The Department of Telecommunications (DoT) has just announced tauter security norms for governing telecom equipment in India. As per the new framework, the responsibility of maintaining security is up to the telecom operator, which will be liable to a maximum penalty of Rs 500 million, in addition to criminal proceedings against it, in case of any breach. A five-member group will be set up by the DoT to decide on the penalties and criminal proceedings in case of rule breach.
Doing away with the earlier clause, which stipulated penalties of 100 per cent of the contract value on vendors if any spyware or malware was found in the imported equipment, DoT noted that hereafter, ?The [telecom] licensee shall be completely and totally responsible for security of their networks,”
If that is not all, mobile companies have been asked to keep call and data records for 12 months and give the telecom department access to all such details. The companies will also have to inform the department of any updates or changes in equipment within 15 days.
According to the DoT, ?Telecom operators will have to create their own policy on the organization and management of the security on their networks. They [the operators] will have to submit their policy to the licensor within 30 working days”.
To keep the DoT in the loop, telecom companies will also have to create monitoring facilities within the next 12 months and have to inform the DoT about the same.
Further, telecom operators also have to furnish location details, which mandate that operators put in place a system that tracks all mobile phone users in a service area. Details have to be part of call data records in the form of longitude and latitude. According to a DoT internal note, in urban areas, the user must be tracked in a radius of 50 meters with an accuracy of 30 per cent while for semi-urban and rural areas, the user must be tracked in a 100-300 meter radius with a 60-80 per cent accuracy.
Changing some of the licensing rules for importing and the use of telecom gear in India, DoT has outlined that telecom operators can only import equipment certified by Indian or international standards from any international agency till March 31, 2013. Thereafter the equipments will have to be certified by Indian labs.
The most contentious clause which mandated that foreign equipment companies put their software, source codes in the equivalent of a sealed envelope and submit it to the government has been removed.
The new rules also dilute the earlier system that instructed vendors to employ only Indian engineers to maintain the networks of local mobile phone companies. The fresh norms say only top personnel with vendors need to be Indians. The names of these individuals will have to be cleared by the DoT and the Ministry of Home Affairs, prior to their appointment.
Besides, the changed policy also directs that mobile phone companies to appoint Indians in the positions of chief technical officer, chief information security officer or as nodal executives for handling monitoring and interception functions across mobile networks.
Over the last year, fearing malicious software in foreign equipment as possible threat to national security the government remained deeply concerned. In fact for several months telecom equipment imports from China was banned. In July 2010 new rules were drafted after some Indian mobile operators complained that their expansion plans were hit. Currently, India has two separate policy guidelines for import of telecom gear. Chinese vendors such as Huawei and ZTE follow the July 2010 guidelines while equipment makers such as Ericsson, Nokia Siemens Networks and Alcatel-Lucent were given the option of following the policy issued in late 2009, after they refused to operate in India under the July rules as they found them too stringent by the stakeholders. To remove the ambiguity arising from the two differing policies, the Prime Minister?s Office (PMO) asked the DoT to bring out a new policy.
The industry reaction so far has been mixed. Expecting substantial cost increase on account of the new rules telecom operators are asking for assistance from the government in putting up monitoring and location based systems. Both the primary telecom industry associations?the Cellular Operators Association of India and the Association of Unified Telecom Service Providers of India?have asked that the government to share the burden of the extra cost as in some cases it is expected to go up to 5 billion to set up such an infrastructure.
