India proposes new smartphone rules, firms raise concerns

India plans to require smartphone manufacturers to share their source code with the government and make software changes under new security proposals, according to documents and sources familiar with the matter.

The draft rules would also require firms to notify authorities of major software updates.

Users would be allowed to uninstall pre-installed apps, block background use of cameras and microphones, and have automatic malware scanning.

Tech firms including Apple, Samsung, and Xiaomi have raised concerns, saying the requirements have no global precedent and could expose proprietary information.

India’s IT ministry said it is open to addressing industry concerns during ongoing consultations.

The proposals are being considered as legal requirements in a market of nearly 750 million smartphone users.

🔗 Source: Reuters

🧠 Food for thought

Implications, context, and why it matters.

Open questions on India’s draft rules and certification paths

Public updates omit legal basis, enforcement tools, and timelines. MeitY (Ministry of Electronics and Information Technology) posted draft Mobile Security Guidelines (MSG) in July 2022, then removed them without clarity on consultation status 1.
The 2022 MSG draft cited standards for communication tech from the International Telecommunication Union (ITU) and 3rd Generation Partnership Project (3GPP) 1. It also named IEEE and National Institute of Standards and Technology (NIST) work 1. It did not name Indian certification bodies that would verify compliance. India runs Common Criteria Test Laboratories (government-accredited facilities that evaluate IT product security) under MeitY 2. Sites are in Kolkata and Delhi. Bengaluru and Mumbai also host labs. It is still unclear whether these labs have the mandate or capacity to review source code access and automatic malware scanning at national scale.

Implications for security compliance vendors and India’s certification ecosystem

Software companies that build compliance tools should target India-specific asks in the proposals. Focus areas include uninstallable preloads, mic or camera background controls, and automatic malware scanning. Teams should also work with India’s four Common Criteria labs 2 to map current evaluation paths. These labs already run evaluations under the Indian Common Criteria Certification Scheme 2 (a national program for certifying IT product security).
Investors can watch companies building modular security Software Development Kits (SDKs) that smartphone makers could use to meet proposed rules. The 2022 MSG draft cited privacy protections aligned to the since-withdrawn 2019 Personal Data Protection (PDP) Bill 1. That signals ongoing attention to user data protection, which could widen demand for compliance infrastructure.