Google and Apple have removed hundreds of apps from their app stores at the request of governments around the world, creating regional disparities in access to mobile apps at a time when many economies are becoming increasingly dependent on them.
[...] However, access to apps is just one concern. Developers also regionalize apps, meaning they produce different versions for different countries. This raises the question of whether these apps differ in their security and privacy capabilities based on region.
In a perfect world, access to apps and app security and privacy capabilities would be consistent everywhere. Popular mobile apps should be available without increasing the risk that users are spied on or tracked based on what country they're in, especially given that not every country has strong data protection regulations.
[...] While our study corroborates reports of takedowns due to government requests, we also found many differences introduced by app developers. We found instances of apps with settings and disclosures that expose users to higher or lower security and privacy risks depending on the country in which they're downloaded.
[...] Our study showed high amounts of geoblocking, with 3,672 of 5,684 globally popular apps blocked in at least one of our 26 countries. Blocking by developers was significantly higher than takedowns requested by governments in all our countries and app categories. We found that Iran and Tunisia have the highest blocking rates, with apps like Microsoft Office, Adobe Reader, Flipboard and Google Books all unavailable for download.
[...] The apps we downloaded from Google Play also showed differences based on country in their security and privacy capabilities. One hundred twenty-seven apps varied in what the apps were allowed to access on users' mobile phones, 49 of which had additional permissions deemed "dangerous" by Google. Apps in Bahrain, Tunisia and Canada requested the most additional dangerous permissions.
[...] App stores allow developers to target their apps to users based on a wide array of factors, including their country and their device's specific features. Though Google has taken some steps toward transparency in its app store, our research shows that there are shortcomings in Google's auditing of the app ecosystem, some of which could put users' security and privacy at risk.
Potentially also as a result of app store policies in some countries, app stores that specialize in specific regions of the world are becoming increasingly popular. However, these app stores may not have adequate vetting policies, thereby allowing altered versions of apps to reach users. For example, a national government could pressure a developer to provide a version of an app that includes backdoor access. There is no straightforward way for users to distinguish an altered app from an unaltered one.
Our research provides several recommendations to app store proprietors to address the issues we found:
- Better moderate their country targeting features
- Provide detailed transparency reports on app takedowns
- Vet apps for differences based on country or region
- Push for transparency from developers on their need for the differences
- Host app privacy policies themselves to ensure their availability when the policies are blocked in certain countries
Journal Reference:
Renuka Kumar, Apurva Virkud, Ram Sundara Raman, et al., A Large-scale Investigation into Geodifferences in Mobile Apps [open], 31st USENIX Security Symposium (USENIX Security 22), 2022. https://www.usenix.org/conference/usenixsecurity22/presentation/kumar
(Score: 2) by MostCynical on Wednesday October 19 2022, @06:35AM
do some have different logging servers, for particular regions?
Do they add 'government' servers, or just give government(s) access?
"I guess once you start doubting, there's no end to it." -Batou, Ghost in the Shell: Stand Alone Complex
(Score: 2) by legont on Thursday October 20 2022, @12:06AM
My friends in Canada, what's going on over there?
"Wealth is the relentless enemy of understanding" - John Kenneth Galbraith.