Seest Thou Yon Dreary Plain

Despite not wanting this to become a wholly Android-related blog, there have been yet more stirrings in this arena worthy of wild unjustified extrapolation.  The base set of data with which one may cavort seems less than sensational - a piece in the Wall Street Journal reports of a Grand Jury investigation of smart phone apps under suspicion of having "illegally obtained or transmitted information about their users without proper disclosures".  Which is bad, but hardly shocking, since theft of personal data by shady web services, while being much reviled, is a well known business model.  What makes it peculiar in this instance is the presence of popular 'net radio provider Pandora amongst the companies under scrutiny; weirdness compounded yet more by the level of skulduggery on Pandora's part described in the WSJ article:

In Pandora’s case, both the Android and iPhone versions of its app transmitted information about a user’s age, gender, and location, as well as unique identifiers for the phone, to various advertising networks. Pandora gathers the age and gender information when a user registers for the service.

This accusation was supported by preliminary investigation carried out by Veracode.  Notice that this applies to both Android and iPhone (although I believe it was not possible for Veracode to confirm the latter given Apple's closed code).  More specifically, and in addition to age and gender, Pandora also sends "android_id, connection status, network information, device brand, model, release revision, and current IP address" to advertisers.  Initial reporting that GPS data ("GPS location, bearing, altitude") was included has proven to be false (because although the app tries to send this data, it does not have access to it), but what is sent would seem to more than cover the famous 33 bits needed to identify a single human amongst 7 billion.

It is not certain that Pandora was actively complicit in this theft, since the code in question comes from "advertisement libraries compiled into the application: AdMarvel, AdMob, comScore (SecureStudies), Google.Ads, and Medialets".  Of those listed, Medialets seems to be the greediest, but all apart from Google are taking more than they should be.  So either Pandora knew and was complicit, or did not know and was negligent. 

Now for the extrapolation.  Simply, if the app of a well trusted brand like Pandora has done this, then a great many other apps are likely to be doing the same.  This conclusion makes various baseless assumptions about how the sample was chosen by the DoJ, but any situation where the best-case scenario involves a trusted service provider ripping off millions of people, it perhaps pays to be pessimistic.