The threat at the tip of 2 billion fingers

As smartphone use explodes in China, so does the prevalence of viruses and scams

Kevin Mahaffey had never been to China before, so the priority in his sightseeing activities in Beijing is, at first blush, a little surprising. At the top of the list is not the Forbidden City or a day trip to see the Great Wall, but an afternoon spent shopping for smartphones in Zhongguancun, the huge electronics market in the capital.

"We will run tests on these smartphones," says Mahaffey, co-founder and chief technology officer of Lookout Mobile Security, a US mobile security company.

Mahaffey says the company has already done research on Huawei and Samsung smartphones, which are highly popular in China, and he expects to gain more insight by studying other local phones.

Mahaffey co-founded Lookout with John Hering and James Burgess five years ago, and it says it now has about 25 million registered users, half of them in the US and the rest in about 140 other countries.

At the World Economic Forum in Tianjin in August, Lookout was named a Technology Pioneer, an accolade whose previous recipients include the Internet giants Twitter, Google and Mozilla.

At the end of March there were 220 million smartphone users in China, an increase of 26.6 percent from last year, according to Analysys International, and by next year the number is forecast to rise to 360 million.

"China is probably the most exciting growth market for mobile phones, because you have so many people and interesting companies building Android phones, and lots of innovations are happening," Mahaffey says.

A Chinese version of Lookout was launched in May, he says, and many more Chinese consumers have signed up.

The company's headquarters is in San Francisco, it has an office in London, and it is thinking about opening an office in China.

Mahaffey says the company is also looking at working with local phone makers to embed Lookout in their products. "Our vision is to have every phone in China automatically scanned for malware and totally free."

Li Jia, an analyst with CCID Consulting, a Beijing IT consultancy, says the focus of Internet security has shifted from the personal computer to mobile phones.

"The popularity of the smartphone in recent years has made protecting data on mobile phones a matter of urgency. Smartphones have spread so rapidly in China that most manufacturers and Internet companies have been preoccupied with smartphones and not pushing apps to protect them.

"The mobile Internet has certain characteristics that make it easier to leak private information, such as location-based services permitting apps to visit photos or contact lists."

As more and more people rely on smartphones every day to do financial transactions and business, many are unaware of the risks they face, and Mahaffey says they need to be educated.

One piece of malware circulating in Europe and the US sends text messages in the background, not known to the user, to whose telephone account the messages are eventually charged.

Liu Peng, an analyst with Analysys International, says that the growing circulation of computer viruses has made Android phones the major battlefield of mobile security.

"About 78 percent of viruses are in billing fraud. And in recent months junk mail with viruses have also been increasing."

Liu says that with the popularity of smartphones, the demand by consumers for billing supervision, data synchronization and system management will increase.

Mahaffey acknowledges that security companies have a vested interest in spreading scary reports to prompt consumers into installing security software, but exaggerating the threat can only erode consumer trust, he says.

Lookout will tell people if their phones are safe, but will also tell them what kinds of threats they may face.

"It is a little bit tricky. We want to educate people, not just make them afraid of our products by publishing various kinds of security threats," Mahaffey says.

Mahaffey says he started programming when he was 8 years old, and he later studied electronic engineering.

"Lookout is focused on keeping everyone in the world safe, which is really our aim. We believe that it is very important that you can trust your phone, that you are not afraid of hackers or privacy being compromised when using banking or contacting other people for business.

"In my opinion there is no such thing as a silver bullet, and there is no one thing you can do to stop all problems, because the real world is much more complicated than that."

However, there are different layers of defense, where various malware may be stopped by different walls, and Lookout is one of them, he says.

"We are trying to do different things to keep people safe."

It also helps people become aware of the potential invasion of privacy they face with every button they touch on their smartphones.

Liu says that as consumers opt to use their smartphones for financial transactions, the privacy protection of contacts, SMS and bank passwords is becoming more important.

Mahaffey says: "Privacy can be a very complicated issue, and we build a thing called Privacy Advisor, trying to solve that problem simply.

"Lookout can scan the apps on the phone and tell users what kind of actions these apps are doing and inform users. And if Lookout finds out that one app is about to invade privacy, it will contact the company and some NGO security organizations."

But the biggest threat with smartphones is losing them, he says, and Lookout's software includes an option that helps users locate missing devices by showing them on a map and prompting them to send out an audio signal.

The company reckons that each day $7 million (5.4 million euros) worth of mobile phones are lost worldwide. Lookout says it located 9 million smartphones worth a total of $2.5 billion last year.

The company says it now has backing from several venture capital partners, including Accel Partners, Andreessen Horowitz and Index Ventures.

Though Mahaffey says he cannot disclose detailed financial information, he says the business is prospering. There is a free version and a paid version targeted at business people and professionals.

He says that the company will focus on products right now and grow its business, and may go public at some point.

"The company treats security as a kind of medicine. Even if people cannot pay for it, they can still have it. Our anti-malware portion is completely free; that is a moral issue."

Contact the writers at linjingcd@chinadaily.com.cn and suzhou@chinadaily.com.cn

(China Daily 10/05/2012 page20)