More from Epic v. Google: everything we learned in Fortnite court

In other words, Epic Games could make Fortnite a trusted, non-scare-screen app by getting it notarized, but other developers wouldn’t have to if they’re fine with more warnings.

Google asked if Apple would have a field day if it dropped its sideloading warnings — setting up a straw man, since Mickens doesn’t propose dropping them entirely.

I think I got one word wrong in this quote, but this is almost entirely what he said:

“I think if Google did not replace those sideloading warnings with something that protects users, then Apple would make some hay out of that.”

He’s Epic’s witness again, just to go over some fine points of what he told Google.

“You agree with the concept of asking users for consent before you allow one app to be an installer on the phone, right?” Yes.

In a March video deposition, Mickens suggested that the discriminatory nature of the scare screens (that is to say, they don’t pop up when you install via Google Play, only third-party stores and sideloaded apps) was his primary remaining concern with them.

Professor Mickens admits he doesn’t know if APKFab reviewed this app at all, and that the “com.tveemobilee.nitflix” file hosted there is likely not a legitimate app.

The point, I assume, is that decentralized notarization would lead to confusion about which websites have legitimate apps? We didn’t quite get to that.

Wonder if a jury will take that into account. Surely, Epic will ask the same question of Google’s expert now.

Speaking of Google’s expert, a Professor Qian — Google says Qian warned Epic’s expert that agencies like CISA recommend against one of his suggestions (I missed which, sorry), and he admits he didn’t incorporate those warnings into his report.

Correction: We’re now learning it’s Professor Qian, not Chen. Dr. Zhiyun Qian. I apologize for the error.

“You don’t say how much Google should charge for a centralized app review process, right?”

The phrases “Cost to Google: ???” and “Cost to developers: ???” appear on Google’s slide, which is clearly designed to suggest Mickens hasn’t thought his proposal through.

Google’s point seems to be that his proposal would give Google more, not less control and burden, but I’m not seeing the problem with that just yet...

Now Google’s asking whether Mickens asked any OEM or developer if they’d prefer it that way. “You didn’t ask any OEM whether they’d be willing to accept this change, correct?”

Mickens says no.

Google puts a phrase up on the screen: “Would OEMs agree: ???” It appears alongside “Google carries the entire burden for Android App Review” and “Warning screen for any app not reviewed by Google.”

Here are some of Mickens’ words that are being thrown back at him now, from his written report:

Google is narrowly asking him about his “centralized” approach, though — he also suggested a decentralized one.

“Would your proposals require Google to police the entire internet?” asks Epic’s attorney, referring to this quote from earlier in the trial.

“They would not,” replies Mickens, pointing to existing third-party entities like Verisign, Digicert, and GoDaddy — and saying that Google already trusts some of them with websites it displays in Chrome. (I don’t know if I buy that third parties do a good job in the aggregate.)

Mickens has even been asked about the testimony of witnesses that were in this courtroom on previous days, and he’s been ready to go.

Then, if you click allow, and an app has not yet been scanned and reviewed by Google, there’d be a second optional friction screen:

What do you think?

“I agree on a high level that friction, when it’s proportional and commensurate to the risk... is appropriate,” he says.

He thinks a single screen should be enough to get the user’s informed consent.

“Now the malware scanner’s going to run, and it’s going to look and see if the app you were trying to install is malicious,” Professor Mickens tells the jury.

Mickens says it’s Google’s most important protection against bad apps.

Judge Donato interrupts to ask: “Could all those other steps be skipped and a user go directly from ‘I’d like to install it’ to the GPP stage?”

Mickens won’t go quite that far: “I don’t think they should be skipped.” He promises to come back to that point in a couple of slides.

Judge Donato interrupts: “If you’re downloading an app from the Play Store, do you see the same warning?”

“No, you do not see this warning,” says Mickens. He continues:

“It’s the same app, it’s just Wikipedia, it’s not like the potential nature of its maliciousness has changed... that’s a problem, and that’s why it’s important to look at these warning screens.”

That’s core to Epic’s case — it wants the court to decide that Google has one monopoly on Android app distribution, and another on in-app payments.

Google already has both automated and human review mechanisms on and off Play to help with this, he says.

Yet even on Google Play, some scam apps get through.

It’s a little opaque, but I think he’s saying Google knows it needs to provide security outside the Play Store, already attempts to do this, and could do more.

There’s also a Compatibility Definition Document and a Compatibility Test Suite to make sure phones are compliant.

“User Apps”

“AOSP Middleware” and “GMS Middleware” and “OEM & SOC Middleware”

“AOSP Kernel”

and at the bottom, “Hardware.” The AOSP and middleware items are all within an “Operating System” bracket.

He says that based on a review of Google’s source code, documents produced for the court, public statements, and academic articles, Google has “under-resourced its security monitoring of off-Play distribution channels” and “has the ability to identify and review apps at the point of installation.”

We’ve heard Google’s security boss suggest the latter isn’t possible: “We can’t make the internet safe.”

His conclusions, as presented to the jury: