Android Developer Verification: Threat disguised as Protection
It may seem alarming, but the reality is that if you use an Android 8 or higher device, a silent "virus" has been installed on it and awaits remote activation. It's not the work of shadowy hackers, but rather Google itself. It is estimated that up to 4 billion Android handsets and tablets are already infected, meaning that potentially half of humanity is at risk from this threat.
This "virus" masquerades as a harmless process called "Android Developer Verifier" (ADV). It runs surreptitiously in the background as a system service with full root privileges, untouchable, undisableable, and unremovable. And, unlike common malware, Play Protect – Google's malware scanning and remediation service – not only fails to detect it, but is the very vector through which it is transmitted and installed. The goal? To block the execution of software from developers not centrally approved by Google.
Threat Disguised as Protection
Google rationalizes the Android Developer Verification program as a solution to curb the spread of malware. However, ADV offers no capability to prevent a malicious actor from distributing malware in the first place. The only alleged benefit is that it can delay the actions of an already identified repeat offender, requiring them to create (or purchase) another account to continue distributing their malware with a new signing key.
For this rather narrow threat vector of malware recidivism, considerably less drastic solutions have been proposed. Play Protect itself could be enhanced to more closely examine newly installed apps with elevated permissions or obtained through suspicious channels, leveraging recent advances in on-device security features. Or a system of federated verifiers could be implemented, where end-users would choose their own trusted curators and authorities for prior approval. Instead, Google has used this minor vector as a pretext to radically redesign the entire Android ecosystem by decree, overturning an 18-year tradition of open software development and positioning itself as the sole global guardian of which applications are allowed to exist.
The Terms of Service Trap
Should a developer choose to register with Google as a "verified" developer, they must expect to sign up for an account, pay a fee, provide detailed personal information, upload government-issued identification, and then register the identifiers and signing keys for all applications they intend to distribute (now or in the future).
But the most insidious stage is the compulsory agreement to the Android Developer Console (ADC) Terms of Service. There are numerous causes for concern in this document, but the most unsettling of all must be clause 6.5: "If You violate any of the Terms or if You distribute malware or other harmful applications, Google may terminate Your access to the ADC…"
This clause, which sounds reasonable, raises the question: what exactly does "malware" mean? No definition of the term can be found anywhere in the document. In the absence of any formal definition, standard, or guideline, it implicitly states: "...and 'malware' means whatever we say it means."
As we have discussed in other contexts, it is dangerous to allow the terminology of a debate to be defined by those who do not have your best interests at heart. "Malware" being synonymous with "software we don't like" means that Google can unilaterally dictate – whether driven by commercial incentives or compelled by a sufficiently powerful government – what the definition of "malware-of-the-day" will be.
As a precedent, personal content filters in the form of "ad blockers" have long been banned from the Play Store, and they have even classified some instances as malware. How long will it take for them to designate all ad-blocking software as malware, block its installation on all certified Android devices worldwide, and permanently designate all developers of this class of software as malware creators? Such a measure would certainly align with their commercial incentives as a global ad-tech monopolist, and would be entirely consistent with the language of their ADC Terms and Conditions.
Why This Matters
Despite Google's claims that "over 99% of applications [from Play Store developers] have been registered" – a misleading statistic, as most were automatically included without informed consent due to existing agreements – opposition to this program is overwhelming. Hundreds of thousands of people have signed petitions, and an Open Letter has been signed by over 70 organizations worldwide, including the EFF, FSF, and ACLU.
Android Developer Verification is not a protection, but a threat to the openness that has defined Android for years. It is an attempt to centralize control over what can and cannot run on billions of devices, transforming a vibrant, open ecosystem into a walled garden where Google is the sole gardener. For developers, this means less freedom, more bureaucracy, and the constant risk of having their work arbitrarily classified as "malware" by an entity with conflicting commercial interests. It is crucial that the developer and user community be aware of and resist this fundamental shift in the nature of Android.