What if the San Bernardino shooters had used a Samsung Galaxy phone?

As Apple continues to battle with the FBI over whether it should help unlock an iPhone used by Syed Rizwan Farook, a gunman in the mass shooting in San Bernardino, California in December, some people after the debate raised this question: would this problem have played out differently if the phone was an Android, such as a Samsung Galaxy S6?

It’s a logical thing to ask, given that Samsung is the most popular smartphone maker after Apple, according to comScore. Although Apple and Samsung are close rivals, there is one key difference between them. Apple controls both the hardware and software of its iPhones. Samsung, however, like most smartphone manufacturers, does not manufacture Android, its operating system. Android is primarily developed by Google, and smartphone manufacturers such as Samsung and HTC then customize the Android operating system according to their preferences.

Would things have turned out differently if an Android phone was the one in question? It’s a little hard to say, but here’s what we’ve gathered:

Apple’s latest devices are encrypted. Are the latest Android devices also encrypted?

Well no. Google supported encryption, but its beliefs on this issue may not carry over to smartphones in the hands of most consumers. Although Google has offered the ability to encrypt Android phone data for a few years, until very recently the implementation was left to the manufacturers.

With its latest operating system, Marshmallow, Google forces companies to offer encryption by default if the phone meets the technical requirements and can encrypt data without affecting its performance. Phones that don’t fall into this camp or that run an older operating system would only have encryption if users decided to enable it. If a user switches to Marshmallow from a previous system, they must also enable encryption themselves.

This means that most Android devices are probably not encrypted. Only 1.2% of Android smartphones on the market run Marshmallow. And keep in mind that Google has very little control over how and when phones are updated to the latest system; smartphone manufacturers and mobile operators control this.

Let’s say our hypothetical Samsung Galaxy S6 was encrypted. How would the FBI do it?

Galaxy S6 – and the upcoming Marshmallow-powered Galaxy S7 – have encryption enabled by default, according to a Samsung spokeswoman. But the government is unlikely to turn to Google for help getting into a phone, said Chris Soghoian, senior technologist at the American Civil Liberties Union. Not only is the Android landscape complicated, but manufacturers, not Google, are responsible for signing security certificates that prove their software is genuine, he said.

And Google wouldn’t be able to circumvent security measures on other companies’ devices. According to Google, it generally can’t update firmware – the code that controls a phone’s chips, processors and other hardware – on phones it doesn’t make, which means it can’t. not modify a phone to accept new software.

So it all depends on the phone manufacturer?

This seems to be the case, especially if the government wanted a company to create new software specifically to circumvent security measures, as is the case in the Apple case. Here’s Soghoian again: “If the government wanted the kind of help it’s asking from Apple, it would go to Samsung rather than Google.” It would be up to Samsung, as the phone maker, to determine how much help it would provide and whether it should fight the same fight as Apple.

Still, because Android is configured the way it is, law enforcement may have a few more avenues of entry, said Tyler Shields, vice president of strategy at web application security firm Signal Sciences. He said “the update chain ends up going from Android, to hardware vendor and service provider – everyone has their hand in the process.” And that means, in theory, the government could look to more than one player in this chain if it wanted to make software changes to a device, which the government wants Apple to do in the case of the iPhone. used by one of the San Bernardino shooters.

But with Apple, the options are limited.

“Apple has chosen to take a hard line on chip ownership down to software,” Shields said. “And by doing that, they don’t have to let people in – they don’t have to let people have the ability to change the product if they don’t want to.”

Where do Samsung and other phone makers stand in this debate?

A Samsung spokeswoman sent us the following statement, specifically noting that creating backdoor changes to software that allows government access could harm its reputation:

“Ensuring trust in our products and services is our top priority. Our phones have encryption that protects privacy and content, and they have no backdoors. When necessary and as part of the law, we work with law enforcement agencies. However, any requirement to create a backdoor could undermine consumer confidence.”

Generally speaking, Samsung states in its terms of use that it will hand over user information to law enforcement in certain cases, such as “when we are required to do so or to protect Samsung and its users.” Another part of its terms and conditions specifically states that it may provide information “to comply with the law or respond to required legal process (such as a search warrant or other court order)”. In other words – like almost all tech companies – Samsung seems to assess these things on a case-by-case basis.

Samsung itself has an encryption system called Knox, which has helped it gain approval for use in government work. According to the spokesperson: “Samsung cannot decrypt user’s encrypted phones. The encryption key is randomly generated for each user and the key is protected by the user’s password.” What we don’t know is if Samsung would create new technology to circumvent its own security measures. Samsung did not directly respond to questions on this topic.

We also don’t know the one from HTC, LG, Lenovo or most other phone makers. The only other phone makers to date that have given explicit support to Apple are Microsoft – which makes Windows phones – and Google.

© 2016 The Washington Post