1 Smartphones

Apple announced in January 2021 that it had an install base of 1 billion iPhones and a total of 1.65 billion active devices (1). In May 2021, Google announced at its (virtual) I/O Developer Conference that Android was running on 3 billion active devices, at a growth rate of about 500 million new devices every two years (2).

In September 2011—a decade prior to the 2021 Apple and Google announcements—82.2 million Americans own smartphones, 70% of which are either iPhones or Android phones (3). 64.2 million U.S. smartphone users accessed social networking sites or blogs on their mobile devices at least once in December 2011 (4). March 2012 marked the tipping point when a majority (50.4%) of U.S. mobile subscribers owned smartphones (5). A decade later in February 2021, the share of Americans that own a smartphone jumped to a whopping 85%. “The vast majority of Americans – 97% – now own a cellphone of some kind. The share of Americans that own a smartphone is now 85%, up from just 35% in Pew Research Center’s first survey of smartphone ownership conducted in 2011” (6).

In fact, a staggering 1.4 billion smartphones were sold worldwide in 2020, and an estimated 1.5 billion smartphones would be shipped in 2021 due to 5G adoption (7). Smartphones are the most prevalent portable social networking devices among some 4 billion Internet users (8).

In June 2011, a Harris Interactive survey of 2,510 Americans aged 18 and older showed that people are so addicted to their mobile devices that a majority of them would “sneak-a-peek” at their smartphones even during work meetings by employing tactics such as “hiding their mobile device under the table or in a notebook” or “excusing themselves to go to the restroom” (9).

A U.K. study in 2012 revealed that two-thirds of people suffer from “nomophobia” – the fear of being without their phone (10). Young adults, aged 18 to 24, are more nomophobic (77%) than average. 41% of people, more men than women, have two phones or more in an effort to stay connected.

In a March 2014 article in Psychology Today , Rev. Nancy Colier wrote, “A friend of mine is separating from her husband because he cannot separate from his iPhone. … There are no more tables for two; tables for four are our most intimate encounters—two humans and two devices” (11).

Technology is trying to keep up with human’s demand. The tremendous growth of cell phone usage in the United States has created “spectrum crunch” – running out of the airwaves necessary to provide voice, text, and Internet services (12). To alleviate the problem, U.S. Congress authorized the Federal Communications Commission (FCC) in 2012 to hold voluntary incentive spectrum auctions for broadcast TV to turn in to the FCC spectrum that they are not using (13).

Mobile security, however, is seriously lagging behind. “Your cell phone is communicating completely digital; it’s part of the Internet,” said Army Gen. Keith Alexander, director of the NSA and commander of the U.S. Cyber Command. “The attack surfaces for adversaries to get on the Internet now include all those mobile devices. … The mobile security situation lags. It’s far behind” (14). Nonetheless, as security strategist Brian Contos at McAfee said, “People aren’t going to go back to driving the Model T any more than they’re going to go back to rotary telephones because of the risks on smartphones” (15).

2 Location Tracking on iPhone and iPad

In April 2011, Alasdair Allan and Pete Warden reported that iPhones and 3G iPads are regularly recording the position of the device into a hidden file called “consolidated.db” (16). The secret database file has been storing the locations (latitude-longitude coordinates) and time stamps, effectively tracking the history of movement of the iPhone and 3G iPad users for a year since iOS 4 was released in 2010. Although the data is unencrypted and unprotected on the mobile device, it is sent to Apple in an anonymous and encrypted form (17).

Apple has since learned to be more transparent and upfront with customers. On the new iPad 2 setup procedure, users can enable or disable Location Services that allow Apple’s Maps, Compass, Camera, Photos, Weather, Reminders, Safari, Find My iPad, and other apps to gather and use data indicating the user’s approximate location. The user location is determined using GPS along with crowdsourced Wi-Fi hotspot and cell tower locations. During the iPad 2 setup, Apple also asks the user for permission to automatically send diagnostics and usage data to Apple. Diagnostic data may include location information.

In March 2013, Apple acquired indoor-GPS company WifiSLAM which combines traditional GPS coordinates with smartphone tools such as accelerometers and compasses in order to pinpoint the user’s location indoors within about 8 feet. “This accuracy will change how you interact with indoor environments,” said WifiSLAM co-founder Anand Atreya. “Think about going to the supermarket. We can provide information relevant to the product right in front of you” (18). Merchants can track customers by their mobile devices’ permanent media access control (MAC) addresses.

