Android: Nightmare or Dream for Enterprise IT?

Google's Android announcement has set off a series of brushfires across the blogosphere, with commenters ranging from those who dismiss the open-source mobile platform as "lame," "vaporspeak" (our own Eric Zeman), and "nothing 'new' here," to those who believe that every other mobile platform including the iPhone has instantly become obsolete.Wall Street Journal biz/tech blogger Ben Worthen stepped in a big pile yesterday when he called Android "A Business-Tech Nightmare Waiting to Happen" because of its open nature, meaning that anyone will be able to write software applications to it. Worthen got dozens of flames from the penguin-head community accusing him of being an "idiot" who lacks all understanding of open-source software. He backtracked in a subsequent post, saying his original piece had been "sloppy."

But his point remains, and it's a valid one: corporate IT managers are going to be leery of any phones running on Google's mobile platform not because open-source platforms are inherently insecure, but because the operating system itself can be modified and customized by users, and because monitoring and vetting applications loaded onto Android-based phones will be more difficult than doing so for BlackBerry devices and ones running Windows Mobile. (I can feel the flaming messages starting to hurtle toward the comments field as I type …)

"Enterprises would like to see large applications vendors build to Android before they sign up for the platform," Maribel Lopez, vice president and principal analyst at Forrester Research, told InformationWeek yesterday, "and they also want to ensure the platform is secure before they move critical data to these devices."

Here's what mobile security firm F-Secure had to say on its blog:

"The key issue here is whether Android will go for totally open systems or whether they will adopt a system for signing approved applications (such as Symbian) … If unsigned and unknown applications written by anyone have full access to phone features, we smell trouble."

Exactly. An Android-based phone can be every bit as secure as smartphones based on operating systems from RIM, Microsoft, and Symbian. But they might not, and without an SDK (software development kit) or actual platform code to look at, there's no way of knowing. IT managers are paid to be suspicious of new platforms - many are still getting used to the idea of employees using Google's Web-based applications for the desktop, much less mobile tools -- and they will be of this one, too. But the future clearly lies with open standards and open source in the mobile world, and IT departments will have to learn to deal. I thought this comment, from "IT Guy" on the WSJ blog, summed it up nicely:

"If security is so much an issue then why would companies allow the use of Microsoft products such as Windows Mobile? Microsoft has a notorious record of security holes in their OS's."

IT learned to live in a Windows world, with tons of third-party applications and plenty of security patches. It has learned to live in the Linux world on the desktop. It will adapt to the Linux-based Android world on mobile devices, too.

As for those who dismiss the Android announcement, and the Open Handset Alliance consortium formed to manifest it, better think again. Even in the absence of an actual platform to show off, Google's long-awaited entry into the mobile realm is a game-changer. As I put it to all the sources I talked to on Monday and Tuesday (each of whom agreed, by the way), "The finger is finally out of the dike" of the carrier-dominated, walled-garden, proprietary-platform mobile Web. Hesitant or not, enterprise IT will be better off for it - it's just going to take a few years to come to full fruition.