Reconciling Interoperability and Security in Tech

• Big tech companies frequently use security risks as a justification to resist mandatory interoperability requirements.
• Security and interoperability are not mutually exclusive; they can and should be treated as essential design principles.
• Regulators must avoid accepting corporate claims at face value and instead implement balanced, phased oversight to ensure compliance without compromising security.

The Security Myth

• Corporations like Apple and Google argue that opening platforms to third parties inherently threatens user security and trust.
• This narrative is used to maintain restrictive ecosystems and suppress competition, such as Apple's opposition to the EU's Digital Markets Act (DMA) and Google's arguments against third-party app stores.
• The U.S. Court of Appeals for the Ninth Circuit rejected Google's security arguments in its case against Epic Games, facilitating more open app distribution.

Proven Success in Standards

• When security and interoperability are both treated as non-negotiable requirements, the result is more robust and feature-rich systems.
• The adoption of Rich Communication Services (RCS) and Message Layer Security (MLS) between Android and iOS demonstrates how standard-based interoperability can improve user security rather than diminish it.

A Path Forward for Regulation

• Regulators should assess legitimate security concerns on a case-by-case basis rather than allowing them to become indefinite delays for compliance.
• A tiered approach is recommended: provide technical guidance and leniency during the initial retrofitting of closed systems, followed by strict enforcement.
• By embedding both interoperability and security into the design phase, the tech industry can create an internet that provides both freedom and safety.