U.S. retailers including American Apparel, Family Dollar, Home Depot, and Nordstrom have experimented with indoor GPS to track customers’ shopping behaviors (19). Some consumers have complained about the perceived invasion of privacy and decided to turn off their smartphones while shopping.

In June 2014, Apple announced at its Worldwide Developers Conference (WWDC) that the WiFi scanning in iOS 8 would use “random, locally administered MAC addresses” instead of permanent MAC addresses. The change will essentially stop retail analytics companies from tracking shoppers in stores using their mobile devices’ MAC addresses (20). However, companies can still use iBeacon, Apple’s implementation of Bluetooth Low Energy (BLE) wireless technology in iOS 7 and 8, to detect the proximity of mobile devices and send them advertisements and other information (21).

3 Carrier IQ

Not to be outdone by the iPhone location tracking software, the Carrier IQ software has been found on about 150 million cell phones including the iPhone, Android, BlackBerry, and Nokia phones (22). On November 28, 2011, security researcher Trevor Eckhart posted a video on YouTube detailing hidden software installed on smartphones that secretly logs keypresses, SMS messages, and browser URLs (23). Carrier IQ responded by saying “we’re as surprised as anybody to see all that information flowing” (24) and went on to explain that the hidden software allows network operators to “better understand how mobile devices interact with and perform on their network” by uploading diagnostic data once per day, at a time when the device is not being used (25).

Amid the public outcry over the Carrier IQ tracking scandal, a lone columnist Matthew Miller at ZDNet concurred with Carrier IQ. He voiced his opinion: “A few years back I was asked if I could install software on my phone so that a company could track my usage patterns to improve services. I accepted and was paid something like $5 to $10 a month for each phone used and sending this data. … The media has made it more malicious than it really is and I am not concerned about my phone usage at all. … It sounds to me like the software is designed to BENEFIT consumers and is not being used to track and target you” (26).

Regardless of the real intention of Carrier IQ, the truth remains that no one wants some strangers or companies snooping around behind their back. To know a person’s location over time generates a great deal of information about the person. American Civil Liberties Union (ACLU) expounded on the severity of the issue, “A person who knows all of another’s travels can deduce whether he is a weekly church goer, a heavy drinker, a regular at the gym, an unfaithful husband, an outpatient receiving medical treatment, an associate of particular individuals or political groups – and not just one such fact about a person, but all such facts” (27).

Although AT&T, T-Mobile, Sprint, and Apple have said that they use the Carrier IQ software in line with their own privacy policies, the Federal Trade Commission and Federal Communications Commission have opened an investigation into the practices of Carrier IQ as possibly unfair or deceptive (28).

While secret location tracking and Carrier IQ are in the spotlight, they are just the tip of the iceberg that deserves scrutiny. As people are communicating via voice, photos, and videos on their cell phones, the phone companies are recording the metadata that travels with them, including locations, identity of the callers and receivers, amount of data transferred, and the costs of the transmissions (29). Verizon keeps such data on their servers for 12 months, Sprint for 24 months, T-Mobile for 60 months, and AT&T for 84 months (30). Most individuals have over 1 million pieces of personal information in the possession of cell phone companies over a 4-year span. This information is analyzed and sold to other companies that handle localized advertisements and offer personalized search results. According to USA Today, AT&T, Verizon, and BellSouth have also provided this information to the National Security Agency (NSA), which reportedly aims “to create a database of every call ever made within the nation’s borders” (31).

4 Smartphone Data Collection Transparency

In the 2011 article titled “Your phone company is selling your personal data,” CNN’s David Goldman wrote that “your phone company knows where you live, what websites you visit, what apps you download, what videos you like to watch, and even where you are. Now, some have begun selling that valuable information to the highest bidder” (32). In fact, all major carriers sell their customers’ smartphone data. “An interesting transformation is happening in wireless, in which consumers are no longer customers – they’re the product,” said Dan Hays, principal in PricewaterhouseCooper’s communications and technology practice. “The trick is for operators to find out how to make money without violating their relationships and trust with their users” (33).

Under the increasing scrutiny from consumers and government officials, companies are learning to be more transparent with data collection practices (34), and giving their customers the option to opt out of their data collection. For instance, Verizon Wireless sent their customers an email on November 17, 2011 about their new privacy programs – information the phone company collects and how the phone company uses the information:

  1. 1.

    Mobile Usage Information:

    1. a.

      Addresses of websites you visit when using our wireless service. These data strings (or URLs) may include search terms you have used.

