India proposes contentious security overhaul for smartphone manufacturers, asks for source code: Report

In a significant shift in policy, the Indian government is contemplating a comprehensive security overhaul for smartphone manufacturers, as reported by Reuters. This initiative could impose stricter regulations that would require companies to share their proprietary source code with government-sanctioned laboratories for security assessments. The proposed framework, known as the Indian Telecom Security Assurance Requirements (ITSAR), is part of a broader effort led by Prime Minister Narendra Modi's administration to enhance digital sovereignty and protect the country's 750 million smartphone users from escalating cyber threats and online fraud. The draft includes over 80 new security standards designed to bolster user safety. However, these proposals have raised alarms among leading tech giants like Apple, Samsung, and Xiaomi, prompting strong resistance from the industry. The Manufacturers’ Association for Information Technology (MAIT), representing major players, has criticized the requirements as "not feasible," citing concerns over intellectual property sensitivity and existing global privacy standards. Beyond the contentious source code disclosure, the draft regulations introduce additional requirements that have sparked further concern among manufacturers. Notably, companies may need to inform the government of significant software updates and security patches prior to their public release, effectively allowing authorities to examine them in advance. Moreover, the regulations suggest that devices conduct automatic malware scans regularly, a move that experts warn could adversely affect battery performance and overall device functionality. Also under consideration is a mandate for devices to retain system activity logs for a minimum of 12 months, a requirement that manufacturers argue could be impractical due to storage limitations on many devices. In response to these developments, India’s IT Secretary, S. Krishnan, assured that the government is open to addressing the industry’s legitimate concerns, emphasizing that it is too early to make definitive conclusions. The Press Information Bureau has clarified that no final regulations have been established yet, with ongoing consultations with stakeholders. A high-level meeting between IT ministry officials and tech executives is anticipated this week to further explore the proposed regulations.