Android Slammed For Removed Privacy Permissions Tool

A beneath-the-scenes change in Android 4.4.2 has prompted questions around Google's opt-out policies for personal data, with power users and privacy advocates angry that an accidentally included tool was removed. Google's decision to quietly remove the so-called "App Ops" permissions feature, which had allowed more granular control post-installation of what data on the phone or tablet third-party applications could access, saw it blasted as a result by the Electronic Frontier Foundation, which accused it of overlooking a "massive privacy problem."

App Ops was, according to Google, a hidden set of settings included from Android 4.3, which had been intended for internal and engineering use only. Although those settings were never meant to be user-facing, a third-party app of the same name gave easier access to the tool.

With it, Android users – or at least a power-user subset of them – could address one of the lingering complaints about the platform, the sometimes surprisingly broad array of permissions applications demand and the inability to selectively trim them. When an Android application is installed, a list of what permissions it requests is first shown; the user can choose whether or not to proceed based on that.

However, what's not possible is to pick and choose which permissions are given and which aren't, while still installing the app. So, if you want the Facebook for Android app but don't want it to have access to location services, it comes down to a choice between either installing it and hoping the developer has built in some sort of global shut-off switch to position, or not installing it at all.

In this way, Android differs from iOS, which breaks down the main categories of personal data – such as location, contacts, calendars, the microphone, and Bluetooth sharing – and allows permissions for each application to be toggled on or off.

The EFF says Google described App Ops inclusion in the public Android 4.3 release as "by accident" and that as an experimental feature it could potentially break apps that had their permissions changed without being set up to handle that selective process.

Unsurprisingly, the Foundation isn't convinced, saying it is "suspicious of this explanation" and arguing that, even if it introduced instabilities, the benefits are worth it. It calls for Google to urgently restore the tool, complete with some user-friendly polish.

In fact, the EFF concludes by advising those Android users particularly concerned by privacy not to upgrade to 4.4.2, though it points out that in remaining on an older version there are security problems to be faced there, too.

The fact that App Ops had no official user-facing dialog strongly suggests that Google didn't intend the tool to be publicly played with quite yet; the fact that it's present at all indicates that some sort of more finessed privacy settings are on the way, though no timescale has been given. As for the EFF's comments about it being a choice between privacy and the reassurance of the latest version, the only people who might actually have to pick between their granular settings and Android 4.4.2 are the minority subset who actually learned about, and used, App Ops.

For everyone else, it's business as usual, which means broad-strokes security permissions that aren't ideal. The general guidance remains that, if you're not happy with what an app wants access to, don't install it in the first place.