Sean Hollister

“Now the malware scanner’s going to run, and it’s going to look and see if the app you were trying to install is malicious,” Professor Mickens tells the jury.

Mickens says it’s Google’s most important protection against bad apps.

Judge Donato interrupts to ask: “Could all those other steps be skipped and a user go directly from ‘I’d like to install it’ to the GPP stage?”

Mickens won’t go quite that far: “I don’t think they should be skipped.” He promises to come back to that point in a couple of slides.

Judge Donato interrupts: “If you’re downloading an app from the Play Store, do you see the same warning?”

“No, you do not see this warning,” says Mickens. He continues:

“It’s the same app, it’s just Wikipedia, it’s not like the potential nature of its maliciousness has changed... that’s a problem, and that’s why it’s important to look at these warning screens.”

That’s core to Epic’s case — it wants the court to decide that Google has one monopoly on Android app distribution, and another on in-app payments.

Google already has both automated and human review mechanisms on and off Play to help with this, he says.

Yet even on Google Play, some scam apps get through.

It’s a little opaque, but I think he’s saying Google knows it needs to provide security outside the Play Store, already attempts to do this, and could do more.

There’s also a Compatibility Definition Document and a Compatibility Test Suite to make sure phones are compliant.

“User Apps”

“AOSP Middleware” and “GMS Middleware” and “OEM & SOC Middleware”

“AOSP Kernel”

and at the bottom, “Hardware.” The AOSP and middleware items are all within an “Operating System” bracket.

He says that based on a review of Google’s source code, documents produced for the court, public statements, and academic articles, Google has “under-resourced its security monitoring of off-Play distribution channels” and “has the ability to identify and review apps at the point of installation.”

We’ve heard Google’s security boss suggest the latter isn’t possible: “We can’t make the internet safe.”