Is Android open source?

There is a screen buried in the settings of almost every phone, usually under "about", called open source licences. Scroll it. On my last device it kept going for a long time — screen after screen of project names, most of which mean nothing to the person holding the phone, all of them acknowledging that this device is built out of work somebody gave away.

That screen exists because licences require it. It is the only place where the arrangement is visible to an ordinary user, and almost nobody has ever opened it. I find that gap interesting: the most widely deployed software in human history is also the least visible.

What is open in an Android phone

The foundation is. The kernel is the same one running on servers, published under a copyleft licence, which is why manufacturers must release their kernel modifications. The layer above it — the base operating system, the parts that draw windows and manage applications and handle the phone being a phone — is published as an open project that anybody can download and build.

So in terms of lines of code, the honest answer is that the overwhelming majority of what runs on your phone is open. But lines of code is the wrong measure, and this is where the interesting part starts.

What is not, and why it matters more

Three categories sit on top of that open base, and together they determine what the device actually does.

The first is the services layer — the account system, the app store, the location services, the push notifications, the mapping. Proprietary, and effectively mandatory in practice because applications are built against it. Take an open build of the base system and install it, and you discover very quickly how much of a modern phone is not the operating system.

The second is the manufacturer's own layer. The interface, the camera application, the preinstalled software. Closed, and it is where most of the differences between two phones running the same base system actually live.

The third is the one almost nobody thinks about and the one that matters most for how long a device lives: the firmware. The code that runs the radio, the camera sensor, the fingerprint reader, the power management. Closed, supplied by the chip manufacturer, and it is the reason a phone stops getting updates. Not because the open parts stopped being maintained — they carry on for years — but because the chip vendor stopped supplying updated closed components for that generation of hardware.

I find this the single most useful thing to know about the whole arrangement, because it explains a pattern that otherwise looks arbitrary. The open parts of a device age gracefully. The closed parts set the expiry date. That is true of phones and it is true of the computers I refurbish, which is why the same machine can be finished under one system and fine under another.

Who checks any of this

The honest answer is: fewer people than the phrase "anyone can audit it" suggests, and more than nobody.

Nobody reads an entire operating system. What actually happens is narrower and more effective than the romantic version: security researchers examine specific components, often because they are paid to or because a bug bounty exists; academic groups analyse particular subsystems; competing manufacturers examine each other's contributions with considerable attention; and independent projects that build their own versions of the base system notice when something changes underneath them.

That is not ten thousand volunteers reading every line. It is a smaller number of motivated specialists with the ability to look — and the difference between "few people look" and "nobody can look" is the entire point. A closed component has zero possible auditors outside its owner. An open one has however many care, which is usually small and is never zero.

What to do with this information

Nothing dramatic. I am not going to suggest you install an alternative phone system; I have done it, it is educational, and for most people the loss of the services layer is not a trade worth making.

What is worth taking is a purchasing habit. Ask how long a device will receive updates before you buy it, because that answer is a statement about the closed parts and it is the only specification that determines how many years the thing will be safe to use. Manufacturers now state it, which is progress, and comparing two devices on that number is more useful than comparing them on almost anything else.

And open that licences screen once. Not because it will tell you anything actionable, but because it is the only moment where the scale of the thing is visible: a list of hundreds of projects, written by people who were not paid by the company that sold you the device, without which the device in your hand would not exist.