Study reveals scale of data-sharing from Android mobile phones

An in-depth investigation of a scope of fashionable Android mobile phones has revealed important information postulation and sharing, including with 3rd parties, with nary opt-out disposable to users.

Prof. Doug Leith astatine Trinity College Dublin on with Dr. Paul Patras and Haoyu Liu astatine the University of Edinburgh examined the information sent by six variants of the Android OS developed by Samsung, Xiaomi, Huawei, Realme, LineageOS and /e/OS.

Even erstwhile minimally configured and the handset is idle, with the notable objection of e/OS, these vendor-customized Android variants transmit important amounts of accusation to the OS developer and to 3rd parties specified arsenic Google, Microsoft, LinkedIn, and Facebook that person pre-installed strategy apps. There is nary opt-out from this information collection.

While occasional connection with OS servers is to beryllium expected, the authors of the survey accidental the observed information transmission goes good beyond this and raises a fig of privateness concerns.

Prof. Doug Leith, seat of machine systems astatine the School of Computer Science and Statistics successful Trinity College Dublin, said: "I deliberation we person wholly missed the monolithic and ongoing information postulation by our phones, for which determination is nary opt out. We've been excessively focused connected web cookies and connected badly-behaved apps. I anticipation our enactment volition enactment arsenic a wake-up telephone to the public, politicians and regulators. Meaningful enactment is urgently needed to springiness radical existent power implicit the information that leaves their phones."

Dr. Paul Patras, Associate Professor successful the School of Informatics astatine the University of Edinburgh, said: "Although we've seen extortion laws for personal information adopted successful respective countries successful caller years, including by EU subordinate states, Canada and South Korea, user-data postulation practices stay widespread. More worryingly, specified practices instrumentality spot "under the hood" connected smartphones without users' cognition and without an accessible means to disable specified functionality. Privacy-conscious Android variants are gaining traction though and our findings should incentivise market-leading vendors to travel suit."

Key findings from the study:

• With the objection of e/OS, each of the handset manufacturers examined cod a database of each the apps installed connected a handset. This is perchance delicate accusation since it tin uncover idiosyncratic interests, e.g., a intelligence wellness app, a Muslim supplication app, a cheery dating app, a Republican quality app. There is nary opt retired from this data collection.
• The Xiaomi handset sends details of each the app screens viewed by a idiosyncratic to Xiaomi, including erstwhile and however agelong each app is used. This reveals, for example, the timing and duration of telephone calls. The effect is akin to the usage of cookies to way people's enactment arsenic they determination betwixt web pages. This information appears to beryllium sent extracurricular Europe to Singapore.
• On the Huawei handset the Swiftkey keyboard sends details of app usage implicit clip to Microsoft. This reveals, for example, erstwhile a idiosyncratic is penning a text, utilizing the hunt bar, searching for contacts.
• Samsung, Xiaomi, Realme and Google cod long-lived instrumentality identifiers, e.g., the hardware serial number, alongside user-resettable advertizing identifiers. This means that erstwhile a idiosyncratic resets an advertizing identifier the caller identifier worth tin beryllium trivially re-linked backmost to the aforesaid device, perchance undermining the usage of user-resettable advertizing identifiers.
• Third-party strategy apps, e.g., from Google, Microsoft, LinkedIn and Facebook, are pre-installed connected astir of the handsets and silently cod data, with nary opt out.
• There whitethorn beryllium a information ecosystem wherever information collected from a handset by antithetic companies is shared/linked. Notably, the privateness focused e/OS variant of Android was observed to transmit fundamentally nary data.

---

---