Smartphone Encryption is a Luxury

Mark Lennihan/AP File Photo

The people that most need privacy often can’t afford the smartphones that provide it.

Last year, a team of technology experts warned against giving law enforcement special access to encrypted communications. They explained that this special access would “undermine and reverse” the technology industry’s efforts to bolster digital security.

The landmark paper addressed a conflict between technology companies and the government that had been brewing for some time. And when Apple and the FBI faced off in court seven months later, computer experts and civil-rights groups rushed to defend Apple as it resisted a federal judge’s order to circumvent its own security features. The experts said that cooperating with law enforcement would put smartphone users at increased risk of snooping from hackers and the government.

That’s certainly true for the tens of millions of iPhone users in the United States, whose devices currently protect their data with strong encryption: A concession to the government’s push for special access to encrypted data would be a tangible step backward for those users’ privacy.

But for many of the remaining American smartphone users, strong data encryption was never really an option. Most Android phones don’t encrypt the data that’s stored on the device, and many come with messaging services that don’t encrypt data that’s sent back and forth between devices.

Unlike iPhones, which are exclusively made by Apple, Android phones are produced by many different manufacturers. That’s made it much more difficult for Google—the company that designs Android software—to turn on device encryption by default.

Many of the devices that run Android software have cheap or out-of-date hardware that can’t handle continuous encryption and decryption. Google recently required that all new Android devices encrypt device data by default—but exempted slower (and therefore cheaper) phones, making encryption a de-facto luxury feature.

(Apple sells its cheapest current iPhone for $400; new Android phones are available for as cheap as $30.)

That disparity affects most smartphone users in the U.S. According to recent data from comScore, a company that studies technology use, about 53 percent of the 198.5 million smartphone owners in the U.S. use Android phones. That’s about 105 million people.

And there are some clear patterns that separate the kinds of people that own Apple and Android devices.

According to 2013 survey data from Pew Research, high-earning and highly educated people are more likely to own an iPhone. The survey also showed that African-American people are more likely to use Android phones.

The groups most likely to use Androids—low-income people and African-Americans—are also the groups that are under the most daily government surveillance, says Michele Gilman, a civil-rights lawyer and law professor at the University of Maryland. She says this is a long-standing pattern that’s been amplified by modern technology.

“When encryption remains a luxury feature, those who are the most surveilled in our society are using devices that protect them the least from that surveillance,” said Christopher Soghoian, the principal technologist at the American Civil Liberties Union. He calls this the “digital-security divide.”

The lack of strong encryption in older and cheaper Android phones allows police to obtain user data more easily. When the contents of a phone are not encrypted, forensic tools that can extract those contents allow police to read all the phone’s data.

And the default messaging applications on Android phones are also less secure than Apple’s iMessage service. When Apple users text one another, their messages are encrypted end-to-end—that is, not even Apple can read them. (Apple can, however, read iMessage conversations that are backed up to its iCloud service.)

By contrast, Android phones come with SMS messaging by default, and most include Google’s Hangouts chat program. Neither of those tools is end-to-end encrypted, meaning that the companies that carry the messages from one phone to the other can turn over message contents to police if they’re required to.

Many Android phones also run outdated versions of the Android operating system, which leaves them more vulnerable to hacking. Even after Google releases patches for security holes, many phones don’t get those updates, because of the decentralized way that Android phones are sold.

“It’s clear that the woeful state of Android privacy and security is disproportionately impacting the most vulnerable in our society,” says Soghoian.

Google has made efforts to step up the security features available on Android devices. Its decision to require default encryption on devices running new versions of the Android operating system was an important change—but one that was hobbled by the exemption extended to lower-end phones. Soghoian predicts that cheap Android phones won’t be capable of disk encryption “for the foreseeable future.”

And a Google prototype called Project Vault would turn existing phones into a “digital safe” by encrypting both the data stored on the phones, and the data sent between phones—text messages and voice and video calls.

But Google won’t say if and when the project, which was announced at a developer’s conference last year, will be released.

For now, apps are available for both iPhones and Androids that give users alternative ways to communicate securely. WhatsApp, which is owned by Facebook, encrypts messages end-to-end. More than a billion users have signed up for WhatsApp, although the app hasn’t caught on in the U.S. nearly as much as it has abroad. Another app called Signal has won praise from technology experts for its robust security features, but it hasn’t taken off among ordinary users.

But most smartphone users stick to the default set of features that come with their phones, and many aren’t aware of the security downsides of using certain hardware and software. That means that users that can afford fancy smartphones like an iPhone or Google’s own Nexus phone will be protected by cutting-edge encryption, whether or not they know it (or care). It also means that users who can only buy the cheapest possible smartphone are the most vulnerable to surveillance—and simultaneously the most likely to be surveilled.

X
This website uses cookies to enhance user experience and to analyze performance and traffic on our website. We also share information about your use of our site with our social media, advertising and analytics partners. Learn More / Do Not Sell My Personal Information
Accept Cookies
X
Cookie Preferences Cookie List

Do Not Sell My Personal Information

When you visit our website, we store cookies on your browser to collect information. The information collected might relate to you, your preferences or your device, and is mostly used to make the site work as you expect it to and to provide a more personalized web experience. However, you can choose not to allow certain types of cookies, which may impact your experience of the site and the services we are able to offer. Click on the different category headings to find out more and change our default settings according to your preference. You cannot opt-out of our First Party Strictly Necessary Cookies as they are deployed in order to ensure the proper functioning of our website (such as prompting the cookie banner and remembering your settings, to log into your account, to redirect you when you log out, etc.). For more information about the First and Third Party Cookies used please follow this link.

