Oracle vs. Google: Android has nothing to worry about

Fear not Android fans, the popular mobile operating system lives to see another day. Android escaped the first round of an infringement trial involving Google and Oracle with few bruises as jurors seemingly could not agree if Android’s use of Javainfringes on Oracle’s rights to the technology.

The jury did find that Google infringed on the structure of Oracle’s Java copyrights but not the platform in total. True infringement was limited to just nine lines of code, far from enough to force Google to completely redesign the innards of Android. Actual monetary damages will now be far less than the $1 billion Oracle demands.

Google also has a possible way out of the entire mess due to the jury’s convoluted decision. While jurors agreed that Google had indeed infringed on Oracle’s Java technologies, they could not agree whether Google’s use could be considered “fair use.” Google lawyers see this as grounds for a mistrial, calling infringement and fair use “two sides of the same coin.”

If the mistrial motion is unsuccessful, the judge will still have to decide the central issue of the case, and that is whether an API is copyrightable. In layman’s terms, APIs are bits of code help programs talk to each other (Android apps use API calls to use the network, or draw on the screen). Copyright law allows for us to place ownership on creative works, but not functional ones — an API is much more functional than creative: it’s a necessary bit to make software work. The judge here must decide whether or not the API is a creative work, an important decision. Agreeing with Oracle here may open up the floodgates of litigation. Look at how much litigation has been generated by patents alone, and then throw APIs into the mix.

Electronic Frontier Foundation attorney Julie Samuels says that such a decision would have broad implications: “APIs are ubiquitous and fundamental to all kinds of program development. It is safe to say that all software developers use APIs to make their software work with other software,” Samuels argues. “Allowing a party to assert control over APIs means that a party can determine who can make compatible and interoperable software, an idea that is anathema to those who create the software we rely on everyday.”

Android seems safe for now

What about Android, and is the operating system in trouble? It appears not. Actual infringement itself is limited to just nine lines of code as I mentioned previously, leaving the whole argument on whether or not APIs are copyrightable as Oracle’s only defense here. If the court disagrees, Google could be liable for as little as $200,000, and wouldn’t have to change much in Android to comply. Considering Oracle was asking for $1 billion, that’s barely a slap on the hand.

Also in Android’s favor is the apparent disagreement over fair use. The jury could not come to a decision, and the concept of fair use must first be struck down for big judgements to occur. While Judge William Alsup has already hinted that he believed Google willfully infringed on Java, the jury was not convinced. That works in Google’s favor should it need to appeal any final decision it deems as too severe.

This case is far from over though. This first phase only dealt with the copyright issues. The second phase now underway addresses the patents, which could still go against Google. The final phase will deal with damages, but the severity of those penalties will be determined by what happens here in the first two phases.

While Oracle has won this first round, Google’s coming out a lot less bruised than it could have.

[Image credit]

Source

EFF reverse engineers Carrier IQ

At this point we have a fairly good idea ofwhat Carrier IQ is, and which manufacturers and carriers see fit to install it on their phones, but the Electronic Frontier Foundation (EFF) — the preeminent protector of your digital rights — has taken it one step further and reverse engineered some of the program’s code to work out what’s actually going on.

There are three parts to a Carrier IQ installation on your phone: The program itself, which captures your keystrokes and other “metrics”; a configuration file, which varies from handset to handset and carrier to carrier; and a database that stores your actions until it can be transmitted to the carrier. Now, the Carrier IQ program is a binary application and fairly hard to reverse engineer, and the database sounds like it’s stored in RAM and thus hard to obtain — but the configuration profile… well, it turns out that that is very easy to crack.

An EFF volunteer, Jered Wierzbicki, reverse engineered the format of these profiles — which were unencrypted — and now, if you understand the Forth programming language, you can see the rules that dictate when Carrier IQ transmits your data to the carrier, and in some cases a hint of what data is being captured. Better yet, Wierzbicki has shared his findings in the form of IQIQ, a program that parse your phone’s Carrier IQ profile into a human-readable XML format.

If you don’t read Forth, you can see an annotated version of the default T-Mobile Carrier IQ profile — but only the section that defines when a handset tries to send data home. The complete, uncommented profile contains rules about which data (“metrics” in codespeak) should be uploaded to the carrier, but as we have no idea what “SS10,” “SS2A,” and myriad other metrics are, we can’t draw many conclusions.

The EFF now has a call-out on XDA-Developers asking Android users to upload their profiles so that Carrier IQ can be better understood. If you have a rooted phone, you’re strongly encouraged to help out — it doesn’t take long to scan your phone for the files, and there’s no risk involved. Don’t forget, though, if you already have CyanogenMod installed, Carrier IQ won’t be on there.

Ultimately, Carrier IQ — not the carriers — aren’t going to tell us the exact extent of the data being keylogged by our own phones. Senator Al Franken squeezed a fair bit of data out of the carriers and OEMs, and he’ll no doubt go back for more, but it’s almost guaranteed that the corporate overlords are holding data back. Hopefully, if the community can produce enough data points, and perhaps if the Carrier IQ software itself can be reverse engineered, we should be able to answer the remaining questions ourselves.

Read more at EFF

Source