India proposes security overhaul for smartphone manufacturers, asks for source code, claims report; IT Ministry refutes

In a significant move aimed at enhancing cybersecurity, the Indian government is reportedly considering a major overhaul of security regulations for smartphone manufacturers. According to a Reuters report, this proposal could force companies to disclose their proprietary source code, a measure that has raised alarms among leading tech firms such as Apple, Samsung, and Xiaomi. The initiative arises from a draft consisting of over 80 new security standards, known as the Indian Telecom Security Assurance Requirements (ITSAR). This framework would require manufacturers to submit their source code to government-approved laboratories for thorough vulnerability testing. The government’s intent is clear: to safeguard the country’s 750 million smartphone users from escalating risks of data breaches and online fraud, a direction strongly backed by Prime Minister Narendra Modi’s administration. However, the proposal has not gone unnoticed by industry leaders, who have voiced strong opposition. The Manufacturers' Association for Information Technology (MAIT), representing significant industry players, has labeled the request as "not possible," citing concerns over the sensitive nature of intellectual property and the broader implications for global corporate privacy policies. Critics also point out that such demands are unprecedented in major markets like the European Union and the United Kingdom, where similar access to core software is not required. Beyond source code disclosures, the draft regulations propose additional measures that are causing apprehension within the tech sector. One notable requirement would compel manufacturers to alert the government about major software updates and security patches before their public release, potentially allowing for governmental testing prior to deployment. Experts warn that this could delay critical updates and affect device performance. Another point of contention is the proposal for devices to conduct automatic malware scans regularly, which could adversely affect battery life. Additionally, the regulations suggest that manufacturers store system activity logs for a minimum of 12 months. However, many manufacturers argue that most smartphones lack the necessary internal storage to accommodate such extensive log retention. In response to the growing concerns, India’s IT Secretary, S. Krishnan, emphasized that the government is open to addressing the industry's legitimate worries and deemed it "premature" to reach any final conclusions. The Press Information Bureau of India has clarified that no definitive regulations have yet been established and that discussions with stakeholders are ongoing. A high-level meeting between IT ministry officials and tech executives is anticipated this week to further deliberate on the regulatory framework. Additionally, the IT ministry has publicly refuted claims regarding the pursuit of source code from smartphone manufacturers, without providing further details on the documents referenced by Reuters.