At the annualGoogle I/O developer conference, the company holds several sessions about updates to the Android platform. During the “What’s new in Android Security” talk,Google‘s head of Android platform security David Kleidermacher talked about the upcoming security changes in theAndroid P release. Near the beginning of the talk, Mr. Kleidermacher discussed how the company was making it easier for OEMs to roll out security patches thanks to the architectural changes implemented withProject Treble. He followed this statement with a small, but incredibly important tidbit of information: Google has modified their OEM agreements to include provisions for regular security patches.
“We’ve also worked on building security patching into our OEM agreements. Now this will really … lead to a massive increase in the number of devices and users receiving regular security patches.” – David Kleidermacher, Google’s head of Android platform security
Google releases monthly security patch bulletinsthat list patches for known vulnerabilities. These security patch bulletins are released to the public generally in the first week of each month, however, OEMs and vendors receive the monthly security patches a month in advance. This gives OEMs and vendor times to patch vulnerabilities before the security bulletin is made public; it’s how companies likeEssential are able to provide security patch updates on the same day as Google.
Google hasn’t required OEMs to update their deviceswith the latest security patches, though generally, larger OEMs offer them for at least their flagship devices to assure customers that their devices are secure. A recent report revealed that some OEMs have missed patches from monthly Android security bulletins, and data shows that many devices fail to receive security patch updates in a timely manner. Google wants to change that.
The company has a few programs in place to bind their partners to certain terms. One of them is the GMSpartner program, and another is the Android partner program. Companies in the latter program work closely with Google to make sure their devices are compliant with Google’s requirements for the latest version of Android (specified in the Compatibility Definition Document and tested by the Compatibility Test Suite.) Android partners also receive new Android releases faster than other companies; it’s why companies likeXiaomi, Essential, andOnePlus receivedearly access to the Android P Developer Preview 2while other companies seemingly did not. Now it seems that Google is reworking the agreement with their Android partners to include terms requiring regular security patches.
Unfortunately, there are few details available about the updated Android partner agreement. We don’t know how often Google will require their OEM partners to implement patches. Google is likely requiring OEMs to roll out security patches on a monthly basis as Google doesn’t want Android devices to stay unpatched, but we aren’t sure about the timeline in the agreement. We also don’t know if Google has provisions in place to verify that security patches are being properly implemented. Still, the Android partner program is hugely beneficial for OEMs to be in, so it’s in their best interests to abide by the changes even if there may be some internal disagreements with the decision. Hopefully, as Mr. Kleidermacher stated, this change will make sure that millions more Android users are kept secure against the latest security threats.