Android—which lives off advertising—has apps sending GPS, phone numbers to ad firms

Of 30 free, successful apps, about half were sending advertisers the user's GPS positioning and even phone numbers beyond what they were known to do. The updates would occur even when no ads were running, Ars Technica noted, and could occur as often as every 30 seconds.

What's beautiful is that while Google has not responded to this study, it has so far "recommended only that developers provide a simple way of accessing the privacy policy for a given app once it's already installed."

In other words, Google isn't concerned about what an app sends to ad firms as long as it's documented somewhere in such a manner the user could be blamed for not knowing about it.

I've said before that Google's customer is not the end user, but rather the advertising firms. This is further evidence of that. Agree with their business model or not (and it's legitimate), this is an end result. 

Google's lax vetting allows almost any app in the Android market. Unscrupulous developers rejoice.

It collects a user’s browsing history, text messages, your phone’s SIM card number, subscriber identification, and even your voice mail password. It sends the data to a web site […] That site is evidently owned by someone in Shenzhen, China. The app has been downloaded anywhere from 1.1 million to 4.6 million times.

Though the research comes from a maker of Android security software, they've identified what the malicious app does and where the data is sent; the issue is real.

No vetting is perfect. Apple recently approved a flashlight app that housed a tethering application (though it harmed no users). But Apple shows concern about iPhone privacy. The excellent location services in iOS 4 are a great example. I appreciate the work they do on this.

For Android, we can and should excoriate the developers of this particular app, but we should also excoriate Google for barely trying to avoid this sort of thing.

So this is Android:

  • Available apps with little curation, and security issues being exploited.
  • Multiple OS releases and features that may or may not be coming to your particular hardware.
  • Multiple devices from multiple vendors each having vendor-specific software/services (crapware).
  • A real possibility that soon running security software will not only be prudent, but a foolish thing not to do.

Do these sound familiar? It's the Windows OS model of the 1990s. Android resembles it more every day. 

Google: With our weak vetting, how could this have happened?

Meanwhile, dozens of apps were found to have the same type of access to sensitive information as known spyware does, including access to the content of e-mails and text messages, phone call information, and device location, said Dan Hoffman, chief technology officer at SMobile Systems.

It seems clear that with unsigned apps and minimal vetting for its market place, Android's (well, Google's) priority is not security. When you're trying like mad to offer as many apps as the iPhone you don't have time for such things. Apps with security issues have been pulled after they've been on the market and enough users complained. It such cases the end user is doing the real vetting.

Problem is, not all apps are obvious about what they do. Sooner or later that comes back to haunt the end user, which leads to the real issue: Google doesn't care that much because the end user is not their customer. I'm not saying Google wants third-party apps to be invasive without user permission, only that preventing it isn't a priority. The end user doesn't pay Google for their services, and are not their customer.

Similar to Facebook, Google's customer isn't the one using the product every day, but rather the marketing, ad, and analytics firms that make use of the massive amounts of data being gathered. There's nothing wrong with this—it's just a business model—but it's important to know Google's customers to understand Google's priorities. Indeed, philosophically Google may not even have an issue with these apps. Google's been gathering your data for years.

I'd like to see Google take some action on this. Get ahead of the game and make changes to the market place for vetting this stuff. Google can talk "open" all it wants, but they have a responsibility for what's on their store. They have no issue refusing apps that violate copyright or other firms' TOS, but that's all in the interest of their real customers. It's time they treated the end user with a little respect and looked out for her as well.