“You don’t say how much it would cost Google to scale up its human review teams,” says Google.
“You don’t say how much Google should charge for a centralized app review process, right?”
The phrases “Cost to Google: ???” and “Cost to developers: ???” appear on Google’s slide, which is clearly designed to suggest Mickens hasn’t thought his proposal through.
Mickens says yes.
Google’s point seems to be that his proposal would give Google more, not less control and burden, but I’m not seeing the problem with that just yet...
Now Google’s asking whether Mickens asked any OEM or developer if they’d prefer it that way. “You didn’t ask any OEM whether they’d be willing to accept this change, correct?”
Mickens says no.
Google puts a phrase up on the screen: “Would OEMs agree: ???” It appears alongside “Google carries the entire burden for Android App Review” and “Warning screen for any app not reviewed by Google.”
Google is starting with the expert’s assertion that yes, it is possible to police the internet with notarized apps.
Here are some of Mickens’ words that are being thrown back at him now, from his written report:
As a result, Google carries the entire burden for reviewing app, generating tokens, and recalling tokens if, for example, an app that initially passed the review process is later found to be malicious.
Google is narrowly asking him about his “centralized” approach, though — he also suggested a decentralized one.
We’re back from lunch. Let’s see what Google takes issue with...
Ever heard of a “signed” application? Mickens says Google has the technology to do the same on Android, either by itself, or by approving third-party reviewing entities to confirm whether apps have been reviewed and sign them to let your Android phone know they’re safe.
“Would your proposals require Google to police the entire internet?” asks Epic’s attorney, referring to this quote from earlier in the trial.
“They would not,” replies Mickens, pointing to existing third-party entities like Verisign, Digicert, and GoDaddy — and saying that Google already trusts some of them with websites it displays in Chrome. (I don’t know if I buy that third parties do a good job in the aggregate.)
Not only did Epic call Professor Mickens as an expert witness (Google will have its own), but the questions from Epic’s lawyer are all in utter lockstep with what Mickens is presenting. Compelling or not — I find the reduced friction compelling! — it’s a fully rehearsed show.
Mickens has even been asked about the testimony of witnesses that were in this courtroom on previous days, and he’s been ready to go.
“We’re imagining a new world, this is a proposal, it’s not something that’s out in the world right now” he tells the jury, before presenting this mock screen:
Allow installation
Do you want F-Droid to be able to install apps?
Allow Don’t Allow
Then, if you click allow, and an app has not yet been scanned and reviewed by Google, there’d be a second optional friction screen:
Allow installation
The app-to-install has not been reviewed. Are you sure that you want to install it?
Cancel Install Anyway
What do you think?
We’re seeing this slide on screen:
Two Core Decisions for User Consent:
1) Do I want to allow this app to install other apps?
2) Has the app I want to install been scanned?
“I agree on a high level that friction, when it’s proportional and commensurate to the risk... is appropriate,” he says.
He thinks a single screen should be enough to get the user’s informed consent.
One of the Epic expert’s biggest points is turning out to be that Google automatically scans incoming apps for malware through a feature called Google Play Protect.
“Now the malware scanner’s going to run, and it’s going to look and see if the app you were trying to install is malicious,” Professor Mickens tells the jury.
Mickens says it’s Google’s most important protection against bad apps.
Judge Donato interrupts to ask: “Could all those other steps be skipped and a user go directly from ‘I’d like to install it’ to the GPP stage?”
Mickens won’t go quite that far: “I don’t think they should be skipped.” He promises to come back to that point in a couple of slides.
Epic’s security expert Mickens says despite Android’s scare screens about downloading apps outside of Google Play, “your phone is also vulnerable to attack by apps in the Play Store.”
Judge Donato interrupts: “If you’re downloading an app from the Play Store, do you see the same warning?”
“No, you do not see this warning,” says Mickens. He continues:
“It’s the same app, it’s just Wikipedia, it’s not like the potential nature of its maliciousness has changed... that’s a problem, and that’s why it’s important to look at these warning screens.”