Why App Store security is no longer Apple's silver bullet

In an hour-long judgment hearing this week, Australian Judge Jonathan Beach not only delivered one of the most anticipated verdicts of the year, but also sent shockwaves through the tech industry with his finding that Apple and Google misused their market power and breached competition law.

But the real showstopper came when the judge told the crowded Melbourne courtroom that he had dismissed Apple’s much-touted security defense. It turns out the iPhone maker’s insistence that the restrictions it imposed on its App Store were justified for security reasons wasn’t the silver bullet the company had been banking on to shield it from liability.

In the Federal Court of Australia judgment hearing, Beach ruled that during the relevant periods, both Apple and Google held substantial market power and contravened Section 46 of the 2010 Competition and Consumer Act, which deals with the misuse of market power (see here).

The ruling came five years after Fortnite developer Epic Games first filed the lawsuit, alleging that the two companies had abused their market power and engaged in anticompetitive conduct in the markets for app distribution and in-app payment solutions (see here and here).

And while the full judgment has yet to be released, Beach singled out Apple in saying that while its centralized app-distribution system may have offered security benefits, these can’t be an excuse to exclude third-party developers.

“The fact that Apple has imposed a centralized app-distribution system for the purpose of protecting security does not entail … that there is not also a substantial anticompetitive purpose involved,” he said.

In short, two things can be true at the same time: you can protect users and still abuse market power.

The fact that Beach’s ruling relied on a logic that had been accepted in a similar US case in 2021, in which Apple was able to avoid an adverse finding, was significant.

During last year’s 16-week marathon trial in Melbourne, Apple leaned hard on its privacy and security credentials, parading a lineup of experts and top brass — most coming from the US to repeat their well-rehearsed testimony — to deliver the same message: security is Apple’s unique selling point.

The witnesses argued that blocking sideloading and third-party app stores was necessary to prevent malware and fraud. As for forcing developers to use Apple’s in-app payment system, or IAP, for in-app digital content, that was just to ensure clean, secure transactions, Apple had argued.

During one cross-examination, Craig Federighi, Apple’s senior vice president of software engineering, conceded that the sky hadn’t fallen after the EU’s Digital Markets Act opened up the App Store to competition. But while users in the bloc continue to have a safe and transparent iPhone experience, Federighi said it is a compromised experience (see here).

That the iOS developer would follow the same script as its US trial wasn’t surprising — after all, US District Judge Yvonne Gonzalez Rogers concluded that Apple’s security justifications for the App Store restrictions were both “valid and nonpretextual” (see here).

But Beach begged to differ. “Apple may have had a security purpose in preventing direct downloading or sideloading, but that does not deny other substantial purposes,” he said.

The judge accepted that the quality of Apple's offerings, including its distribution services, was, in part, a function of the “premium-style security” that Apple offers and combines in its centralized app distribution system. “So, it is a relevant non-price factor,” he said.

However, “any security beneficial effects in maintaining a centralized distribution system, in my view, do not outweigh any anticompetitive effects flowing from Apple's conduct,” he said.

The judge, who had spent a year writing his verdict, also noted that Apple allows alternative in-app payment solutions for the purchase of physical goods and services on iOS apps, including food-delivery apps. The suggestion being: other payment systems can be accommodated.

In a statement to MLex, Apple said that it “strongly” disagreed with the court’s ruling on some of Epic’s claims.

Among Beach’s unpalatable rulings for Apple is the conclusion that the company has substantial market power in the two markets identified: iOS app distribution and in-app payment solutions market. MLex understands this is the first time a court has found that Apple is a monopolist in the relevant markets.

“Apple faces fierce competition in every market where we operate,” the tech giant said.

“We continuously invest and innovate to make the App Store the safest place for users to get apps and a great business opportunity for developers in Australia and around the world,” it added.

— Google’s marginal edge —

While Google’s fate was similar, Beach’s ruling was nuanced, suggesting that the search giant was slightly more open to third parties than Apple — albeit, not to the point of allaying competition concerns.

Beach found that Google misused its market power in two of the three markets he recognized: the Android app-distribution market and the Android in-app payment solutions market.

The third market he accepted included the supply of operating systems to the OEM, or original equipment manufacturers, market. But for this one, Beach ruled that Google hadn’t breached the provisions of the act.

In the judge’s view, Epic had failed to prove that the technical restrictions relating to install flows and frictions had been imposed by Google, or had been maintained by Google, for the purpose of substantially lessening competition.

“I have not accepted Epic's case concerning the technical restrictions that [Epic’s lawyer] Dr Ruth Higgins … so ruthlessly pursued during the course of this litigation,” he said.

The judge accepted that the security warnings that pop-up when a user attempts to directly download or sideload an app from outside the Google Play Store amounted to overkill. But it wasn’t anticompetitive.

“What I'm saying is that Google's technical restrictions were disproportionate to protect the security risks, but it doesn't flow from that that it had an anticompetitive purpose or effect in imposing them,” he said.

Beach’s ruling came despite the testimony of Google Security Engineering Manager Sebastian Porst in a May 2024 hearing, where he acknowledged that the security warnings that appeared during sideloading created “install friction” and didn’t provide any meaningful guidance about the trustworthiness of the app’s developer.

During cross-examination, Higgins asked Porst, “Do you agree that the text in the Chrome browser warning does not convey any information to the user to enable them to make an assessment of the likelihood that the app to install is malicious?” Porst replied: “I would agree with that” (see here).

In announcing his decision yesterday, Beach also made a subtle but pointed comparison between Apple and Google’s operating systems. Referring to Google’s ban on allowing another app store to be downloaded from within the Google Play Store — a restriction the company said was intended to prevent security issues and free-riding — Beach noted that Android still permits sideloading from other sources.

“Given the other avenues for the direct downloading or sideloading of alternative Android app stores, in my view, no actual or likely anticompetitive effect has been shown in the relevant markets,” Beach said.

In a statement to MLex, Google said that it welcomed the Australian court’s recognition of Android’s open platform compared to Apple’s closed system.

However, Epic did win the key arguments in its legal challenge to both Apple and Google, and the company was pleased with the outcome, as revealed by a post from Chief Executive Officer Tim Sweeney.

“Victory in the Australian antitrust proceedings of Epic v Apple and Epic v Google! Fortnite will return to the Land Down Under through Epic Games Store at a date to be determined,” he said.

It’s a ruling sure to reverberate through global antitrust circles. However, closer to home, Australia’s competition watchdog might find more than a few takeaways in the judgment’s 2,000-plus pages once it’s published.

In a statement to MLex, the Australian Competition & Consumer Commission, or ACCC, said the ruling was an example of how private enforcement of competition laws can complement public enforcement and has the potential to enhance deterrence (see here).

Some observers have already pointed out that Epic did the heavy lifting that the ACCC could have done itself. However, the real story may yet prove to be the butterfly effect this ruling sets off across the global digital landscape for years to come.

Please e-mail editors@mlex.com to contact the editorial staff regarding this story, or to submit the names of lawyers and advisers.