<http://schema.org/articleBody>
"Having been the subject of \u00A0questions regarding its collection of user locations in the past, Apple has been sent a letter over concerns that developers may be accessing and storing user data on its products.\r\n\r\nHouse Energy &amp;amp;amp; Commerce Committee Chairman Henry Waxman and Commerce Manufacturing and Trade Subcommittee Chair G.K. Butterfield sent a letter to Apple on Wednesday, following complaints that the smartphone application Path was collecting address book data and storing it on remote servers without permission.\r\n\r\nWhilst Path's CEO Dave Morin apologised for the actions of its app and moved to introduce a new notification which alerts users to the fact that it would access and store contact data, it brought into question how other app developers accessed the data and how they utilised it.\r\n\r\nSensing a huge public response, Instagram silently updated its app to request data access when matching contacts.\r\n\r\nIn a letter to Apple CEO Tim Cook, the legislators state:\r\nThis incident raises questions about whether Apple\u2019s iOS app developer policies and practices may fall short when it comes to protecting the information of iPhone users and their contacts.\r\nButterfield and Waxman then quote parts of Apple's iOS developer website which states that Apple provides a comprehensive collection of tools and frameworks for storing, accessing and sharing data. It is then questioned whether Apple requires apps to request user permission before transmitting data about a user.\r\n\r\nThe letter then quotes\u00A0Dustin Curtis' article,\u00A0Stealing Your Address Book, which\u00A0states: &amp;quot;there\u2019s a quiet understanding among many iOS app developers that it is acceptable to send a user\u2019s entire address book, without their permission,&amp;quot; and a report that app developers may stores the contact details for Mark Zuckerberg, Larry Ellison and Bill Gates.\r\n\r\nUsing those pieces as a reference,\u00A0Butterfield and Waxman state that because Path was able to gain approval to the App Store, there might be truth to claims of nefarious contact list access and data storage. They state that in order to understand and assess the claims, they ask Tim Cook -- or Apple -- to answer the following questions:\r\n\r\n\tPlease describe all iOS App Guidelines that concern criteria related to the privacy and security of data that will be accessed or transmitted by an app.\r\n\tPlease describe how you determine whether an app meets those criteria.\r\n\tWhat data do you consider to be \u201Cdata about a user\u201D that is subject to the requirement that the app obtain the user\u2019s consent before it is transmitted?\r\n\tTo the extent not addressed in the response to question 2, please describe how you determine whether an app will transmit \u201Cdata about a user\u201D and whether the consent requirement has been met.\r\n\tHow many iOS apps in the U.S. iTunes Store transmit \u201Cdata about a user\u201D?\r\n\tDo you consider the contents of the address book to be \u201Cdata about a user\u201D?\r\n\tDo you consider the contents of the address book to be data of the contact? If not, please explain why not. Please explain how you protect the privacy and security interests of that contact in his or her information.\r\n\tHow many iOS apps in the U.S. iTunes Store transmit information from the address book? How many of those ask for the user\u2019s consent before transmitting their contacts\u2019 information?\r\n\tYou have built into your devices the ability to turn off in one place the transmission of location information entirely or on an app-by-app basis. Please explain why you have not done the same for address book information.\r\n\r\nButterfield and Waxman give Apple until February 29 to answer the questions, hoping to work out if Path's previous data requests are something that consumers should be worried about.\r\n\r\nIt is not known the answers to these questions will ever become clear but we will be watching for Apple's response, if it is ever made public. Congress wants clarification, as do most iOS device owners who have read reports over the unauthorised collection and storage of user data.\r\n\r\nIf you are interested in finding out which of the top iOS apps collect your data, check out our detailed report here.\r\n\r\nThe letter in full:\r\n\r\nMr. Tim Cook\r\nChief Executive Officer, Apple Inc.\r\n1 Infinite Loop\r\nCupertino, CA 95014\r\nDear Mr. Cook:\r\n\r\nLast week, independent iOS app developer Arun Thampi blogged about his discovery that the social networking app \u201CPath\u201D was accessing and collecting the contents of his iPhone address book without ever having asked for his consent.