Following up on my "So You Want a SpyPhone Eh?" piece from the 20th we get this interesting little ditty in the Wall Street Journal this morning:
In the case of Google, according to new research by security analyst Samy Kamkar, an HTC Android phone collected its location every few seconds and transmitted the data to Google at least several times an hour. It also transmitted the name, location and signal strength of any nearby Wi-Fi networks, as well as a unique phone identifier.
Much depends on what you have turned on - or not.
This is one of the places that Android is different. Here are the screens in question on my Android-powered phone:
Note the "location" tab. Here's what's inside:
And if you turn off and then back on (or on originally) the top selection, this is what displays:
Uh, see that quote up above?
Now I've gone through Android with a pretty fine-tooth comb and I've not found what this person claims is being sent - that is, the IMEI (unique to each handset) or something similar. That's not to say I couldn't have missed it - I might have. But with Android, at least allegedly (and as near as I can determine from monitoring when it powers up the data connection and sends up data unsolicited) if I have location data turned off it does not appear to be sending anything.
That is, I can quiesce data connectivity by killing any applications that run background data. Android phones contain a little icon that tells you when transmission is taking place over the wireless network. If I have those applications all turned off (e.g. email) and also have locations disabled, I've yet to observe the phone transmitting data on an unsolicited basis. My examination of the code appears to confirm this expectation and observation.
I also have, on my phone, a local navigation application (ALK's CoPilot) that runs from data on the SD card. It uses the GPS in the phone but is not reliant on a data network connection. When that is running the top bar that shows data activity remains visible, and once again, while actually driving with it enabled but locations turned off, I have yet to see the phone attempt to upload data unsolicited.
There are a few other things I've turned off and changed, however. One of them is Android's "open Wifi finder." I disable it mostly for power reasons; having the Wifi chipset scanning all the time for open networks consumes quite a bit of power. As a result I turn the "network notification" checkbox off, and when away from anywhere that is expected to have a Wifi connection available I use a home-screen widget to disable Wifi entirely.
The iPhone claim was of an entirely-different color. Dropping a "breadcrumb" log file in the phone's data directory that is effectively appended to all the time has no rational purpose for providing location data to an application right now - that is, "where are you"? Rather, it's only used for showing where you've been. Some applications (e.g. a navigator) obviously need to know where the phone is. Knowing where it was is very, very different, and attaching a user-specific identification to that data (which is always the case when the data is stored on the phone itself) just adds more insult to injury.
There is another point that people have brought up in the last couple of days as well - and that is the fact that your carrier knows where the phone is whenever it is turned on. This is true within a rather-large area of uncertainty - since the phone is connected to a tower, and it also has the adjacent-cell visibility data that is transmitted on the control channel back to the tower, a reasonable guess (within a moderately-large area) as to where the device is can be ascertained. This information is necessary for the phone network to operate - the tower has to know which adjacent towers your phone can "see" in order to perform a hand-off from one tower to the next as you move.
But that data, at the level of the carrier, has always required a subpoena to obtain. If the cops are looking for you, and they know your cellular number and that you've probably got the phone with you and it's on, they can get a warrant or subpoena and take it to the phone company. They'll get the data, and on request the cell company can perform what amounts to triangulation using the propagation delay between different cells. This won't provide a perfect location by any means, and the data available without specific triangulation is "rather" prone to error. For example, this is where Google Maps says I am right now, not using the GPS:
I assure you that I am not swimming while I write this. 
Never mind that 3200 meters is quite a distance, and what's better I'm not inside the error circle either. That is, Google got it "just a bit" wrong.
The upshot, however, is this: If either Apple or Google is collecting data linked to your specific device and thus person (e.g. your Google or iTunes account) then it appears, from the disclaimer and disclosure being provided that they are violating the law as you never consented to any such thing.
If Representative Markey is looking into the matter then I have this recommendation for him, since it appears we have conflicting data points: Someone needs to get the executives involved up in front of Congress for some sworn testimony, along with people who examine both the code (when possible, as is the case with Android) and a dump of the data stream being emitted under various conditions.
Let's get to the bottom of this, and if there have been violations of the law, either here in the US or in other nations, heads must roll.
