Fight against data abuse: India may ask smartphone maker to allow removal of pre-installed apps

According to Reuters, the central government will force smartphone makers to allow the removal of pre-installed apps and mandate screening of major operating system updates under proposed new security rules.

Citing two people and a government document seen by the news outlet, the report says India’s IT ministry is considering these new rules, the details of which have not been previously reported, for spying and misuse of user data.

A senior government official, speaking on condition of anonymity because the move is not yet public, told the agency: “Pre-installed apps can be a security weakness, and we want to make sure foreign countries, including China, don’t take advantage of that. It’s a matter of national security.”

The new rules are likely to lengthen release schedules in the world’s No. 2 smartphone market and lead to business losses due to pre-installed apps for players such as Samsung, Xiaomi, Vivo and Apple.

The issue of data breaches and the risks associated with using Chinese mobile apps and phones was first raised in 2020. After the Galwan Valley clash, the Indian government banned several Chinese mobile apps. The government had banned 59 Chinese apps, including popular ones like TikTok, WeChat and ShareIt, to protect the privacy of its citizens. The list is longer as new apps have been added in recent months. But these apps have come back to India with new identities, posing a significant threat to the security and privacy of Indian users.

In the global scenario, several countries have already restricted the use of technology by Chinese companies such as Huawei and Hikvision, fearing that Beijing could use them to spy on foreigners. However, the Chinese government denied such claims.

Currently, many smartphones come with pre-installed apps that cannot be removed, such as Chinese smartphone maker Xiaomi’s app store GetApps, Samsung’s payment app Samsung Pay mini, and iPhone maker Apple’s Safari browser.

Under the new rules, smartphone makers will have to offer an uninstall option, and a laboratory authorized by the Bureau of Indian Standards Agency will test new models for compliance, two people familiar with the plan told Reuters.

The sources further said that the center is considering allowing screening of every major operating system update before it is available to users. “Majority of smartphones in use in India contain pre-installed apps/bloatware which pose serious privacy/security issues,” said Reuters’ February 8 confidential government minutes of an IT ministry meeting.

The important meeting was held in the presence of representatives of Xiaomi, Samsung, Apple and Vivo. According to the document, smartphone manufacturers have one year to comply with the entry into force of the rule.

Banned Chinese Apps Returning to India in New Forms?

Return Byte reported in February that some banned Chinese apps have come back to India with new identities, posing a significant threat to the security and privacy of Indian users. One such app is Tiki, which is allegedly owned by Singapore-based Bigo, but the company has denied involvement despite evidence showing it has footprints in Beijing.

“While checking with online tools, the https://tiki.video/ IP history showed us that it is traced back to Beijing and in fact to BGO Technology PTE LTD. It uses a similar layer to BIGO’s earlier app,” said cyber expert Amit Dubey. In response, Tiki denied any association with China or Chinese apps or companies, saying their servers and user data are strictly based in India.

ShareKaro, Helo and Resso are other apps allegedly owned by Chinese companies, again operating in India and marketed under the false pretext of “Make in India” to lure users. However, Tiki was the only company to respond to the allegations and deny any Chinese connections. ShareKaro, on the other hand, uses personal email IDs, which is a red flag for many. Experts believe that personal email IDs are not a problem, but when an app is promoted to a large audience, people look for credibility and identity.

“Apps take multiple access rights upon installation, and these rights are sometimes not needed. Although marketplaces have their own rules related to access rights, they are not very defined according to the operation of the application and user behavior. The applications have their own logic to access their data, but when the server located in China has stored our important data , so how can you trust this,” Dubey explained.

Apart from changing the identity, the banned apps promote alternative ways of downloading for Indian users. One such way is to download the APK file from Google or use a proxy server and download it as a user from another country. However, both methods have their own risks.

When users install apps from APK files, they are not getting them from the official source, which increases the chances of downloading a modified version that contains malware or viruses. Likewise, using a proxy server to download an app can compromise a user’s privacy because the app can collect information about their online activity.

(via Reuters feeds)

Read all the Latest Tech News here.