Qualcomm, a leading provider of modems and chipsets to companies including Apple and Samsung, was found to be uploading private user data, including IP addresses to a cloud attributed to the company, research from Nitrokey cybersecurity firm claimed.
The top concerns regarding the data collection were the data packages being sent to the cloud was shared using the HTTP protocol which is not encrypted, thus making them vulnerable to attacks from threat actors.
Anyone including hackers, government agencies, network administrators, and telecom operators could easily use the data to spy on users using record history and the phone’s unique ID, the research said.
The research also claimed that the data sharing with Qualcomm was not mentioned in the terms of service from Sony, the device used for the research, thereby stating that Qualcomm did this without user consent, which is against General Data Protection Regulation (GDPR) regulations.
(For top technology news of the day, subscribe to our tech newsletter Today’s Cache)
Qualcomm, in a statement to The Hindu, called Nitrokey’s report “riddled with inaccuracies”, and noted that it only collects personal information permitted by applicable law.
“As disclosed in our publicly available privacy policy, the relevant Qualcomm technologies use non-personal, anonymized, technical data to enable device manufacturers to provide their customers location-based apps and services that end users expect from today’s smartphones,” a company spokesperson said.
According to Nitrokey’s report Qualcomm’s privacy policy states that “Through these software applications, we may collect location data, unique identifiers (such as a chipset serial number or international subscriber ID), data about the applications installed and/or running on the device, configuration data such as the make, model, and wireless carrier, the operating system and version data, software build data, and data about the performance of the device such as performance of the chipset, battery use, and thermal data.
Qualcomm does not mention IP address in the data it collects, however, the company added IP addresses to the list of data points after the research was completed, Nitrokey said.
But the chipmaker’s privacy policy, reviewed by The Hindu, states that it does not permanently store Location Data with software ID or IP address, nor does it attempt to personally identify users of Qualcomm Location Service.
“To evaluate, maintain and improve system performance, your software ID and IP address are associated with your Location Data for thirty days from receipt after which time it is permanently deleted,” according to the privacy policy.
Qualcomm uses its “XTRA Service” to provide Assisted GPS for accurate satellite positions for mobile devices.
(This copy has been updated with comments from Qualcomm, and its privacy policy)
