In an open letter published yesterday, more than 50 organizations have asked Google to take action against Android smartphone vendors who ship devices with unremovable pre-installed apps, also known as bloatware.
The letter, signed by 53 organizations, was addressed to Google CEO Sundar Pichai.
Signees say Android bloatware has a detrimental effect on user privacy. They say many bloatware apps cannot be deleted and leave users exposed to having their data collected by unscrupulous phone vendors and app makers without their knowledge or consent.
"These pre-installed apps can have privileged custom permissions that let them operate outside the Android security model," the open letter reads.
"This means permissions can be defined by the app - including access to the microphone, camera and location - without triggering the standard Android security prompts. Users are therefore completely in the dark about these serious intrusions."
This means that most bloatware apps don't go through Google's app screening process, aren't reviewed for exaggerated permissions, aren't checked for known security bugs or malware, and nor can they be updated via the Play Store mechanism with new versions to fix bugs and security flaws.
The organizations that signed the open letter believe that Android users are most at risk from "the exploitative business practices of cheap smartphone manufacturers around the world" and that "privacy cannot be a luxury offered only to those people who can afford" to buy an expensive phone.
Coincidentally, the open letter was published a day before Malwarebytes revealed the existence of unremovable malware inside two apps pre-installed on cheap low-end smartphones sold to low-income Americans via a government-subsidized program.
Signees want new rules for OEMs
The signees are now asking Pichai to protect's Google brand by imposing new rules for Android OEMs (official equipment manufacturers, aka Android smartphone makers) in terms of the type of bloatware apps they can pre-install on their respective devices.
The three rules the group proposed are as follow:
Individuals should be able to permanently uninstall the apps on their phones. This should include any related background services that continue to run even if the apps are disabled.
Pre-installed apps should adhere to the same scrutiny as Play Store apps, especially in relation to custom permissions.
Pre-installed apps should have some update mechanism, preferably through Google Play and without a user account. Google should refuse to certify a device on privacy grounds, where manufacturers or vendors have attempted to exploit users in this way.
The letter's signees include organizations ranging from privacy groups to universities and from journalism organizations to consumer protection groups. The full list of 53 organizations that signed the open letter is available below.
Privacy International, the driving force behind this initiative, has also set up a petition page where normal users can add their voice to this campaign and put pressure on Google to intervene.
American Civil Liberties Union (ACLU)
Afghanistan Journalists Center (AFJC)
Americans for Democracy and Human Rights in Bahrain (ADHRB)
Asociación por los Derechos Civiles (ADC)
Association for Progressive Communications (APC)
Association for Technology and Internet (ApTI)
Association of Caribbean Media Workers
Australian Privacy Foundation
Center for Digital Democracy
Centre for Intellectual Property and Information Technology Law (CIPIT)
Civil Liberties Union for Europe
Consumer Association the Quality of Life-EKPIZO
Digital Rights Foundation (DRF)
Douwe Korff, Emeritus Professor of International Law, London Metropolitan University and Associate of the Oxford Martin School, University of Oxford
Electronic Frontier Foundation (EFF)
Forbrukerrådet // Norwegian Consumer Council
Foundation for Media Alternatives
Free Media Movement (FMM)
Gulf Centre for Human Rights (GCHR)
Initiative for Freedom of Expression- Turkey (IFox)
Irish Council for Civil Liberties
Media Foundation for West Africa
Media Institute of Southern Africa (MISA)
Media Policy and Democracy Project (University of Johannesburg)
Media Policy Institute (MPI)
Metamorphosis Foundation for Internet and Society
Open Rights Group (ORG)
Palestinian Center For Development & Media Freedoms (MADA)
Philippine Alliance of Human Rights Advocates (PAHRA)
Red en Defensa de los Derechos Digitales (R3D)
Syrian Center for Media and Freedom of Expression (SCM)
The Danish Consumer Council
The Institute for Policy Research and Advocacy (ELSAM)