India’s proposed phone security rules worry tech firms
Technology companies are opposing basic security requirements that India has proposed for smartphone makers such as Apple and Samsung, according to government documents seen by Reuters.
SOURCE CODE DESCRIPTION
* Manufacturers must test and provide proprietary source code for review by government-designated laboratories to identify vulnerabilities in phone operating systems that could be exploited by attackers.
* MAIT, the industry group that represents Apple, South Korea’s Samsung, Google and China’s Xiaomi, told the government this was “not possible” due to corporate secrecy and global privacy policies
BACKGROUND PERMISSIONS RESTRICTIONS
* Apps cannot access cameras, microphones, or location services in the background when phones are inactive; constant status bar notifications required when these permissions are enabled
* Manufacturers say this has no global precedent and no specific testing method is foreseen
PERMIT REVIEW WARNINGS
* Devices must display persistent notifications and periodic alerts prompting users to review all app permissions.
* Companies say notification should be limited to “highly critical” permissions
ONE YEAR DAILY STORAGE
*Devices must retain security audit logs for 12 months, including app installations and login attempts
* MAIT argues consumer phones don’t have a year’s worth of data storage
PERIODIC MALWARE SCANNING
* Phones should regularly scan for malware and identify potentially harmful apps
* Manufacturers warn that constant on-device scanning significantly drains battery and slows down hardware performance
OPTION TO UNINSTALL PRE-INSTALLED APPLICATIONS
*All pre-installed applications included with the phone operating system must be deletable, except those required for basic phone functions
* Companies argue that many applications are critical system components that cannot be removed
INFORMING THE GOVERNMENT ABOUT IMPORTANT UPDATES
* Phone manufacturers must notify a government agency before releasing any major updates or security patches.
* Manufacturers argue this is “impractical” because security fixes need to be released quickly to protect users from active exploits, while government delays could leave users vulnerable
TAMPER DETECTION WARNINGS
* Devices must detect whether phones have been rooted or “jailbroken,” where users bypass built-in security restrictions, and constantly display warning banners to suggest corrective measures.
* Companies say there is no reliable mechanism to detect jailbreak
PROTECTION AGAINST BACKBACK
* To prevent security drops, phones must permanently block the installation of older software versions, even if they are officially signed by the manufacturer
* Manufacturers say there is no global standard for this requirement
