Interoperability vs. Security: Why not both?
An open internet where people can freely build, share, and remix each other's work is a powerful engine of grassroots innovation we’ve all benefited from. In recent decades, however, corporations have taken control of an increasing share of this work, giving them a greater ability to stifle challengers and limit our choices. When regulators address this by mandating that tech giants play fair by…
In the ongoing debate between interoperability and security in the digital world, it is clear that the two should not be mutually exclusive. The open internet, which has fostered grassroots innovation, has seen corporations gaining control over a larger share of online work. As regulators intervene to mandate fair practices, tech giants respond with claims that imposing interoperability would compromise users' security.
However, this argument is not without its flaws. Lawmakers are catching up, recognizing that the best way to rein in big tech is to require these oligopolies to open up their platforms to independent developers. Mandating interoperability can help prevent the misuse of people's data and enable privacy-respecting alternatives.
The European Union's Digital Markets Act (DMA) mandates interoperability, requiring gatekeepers to allow providers of services and hardware to communicate with designated Core Platform Services without charge. Apple, for instance, has argued that enforcing this obligation in mobile app stores would put their customers at risk, citing concerns about brand trust.
Similarly, Epic Games sued Google for its restrictive terms of service and revenue-generating policies, which Google has countered by alleging that opening its platform would allow harmful apps to be installed.
Despite these claims, policymakers must not take tech giants' words at face value. Independent experts are often unable to verify these technical and security assertions. Instead, policymakers should recognize that when interoperability and information security are set as essential and non-negotiable criteria, secure interoperable systems can and should exist.
A prime example is the cross-platform rollout of Rich Communication Services (RCS) and Message Layer Security (MLS) on top of it, which has created end-to-end secure messaging between Android and iOS devices. Google has been a proponent of this standard, campaigning for Apple to adopt it, thereby improving messaging security for all users.
When legitimate security concerns arise, they should be assessed and addressed on a case-by-case basis, without sacrificing user agency. Retrofitting interoperability into already secure closed systems should not be done carelessly, as components developed with privileged access can pose significant security risks. To ensure a balanced approach, regulators should strike the right pressure and leniency to allow for the necessary time and precision in renovations.
For cases where security concerns are valid, regulators can offer guidance and technical implementation support while providing clarity on regulatory compliance. Policymakers must proceed with care, ensuring that disruptions do not last indefinitely and that closed systems are impartially evaluated and given sufficient time to implement changes.
Written by urgent.news from EFF Deeplinks's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