[1] The information taken without his permission \u2013 or that of the individual contacts who own that information \u2013 included full names, phone numbers, and email addresses.[2] Following media coverage of Mr. Thampi\u2019s discovery, Path\u2019s Co-Founder and CEO Dave Morin quickly apologized, promised to delete from Path\u2019s servers all data it had taken from its users\u2019 address books, and announced the release of a new version of Path that would prompt users to opt in to sharing their address book contacts.[3]\r\n\r\nThis incident raises questions about whether Apple\u2019s iOS app developer policies and practices may fall short when it comes to protecting the information of iPhone users and their contacts.\r\n\r\nThe data management section of your iOS developer website states: \u201CiOS has a comprehensive collection of tools and frameworks for storing, accessing, and sharing data. . . . iOS apps even have access to a device\u2019s global data such as contacts in the Address Book, and photos in the Photo Library.\u201D[4]The app store review guidelines section states: \u201CWe review every app on the App Store based on a set of technical, content, and design criteria. This review criteria is now available to you in the App Store Review Guidelines.\u201D[5] This same section indicates that the guidelines are available only to registered members of the iOS Developer Program.[6] However, tech blogs following the Path controversy indicate that the iOS App Guidelines require apps to get a user\u2019s permission before \u201Ctransmit[ting] data about a user\u201D.[7]\r\n\r\nIn spite of this guidance, claims have been made that \u201Cthere\u2019s a quiet understanding among many iOS app developers that it is acceptable to send a user\u2019s entire address book, without their permission, to remote servers and then store it for future reference. It\u2019s common practice, and many companies likely have your address book stored in their database.\u201D[8] One blogger claims to have conducted a survey of developers of popular iOS apps and found that 13 of 15 had a \u201Ccontacts database with millions of records\u201D \u2013 with one claiming to have a database containing \u201CMark Zuckerberg's cell phone number, Larry Ellison\u2019s home phone number and Bill Gates\u2019 cell phone number.\u201D[9]\r\n\r\nThe fact that the previous version of Path was able to gain approval for distribution through the Apple iTunes Store despite taking the contents of users\u2019 address books without their permission suggests that there could be some truth to these claims. To more fully understand and assess these claims, we are requesting that you respond to the following questions:\r\n\r\n- Please describe all iOS App Guidelines that concern criteria related to the privacy and security of data that will be accessed or transmitted by an app.\r\n\r\n- Please describe how you determine whether an app meets those criteria.\r\n\r\n- What data do you consider to be \u201Cdata about a user\u201D that is subject to the requirement that the app obtain the user\u2019s consent before it is transmitted?\r\n\r\n- To the extent not addressed in the response to question 2, please describe how you determine whether an app will transmit \u201Cdata about a user\u201D and whether the consent requirement has been met.\r\n\r\n- How many iOS apps in the U.S. iTunes Store transmit \u201Cdata about a user\u201D?\r\n\r\n- Do you consider the contents of the address book to be \u201Cdata about a user\u201D?\r\n\r\n- Do you consider the contents of the address book to be data of the contact? If not, please explain why not. Please explain how you protect the privacy and security interests of that contact in his or her information.\r\n\r\n- How many iOS apps in the U.S. iTunes Store transmit information from the address book? How many of those ask for the user\u2019s consent before transmitting their contacts\u2019 information?\r\n\r\n- You have built into your devices the ability to turn off in one place the transmission of location information entirely or on an app-by-app basis. Please explain why you have not done the same for address book information.\r\n\r\nPlease provide the information requested no later than February 29, 2012. If you have any questions regarding this request, you can contact Felipe Mendoza with the Energy and Commerce Committee Staff at 202-226-3400.\r\n\r\nSincerely,\r\n\r\nHenry A. Waxman, Ranking Member\r\n\r\nG.K. Butterfield, Ranking Member\r\n\r\nSubcommittee on Commerce, Manufacturing, and Trade"^^<http://www.w3.org/2001/XMLSchema#string>
<http://thenextweb.com/apple/2012/02/15/congress-sends-letter-to-apple-questioning-the-path-debacle-developer-data-access/>