 |
|
|
| |
iPhone Dev Storm8 Sued Over User Data Harvesting Allegations
by Danny Cowan [PC, Console/PC]
|
|
| |
|
November 6, 2009
|
| |
iPhone developer Storm8 has been served with a class action lawsuit accusing the company of collecting and transmitting its users' phone numbers without prior consent or notification.
Storm8 publishers a lineup of popular multiplayer online role-playing games for the iPhone and iPod Touch, including World War, iMobsters, and Vampires Live.
The suit, filed by Washington resident Michael Turner and reported by technology blog Boing Boing, alleges that Storm8 engaged in the practice of "accessing, collecting, and transmitting without notice or consent the wireless telephone numbers of iPhone users who download Storm8's games to their iPhones via Apple's App Store."
Furthermore, it claims, "The wireless telephone numbers of users' phones are not used or necessary to play any of Storm8's games, yet Storm8 has written the software for all its games in such a way that it automatically accesses, collects, and transmits the wireless telephone number of each iPhone user who downloads any Storm8 game. It does so without disclosing this to any user before or after the fact."
Storm8 acknowledged this behavior in August, claiming that any harvesting action was the result of a bug that had been fixed in a software update.
The suit, however, says that no such activity could take place as the result of a programming error. "Storm8's characterizations of its practice of harvesting phone numbers as a 'bug' and an 'oversight' are false," the lawsuit reads. "Storm8 could not have accidentally harvested its users' phone numbers — it used very specific and specialized software code to do so."
Storm8 has not yet publicly addressed the matter.
|
| |
|
|
There is no actual proof in the information provided above to suggest that Storm8 either a) store this information, at all, or b) meant to use this information for a purpose other than providing the regular game service.
Let's not jump to conclusions and put them in front of the firing squad before hearing the full case, eh?
NSString *num = [[NSUserDefaults standardUserDefaults] stringForKey:@"SBFormattedPhoneNumber"];
It is unlikely that this could be called by mistake. In addition, this API is not supported by Apple and may cause an app to be rejected during the submission process as seen here: http://stackoverflow.com/questions/193182/programmatically-get-own-phone-number-
in-iphone-os/1685369#1685369
The HTTP headers do not include the phone number of the device unless the developer inserts it themselves. Doing so would require use of the unauthorized API listed above or prompting the user to input their phone number.
There is simply no accidental way to harvest phone numbers or user data from a phone (any phone). The data has to be specifically requested within code. In the case of games there is zero reason to ever need that information.
Jon above even lists the Api calls that would need to have been made to get the information. Web calls don't include phone data so none of Storm8's stuff would ever have needed it for testing or otherwise. I assume Apple have removed these games or will do once this news reaches their ears.
Unless the code comes from something else, i.e. another engine where they have overlooked to remove parts of the code. I agree its rather weak, however, still possible.
@Bell / Dwyer
Yes, WEB calls do include phone data in certain countries as part of HTTP headers (including phone number or a typical msisdn hash). This is not added by the device itself but by different carriers. Some carriers do this for all users and some adds it on specific URLs provided as part of CPA agreements. But this is not likely the case above neither.
It all sounds rather suspicious though.
Tarragon Allen does bring up a good point; so far, there hasn't been any actual indication that they're doing anything with the phone numbers. That said, I don't know how much the code has been audited by people who've found out about the line of code that finds the phone number.
1) is sending phone number information like this actually illegal? If it were, I'd have presumed this would be more than a civil case.
2) for any result in the civil case, I'd say that the litigant will need to prove they were "damaged" somehow. If Storm8 can show that the data wasn't stored or used in any way, I think proving damages will be difficult.