Friday 19 April 2013

Android: fragmentation and security - an extraordinary coincidence

We've been reading for years that Android is suffering dreadfully from fragmentation. Barely 2% of phones out there run the latest version of the operating system, while a good 40% and more are more than two major versions old. The problem is that the OS is installed (mostly) by the manufacturers, who then sit back and do nothing, losing interest because they just want to sell new phones, not support old ones, while the telcos may push out a couple of minor revisions, if you are lucky, and then they lost interest too, because they want to sell you a new phone with a new plan.

At the same time, Google faces challenges in maintaining control over the Android platform itself, as other players (Amazon, Alibaba, maybe soon Samsung) are choosing to fork the OS and mould it to their own plans, replacing links to Google's online services with their own.

Now, completely coincidentally, the American Civil Liberties Union (ACLU) has asked the Federal Trade Commission (FTC) to investigate the lack of updates, on the basis that older versions of the operating system have known bugs that are exploitable to gain remote control over consumers' phones; thus the telcos are lacking in their duty of care to the consumer. This, I have to say immediately, is a Really Big Deal, and I guarantee that the telcos will sit up and take notice. Not only do they risk FTC investigations into their business practices, and audits of their security, they have just been put on notice that they may soon be facing class action suits from aggrieved consumers, or at least by the ACLU and others on their behalf. In effect, their operations have just become materially more risky, and that will have to be noted in their statutory filings with the SEC... the consequences just go on, and they are all unpleasant.

My guess is that as the telcos wake up to the magnitude of their exposure here, they will rush todo two things. First, they will absolutely require from the handset manufacturers that they ship the latest version of the OS on new phones. Second, they will address the problem of updates. Here, the most desirable solution would be to make it somebody else's problem: try to enforce a requirement to keep the OS up-to-date on the handset suppliers. This may or may not stick, and certainly is likely to be limited in scope, perhaps to the consumer's contract term (where the phone sold via a contract) - arguably, if the consumer supplies their own phone, updating it is the consumer's problem. If it doesn't stick however, the telcos will have to manage the updates themselves, and the consequence of that will be a rush, nay a stampede, to make sure that the handsets are easily updateable from Google's stock updates. In other words, it will be the kiss of death for supplier's custom skinning of the OS.

The effect on forked versions such as Amazon's Kindle will arguably be less, since those firms are currently bearing the support burden themselves anyway, but at least those suppliers will be on notice that their versions of Android will need to be as secure as Google's. Otherwise they may be exposed to legal risk.

At a single stroke, the ACLU has gone a long way to solving the problems that Google is experiencing from zombie versions, excessive manufacturer skinning and shell replacements, and even, to a degree, forking. What an amazing coincidence!

No comments:

Post a Comment