India plans stricter smartphone security rules, including source code access

The Centre is proposing to require smartphone manufacturers to share their source code with the government and make multiple software changes as part of a broader security overhaul, prompting opposition from major technology firms such as Apple and Samsung, Reuters reported quoting people familiar with the matter.

The proposals are part of a package of 83 security standards that would also require companies to alert the government to major software updates. Technology firms say the measures lack any global precedent and risk exposing proprietary information, according to four Reuters sources and a Reuters review of confidential government and industry documents.

The plan is part of Prime Minister Narendra Modi’s efforts to strengthen user data protection as online fraud and data breaches rise in India, the world’s second-largest smartphone market with nearly 750 million devices.

IT Secretary S Krishnan told Reuters that “any legitimate concerns of the industry will be addressed with an open mind,” adding it was “premature to read more into it.” A Ministry spokesperson said no further comment could be made due to ongoing consultations with technology companies.

Disagreements over security requirements

Apple, South Korea’s Samsung, Google, China’s Xiaomi, and the Manufacturers’ Association for Information Technology (MAIT) did not respond to requests for comment.

Technology companies have previously pushed back against government mandates. Last month, the Centre revoked an order requiring a state-run cyber safety app to be installed on smartphones after concerns were raised over surveillance. Last year, however, it pressed ahead with stricter testing rules for security cameras amid concerns over Chinese spying.

Xiaomi and Samsung, whose phones run on Google’s Android operating system, account for 19% and 15% of India’s smartphone market, respectively, while Apple holds a 5% share, according to Counterpoint Research.

Among the most sensitive provisions in the proposed Indian Telecom Security Assurance Requirements is access to source code — the programming instructions that enable smartphones to function. The documents show this code would be analysed and possibly tested at designated laboratories.

The proposals also require software changes to allow pre-installed apps to be removed and to block apps from accessing cameras and microphones in the background “to avoid malicious usage.”

“Industry raised concerns that globally security requirements have not been mandated by any country,” a December IT Ministry document said, summarising meetings with Apple, Samsung, Google and Xiaomi.

The standards were drafted in 2023 but are now under focus as the government considers giving them legal backing. IT Ministry officials and technology executives are scheduled to meet on Tuesday, January 13, 2026, for further discussions, sources said.

Companies say source code review not feasible

Smartphone makers closely guard their source code. Apple declined requests from China for access between 2014 and 2016, and U.S. law enforcement agencies have also failed to obtain it.

The Centre’s proposals on “vulnerability analysis” and “source code review” would require companies to conduct a “complete security assessment,” after which Indian test labs could verify claims through source code analysis.

“This is not possible due to secrecy and privacy,” MAIT said in a confidential document prepared in response to the proposals and reviewed by Reuters. “Major countries in the EU, North America, Australia, and Africa do not mandate these requirements.”

A source with direct knowledge said MAIT asked the Ministry last week to drop the proposal.

The proposals would also mandate automatic and periodic malware scanning on devices. Manufacturers would need to inform the National Centre for Communication Security about major software updates and security patches before release, with the government retaining the right to test them.

MAIT said regular malware scanning significantly drains battery life and that seeking government approval for software updates is “impractical” because updates often need to be rolled out quickly.

The Centre has also proposed storing system logs — digital records of device activity — on smartphones for at least 12 months. “There is not enough room on the device to store one-year log events,” MAIT said.

(With inputs from Reuters)