India Plans 83 Security Standards for Smartphone Manufacturers – Source Code Access and Delays Remain Controversial

Summary

India plans to require smartphone manufacturers to comply with 83 security standards. The requirements include controversial provisions such as government testing laboratories' access to proprietary source code, blocking background app access, and advance notification of security updates. The industry association MAIT rejects several requirements, arguing that they are economically and technically unviable. The Indian government is still in consultation with technology companies and signals openness to legitimate concerns.

People

• IT Secretary Krishnan

Topics

• Smartphone security standards
• Source code transparency
• Tech industry regulation
• Data protection and confidentiality

Detailed Summary

The Indian government is planning a comprehensive ruleset with 83 security standards for smartphone manufacturers. The catalog, developed in 2023, is now set to be enforced as binding. The requirements address legitimate security concerns but significantly conflict with manufacturers' business interests.

The most controversial provision concerns "full security assessment": Indian testing laboratories should gain access to proprietary source code of devices to identify vulnerabilities. This violates the established protection of trade secrets. The industry association MAIT – which represents, among others, Apple, Samsung, Google, and Xiaomi – vehemently opposes this and calls on the IT Ministry to remove the requirement.

Other critical requirements include:

• Uninstalling pre-installed apps: Users should be able to remove apps unless they are essential for basic phone functions. MAIT argues that many apps are system-critical.

• Limiting background app access: Apps must not access camera, microphone, and location when the phone is not actively in use. MAIT misses clear testing methods.

• Visible root detection: Devices should clearly show when they have been rooted and suggest correction measures to the user. This could disturb users with intentionally rooted devices; manufacturers say reliable detection methods do not exist.

• Advance notification of updates: Manufacturers should inform India's National Center for Communication Security before delivering updates and security patches. This carries the risk of dangerous delays in critical security fixes.

However, the Indian government signals willingness to engage in dialogue. IT Secretary Krishnan emphasized that legitimate industry concerns would be examined without prejudice. A precedent from December 2025 illustrates this: after India wanted to force manufacturers to install a government security app, the government quickly backtracked following broad criticism.

Key Statements

• Source code access: The demand for government laboratories to access proprietary smartphone source code is a central point of conflict between government and industry.
• Feasibility disputed: Several standards are criticized by manufacturers as technically unrealistic or economically unfeasible.
• Security vs. user autonomy: Some requirements (e.g., root visibility) conflict with user freedoms.
• Delay risks: Mandatory advance notification of security updates could delay critical patches and endanger security.
• Regulatory trend: India's approach reflects a global trend toward stronger tech regulation.
• Consultative stance: The government remains open to negotiations, as a recent reversal showed.

Stakeholders & Those Affected

Opportunities & Risks

Action Relevance

Relevant for decision-makers:

1. Monitor: Follow negotiations between Indian government and manufacturers. The process could have precedent character for other emerging markets.

2. Strengthen communication: Manufacturers should constructively propose alternative solutions to source code disclosure (e.g., third-party audits).

3. Balance security: Governments should weigh genuine security objectives against practical implementation barriers.

4. Resolve contradictions: Security updates and patches require speed – advance notification requirements must account for this.

5. Global context: This is part of a broader trend toward tech regulation; similar requirements could emerge in other markets.

Quality Assurance & Fact Checking

• [x] Central statements and figures verified
• [x] Unconfirmed data marked with ⚠️
• [x] Reuters reports validated as primary source
• [x] Bias or political one-sidedness marked

⚠️ Notes:

• The exact timeline for implementation is not known.
• Financial impacts on manufacturers are speculative.
• The Indian government's stance could change quickly (as the December 2025 precedent shows).

Supplementary Research

1. Indian Cybersecurity Strategy: Official papers on the National Center for Communication Security and its mandates.

2. Global Tech Regulation Trends: Comparison with EU Digital Services Act, US regulation, and similar initiatives in other emerging markets.

3. Industry Positions: Statements from Apple, Samsung, Google on source code transparency and security audit standards.

Bibliography

Primary Source:
Heise.de: "With Source Code Access – India Plans Various Obligations for Smartphone Manufacturers" – Based on Reuters reporting

Supplementary Sources:

1. Reuters – Investigative article on Indian smartphone security standards (2023/2025)
2. MAIT (Mobility Association of India) – Official position papers on regulation
3. Indian IT Ministry – Official documents on national cybersecurity standards

Verification Status: ✓ Facts checked as of 2025

Footer

This text was created with the support of Claude.
Editorial responsibility: clarus.news | Fact check: January 2025
Source: Heise.de / Reuters