Sophos News

Android Lollipop 5.1 brings promised anti-theft “kill switch”

Google just announced a new version of Android, Lollipop 5.1, which it says includes some “tasty additions” along with improved stability.

One of the major new features, called Device Protection, fulfills a pledge Google made to the law enforcement group Secure Our Smartphones last year to add a kill switch to Android devices.

Device Protection lets you remotely lock and delete all the data from a lost or stolen device, and even freeze the device completely.

You can get the device back into working order, but a simple “factory reset” is not enough, so even crooks who steal your phone for the phone alone, and don’t care if it’s wiped, are out of luck.

It’s the Android version of what’s known on the iPhone as Activation Lock or Find My iPhone.

According to Secure Our Smartphones, the addition of the kill switch in iPhones running iOS 7 and iOS 8 has cut iPhone thefts dramatically in cities like San Francisco, New York and London – because, they say, would-be thieves have learned they can’t resell them.

Although a remote lock-and-wipe feature is available on most Androids already, Device Protection promises to go beyond the Android Device Manager feature available on older versions.

In Android 5.1, Device Protection is enabled automatically when you set a screen lock and link the device to your Google account.

With Device Protection turned on, your lost or stolen device can only be unlocked with your Google account login, and it will remain inoperable even if a thief resets the device to factory settings.

A Google account username and password are required to complete the setup process after a factory reset – without the login, the device is essentially “frozen” for anyone but the rightful owner.

Google’s remote-wiping technology didn’t previously meet the definition of a kill switch established by the state of California, which passed a law requiring such a feature in smartphones sold in the state after July 1, 2015.

Android Device Protection appears to meet the requirements of the California law, at least as it is interpreted by the Save Our Smartphones coalition, which called Google’s new technology a kill switch in a press release in February.

Android’s chief security engineer, Adrian Ludwig, said last October that Lollipop 5.0 would include the kill switch (which he referred to then as Factory Reset Protection), according to CNET – but Android Device Protection wasn’t made available until Lollipop 5.1.

Google also promised last September that all Lollipop devices would come with encryption enabled by default, but has since pulled back due to “performance issues” on many devices.

According to Google’s announcement on the Android Official Blog, Device Protection “will be available on most Android phones and tablets shipped with Android 5.1 in addition to Nexus 6 and Nexus 9.”

As for other Android devices, it could be months before they get brought up to Lollipop.

Unlike iPhones, which are all built by Apple, Android devices come from multiple manufacturers who need to make the software work with their hardware – and even then wireless carriers may wait months to push the updates out on their networks.

While any iPhone user who wants to upgrade to the newest version of iOS can do so at any time (version 8.2 just came out), Android users usually have to wait – or buy a new phone with the new version installed.

Android 5.1 is the third update to Android since Lollipop was introduced in October 2014, but many users of Google’s own Nexus smartphones aren’t up to date yet, and only about 3% of all Android devices are currently running Lollipop.

Image of computer key kill switch courtesy of Mega Pixel / Shutterstock.com.