HTC settles privacy case over flaws in phones

More than 18 million smartphones and other mobile devices made by HTC, a Taiwanese company that is one of the largest sellers of smartphones in the United States, had security flaws that could allow location tracking of users against their will and the theft of personal information stored on their phones, federal officials said Friday.

The Federal Trade Commission charged HTC with customising the software on its Android- and Windows-based phones in ways that let third-party applications install software that could steal personal information, surreptitiously send text messages or enable the device’s microphone to record the user’s phone calls.

The action is the first attempt by the commission to police a manufacturer of mobile devices. As smartphones and tablets become a common way for consumers to shop, bank and chat online, personal information and privacy will need to be guarded.

HTC America, based in Bellevue, Washington, agreed to settle the civil suit with the commission by issuing software patches that close the security holes, and by creating a security program that will be monitored by an independent party for the next 20 years. The FTC does not have the authority to assess fines in consumer protection cases.

“The company didn’t design its products with security in mind,” Lesley Fair, a senior lawyer in the commission’s Bureau of Consumer Protection, wrote in a blog post. “HTC didn’t test the software on its mobile devices for potential security vulnerabilities, didn’t follow commonly accepted secure coding practices and didn’t even respond when warned about the flaws in its devices.”

An HTC official said Friday that the company had already started to update its software and distribute it to users of some, but not all, of the affected phones.

“Working with our carrier partners, we have addressed the identified security vulnerabilities on the majority of devices in the U.S. released after December 2010,” Sally Julien, an HTC spokeswoman, said in a statement. “We’re working to roll out the remaining software updates now and recommend customers download them once available.”

“Privacy and security are important,” the statement added, “and we are committed to improving practices that help safeguard our customers’ devices and data.”

The trade commission charged that the security flaws resulted from HTC’s modifying the operating system software used on most of the affected phones. In the case of Android, created by Google, the system is designed to protect sensitive information and phone functions through what is known as a permission-based security model.

That requires a user, when installing an application that is not a standard part of the operating system, to be notified and to agree that the application could gain access to certain information or functions.

HTC, however, preinstalled certain apps on its phones in a way that, in addition to preventing consumers from removing them, disabled the permission-based model and allowed newly installed apps to have immediate access to personal data.

“The analogy isn’t exact,” wrote Ms. Fair of the F.T.C., “but it’s like giving a friend the combination to a safe only to find out he’s handing it over to anyone who asks.”

That security hole could, for example, let the rogue software secretly record users’ phone conversations or track their location.

Flaws in the security system could also give third-party apps access to phone numbers, contents of text messages, browsing history and information like credit card numbers and banking transactions. Those flaws also affected HTC phones that used Windows-based operating systems.

While HTC’s actions introduced numerous security vulnerabilities to its phones, a commission official said it was not clear how many users experienced illegal incursions into their phones and personal information.

©2013 The New York Times News Service