    2. b.

      Location of your device (“Location Information”).

    3. c.

      App and device feature usage.

  2. 2.

    Consumer Information:

    1. a.

      Information about your use of Verizon products and services (such as data and calling features, device type, and amount).

    2. b.

      Demographic and interest categories provided to us by other companies, such as gender, age range, sports fan, frequent diner, or pet owner (“Demographics”).

The information is used by Verizon Wireless and shared with other companies to create business and marketing reports, as well as to make mobile ads more relevant for the consumers. As a consolation, Verizon Wireless assures their customers, “Under these new programs, we will not share outside of Verizon any information that identifies you personally.” In addition, consumers are given a chance to opt out of the new privacy programs within 45 days of receiving the email notice.

We are witnessing more transparency in business practices today. In November 2011, two U.S. shopping malls (Promenade Temecula in California and Short Pump Town Center in Virginia) announced that they would track shoppers’ movements throughout the premises by monitoring the signals from their cell phones (35). The collected data monitored how the shopping crowds moved from store to store, and how long they lingered in any given shop. Consumers could opt out by turning off their cell phones. After an intervention from a U.S. Senator who raised privacy concerns, the shopping malls ceased their monitoring programs (36).

U.S. retailers including J.C. Penney and Home Depot are reportedly also considering using the same cell phone technology to track their customers (37). Meanwhile, Neiman Marcus hosted its second in-store foursquare challenge in March 2012. For a chance to win a coffee table book, participating customers checked in using the location-based social site foursquare to a Neiman Marcus location on March 31 using their smartphones (38). At Walgreens, customers checking in to the drugstore via a foursquare or Facebook mobile app would receive e-flyers and e-coupons (39).

5 Always On

Some may say that smartphones are liberating and convenient anytime and anywhere, but others may vehemently disagree when “anytime and anywhere” becomes “all the time and everywhere.” Social critic Andrew Keen declared in a February 2012 CNN article that our mobiles have become Frankenstein’s monster: “As always, Mobile World Congress, the world’s largest mobile telephone extravaganza, is being held in Barcelona this year. But it really should be held in Geneva, close to where Mary Shelley created Frankenstein. That’s because, with our increasing addiction to our mobile phones, we are in danger of creating a monster that we are less and less able to control. … These hardware companies will articulate the benefits of their technology in terms of personal empowerment. But the real truth behind these increasingly intelligent devices is personal disempowerment” (40).

Keen’s point of view is manifested in the mobile phone users’ reactions to the April 2012 release of the photo-sharing Instagram app on Android devices. With 14 million users, Instagram was awarded the 2011 iPhone App of the Year (41). A crossbreed between Facebook and Twitter, Instagram enables sharing and comments on friends’ pictures as well as allows people to follow other users. When the iPhone-exclusive app was made available for Android, an insidious tweet war broke out between iPhone and Android users. CNET associate editor Emily Dreyfuss remarked, “Which smartphone we own has begun to inform our identities. In our gadget-filled lives, our phones have become another way for us to organize ourselves into separate groups, to label each other as ‘other’ and ‘apart.’ Our tech has come to define us” (42).

Since the $1 billion acquisition by Facebook, Instagram has hit 1 billion monthly users in December 2020 (43). To allow for user control of online privacy, Facebook launched Instagram Direct in December 2013 to let users send text, video, and photo messages to each other privately on Android and iPhone (44).

Regardless of Android or iPhone, smartphone addiction can be a nuisance in public. In March 2012, a Philadelphia bus rider named Eric was so annoyed by loud phone calls on the bus that he decided to jam the cell phone signals using an electronic jammer (45). “A lot of people are extremely loud, no sense of just privacy or anything. When it becomes a bother, that’s when I screw on the antenna and flip the switch,” said Eric before realizing that cell phone jamming is illegal in the United States. Apparently, many share Eric’s sentiment. During the weekend after Eric appeared on NBC10 News, “cell phone jammer” became one of the top 10 searches on Google Trends (46). Jokingly perhaps, controversial CNN contributor Bob Greene suggested bringing back the phone booths, or phoneless booths to be precise, in public places around the country for people to make their private cell phone calls (47). No one believes that the idea would work. Stationary phone booths simply do not sit well with the consumer’s need for mobility that makes cell phones so attractive in the first place.

