Does the use of Android One remove the risk of OEM spying?

Question

China is forcing tourists to install text-stealing malware at its border.

Also, U.S. intelligence officials imply that Huawei, ZTE devices aren't safe for consumers (even in the West).

Some suggested avoiding Chinese phones:

Consider a scenario where you may use a Hauwei or KTE phone to have a
conversation with a friend or a work colleague. It could be a
discussion about a business deal, a programming project youâ€™re working
on, or important business meetings. You could inadvertently pass along
proprietary information to a foreign government without even realizing
it.

What global intelligence communities are hinting to the world is that
there is enough evidence in their posession to warrant banning these
phones from military bases and governments. Even if you donâ€™t believe
them, history has turned up enough wrongdoing by these companies to
justify very real concern.

Avoiding phones made by Chinese manufacturers is a good start.

Assuming the accusers are correct, does the use of Android One, as is done by some Xiaomi phones, reduce the risk of OEM spying on you, or is Android One irrelevant here?

(There is a difference between trusting an American company, like Google, subject to US laws and regulations, and trusting a Chinese OEM)

— MWB | Sources

Answer

AndroidOne can lower risk of spying due to vendor's negligence or non-systematic action (e.g., one employee adds some spying code without anyone else in the company knowing about that). The more modifications are there, the more places to inject some malicious modification and the more employees to care about.

You might argue that the vendor is just replacing the code from Google, so this is exchange of one potentially risky part for another part with the same risk. However, I would assume that the code from Google (especially the AOSP parts) get much more scrutiny both internally (within the vendor) and externally (by phone vendors and others).

When talking about some backdoors intentionally added (and probably approved by the management), AndroidOne cannot protect you. It might be harder to find a suitable place, but there always will be some:

There can be an additional app in AndroidOne. Nokia is known to add a controversial app for battery management. While this one is not known to be malicious, it shows that Android One can be less pure than you think.

The phone vendor can add some hardware-based backdoor.

The phone vendor can claim it is AndroidOne, while actually not fully being AndroidOne. This can be even obscured in some ways, so it is not noticable from the OTA update packages.

— v6ak | Sources

Does the use of Android One remove the risk of OEM spying?

Topics