If you read the papers (or the webs) these days, it's clear the Government has hit the Panic button on the mobile operators, equipment manufacturers and service providers. They want the source-code of the equipment to be put in an escrow account and be made auditable by the agencies. While the Chinese are happy to comply, the American and European manufacturers are up in arms. It's their proprietary code and intellectual property, after all. What if that code itself is compromised? It's clear the Nokias and Ericssons are not trusting Indian Government's security systems and compliance policies. Neither does RIM (Research In Motion), the makers of enterprises' proliferating BlackBerrys. It rejected the government's request to handover the IP address of BlackBerry user, the security PIN and the backdoor key to their encryption algorithm. And that's exactly what scares me -- I'm not sure how competent the government 'auditing' agencies in India are and what's the state of Information Security  in the country. Consider this data by CERT (Computer Emergency Response System), a government arm: almost 1900 sites were hacked in India in the first three months of 2010 and those also include several government websites. If you happen to check out the thousands of government websites, most would look like a high-school HTML project from 1999. Who's watching out for those sites, making sure they are secure, compliant and audited? Do our officers know about audit protocols and certification standards? Because hacking into web-servers might potentially give access to servers having sensitive data that could also be compromised.  Things might get even more complicated when the UID project comes in. Managing 360 degrees security  starting from end-applications, devices and smart-cards to application / web servers, database might be a security nightmare. What's funny is that the hacking instances are reported to the local Police which is then responsible for registering a complaint and going after the culprits. 
And that's what I find ironical about the whole flame war about security these days. In a state where the government agencies are themselves so clueless about Information Security, whom would they repose their trust on under the circumstances? IBM, HP, Accenture? Oh, but those are again American companies, so they'll need an Indian co. to audit the auditors. What's needed is a PPP (Public Private Partnership) organization, independent from the tight clutches of govt. regulations and mandates. Hire the best hackers, scout for geeky teenagers, get compliance policies in line with what's considered standard internationally, introduce best-practices for web-site designers and admins, train and educate them, get departments and govt. institutions Certified (CISA, CISSP etc.) and let them centrally handle all the security issues that might arise. Not the police, please. At DefCon last week, a 'security researcher' gave a demo of hacking GSM cell phones with a device (a $1500 tower) he made:

  A hardware hacking expert here at Defcon18 successfully faked several attendees' cell phones into connecting to his phony GSM base station during a live demonstration that had initially raised concerns at the Federal Communications Commission (FCC). It's a never-ending game of the smarter outsmarting the smart. Will always be.