6 Mobile Apps Privacy Invasion

Besides the carrier-installed apps on cell phones, there are plenty of utility and social media apps that users may download onto their cell phones. With an install base of over 1 million people, Path for iPhone and Android is one such free app that is “the smart journal that helps you share life with the ones you love” (48). In February 2012, Arun Thampi in Singapore discovered that Path uploaded the entire iPhone address book (names, email addresses, phone numbers, etc.) to its servers without seeking permission from the user (49). Within a couple of days, Path co-founder and CEO Dave Morin issued a public apology and released a new version of the app that asks the user for permission to upload the address book from iPhones and Android devices (50).

It turns out that Path is not alone. Twitter also acknowledged in February 2012 that when a user taps the “Find friends” feature on its smartphone app, the company downloads the user’s entire address book, including email addresses and phone numbers, and keeps the data on its severs for 18 months (51). Unlike Path, Twitter did not apologize, and the company simplify clarified the language associated with Find Friends: Instead of “Scan your contacts,” it would display “Upload your contacts” for iPhones and “Import your contacts” for Android devices in order to inform the users that the entire address book would be shared with Twitter.

Path and Twitter mobile apps have become emblematic of disrespect for individual privacy in the digital information age. It is conceivable that many more smartphone apps are collecting private information without the knowledge of the users. Facebook, Flickr, and other mobile apps have been accused of reading text messages and other personal information on their installed cell phones (52). LinkedIn’s mobile app was caught collecting users’ complete calendar event, including email addresses of people users are meeting with, meeting subject, location and meeting notes (53).

Moreover, security experts have demonstrated that Apple’s iOS platform enables software developers to create mobile apps to upload all the photos, calendars, and recorded conversations on an iPhone (54). Similarly, Google’s Android platform also allows developers to build mobile apps to copy or steal photos and personal data from the Android phones of unwitting users (55).

Imagine you are talking to your friend on the phone about going to Hawaii for your next vacation. After you hang up, you start getting calls from travel agencies, sunscreen pharmaceuticals, and other companies trying to sell you something useful for your upcoming trip. There are two possible reactions to this: One, you are spooked by the invasion of privacy; or two, you are delighted by the offers of coupons and promotions without having to search for them online.

7 Mobile Apps for Children

In September 2011, the Federal Trade Commission settled its first legal action against a mobile app developer in enforcement of the Children’s Online Privacy Protection Act (56) . According to the consent decree, the iOS developer was fined $50,000 and ordered to start publishing information about the kinds of data collected via their apps and how that data is shared, to get parental consent before collecting any new data, and to delete all the data they had collected so far (57).

In February 2012, the Federal Trade Commission issued a staff report showing the results of a survey of mobile apps for children (58). The survey reveals that neither the app stores nor the app developers provide adequate information for parents to determine what data is being collected from their children, how it is being shared, or who will have access to it. The report states, “[The FTC] staff was unable to determine from the promotion pages whether the apps collected any data at all – let alone the type of data collected, the purpose of the collection, and who collected or obtained access to the data. … Although the app store developer agreements require developers to disclose the information their apps collect, the app stores do not appear to enforce these requirements. This lack of enforcement provides little incentive to app developers to provide such disclosures and leaves parents without the information they need. … Ads running inside an app may incorporate various capabilities allowing the user to do things like directly call phone numbers or visit websites appearing in the ad” (59).

In a Fall 2013 research report by Common Sense Media, 72% of children age 8 and under have used a mobile device for some type of media activity such as playing games, watching videos, or using apps, up from 38% in 2011; and 38% of children under 2 have also used a mobile device for media, up from 10% in 2011 (60).

In June 2013, President Barack Obama announced the new ConnectED initiative to connect 99% of America’s students to the Internet through high-speed broadband and high-speed wireless within 5 years (61). In response, Microsoft offered $1 billion in April 2014 to help set up public school kids with mobile devices across the country’s 14,000 public school districts (62).

There will be a lot more variety of mobile apps for children, and as a result, more scrutiny as well.

8 Android Market and Google Play

In October 2011, the Android Market had over 200,000 free and paid apps (63) available for 190 million activated Android devices around the world (64). By December 2011, Google announced that 10 billion apps have been downloaded from the Android Market (65). As of April 2021, there were almost 3 million Android apps on Google Play (66) .

With the overwhelming number of new mobile apps, Google has fallen short of ensuring that the mobile apps are tested to be free of virus and suspicious behavior (67). For example, DroidDream, a trojan rootkit exploit, was released in early March 2011 to the Android Market in the form of several free applications that were, in many cases, pirated versions of existing priced apps (68). This exploit allowed hackers to steal information such as IMEI and IMSI numbers, phone model, user ID, and service provider. Such information can be used in cloning a cell phone and using it illegally without the knowledge of the original owner. The exploit also installed a backdoor that allowed the hackers to download more code to the infected device.

