A recent complaint filed on Tuesday by the American Civil Liberties Union (ACLU) with the Federal Trade Commission, requested that the agency investigate the US's four major wireless carriers into their practice of providing Android updates to customers. The ACLU are concerned that a large majority of Android handset users are being left behind in the update curve. This means that there are an alarming number of people that are exposed to an ever increasing amount of Android malware due to software left unpatched as a result of the lack of updates.
Whilst this is clearly a problem and puts people at risk, another element of the 'lack of updates' debate (an example of which recently highlighted by the Xperia Blog) is how often and for how long after release should owners of handsets expect to receive updates to the software running on their phones.
I own a Sony Xperia S which is the handset spotlighted by the Xperia Blog in it's example of customer frustration at the lack of updates. I bought the Xperia S on the promise that Sony would be releasing Android version 4.0 (aka Ice Cream Sandwich) soon after release. When my phone arrived, said update was available and has worked great since the day it was installed. For me I'm happy with what was promised and I feel I can't join the seemly large contingent of owners complaining that Sony have yet to release the next Android version (4.1, Jelly Bean). However what I do expect is that for a reasonable amount of time that Sony (and their carrier partners) release at the least security updates to keep my phone protected from known risks.
The big question is for how long should this be the case?