Impractical demand

Context: The recent proposal by the Department of Telecommunication (DoT) mandating sharing of source codes of all equipment is unjustified and will create roadblocks.

Arguments in favour of the government’s proposal: To address internal security concerns

• As a part of draft Indian Telecommunication Security Assurance Requirements (ITSAR): DoT wants all network equipment and devices to be supplied to the department for security certification.

• To address concerns related to backdoor placed in networks; Huawei has been targeted of such allegations.
• To plug security gaps that may be exploited by hackers or bad state actors.

Critique of Government’s proposals: 

• Threat to intellectual property: As it makes it easier to re-engineer equipment or compromise it after the source code has been obtained.
• Unrealistic certification:

• Certification does not reduce vulnerability of equipment. No nation’s agency demands it.
• Frequent software updates and launch of new models makes it redundant to certify each and every equipment.
• It will introduce long delays with each upgrade and repeated certification and testing.

• Security Compromised: Making the source code open would impact the privacy of the users especially if the testing is done by third party.

Way Forward: 

• Rather than having a blanket demand for the source codes of equipment, mutual assistance can be sought for specific demand.