Leaked GitHub repo raises questions on IITM’s BharOS: Story so far

In a recent development, the Indian Institute of Technology Madras-incubated startup JandK Operations has found itself embroiled in a controversy surrounding its mobile operating system, BharOS. Allegations have surfaced suggesting that BharOS is a fork of GrapheneOS, a privacy and security-focused Android-compatible operating system. The claims were made first by a group known as 'Tech and Leaks’, following a source code leak of BharOS after its GitHub repository was made public.

“But if you look clearly in the leaked repos, BharOS is literally a FORK of GrapheneOS with some added commits. Things forked from GrapheneOS to indigenously develop BharOS include Settings App, Camera App, Frameworks Base, Platform, Manifest, Setup Wizard, Updater etc.,” the group said on its Telegram channel. 

IITM Pravartak Technologies Foundation (that has incubated BharOS parent company) has declined any association between the GrapheneOS fork and BharOS.

In an email statement to TechCircle, the spokesperson said, “The GrapheneOS fork created and named BharOS has nothing to do with the BharOS developed by IITM incubated company JandKOps. Once this was brought to our notice, the owner of the GrapheneOS fork was contacted. They acknowledged the mistake and removed the same.” To be sure, IITM Pravartak Technologies Foundation is a section 08 company housed by the institute and funded by the Central science and technology department.

A GrapheneOS fork – what does it mean?

To be sure, GrapheneOS is an Android-compatible mobile OS with a special focus on privacy and security. It was publicly released in 2019 (earlier in 2014 as CopperheadOS). It is an Android-based custom OS that offers additional guardrails and improves the overall permission model. GrapheneOS offers several built-in apps including Vanadium WebViewer and browser, and a camera app called Secure Camera.

When it is alleged that BharOS is a fork of GrapheneOS, it basically means that the former is built by making changes/modifications to the existing project. A common practice, forking is done either to propose changes to an existing software project or to use someone else’s project as a starting point for an individual idea.

When BharOS was initially introduced in January, it was marketed as an indigenous mobile operating system that aligns with the Atmanirbhar Bharat mission, aiming to promote self-reliance. 

In a March 9 Mint article, IITM director V Kamakoti said that BharOS only uses an ‘Android-type’ interface but the underlying work has been done by parent JandK Operations, which includes security operations, verification methods, and others ‘which is not there in conventional Android forks’. An Android fork is built on Google’s Android Open Source Project (AOSP) and is a legally-modified version. The institute had earlier said that the OS was built over a period of one year.
In response to the recent allegations, IITM has continued to assert that BharOS is not a fork of GrapheneOS. In a tweet, the IITM Pravartak Technologies Foundation identified the alleged fork as originating from a Chennai-based software company named Megam Solutions, suggesting that this was a case of mistaken identity. “This fork has nothing to do with BharOS of our incubated company, JandKOps. On investigation, we found that one of the engineers in #Megam wanted to try out a port of android and he used the name BharOS unintentionally,” the tweet said. 

We have received reports about BharOS forks in git attributed to #Megam. This fork has nothing to do with BharOS of our incubated company, JandKOps. (1/2)@IITMPravartak @IndiaDST @iitmadras #jandkops

— IITM Pravartak (@IITMPravartak) September 30, 2023

What next for BharOS

IITM had said at the time of the launch that it would be first offered to organisations with ‘stringent privacy and security requirements and those handling sensitive information requiring confidential communications on restricted apps on mobiles. In the Mint article, cited above, director Kamakoti said that individual customers are not a priority for now, and the end-user model could evolve if ‘some 40-50 million users show interest’.

JandK Operations, which was founded by a technologist-cop duo — Karthik Ayyar and Jaffar Sait, was registered only in January 2022. Limited information about the company is provided on its official website.