Allow All Cookies

Manage Consent Preferences

Strictly Necessary Cookies - Always Active

We do not allow you to opt-out of our certain cookies, as they are necessary to ensure the proper functioning of our website (such as prompting our cookie banner and remembering your privacy choices) and/or to monitor site performance. These cookies are not used in a way that constitutes a “sale” of your data under the CCPA. You can set your browser to block or alert you about these cookies, but some parts of the site will not work as intended if you do so. You can usually find these settings in the Options or Preferences menu of your browser. Visit www.allaboutcookies.org to learn more.

Sale of Personal Data, Targeting & Social Media Cookies

Under the California Consumer Privacy Act, you have the right to opt-out of the sale of your personal information to third parties. These cookies collect information for analytics and to personalize your experience with targeted ads. You may exercise your right to opt out of the sale of personal information by using this toggle switch. If you opt out we will not be able to offer you personalised ads and will not hand over your personal information to any third parties. Additionally, you may contact our legal department for further clarification about your rights as a California consumer by using this Exercise My Rights link

If you have enabled privacy controls on your browser (such as a plugin), we have to take that as a valid request to opt-out. Therefore we would not be able to track your activity through the web. This may affect our ability to personalize ads according to your preferences.

Targeting cookies may be set through our site by our advertising partners. They may be used by those companies to build a profile of your interests and show you relevant adverts on other sites. They do not store directly personal information, but are based on uniquely identifying your browser and internet device. If you do not allow these cookies, you will experience less targeted advertising.

Social media cookies are set by a range of social media services that we have added to the site to enable you to share our content with your friends and networks. They are capable of tracking your browser across other sites and building up a profile of your interests. This may impact the content and messages you see on other websites you visit. If you do not allow these cookies you may not be able to use or see these sharing tools.

If you want to opt out of all of our lead reports and lists, please submit a privacy request at our Do Not Sell page.

Save Settings
Cookie Preferences Cookie List

Cookie List

A cookie is a small piece of data (text file) that a website – when visited by a user – asks your browser to store on your device in order to remember information about you, such as your language preference or login information. Those cookies are set by us and called first-party cookies. We also use third-party cookies – which are cookies from a domain different than the domain of the website you are visiting – for our advertising and marketing efforts. More specifically, we use cookies and other tracking technologies for the following purposes:

Strictly Necessary Cookies

We do not allow you to opt-out of our certain cookies, as they are necessary to ensure the proper functioning of our website (such as prompting our cookie banner and remembering your privacy choices) and/or to monitor site performance. These cookies are not used in a way that constitutes a “sale” of your data under the CCPA. You can set your browser to block or alert you about these cookies, but some parts of the site will not work as intended if you do so. You can usually find these settings in the Options or Preferences menu of your browser. Visit www.allaboutcookies.org to learn more.

Functional Cookies

We do not allow you to opt-out of our certain cookies, as they are necessary to ensure the proper functioning of our website (such as prompting our cookie banner and remembering your privacy choices) and/or to monitor site performance. These cookies are not used in a way that constitutes a “sale” of your data under the CCPA. You can set your browser to block or alert you about these cookies, but some parts of the site will not work as intended if you do so. You can usually find these settings in the Options or Preferences menu of your browser. Visit www.allaboutcookies.org to learn more.

Performance Cookies

We do not allow you to opt-out of our certain cookies, as they are necessary to ensure the proper functioning of our website (such as prompting our cookie banner and remembering your privacy choices) and/or to monitor site performance. These cookies are not used in a way that constitutes a “sale” of your data under the CCPA. You can set your browser to block or alert you about these cookies, but some parts of the site will not work as intended if you do so. You can usually find these settings in the Options or Preferences menu of your browser. Visit www.allaboutcookies.org to learn more.

Sale of Personal Data

We also use cookies to personalize your experience on our websites, including by determining the most relevant content and advertisements to show you, and to monitor site traffic and performance, so that we may improve our websites and your experience. You may opt out of our use of such cookies (and the associated “sale” of your Personal Information) by using this toggle switch. You will still see some advertising, regardless of your selection. Because we do not track you across different devices, browsers and GEMG properties, your selection will take effect only on this browser, this device and this website.

Social Media Cookies

We also use cookies to personalize your experience on our websites, including by determining the most relevant content and advertisements to show you, and to monitor site traffic and performance, so that we may improve our websites and your experience. You may opt out of our use of such cookies (and the associated “sale” of your Personal Information) by using this toggle switch. You will still see some advertising, regardless of your selection. Because we do not track you across different devices, browsers and GEMG properties, your selection will take effect only on this browser, this device and this website.

Targeting Cookies

We also use cookies to personalize your experience on our websites, including by determining the most relevant content and advertisements to show you, and to monitor site traffic and performance, so that we may improve our websites and your experience. You may opt out of our use of such cookies (and the associated “sale” of your Personal Information) by using this toggle switch. You will still see some advertising, regardless of your selection. Because we do not track you across different devices, browsers and GEMG properties, your selection will take effect only on this browser, this device and this website.