ACLU Files FTC Complaint Against Wireless Carriers

[tubemonkey]

ACLU files complaint with FTC over older Android software

Good! I hope this has feet and would love to see these carriers raked over the coals.

The American Civil Liberties Union filed a federal complaint Tuesday accusing the nation’s largest wireless carriers of “deceptive” business practices for failing to keep the software on tens of millions of Android smartphones updated — a shortcoming that can make the devices vulnerable to hackers.

Only one in four Android phones worldwide has the latest generation of the operating system, called Jelly Bean, according to statistics kept by Google, and more than 45 percent run on software first released more than two years ago. Older versions sometimes receive security patches provided by Google, though the process of delivering these to consumers is inconsistent across the dozens of different Android smartphones made by several major manufacturers.

We really feel this is like a defective product,” said Christopher Soghoian, principal technologist for the ACLU and a former official with the FTC. “The companies know about the flaws, so they should either recall the products or tell consumers so that they can make an informed choice.”

The complaint names the four largest wireless carriers — Verizon Wireless, AT&T, Sprint Nextel and T-Mobile USA — as parties but not Google, whose relationship with most consumers using Android phones is indirect.

[tubemonkey]

Some of the wireless companies issued statements Tuesday afternoon in response to the ACLU complaint.

“Verizon Wireless is focused on ensuring our customers have good experiences with their smartphones and tablets,” spokeswoman Brenda Rainey said, adding, “We work closely with [mobile device makers] and provide mandatory updates to devices as quickly as possible.”

“Sprint follows industry-standard best practices designed to protect its customers,” spokesman John B. Taylor said.

...maybe they should quit selling phones and try their hand at comedy

[murraypaul]

Seems like a stretch calling that a deceptive business practice, unless they can show that they mislead customers into thinking that their devices would be updated to the latest versions. Absent that, who has been deceived?

[ucfgrad93]

Originally Posted by murraypaul

Seems like a stretch calling that a deceptive business practice, unless they can show that they mislead customers into thinking that their devices would be updated to the latest versions. Absent that, who has been deceived?

Agreed. Not to mention, how long should carriers be required to update phones?

[calvin-c]

Originally Posted by murraypaul

Seems like a stretch calling that a deceptive business practice, unless they can show that they mislead customers into thinking that their devices would be updated to the latest versions. Absent that, who has been deceived?

That depends on the marketing. I've seen ads touting 'latest version of Android'. I'm sure the marketer means the latest version then available-but it can also be read as a commitment to keep the phone updated to the latest version. I'm sure that's nit-picking but isn't that what lawyers do?

As for the time, if it's a security issue then I'd say they're required to keep them updated as long as they allow them to use their network....but not all updates are security issues. The courts would need to look at the specific claims but IMO the companies would find it easier to simply provide all updates.

BTW, they don't need to push the updates to fulfill their responsibilities-all they need to do is provide them along with clear notification & instructions for obtaining & installing them. If the customers fail to install them (as most undoubtedly will) it's not the company's fault.

[tubemonkey]

Originally Posted by calvin-c

That depends on the marketing. I've seen ads touting 'latest version of Android'. I'm sure the marketer means the latest version then available-but it can also be read as a commitment to keep the phone updated to the latest version. I'm sure that's nit-picking but isn't that what lawyers do?

As for the time, if it's a security issue then I'd say they're required to keep them updated as long as they allow them to use their network....but not all updates are security issues. The courts would need to look at the specific claims but IMO the companies would find it easier to simply provide all updates.

BTW, they don't need to push the updates to fulfill their responsibilities-all they need to do is provide them along with clear notification & instructions for obtaining & installing them. If the customers fail to install them (as most undoubtedly will) it's not the company's fault.

Agreed

[david_e]

Apologies if I have misunderstood this, I'm used to looking at things like this through Apple-colored glasses, but why is it the responsibility of the carrier and not the manufacturer of the handset?

[tubemonkey]

Originally Posted by david_e

Apologies if I have misunderstood this, I'm used to looking at things like this through Apple-colored glasses, but why is it the responsibility of the carrier and not the manufacturer of the handset?

Because the carrier dictates when an upgrade will be allowed. They already cripple phones by telling the manufacturers to leave certain features off.

The OS upgrade path for most Android phones goes like this:

• Google releases new version of Android.
• Manufacturers adapt that version to conform with the software they've overlaid on Android.
• Wireless carriers then adapt that version to conform to the software they've put on the device.

Apple and Nexus devices don't have this convoluted upgrade path. They get upgrades instantly.

[pholy]

For some reason the carriers have decided that they will control the software used on phones that use their wireless networks. If Apple escaped that it's a miracle. Both Google and Blackberry suffer from delays in approvals.

[david_e]

Originally Posted by tubemonkey

Because the carrier dictates when an upgrade will be allowed. They already cripple phones by telling the manufacturers to leave certain features off.

The OS upgrade path for most Android phones goes like this:

• Google releases new version of Android.
• Manufacturers adapt that version to conform with the software they've overlaid on Android.
• Wireless carriers then adapt that version to conform to the software they've put on the device.

Apple and Nexus devices don't have this convoluted upgrade path. They get upgrades instantly.

[Apache]

Apple iPhones automatically notify you when there is a new update available. You do not have to install it, but it is available.
Apache

[teh603]

Originally Posted by Apache

Apple iPhones automatically notify you when there is a new update available. You do not have to install it, but it is available.
Apache

Let's not think about iPhones for a moment. I've got a flip phone. How often do you see one of those getting an update?

Exactly.

[Ankh]

Originally Posted by teh603

Let's not think about iPhones for a moment. I've got a flip phone. How often do you see one of those getting an update?

Exactly.

Security by obscurity, isn't it?

[Apache]

Originally Posted by teh603

Let's not think about iPhones for a moment. I've got a flip phone. How often do you see one of those getting an update?

Exactly.

Originally Posted by Ankh

Security by obscurity, isn't it?

Apache

[Ankh]

Huh?!

A "flip phone", if I am not mistaken, is a device that is not a "smart phone", and is rarely used with the data plan. The minimal net presence of such a device, coupled with a variety of software and hardware platforms, made it an unlikely hacking target, which is a "security by obscurity". There was a limited number of available apps, most frequently sold by the service provider. There was rarely, if ever, a need to upgrade such an... appliance. A software upgrade was more likely to provide a fix for broken functionality, less likely to plug a security hole.

For the record, I still use my slider phone for SMS and voice calls only. But it seems logical to me that old model of "bundling" a phone with the service forces service providers to take responsibility NOT only for their network, but for the basic maintenance of the device that they have locked/crippled when they sold it to the customer.