Android Devices in Enterprise Mobility — Navigating Key Risks

Mobile phones have always been a staple of corporate communication. In the early days, companies would provide mobile devices to their employees. When the technology became widely available in the early 2000s, people began using personal phones for work-related communication. 

The practice reached a whole new level when smartphones hit the scene and employees started using their own devices for various work-related tasks. Companies embraced the Bring Your Own Device (BYOD) trend, cutting down expenses on fancy gadgets like Blackberries. Nowadays, smartphones are versatile tools and can take on tasks that previously required specialized equipment. With full-fledged office suites installed, mobile devices are the go-to tool for around 90% of employees.

Google's Android and Apple's iOS are the undisputed leaders in the global mobile operating system market — a claim that can safely be extrapolated to the corporate world as well. In terms of global market share, Android occupies a dominant position with 72% of the share, while iOS claims a smaller but still very substantial share of 27%. All of the other players in this space collectively hold the remaining 1%.

The reason behind Android's global popularity with users is the extensive range of devices it supports. In contrast to Apple's own exclusive iPhone line, Android runs on smartphones produced by dozens of manufacturers and caters to all price segments, from budget models priced at a mere $50 to premium flagship devices costing upwards of $1500. This has made the Android operating system a favorite in emerging markets, where cost often takes precedence over brand recognition. Given that from the consumer’s point of view app ecosystems of Android and iOS are very much alike, many users opt for much more affordable Android-powered options.

So how does Google monetize Android? The 15-30% cut it takes of what app developers earn on Google Play represents only a small slice of Alphabet's total revenue. In fact, it’s included in the category "apps, devices, and content" which constitutes only about 11% of overall earnings. Similarly, cloud technologies account for about 8% of Google’s revenue.

A whopping 80% of the company's earnings come from advertising, heavily fueled by data analytics so that the company can target users even more effectively.

Google's services and products, such as Android, are key ways for the company to get access to users and their data. When you buy an Android phone, you'll notice it comes with a whole suite of Google services already pre-installed. These are part of Google Mobile Services (GMS), which include apps like Google Play Store, Gmail, Google Drive, Chrome, Search, YouTube, Maps, and Photos. Google's agreement with smartphone manufacturers requires that these apps are displayed on the phone's first screen and set as the default. This strategy is crucial, as research shows that most users do not bother to change their default search engine or use other apps that are not immediately visible. As a result, Google gains access to a massive array of user data that these apps collect.

Basic core Android OS apps, such as the Dialer, which is used to make phone calls, or SMS Messenger collect data as well. Research studies have confirmed that the Google Dialer sends data to Google's servers such as call details, including its time and duration, phone numbers, and even app usage time. Google Messages service collects the message hash of both sent and received texts, giving the tech giant even more insight into its users' communication habits. Android users can’t choose to opt out of sharing this data with Google.

Device vendors receive Android OS with GMS from Google and are responsible for installing the OS. The OS code consists of millions of lines which makes it very difficult — or downright impossible — for device vendors to audit. All the GMS apps are controlled entirely by Google. Hence, all devices on Android are potentially subject to undocumented vulnerabilities or may run features unknown to device vendors. 

Device vendors also receive Android updates that fix various vulnerabilities and update security policies directly from Google and then need to roll out these updates themselves on user devices. The update process is cumbersome, and thus security updates are usually installed months after being released by Google.

As long as there is an internet connection, every Android device is fully controlled by the OS developer and device vendor.  There is always a chance of it getting blocked or having certain features selectively disabled. Moreover, data could be remotely wiped off, or accessed without authorization by the device manufacturers or even third parties such as government agencies ​​of the country where the device or OS manufacturer is registered. Unless, of course, authorities or security forces specifically require back-door access to devices.

In recent years, there have been numerous instances of remote service restrictions imposed on users. A prime example took place in the spring of 2022 when Google shut down all payments and monetization for apps in Russia, including advertising and monetization across its products such as YouTube and AdSense. In addition, Google began arbitrarily disabling its cloud services and deleting apps from stores, mirroring Apple's policies.

There are other numerous examples of Google’s will and policies being imposed upon users located very far from its headquarters in Mountain View, CA. Earlier, in August 2017, Android began to limit access to its services for Iranian users. In September 2018, Google stopped licensing new phone sales in Turkey after being fined 93 million liras by Turkish authorities for antitrust violations. In May 2019, Huawei faced a major setback when Google imposed a massive ban on the company.
_______________________________________________________________

In today's hyper-connected world, data security and privacy are of paramount importance, especially in a corporate setting. Unfortunately, when it comes to Android devices, it appears that Google is in complete control. They have access to user data and the ability to disable it at will, as demonstrated by several examples of remote restrictions in recent years. This level of control raises significant concerns, particularly for those who require high levels of confidentiality in their communications.

Despite this, Google is unwilling to fully disable support for Android devices in sanctioned countries. Of course, doing so would disrupt the collection of user data - perhaps, not the desired outcome for Google.