Reps. G.K. Butterfield (D-N.C.) and Henry A. Waxman (D-Calif.) issued the letter to Cook on Wednesday, questioning whether Apple's iOS application developer policies and practices adequately protect consumer privacy.
The letter follows a controversy that arose earlier this month when social networking application "Path" was revealed to be uploading users' address books to its servers without asking for permission. The activity was discovered and publicized by developer Arun Thampi.
Last week, Path offered a public apology for its activities, and modified its software so that users could opt out of the address book upload. The company said the data was used to streamline the application's "Add Friends" feature, and not to collect sensitive information.
The letter from Waxman and Butterfield has requested Apple's response to nine questions. They pertain to user security and how Apple defines whether an application is suitable for users to download to their iPhone.
The government questioning is similar to a separate incident from last year, when a U.S. senator and congressman pushed Apple for answers about a location database controversy that arose. The issue gained attention after security researchers discovered a database file in iOS 4 that stored a large amount of location data representing cellular towers and Wi-Fi hotspots accessed by an iPhone.
Apple explained that the location database file was intended to improve location tracking services on the iPhone, but the size of the file grew to be large because of a programming glitch. The issue was quickly resolved with a software update.
The latest issue is not a result of a glitch in the iOS operating system, but a feature that Apple allows to developers that could potentially be abused. The congressmen are concerned that other applications are uploading users' address book information without their knowledge. The full letter is included below:
February 15, 2012
Mr. Tim Cook
Chief Executive Officer, Apple Inc.
1 Infinite Loop
Cupertino, CA 95014
Dear Mr. Cook:
Last week, independent iOS app developer Arun Thampi blogged about his discovery that the social networking app âPathâ was accessing and collecting the contents of his iPhone address book without ever having asked for his consent. The information taken without his permission â or that of the individual contacts who own that information â included full names, phone numbers, and email addresses. Following media coverage of Mr. Thampiâs discovery, Pathâs Co-Founder and CEO Dave Morin quickly apologized, promised to delete from Pathâs servers all data it had taken from its usersâ address books, and announced the release of a new version of Path that would prompt users to opt in to sharing their address book contacts.
This incident raises questions about whether Appleâs iOS app developer policies and practices may fall short when it comes to protecting the information of iPhone users and their contacts.
The data management section of your iOS developer website states: âiOS has a comprehensive collection of tools and frameworks for storing, accessing, and sharing data. . . . iOS apps even have access to a deviceâs global data such as contacts in the Address Book, and photos in the Photo Library.â The app store review guidelines section states: âWe review every app on the App Store based on a set of technical, content, and design criteria. This review criteria is now available to you in the App Store Review Guidelines.â This same section indicates that the guidelines are available only to registered members of the iOS Developer Program. However, tech blogs following the Path controversy indicate that the iOS App Guidelines require apps to get a userâs permission before âtransmit[ting] data about a userâ.
In spite of this guidance, claims have been made that âthereâs a quiet understanding among many iOS app developers that it is acceptable to send a userâs entire address book, without their permission, to remote servers and then store it for future reference. Itâs common practice, and many companies likely have your address book stored in their database.â One blogger claims to have conducted a survey of developers of popular iOS apps and found that 13 of 15 had a âcontacts database with millions of recordsâ â with one claiming to have a database containing âMark Zuckerberg's cell phone number, Larry Ellisonâs home phone number and Bill Gatesâ cell phone number.â
The fact that the previous version of Path was able to gain approval for distribution through the Apple iTunes Store despite taking the contents of usersâ address books without their permission suggests that there could be some truth to these claims. To more fully understand and assess these claims, we are requesting that you respond to the following questions:
1. Please describe all iOS App Guidelines that concern criteria related to the privacy and security of data that will be accessed or transmitted by an app.
2. Please describe how you determine whether an app meets those criteria.
3. What data do you consider to be âdata about a userâ that is subject to the requirement that the app obtain the userâs consent before it is transmitted?
4. To the extent not addressed in the response to question 2, please describe how you determine whether an app will transmit âdata about a userâ and whether the consent requirement has been met.
5. How many iOS apps in the U.S. iTunes Store transmit âdata about a userâ?
6. Do you consider the contents of the address book to be âdata about a userâ?
7. Do you consider the contents of the address book to be data of the contact? If not, please explain why not. Please explain how you protect the privacy and security interests of that contact in his or her information.
8. How many iOS apps in the U.S. iTunes Store transmit information from the address book? How many of those ask for the userâs consent before transmitting their contactsâ information?
9. You have built into your devices the ability to turn off in one place the transmission of location information entirely or on an app-by-app basis. Please explain why you have not done the same for address book information.
Please provide the information requested no later than February 29, 2012. If you have any questions regarding this request, you can contact Felipe Mendoza with the Energy and Commerce Committee Staff at 202-226-3400.
Henry A. Waxman
Subcommittee on Commerce, Manufacturing, and Trade
cc: Dave Morin
Path, Co-Founder and CEO