Source Code Disclosure Debate — Cybersecurity vs Digital Rights

Why in News ?

• Reports (Reuters) suggested the Indian government was considering mandating smartphone manufacturers to:
  • Disclose source code to third-party testing agencies.
  • Notify the government before rolling out major software updates.
• Government has officially denied any finalised demand, stating discussions are exploratory.
• Triggered concerns over cybersecurity, privacy, transparency, and regulatory overreach.

Relevance

• GS II (Polity & Governance)
  • Right to Privacy (Art. 21), proportionality doctrine (Puttaswamy)
  • Transparency, stakeholder consultation
• GS III (Internal Security & S&T)
  • Cybersecurity, critical digital infrastructure
  • Supply-chain risks, state-sponsored cyber threats

What is Source Code?

• The core human-readable instructions that define how software functions.
• Includes:
  • Algorithms
  • Security architecture
  • System design logic
• Kept confidential because:
  • Commercial IP protection
  • Cybersecurity (prevents attackers from identifying vulnerabilities).

Why Source Code Disclosure Is Risky ?

• Security-by-obscurity vs Security-by-design:
  • Full disclosure increases attack surface.
• Risks include:
  • Easier identification of zero-day vulnerabilities.
  • Supply-chain attacks via testing agencies.
  • Potential state or non-state cyber exploitation.
• Smartphones = critical digital infrastructure:
  • Banking, Aadhaar, health, communications.

Paradox: A measure meant to enhance security may weaken systemic cyber resilience.

Internal Security Dimension 

• Smartphones are gateways to:
  • Personal data
  • Critical communications
  • Location and biometric-linked services
• Any compromise affects:
  • Individual security
  • National cyber posture
• India already faces:
  • Rising cybercrime
  • State-sponsored cyber threats

Source code exposure magnifies internal security vulnerabilities.

Governance & Regulatory Dimension 

Existing Regulatory Framework

• Indian Telegraph (Amendment) Rules, 2017
• MTCTE (Mandatory Testing & Certification of Telecom Equipment):
  • Includes Indian Telecom Security Assurance Requirements (ITSAR).
• Telecommunications Act, 2023:
  • Shifted regulatory approach.
• Smartphones already undergo:
  • BIS certification for India.

Institutional Overlap

• Earlier: DoT → MTCTE & ITSARs.
• Now: MeitY assumes lead role.
• Raises issues of:
  • Regulatory clarity
  • Jurisdictional overlap

Polity & Constitutional Dimension

Article 21 – Right to Privacy

• Source code access could:
  • Enable mass surveillance (directly or indirectly).
  • Undermine data security guarantees.
• Puttaswamy judgment (2017):
  • Any intrusion must satisfy:
    • Legality
    • Necessity
    • Proportionality
    • Procedural safeguards

Blanket source code access fails proportionality test.

Transparency & Democratic Governance

Civil Society Concerns

• Internet Freedom Foundation (IFF) flagged:
  • Closed-door consultations.
  • Lack of public disclosure of draft ITSARs.
• Governance issue:
  • Stakeholder consultation ≠ Big Tech consultation alone.
  • Democratic regulation requires public scrutiny.

Comparative Global Practice

• China:
  • Heavy state control, but even China does not mandate Apple to share full source code.
• EU / US:
  • Focus on:
    • Security audits
    • Vulnerability disclosure programmes
    • Standards-based compliance
  • Not source code handover.

India’s reported approach would be globally atypical.

Technology & Innovation Impact

• Risks:
  • Discouraging foreign investment.
  • Undermining India’s image as a trusted digital market.
• Potential chilling effect on:
  • Innovation
  • Startup ecosystem
  • Global supply chains.

Ethical Dimension 

Competing Ethical Claims

• State ethics: Protect citizens from insecure devices.
• Rights ethics: Protect users from overreach & surveillance.
• Corporate ethics: Duty to protect users’ data and systems.

Ethical governance demands least intrusive means.

Way Forward 

Regulatory Design

• Prefer:
  • Black-box security audits
  • Penetration testing
  • Bug bounty programmes
• Avoid:
  • Blanket source code access.

Institutional

• Clear division of roles:
  • DoT vs MeitY vs CERT-In.
• Strengthen:
  • CERT-In
  • National cyber testing labs.

Governance

• Publish draft ITSARs.
• Open public consultation.
• Parliamentary oversight of digital security norms.

Rights Protection

• Embed privacy-by-design and security-by-design.
• Align with Digital Personal Data Protection Act principles.

Challenges

• Balancing:
  • National security
  • Cyber resilience
  • Privacy & trust
• Rapid technological change outpacing regulation.
• Capacity constraints in indigenous testing infrastructure.

Prelims Pointers

• Source code ≠ executable code.
• Smartphones already certified by BIS.
• MTCTE stems from Indian Telegraph Rules, 2017.
• Privacy is a fundamental right under Article 21.

---