A startup on a shoestring budget is working to clean up the Android security mess, and has even demonstrated results where other “secure” Android phones have failed, raising questions about Google’s willingness to address the widespread vulnerabilities that exist in the world’s most popular mobile operating system.

“Copperhead is probably the most exciting thing happening in the world of Android security today,” Chris Soghoian, principal technologist with the Speech, Privacy, and Technology Project at the American Civil Liberties Union, tells Ars. “But the enigma with Copperhead is why do they even exist? Why is it that a company as large as Google and with as much money as Google and with such a respected security team—why is it there’s anything left for Copperhead to do?”