Govt. disputes reports that it plans to seek source codes of phones

UPSC Prelims + Mains Study Note

1. At a Glance

• MeitY (Ministry of Electronics and Information Technology) disputed media reports (January 2026) that India planned to compel phone makers — Apple, Samsung, Google, Xiaomi — to disclose operating system source code, calling the consultation "routine." [1]
• The controversy stems from ITSAR (Indian Telecom Security Assurance Requirements), a DoT-issued standard (2023) that does reference source-code access for third-party security audits. [1][2]
• The episode sits at the intersection of national telecom security, sovereignty over digital infrastructure, Big Tech regulation, and the newly enacted Telecommunications Act, 2023. [3][4]
• High UPSC relevance: GS-II (government policy/IT regulation), GS-III (technology & security), and Essay.

2. Why in the News

• 11 January 2026: Media reports (based on a leaked ITSAR draft document) claimed India would legally mandate smartphone OEMs to share their core source code with Indian testing labs as part of a security overhaul. [2]
• 13 January 2026: MeitY issued a press note disputing the reports, describing the exercise as part of its "regular and ongoing engagement with industry on safety and security standards." [1]
• The December 2025 IT Ministry document detailing consultations with Apple, Samsung, Google, and Xiaomi also surfaced, noting that industry had flagged that "globally, security requirements have not been mandated by any country." [2]

3. Background & Evolution

• Predecessor regime: The old Indian Telegraph Act, 1885 had no meaningful provisions for hardware/software security standards of end-user devices.
• ComSec framework (2023): Requires strategically important telecom equipment to undergo mandatory third-party testing at designated TSTLs in India [2].

4. Core Static Facts

Institutional actors

Key terms / definitions

• ITSAR (Indian Telecom Security Assurance Requirements): Security standards framework for ICT/telecom equipment sold/used in India; sets test schedules and procedures.
• Source code: Underlying human-readable programming instructions of an operating system or application — its disclosure to a third-party lab is the contentious ask.
• TSTL (Telecom Security Testing Laboratory): Labs designated by NCCS to test equipment per ITSAR; 9 TSTLs operational as of 2024 [2].
• ComSec: Mandatory third-party testing regime for strategically important telecom equipment, activated 2023 [2].

Enabling law

• Telecommunications Act, 2023 — enacted December 2023; replaces Indian Telegraph Act, 1885; grants government power to set standards, conformity-assessment measures, and security norms for telecom networks and equipment [3][4].
• Section 42(3)(c) — prohibits tampering of telecommunication identifiers (IMEI) [4].
• Section 42(7) — offences related to IMEI tampering are cognizable and non-bailable [4].

ITSAR requirements (as per 2023 draft)

• Source code must be open to third-party audits.
• Companies must intimate the government of any software updates.
• Pre-installed apps must be uninstallable by users.
• Apps must be blocked from accessing cameras/microphones in background [2].

5. Multi-Dimensional Analysis

Legal / Constitutional

• The Telecommunications Act, 2023 is the enabling statute; however, source-code access has not yet been legislated — it exists only in a DoT standard document (ITSAR, 2023) [1][2].
• Compelling source-code disclosure could implicate IP rights under TRIPS (Agreement on Trade-Related Aspects of Intellectual Property Rights) and bilateral trade agreements.
• Draft Telecom Cyber Security Rules 2024 — under consultation — could formalise these requirements; PRS India tracks the bill [5].

Geopolitical / Strategic

• India's demand mirrors broader global conversations: the US has banned certain Chinese telecom vendors (Huawei, ZTE) over source-code/backdoor concerns, yet no country has yet mandated OEM source-code disclosure at the scale India proposes [2].
• The US formally criticised India's local testing and standards regime for telecom and electronics in April 2025, flagging it as a market-access barrier [7].
• Apple, Samsung, Google, Xiaomi all participated in December 2025 consultations — signalling the global stakes of India's ~750-million smartphone market.

Economic

• India is the world's second-largest smartphone market; any mandatory source-code regime could deter OEM investment, delay device launches, and raise consumer prices.
• DoT postponed the mandatory broadband gear testing deadline twice (April 2025 → September 2025 → December 2025) amid US tariff pressure and industry pushback [7][8].
• If enforced, testing costs would be borne by OEMs, potentially passed on to consumers.

Scientific / Technological

• ITSAR covers all ICT and telecom equipment — routers, mobile handsets, core network elements.
• The 9 designated TSTLs cover 27 equipment categories — capacity may be inadequate for the volume of devices sold in India [2].
• Source-code auditing requires specialised cybersecurity expertise; India is building this through C-DOT and academic partnerships.

