Apple’s awkward security calculus

This week, Apple published a white paper in support of its position that the App Store be the only source of app distribution on iOS devices. The white paper comes on the heels of the introduction of five bills to the US House in early June that, collectively, form an aggressive legislative salvo against “big tech.” One of the bills in the set, The American Innovation and Choice Online Act, specifically targets self-preferencing by “designated platforms.” This blog post, containing a crossfire of legal academic work between anti-trust lawyers, is a good survey of the monopoly arguments and counter-arguments related to the App Store.

Apple’s white paper proposes that, were iOS to allow the sideloading of apps, users’ iPhones would be subjected to a relentless onslaught of scams and security exploits, rendering all of their sensitive personal data subject to invasive collection from malicious actors. The paper suggests that a shadowy army of security exploiters and hackers is drooling over the opportunity to invade the 1 billion iPhones that are currently active, and all that is keeping them at bay, currently, is the App Store’s position as the sole legitimate distribution point for apps on iOS devices. From the paper:

iPhone is used every day by over a billion people – for banking, to manage health data, and to take pictures of their families. This large user base would make an appealing and lucrative target for cybercriminals and scammers, and allowing sideloading would spur a flood of new investment into attacks on iPhone, well beyond the scale of attacks on other platforms like Mac. Scammers would be galvanized to develop tools and expertise to attack iPhone device security. The App Store is designed to detect and block today’s attacks, but changing the threat model would bypass these protections. Scammers would then use their newly developed tools and expertise to target third-party stores as well as the App Store, which would put all users at greater risk, even those who only download apps on the App Store. The additional distribution channels introduced by sideloading provide malicious actors expanded opportunities to exploit system vulnerabilities, thereby incentivizing attackers to develop and disseminate more malware.

The problem with this positioning is that we know what an open app ecosystem that allows for multiple points of distribution looks like: Android. And while Android users are at more risk of security exploitation than iPhone users (a good example is Fortnite’s launch outside of Google Play, which I detail in Why did Epic publish Fortnite on Google Play?), the Android ecosystem is far from the frail, pregnable consumer hellscape that Apple describes above as the fate of any open platform that features multiple stores. In fact, only about 24% of global app downloads take place on iOS devices, according to the Wall Street Journal / Sensor Tower:

In its legal filing in the Epic v. Apple suit, Apple repeatedly highlights the competition the App Store faces as a games distribution storefront, for example with:



Apple has utilized contradictory logic. iOS can’t simultaneously claim that it can’t open its platform to sideloading and other app distribution storefronts because consumers won’t tolerate it, while also highlighting just how little of the market for installs and consumer attention it captures relative to a platform that does allow for those things. Android has more than 70% of the global smartphone install base and, as per above, generates about 76% of global smartphone app installs. Clearly, security is not the sole factor upon which consumers rely in buying a smartphone.

Apple can propose that malware and security exploits will proliferate on iOS if it allows for sideloading or alternative app stores, but it cannot propose that consumers won’t stand for that. Consumers are more price-sensitive than security or privacy-sensitive: it’s awkward for Apple to argue that its security advantages preference it with consumers while also leaning on its minority market share relative to Android as support for not being a monopoly.

Photo by Emiliano Bar on Unsplash