For years, critics have bemoaned the sad state of security updates available to hundreds of millions of owners of mobile devices running Google's Android operating system. Now, federal regulators are investigating whether Google, Apple, and the rest of the players in the mobile industry are doing everything they can to keep their customers safe.

In a joint action, the Federal Communications Commission and the Federal Trade Commission are ordering mobile operating system developers, hardware manufacturers, and carriers to explain their rationale in deciding when to issue updates, or as is so often the case for Android users, why they don't provide updates. Two of the more glaring examples are a vulnerability dubbed Stagefright disclosed last year and another disclosed in March called Metaphor. Both allow attackers to surreptitiously execute malicious code on Android devices when they view a booby-trapped website.

"There have recently been a growing number of vulnerabilities associated with mobile operating systems that threaten the security and integrity of a user’s device and all the personal, sensitive data on it," Jon Wilkins, chief of the FCC's Wireless Telecommunications Bureau, wrote in a letter to carriers. "One of the most significant to date is a vulnerability in the Android component called 'Stagefright.' It may have the ability to affect close to 1 billion Android devices around the world. And there are many other vulnerabilities that could do just as much harm."

Google has released updates that fix both Stagefright and Metaphor, but millions of end users are unable to receive them. That's because carriers and manufacturers often don't permit updates until they have been thoroughly tested. The result: tens of millions of phones that only sporadically–and in some cases never—receive such fixes. Last year, following the Stagefright disclosure, Google implemented a monthly rollout of updates available to a small set of Android users, including owners of Google-branded Nexus devices. Besides being limited to an extremely select group of users, this program has also been problematic because it routinely takes a week or more for the fixes to be pushed out to all customers.

Feet to the fire

Some of the information the FCC is demanding from carriers includes:

• The period of time that a specific device model will be supported for security updates, including the frequency or timing of security updates;
• The Company’s process for developing a security update to address the vulnerability, including whether and how any other entity identified in [a previous]
  response ... was involved in developing or testing the security update; and
• If a security update for the vulnerability was not deployed to end-user devices, whether the company notified consumers that the specific device model would not receive a security update for the vulnerability.

Information the FTC is demanding from OS and hardware makers includes:

• the factors that they consider in deciding whether to patch a vulnerability on a particular mobile device;
• detailed data on the specific mobile devices they have offered for sale to consumers since August 2013;
• the vulnerabilities that have affected those devices; and
• whether and when the company patched such vulnerabilities.

It may seem unfair that Apple and its partners are among those receiving the same scrutiny when the company's iOS is widely regarded as the model for timely mobile security updates. There's some legitimacy here, but at the same time, the responses are likely to provide a stark contrast with those coming from Google and its partners.

In 2013, the American Civil Liberties Union asked the FCC to take action against the four major US carriers for selling millions of Android phones that never, or only rarely, received updates. More than three years later, the availability of timely updates hasn't shown much improvement, in part because carriers blame the delays on manufacturers and vice versa. The coordinated probe of OS developers, carriers, and device makers may not lead to a longterm solution either, but the feds should at least be commended for giving it a try.