Epic and Epic’s expert witness has been asked to speed things along — we’ve been promised there’s a new and salient comparison coming.
“We can think of the reviewing process from an app separate from the distribution process for an app.”
That’s core to Epic’s case — it wants the court to decide that Google has one monopoly on Android app distribution, and another on in-app payments.
James Mickens, Epic’s mobile security expert:
Even if a user does have the misfortune to download a potentially harmful app on their phone, there are going to be all these mechanisms in place trying to keep the user safe.
Google already has both automated and human review mechanisms on and off Play to help with this, he says.
Yet even on Google Play, some scam apps get through.
It’s called The Android Platform Security Model, and it contains phrases that are appearing in court, like:
Both users and developers are part of an open ecosystem that is not limited to a single application store. Central vetting of developers or registration of users is not required
It’s a little opaque, but I think he’s saying Google knows it needs to provide security outside the Play Store, already attempts to do this, and could do more.
[css.csail.mit.edu]
Epic’s mobile security expert, after showing us a slide that states the Google Play Store is “Mandatory on GMS devices” whereas the Samsung Galaxy Store is merely “Possible on GMS devices.”
“OEM can’t just take the GMS suite and put that on the OEMs phone... they have to engage in contractual engagements with Google.” Those phones have to go through Google Test Suites for compliance.
There’s also a Compatibility Definition Document and a Compatibility Test Suite to make sure phones are compliant.
We’re looking at a slide titled “Android Operating System” which contains these stacked elements:
“User Apps”
“AOSP Middleware” and “GMS Middleware” and “OEM & SOC Middleware”
“AOSP Kernel”
and at the bottom, “Hardware.” The AOSP and middleware items are all within an “Operating System” bracket.
but rather what it tries to do, says Epic’s security expert.
He says that based on a review of Google’s source code, documents produced for the court, public statements, and academic articles, Google has “under-resourced its security monitoring of off-Play distribution channels” and “has the ability to identify and review apps at the point of installation.”
We’ve heard Google’s security boss suggest the latter isn’t possible: “We can’t make the internet safe.”
Mickens came in with an agenda — he decided to “Examine whether the friction that Android imposes on non-Google Play Store app installation is justified by security concerns.”
His conclusions, as presented to the jury:
Conclusion 1: “The friction imposed by an operating system during app installation should be proportional to the likelihood that the app is harmful (as determined by a high-quality security review)
Conclusion 2: The friction that Google imposes to installing apps via third-party channels is unwarranted and disproportionate to the security risks posed
Conclusion 3: By making small changes to Android, Google could reduce the unwarranted friction while preserving (or even strengthening) the status quo of security on Android today
He teaches a class on operating systems, another on computer security, and is co-director of the Berkman-Klein Center for Internet and Society and the Institute for Rebooting Social Media. He says he used to work for Microsoft Research, and has published papers on mobile device security including “the propagation of malware on mobile devices.”
Epic has submitted him as an expert witness on mobile device security — and Judge Donato agrees he’s qualified. On we go!