Android’s Enterprise program to switch out security update requirements for mandatory transparency

For two years, Google has been trying to make it easy for businesses to run and deploy reliable Android devices through its Android Enterprise Recommended (AER) program. It’s essentially a collection of certified hardware with certain minimum guarantees: They must be eligible for zero-touch enrollment, carrier-unlocked, and should receive security updates no later than 90 days of release for a minimum of three years. As XDA Developers reports, the latter requirement might soon be significantly relaxed in favor of more nebulous transparency requirements.

According to some leaked, nonfinal documents, Google is looking into dropping the 90-day security update requirement altogether. Instead, manufacturers have a new rule to work with: Transparency. On their websites, OEMs have to publish the date when their participating phone will receive its last security update and which patch is currently available. They also have to share how frequently they’ll update it. The same is true for new Android releases: Customers must be able to know which software the phone initially shipped with, which version it’s currently on, and which update you can expect to be the last.

The mandatory 3-year support for Emergency Security Maintenance Releases (ESMR) remains active, though. That means that critical security flaws must be patched for at least three years, even if the phone doesn’t receive regular system updates any longer.

Take a look at the leaked table below for all the minuscule changes. If you wonder why it says “30-day security updates” and not 90 in the Android 10 section, it seems like Google has updated the requirement to be more rigorous, but has only informed manufacturers, not the general public.

Above: Revision to Device Security requirements. Below: New transparency requirements.

Keep in mind that these are just proposed changes. The new rules aren’t carved in stone, and Google might decide against them before it publishes the next finalized version of the AER guidelines. We can also only speculate as to why Google considers making the rules less strict. It’s possible that these requirements are now part of the secret contract Google and manufacturers enter when they want to use Android. We once had a glance at such a document back in 2018, when a leak showed that phones had to be updated for at least two years. If that’s the case, the extra requirement for the AER program would be unnecessary.

In the end, the transparency requirement could be beneficial for all phone owners — we’d finally be able to reliably find update information on all manufacturers’ websites, helping us judge which phones will be the most secure and long-lasting.

• Source:
• XDA Developers