India Proposes Mandatory Source Code Sharing for Smartphones, Drawing Pushback from Apple and Samsung

India has drafted a sweeping set of security regulations that would force smartphone manufacturers to hand over their operating system source code to government-designated testing labs. The proposal, part of a broader 83-point security framework, has triggered intense, behind-the-scenes resistance from Apple, Samsung, and other major device makers who view the mandate as an unprecedented risk to their intellectual property and global security architecture.[1][2]

The draft framework, known as the Indian Telecom Security Assurance Requirements (ITSAR), is positioned by the government as a necessary defense against rising online fraud in a market of nearly 750 million smartphone users. Under the proposed rules, manufacturers would have to submit their source code—the foundational instructions that dictate how iOS and Android operate—for "vulnerability analysis" and "source code review."[2][3]

While the government frames this as a consumer protection measure, the reality of implementation tells a different story. Handing over proprietary source code to third-party labs expands the attack surface, creating new potential leak points for trade secrets and zero-day vulnerabilities. The industry consortium MAIT, representing Apple, Samsung, Google, and Xiaomi, explicitly told the government that compliance is "not possible" due to secrecy and privacy constraints.[1][4][5]

Beyond the source code handover, the ITSAR draft includes a requirement that could fundamentally alter how devices are maintained. Manufacturers would be forced to notify the National Centre for Communication Security about major software updates and security patches before releasing them to users, giving the agency the right to test them first.[1][4]

This creates a glaring paradox: a policy marketed as enhancing security would actively delay the deployment of critical, time-sensitive patches. If a zero-day vulnerability is actively being exploited, waiting for a government lab to approve the patch leaves millions of users exposed during the bureaucratic review process.[3][4]

The 83-point framework doesn't stop at code review. It also mandates that devices perform automatic, periodic malware scanning—a process that manufacturers warn would significantly drain battery life. Furthermore, the rules would require phones to store digital logs of system activity locally for at least 12 months, a demand that companies argue exceeds the storage capacity of many entry-level devices.[1][5]

Not all of the proposed changes are hostile to users. The framework includes mandates that would allow consumers to completely uninstall pre-loaded applications—often referred to as bloatware—and block apps from accessing cameras and microphones in the background. These specific provisions align with broader global trends toward user empowerment, even as the source code demands diverge sharply from international norms.[1][4]

The pushback highlights the global stakes of localized tech regulation. There is currently no precedent in North America, Europe, or Australia for mandating source code disclosure as a baseline regulatory requirement for consumer electronics. While India's IT ministry has publicly stated that consultations are ongoing and denied that the source code mandate is finalized, the existence of the draft has forced the industry to draw a hard line. If implemented, the framework could fracture the global smartphone ecosystem, forcing companies to choose between compromising their core security architecture or exiting the world's second-largest market.[2][3][5]