In February 2012, Google revealed the use of “Bouncer” to automate the scanning of Android Market for potentially malicious software without requiring developers to go through an application approval process (69). Google reported, “The [Bouncer] service has been looking for malicious apps in Market for a while now, and between the first and second halves of 2011, we saw a 40% decrease in the number of potentially-malicious downloads from Android Market. This drop occurred at the same time that companies who market and sell anti-malware and security software have been reporting that malicious applications are on the rise” (70).

In the same report, Google also admitted, “no security approach is foolproof, and added scrutiny can often lead to important improvements” (70). Indeed, while faking an SSL certificate enabled iOS developer Arun Thampi to watch the transmitted data and thereby expose the Path app, it would be more difficult if the data was encrypted without SSL.

In March 2012, Google replaced Android Market with Google Play to offer consumers a broad spectrum of content including books (previously Google eBookstore), music (previously Google Music), movies, and mobile apps (71).

The consolidation, along with the proliferation of Android devices worldwide, seems to pay off. In Q1 2014, Google Play led the iOS App Store in downloads by approximately 45% according to App Annie Analytics (72) . The growth was driven mostly by emerging markets such as Russia, Brazil, Mexico, and Turkey.

9 Apple’s App Store

In March 2011, Apple’s App Store had over 500,000 free and paid apps (73) available for more than 100 million iPhone users worldwide (74). By July 2011, the App Store had reached 15 billion downloads (75); and by December of the same year, iOS apps had generated six times the revenue of Android apps (76).

In June 2012, Apple CEO Tim Cook announced at the annual Worldwide Developers Conference, “The App Store now has 400 million accounts – the largest number of accounts with credit cards anywhere on the Internet. Some 650,000 apps are now available. … Customers have now downloaded an astounding 30 billion apps” (77). In October 2013, Cook updated the audience at the annual iPad event that more than 1 million apps were in the App Store and over 60 billion total apps had been downloaded (78).

Despite Apple’s assertion of its tight quality control over its App Store, a scam Pokemon game reached number 2 on Apple’s App Store charts in February 2012 and raked in $10,000 before it was pulled (79). The 99-cent “Pokemon Yellow” game crashed as soon as it opened. The debacle called into question Apple’s approval process, let alone the company’s ability to ensure that the mobile apps have a privacy policy in place. The consensus in the developer community believes that “overworked Apple reviewers, with thousands of apps waiting in the approval queue, likely don’t test apps too thoroughly at first. But once they gain popularity, the Apple team gives them a closer look” (80).

On February 15, 2012, Apple announced that it will start requiring mobile apps to obtain explicit permission from iPhone and iPad users before the apps can collect and store information about user’s personal contacts. “Apps that collect or transmit a user’s contact data without their prior permission are in violation of our guidelines,” Apple spokesman Tom Neumayr told CNN (81).

In May 2013, Apple’s App Store reached another milestone by hitting 50 billion downloads (82). Six years later in 2019, App Store saw a record 204 billion downloads as consumers spent over $120 billion on apps, subscriptions and other in-app purchases (83).

10 Facebook App Center

On May 9, 2012, Facebook unveiled Facebook App Center, a clearinghouse for social apps on the web and on smartphones. Facebook’s Aaron Brady wrote in the Developer Blog, “For the over 900 million people that use Facebook, the App Center will become the new, central place to find great apps like Draw Something, Pinterest, Spotify, Battle Pirates, Viddy, and Bubble Witch Saga. … The App Center is designed to grow mobile apps that use Facebook – whether they’re on iOS, Android or the mobile web” (84).

The Facebook App Center opened in June 2012 with over 600 apps (85). Featuring mobile and web apps, the App Center gives users personalized recommendations and lets them browse through the apps that their friends are using.

A Facebook app has access to plenty of user information on Facebook, which includes the user’s name, profile pictures, username, user ID, networks, friend list, gender, age range, and locale as well as a user’s email address and birthday on some occasions (86). This makes a malicious Facebook app much more dangerous.

Back in January 2011, Facebook had disabled a feature that gave app developers access to user’s address and phone number (87). It remains to be seen whether the Facebook App Center will do a better job than the Google Android Market and Apple Store in screening their apps.