Just under two years ago, HTC's CEO responded to public pressure by making an equally public promise: "We will no longer be locking the bootloaders on our devices." Today, that promise is only half-kept by HTC, while other manufacturers have an even spottier record when it comes to keeping the Android ecosystem as "open" as its intended reputation. The bootloaders are locked, and the carriers are holding the keys.
The bootloader, if you're unfamiliar, is basically the low-level bit of software on a computer that allows the rest of the operating system to start up — a nerdy little piece of code that turns out to be important if you want to tinker with the phone to make it do what you want. If the bootloader is locked, you can't put your own operating system on the phone; if it's unlocked, you're free to delve into the life-extending and carrier-free world of custom ROMs.
The carriers are holding the keys
Now that the biggest flagship Android phones of 2013 are out and available, we thought we'd check in on the state of their bootloaders. As you've probably guessed by now, it's not a pretty picture — so far as we know, the major carriers in the US by-and-large continue to force manufacturers to lock the bootloaders on their phones.
However, the situation is not quite as dire as it sounds. Samsung has occasionally created "developer editions" of its flagship phones with unlocked bootloaders, though it generally offers them at a later date. HTC and Sony both have done the same. Developer editions are not ideal solutions — they are full-priced, unsubsidized phones and not always available on your carrier — but they're at least an option. Android hackers are also adept at finding ways to unlock bootloaders despite the carrier’s best efforts. Even Motorola’s famously locked-down handsets have recently been opened up and there's hints that the Galaxy S4's locked bootloader is also hackable.
HTC has also created a system wherein you can register your phone's unique identifier and then receive an unlock key. That system still applies today to the HTC One — most customers can visit HTC's site and get the code to unlock their bootloaders. HTC keeps a record of which phones have been unlocked just in case it comes up in a warranty situation, the company says, though it hasn't shared that data with the carriers.
When we asked Samsung which of its phones were locked, the company simply wouldn't say — we were directed to ask each carrier individually. HTC tells The Verge that two carriers out of the over 185 that are carrying the One have blocked unlocking. HTC would not say which two carriers have blacklisted the One from being unlocked, though.
The two most likely candidates are also the two most obvious ones
So we asked around and discovered that the two most likely candidates are also the two most obvious ones: AT&T and Verizon. The bootloader is locked on both the Samsung Galaxy S4 and the HTC One on both carriers. Verizon has yet to actually announce that it will carry the One, but rumors strongly suggest that it will. We asked Verizon why it continued to lock the bootloader on Android phones and the answer we received is the same we heard back in November: to ensure an "outstanding user experience." Here's what Verizon has to say about bootloaders:
Our position on open bootloaders doesn't change with the phone. Customers expect a certain level of service from us. Any time a device is modified which can happen with an open bootloader, we cannot guarantee device performance, security, or the outstanding user experience our customers have come to expect. Additionally, Verizon takes device security very seriously and an open bootloader can compromise the security of the device. A secure bootloader does not deny, limit, or restrict a customer from accessing or downloading applications using the device capabilities.

 HTC One Samsung Galaxy S4
Verizon Locked, unlock blacklisted (rumored) Locked
AT&T Locked, unlock blacklisted Locked
Sprint Unlockable Unlocked
T-Mobile Unlockable Locked
Bootloader plans as told by each US carrier
As is often the case, the underdogs are more willing to tout openness amongst the big four US carriers. Sprint and T-Mobile are more supportive of HTC's program to unlock the bootloader. Sprint says that the bootloader can be unlocked on the HTC One and the Galaxy S4 comes unlocked. T-Mobile says that the bootloaders on both the HTC One and the Galaxy S4 are locked, but that it won’t prevent customers from unlocking them. It also gave us a rather un-un-carrier statement about bootloaders that mirrored Verizon’s:
T-Mobile does not prevent customers from unlocking the bootloader; however, we are committed to delivering an optimal experience on our devices for T-Mobile customers, and the installation of unauthorized firmware can negatively impact that experience. Additionally, this will help prevent device fraud, as well as security threats that may result from third-party firmware that has not been tested by T-Mobile and its OEM partners.
Open for business, not users
So the current state of openness on Android, at least for the two big-name manufacturers, is a mixed bag. The largest carriers continue to keep their devices locked down as much as possible, while the smaller carriers are slightly more willing to let tinkerers and hackers dig in.
The most surprising thing of all — or perhaps it's not really all that surprising — is that neither HTC nor Samsung are even willing to go on the record about exactly what the software controls are on the devices they make. The classic complaint about Android's so-called "openness" is that it's open to the carriers, not to the consumers. Though we've made some progress, we're not there yet: the flagship Android phones of 2013 are still being locked down by the flagship carriers.