Ethical / Governance

• The government's claim of "routine consultation" vs. the leaked document suggesting mandatory requirements raises transparency concerns about the standard-setting process.
• Industry allegation: regulatory uncertainty and opaque consultation processes create an ease-of-doing-business problem.
• There is a tension between national security (preventing backdoors, foreign surveillance) and privacy of source code (corporate IP, preventing government-mandated backdoors for surveillance).

Administrative

• Jurisdictional ambiguity: ITSAR was issued under DoT, but phone manufacturers sought to be under MeitY's purview — the January 2026 consultation was partly about resolving this administrative split [1].
• The enactment of the Telecommunications Act, 2023 triggered industry requests to clarify under which ministry's ambit smartphones fall [1].

6. Recent Developments (Last 12–18 Months)

• April 2025: US criticised India's local testing norms and standards for telecom/electronics as non-tariff barriers [7].
• April 2025: DoT delayed mandatory testing deadline for broadband gear to September 2025 amid US tariff concerns [8].
• September 2025: DoT further extended mandatory broadband gear testing to December 31, 2025 [9].
• December 2025: IT Ministry consultations with Apple, Samsung, Google, Xiaomi on security standards; industry flags no country has mandated source-code disclosure globally [2].
• 11 January 2026: Business Standard reports India mulls forcing smartphone companies to provide source code [2].
• 11 January 2026: Reports emerge of OEM "pushback" on proposed smartphone security rules [10].
• 13 January 2026: MeitY disputes source-code demand reports; calls consultation "routine"; notes no smartphone maker expressed concern about how consultation was conducted [1].

7. Prelims Hooks

1. ITSAR stands for Indian Telecom Security Assurance Requirements — issued by a body under the Department of Telecommunications (not MeitY). [1][2]
2. The ITSAR standard for mobile phones was issued in 2023. [1]
3. The ministry that disputed the source-code reports in January 2026 was MeitY (Ministry of Electronics and Information Technology). [1]
4. The Telecommunications Act, 2023 replaced the Indian Telegraph Act, 1885 and the Indian Wireless Telegraphy Act, 1933. [3][4]
5. NCCS (National Centre for Communication Security) is the body that designates Telecom Security Testing Laboratories (TSTLs) — under DoT. [2]
6. As of 2024, 9 TSTLs covering 27 equipment/network functions have been designated across India. [2]
7. Section 42(3)(c) of the Telecommunications Act, 2023 prohibits tampering with telecom identifiers including IMEI numbers. [4]
8. ITSAR requirements include: source-code access for third-party audits, mandatory software update intimation to government, ability to uninstall pre-installed apps, and blocking background camera/mic access. [2]
9. The four OEMs named in December 2025 consultations were Apple, Samsung, Google, and Xiaomi. [2]
10. India's previous attempt to seek mobile device source code was in 2020 — declined by industry. [6]
11. The ComSec framework requires mandatory third-party testing for strategically important telecom equipment — activated in 2023. [2]
12. The Telecommunications Act, 2023 came into force from 26 June 2024 (key provisions). [11]
13. The ITSAR framework is administered through DoT, while smartphones manufacturers sought to be regulated under MeitY's purview — a key jurisdictional issue in the January 2026 consultation. [1]

8. Mains Relevance

GS Paper mapping

Plausible Mains question stems

1. "India's proposed ITSAR-based source code disclosure requirement for smartphones represents a legitimate national security measure. Critically examine in the context of IP rights, ease of doing business, and digital sovereignty." (GS-II/GS-III, 250 words)
2. "Discuss the provisions of the Telecommunications Act, 2023 relating to security of telecom equipment and networks. How does India's security testing regime compare with global best practices?" (GS-III, 250 words)
3. "Jurisdictional ambiguity between DoT and MeitY in regulating smartphones illustrates the challenges of technology governance in India. Analyse." (GS-II, 150 words)

9. Related Topics to Study Next

10. Common Errors / Trap Areas

1. MeitY vs. DoT confusion: ITSAR is a DoT instrument (not MeitY). The January 2026 controversy began precisely because manufacturers wanted MeitY (not DoT) to be their regulatory home. Do not conflate the two ministries.
2. ITSAR as law vs. standard: ITSAR is a technical standard/requirement document, not a statute. It is not yet legally enforceable as a standalone mandate — the Telecommunications Act, 2023 is the statutory backing.
3. 2020 vs. 2023 episode: India tried to demand source code from mobile device makers in 2020 as well. The 2026 controversy is a revival/escalation, not the first instance.
4. Telecom Act commencement date: The Telecommunications Act was enacted in December 2023 but key provisions came into force from June 26, 2024 — aspirants often cite only the enactment year.
5. TRAI vs. NCCS/TSTL: TRAI (Telecom Regulatory Authority) is a tariff/licence regulator; it has no role in ITSAR or security testing. Security testing is under DoT's NCCS. Do not mix them up.