Last year the Nexus 6 handset arrived with full data encryption enabled out the box. Google also pushed its hardware partners to do the same at first, but now appears to have quietly changed the requirement with a strong recommendation to enable encryption by default.
The performance issues with Google’s Nexus 6 in November, particularly with regards to read and write disk speeds, which it attributed to the encryption. How much of an impact did the tests show?
In some cases, the new Google Nexus 6 was slower than the Nexus 5 it was designed to replace, even though the handset had improved internal components. Google did say in September of 2014 that the then called Android L software — later to become Android 5.0 Lollipop — would have encryption enabled by default out of the box. New devices with Android 5.0, however, don’t have the security feature enabled: The new $149 Moto E with LTE, is a perfect example. So what’s changed? Google’s Android Compatibility Definition document is what’s changed; specifically, the section on disk encryption with Google making emphasis on what it recommends:
If the device implementation has a lock screen, the device MUST support full-disk encryption of the application private data (data partition) as well as the SD card partition if it is a permanent, non-removable part of the device. For devices supporting full-disk encryption, the full-disk encryption SHOULD be enabled all the time after the user has completed the out-of-box experience. While this requirement is stated as SHOULD for this version of the Android platform, it is very strongly RECOMMENDED as we expect this to change to MUST in the future versions of Android.
Essentially, Google has gone back to having encryption as an option for new Android 5.0 devices, not a requirement: They must support it but it isn’t necessary to enable it by default. However, the last sentence in the guidelines indicates that hardware partners should be ready for this to change back in a future version of Android. Most mainstream Android users won’t know that they should enable encryption their device or simply don’t know how. If Google reduced the requirements due to performance, it finds a way to address the root cause of the issue and then get device encryption back as a default option.
