporting agent in the code to Amazon’s cloud storage service, which wouldn’t be used by Google itself.
HTC hasn’t responded to the claims and might not necessarily be tracking as much information as it might appear.
The shift has still raised concerns that HTC might use the approach to try and enforce warranty terms by watching customers without their explicit knowledge. With an IMEI, it could tell if a particular phone was running certain apps HTC thought might break the warranty or even to detect if a phone had been rooted, disqualifying it whether or not the hack was responsible for the bug.
Adding Carrier IQ raises concerns at the very moment at which the Senate is proposing location consent laws and other privacy measures that would prevent such information from being sent out in secret. Google for its part requires consent for most location and privacy features, but Apple is one of the few major smartphone makers to actively refuse certain kinds of tracking for privacy reasons.
