Remember the emails that AT&T sent out to people it suspected of tethering their phones without paying the exorbitant monthly fee (http://www.engadget.com/2011/03/18/atandt-tells-customers-us...)? Something tells me that this wonderful "diagnostic" information had something to do with it.

Why packet-sniff and risk legal issues when you can just look at your CarrierIQ analytics for people who opened a tethering app regularly?