In a rare step away from increased security around personal data, Amazon confirms its latest operating system will no longer encrypt its customers’ data

Amazon has quietly removed the ability to encrypt data stored on its Fire tablets, streaming media devices and Kindle e-readers with the latest update to the Fire OS operating software.

The change, which has been confirmed by Amazon, could make private documents, financial data and other sensitive information vulnerable to attack.

Previous versions of Amazon’s operating system allowed consumers to encrypt their device’s storage, and the Android platform on top of which Fire OS is built also supports full-disk encryption by default. The latest update to the operating system, by contrast, tells users to save their data or wait to install the new Fire OS.

Full-disk encryption is often used to protect information stored on a device, even if it’s lost or stolen. Without it, owners of Fire tablets and Kindle e-readers risk the possibility of having their data compromised by someone who steals their device or attempts to access its storage after it’s been thrown away.

“In the fall when we released Fire OS 5, we removed some enterprise features that we found customers weren’t using,” an Amazon spokeswoman said in a statement. “All Fire tablets’ communication with Amazon’s cloud meet our high standards for privacy and security including appropriate use of encryption.”

Consumers are often advised to install new software as it becomes available because the updates often address security vulnerabilities discovered in previous versions. Yet they now face a choice between using the new version of Fire OS, code-named Bellini, or securing their personal data.

“Upgrading is really your only protection against all of the prior exploits that have been taken advantage of in older versions of the software,” says independent security researcher Jonathan Zdziarski.

Amazon does not appear to have mentioned the removal of full-disk encryption from Fire OS in any public materials related to the update, which has been rolling out to the company’s products since September. Customers seeking an explanation of the change on the company’s support forum are unanswered.

The change is curious for several reasons, not least of which being that Amazon has pledged to support for Apple as it fights a court order compelling it to create a backdoor so that the FBI can access an iPhone used by one of the San Bernardino shooters.

Amazon chief technology officer Werner Vogels also voiced his support for Apple on 21 February at the Mobile World Congress trade conference in Barcelona.

“We believe that you cannot have a connected business, or an internet-connected business and not make security and protection of your customers your number one priority,” Vogels said, according to the Arc tech blog. “Encryption plays a very, very important role in that ... it is one of the few really strong tools we have so customers know that only they have access to their data and nobody else.”

Amazon recalls Fire 7 and Kids Edition power adapter over electrical shock risk Read more

Yet customer complaints on Amazon’s support forum indicate that the company had already removed the ability to encrypt data on Fire OS devices when Vogels made his remarks. The company has, effectively, created a public facade that supports encryption even as it removes security features from its products.

“Actions speak louder than words, and removing encryption says a lot more to me than releasing statements in support of Apple, especially when you’re a manufacturer of devices that can also support encryption,” said Electronic Frontier Foundation staff technologist Jeremy Gillula.

“When you’re a device manufacturer that’s also in control of the software, there’s really no good reason not to make sure that you can support default encryption. It definitely seems like there is quite a bit of hypocrisy there.”