The NSA Released a Security-Hardened Version of Android
In 2012, the National Security Agency publicly released SE Android, a security-enhanced derivative of the Android operating system built on top of the Android Open Source Project. The initiative extended the NSA’s earlier work on Security-Enhanced Linux into the mobile space, applying mandatory access control policies to the Android platform. The source code was made freely available for download and compilation.
What SE Android Actually Did
SE Android applied granular, policy-driven access controls to every file, folder, and system resource that Android could interact with. Rather than relying solely on Android’s standard permission model, SE Android enforced mandatory security policies at the operating system level, meaning that even if an application was compromised, it could not access resources outside its designated permissions.
Network security received significant enhancements across both Wi-Fi and cellular connections. The existing Android application permission system was augmented with multi-level security classifications, allowing administrators to define access tiers that restricted what data and system functions each application could reach.
Building SE Android Required Significant Technical Expertise
Deploying SE Android was not a consumer-friendly process. Users needed to download the latest Android Open Source Project code, then apply the SE Android modifications on top of it. The build process was officially supported only on Fedora Linux, though other operating systems were theoretically compatible. The project documentation assumed familiarity with compiling Android from source and working in Linux and Unix-based environments.
At the time of release, SE Android was designed to run on the Android emulator and the Google Nexus S smartphone. Support for other devices was limited, and the project offered minimal guidance for those attempting to port the system to additional hardware.
The Irony of Trusting the NSA With Mobile Security
The release raised an inherent tension: users interested in maximum mobile security were being asked to trust an intelligence agency known for large-scale surveillance operations. While the open-source nature of the project meant that the code was publicly auditable, the involvement of the NSA prompted skepticism from privacy advocates who questioned whether security tools developed by a signals intelligence agency could be fully trusted. Nonetheless, the underlying SELinux technology developed by the NSA had been widely adopted in the Linux ecosystem and was generally regarded by the security community as a legitimate and effective access control framework.
