dozens of users exposed —

Amazon removed device encryption from Fire OS 5 because no one was using it

New Fire tablets and old ones that were upgraded to Fire OS 5 can't be encrypted.

Amazon's $50 Fire tablet, which runs Fire OS 5.
Amazon's $50 Fire tablet, which runs Fire OS 5.
Mark Walton

Update: Amazon will release a software update this spring that will restore encryption support to Fire OS 5.

Original story: In the wake of Apple's high-profile fight with the FBI, more users and journalists have been paying attention to encryption of local storage in phones and tablets. Apple strengthened the encryption on all iDevices in iOS 8, making it so that no one could decrypt the storage without knowing the user's passcode. Google made encryption a requirement for all Google-approved Android phones that ship with Marshmallow (after a false start in Lollipop), and it has been available as an optional Android security feature for years.

Amazon's Fire OS is a fork of Android, based on the Android Open Source Project (AOSP) code but without Google's apps and services or guaranteed compatibility with apps developed for Google-approved Android. Amazon has heavily customized the UI and provides its own app store, but it typically leans on AOSP code for under-the-hood, foundational features—in older Fire OS versions, the optional device encryption was handled the same way it was on any Android device. However, according to user David Scovetta and others on Amazon's support forums, that encryption support has been deprecated and removed in recent releases of Fire OS 5, both for new Fire tablets and for older devices that have been upgraded.

We contacted Amazon for comment, and the company told us that local device encryption support was removed in FireOS 5 because the feature wasn't being used:

"In the fall when we released Fire OS 5, we removed some enterprise features that we found customers weren’t using," Amazon told Ars. "All Fire tablets’ communication with Amazon’s cloud meet our high standards for privacy and security including appropriate use of encryption."

In short, encrypted connections between the Fire tablets and external servers are safe (or, as safe as the server involved and the method of encryption being used will allow for), but thieves and law enforcement officials will be able to grab user data stored locally without much trouble.

Fire tablets aren't as widely used as those running iOS or some Google-approved version of Android, and the tablets Amazon currently sells are slow enough that enabling encryption would significantly impact the user experience. Older devices that haven't gotten the Fire OS 5 update, including the ill-starred Fire Phone, still support encryption. This decision doesn't have the same impact that it would if Apple or Google removed encryption support from their operating systems, and if Amazon's statement is correct it doesn't look like many people were taking advantage of it anyway. But given that Amazon gets encryption support for "free" with the Android source code, it's disappointing to see that the company can't leave the option buried in the settings as it has on older Fire devices.

Channel Ars Technica