Why in News?

• The Union Government is considering legally enforcing Indian Telecom Security Assurance Requirements (ITSAR) for smartphones, involving 83 security standards, including source code disclosure, software controls, and user-permission restrictions.
• This has triggered strong resistance from global smartphone makers like Apple (5% market share in India), Samsung (15%), Google, and Xiaomi (19%), who argue that many provisions lack global precedent and threaten proprietary technologies.

What’s in Today’s Article?

• Background
• Key Features of the Proposed Security Standards
• Key Challenges and Way Ahead
• Conclusion

Background:

• India is the world’s second-largest smartphone market with nearly 750 million users.
• Rising online fraud, cybercrime, and data breaches have prompted the government to strengthen device-level security.
• The proposals align with the Indian PM’s broader push for digital security and data sovereignty.
• Similar tensions have emerged earlier over mandatory cyber safety apps (later revoked), and stringent testing norms for security cameras due to national security concerns.

Key Features of the Proposed Security Standards:

• Source code disclosure:
  • Manufacturers must submit proprietary source code for review and vulnerability analysis by government-designated labs.
  • Objective: Detect backdoors and systemic vulnerabilities.
  • Industry response:
    • The Manufacturers’ Association for Information Technology (MAIT) calls it “not possible” due to corporate secrecy and privacy norms.
    • No such requirement exists in the EU, North America, Australia, or Africa.
• Background permission restrictions:
• Apps cannot access camera, microphone, or location in the background. Mandatory continuous status-bar alerts when permissions are active.
• Concern: No global precedent or standardized testing method.
• Permission review alerts: Devices must periodically prompt users to review app permissions. Industry wants alerts limited to “highly critical” permissions to avoid user fatigue.
• One-year log retention:
  • Phones must store security audit logs (logins, app installs) for 12 months.
  • Industry concern: Consumer devices lack sufficient storage capacity.
• Periodic malware scanning: Mandatory automatic malware scans. Concerns: Battery drain, slower device performance, etc.
• Removal of pre-installed apps: All non-essential pre-installed apps must be removable. Companies argue many apps are integral system components.
• Mandatory notification of software updates:
  • Manufacturers must inform the National Centre for Communication Security before releasing major updates or patches.
  • Industry view: This will be impractical during zero-day vulnerabilities. Delays may increase user exposure to active cyber threats.
• Tamper detection (Rooting/Jailbreaking): Devices must detect tampering and show persistent warnings. Industry response: No reliable universal detection mechanism exists.
• Anti-rollback protection: Blocking installation of older software versions, even if manufacturer-signed. Concern: No global standard; may restrict legitimate use cases.

Key Challenges and Way Ahead:

• Data Security vs proprietary rights: Risk of exposing trade secrets. Risk-based regulation focusing on critical vulnerabilities rather than blanket controls.
• Lack of global precedent: Potential regulatory overreach. Adopt global best practices aligned with OECD and EU cybersecurity norms.
• Ease of doing business: Compliance costs may deter investment. Ensure time-bound clearance mechanisms for security updates. Strengthen user-level security awareness alongside device-level controls.
• Operational practicality: Update delays, battery drain, storage constraints. Explore independent third-party audits instead of direct source code disclosure.
• Innovation chill: Excessive regulation may impact R&D. Maintain a balance between national security, privacy, and innovation.

Conclusion:

• India’s proposed smartphone security framework (ITSAR) reflects legitimate concerns over cybersecurity, data protection, and national security in a rapidly digitising economy.
• However, enforcing intrusive measures like source code disclosure without global precedent risks undermining innovation, trust, and market competitiveness.
• A consultative, proportionate, and globally harmonised approach is essential to safeguard users while preserving India’s attractiveness as a major digital and manufacturing hub.