Interoperability vs. Security: Why not both?

An open internet where people can freely build, share, and remix each other's work is a powerful engine of grassroots innovation we’ve all benefited from. In recent decades, however, corporations have taken control of an increasing share of this work, giving them a greater ability to stifle challengers and limit our choices. When regulators address this by mandating that  tech giants play fair by requiring interoperability, the gatekeepers respond with a tired refrain: Playing fair puts users’ security at risk.

Unfortunately for these trillion-dollar companies, this gotcha isn’t the end of the conversation. Regulators can ensure that meaningful choice and security thrive.

Lawmakers have been catching up, recognizing that the best way to rein in big tech is to require these oligopolies to open up their platforms to independent developers. As we explained six years ago, mandating interoperability helps prevent the misuse of people’s data and enables more privacy-respecting alternatives. Tech giants, in contrast, have been arguing that our data is safer when they have exclusive control.

Tech Giants Claim Interoperability Means Insecurity

The European Union’s Digital Markets Act (DMA) put interoperability into law under Article 6(7): “gatekeeper shall allow providers of services and providers of hardware, free of charge, effective interoperability with” a designated Core Platform Service they operate. The language describes an unambiguous requirement to remediate vendor lockouts and anti-competitive behavior of the major service operators—it is not optional.

Apple claimed that enforcing this obligation in mobile app stores would put their customers at risk and do irreparable harm to trust in their brand. It’s an argument reminiscent of Apple’s fight against the right to repair, and in both instances the company is fighting to maintain its restrictive ecosystem to stop people from finding better deals elsewhere. Apple has long cultivated a more corporate-controlled experience with the iPhone, but this argument is now also being used for the relatively-more-open Android devices from Google.

In the same year Apple argued against the DMA, Epic Games sued Google for its restrictive terms of service and extractive policies for revenue generated in apps. Google predictably alleged that opening up its platform to other app stores it couldn’t vet would allow harmful apps to be installed. The case was ultimately decided this year in the U.S. federal appeals court for the Ninth Circuit, with the court rejecting this argument, dealing a blow to  Google’s feudal security arrangement, and paving the way for third-party app stores to be delivered as apps via the Google Play Store.

Interoperating Secure Systems Can (and Should) Exist

Policymakers cannot take tech giants’ claims at face value. Companies have every incentive to resist interoperability requirements, because interoperability lowers practical barriers and reduces switching costs for consumers adopting competing services. 

Even where companies offer credible claims from internal technical and security experts, independent experts rarely have the access and information they need to tes