Telecom Cyber Security Rules: A Framework to Bolster Security in the Telecom Sector

Power to seek traffic data: The Rules empower authorised agencies to seek traffic and other data from any Telecom Entity and to direct a Telecom Entity to establish necessary infrastructure and equipment for collection and provision from designated points, coupled with provisions that require such government agencies to prevent unauthorized access or use of this data. Such data collected may be analysed for improving telecom cybersecurity and be shared with relevant government agencies or telecommunication entities or users.

Reporting of security incidents: Telecom Entities are required to report any ‘security incidents’ to the Central Government within 6 hours of its occurrence. Importantly, ‘security incident’ is defined in an extremely wide manner to include any event that has an actual or potential adverse effect on telecom cybersecurity. Such report must include details such as the number of users affected, the duration of the incident, the geographical area affected, the extent of the impact on the network or services and remedial measures taken. The Central Government may also require the disclosure of certain incidents to the public if deemed necessary in the public interest. The Central Government may also require the impacted Telecom Entity to undergo a security audit by a certified agency and implement suggested remedial measures.

Other obligations of Telecom Entities: Telecom Entities have several obligations under these rules, including:

Appointment of Chief Telecommunication Security Officer (CTSO): Each Telecom Entity is required to appoint a citizen and resident of India as a CTSO and notify such details to the Central Government. The CTSO is responsible for coordinating with the Central Government to ensure compliance with these Rules including any reporting requirements under the Rules.

Adoption of cybersecurity policy: Telecom Entities must adopt a comprehensive cybersecurity policy that comprises of security safeguards, risk management approaches, and best practices, and consequently put in place measures to enforce such policy.

Network testing and risk management: Entities are required to undertake regular testing of telecommunication networks, including vulnerability assessments and penetration testing, to identify and mitigate risks.

Establishment of incident response mechanisms: Entities must establish rapid action systems to respond to security incidents, mitigate impact of such incidents and conduct forensic analyses to learn from such incidents and further strengthen cyber security.

Conducting periodic cyber security audits: Telecom Entities are required to conduct periodic cyber security audits through its own mechanisms and through government certified agencies to assess resilience to telecom cyber security threats.

Power to suspend / terminate telecom identifier that endangers telecom cyber security: The Central Government may issue show cause notices to individuals or entities whose telecom identifiers are suspected of being involved in such endangering activities and thereafter order the temporary suspension or termination of the use of such telecom identifiers after following due process.

Obligations relating to Telecommunication Equipment: Manufacturers and importers of telecommunication equipment with International Mobile Equipment Identity (IMEI) numbers are required to register these numbers with the Central Government before selling or importing the equipment in India. Under the superseded MDEI Rules, manufacturers were required to obtain the right to assign a Mobile Device Equipment Identification Number (MDEI) to a mobile device, however, no such requirement has been set out in the Rules. The Rules further prohibit tampering or alteration of unique telecommunication equipment identification numbers (i.e., a number / signal that uniquely identifies a telecom equipment including an IMEI number or electronic serial number). It is pertinent to note here that the MDEI Rules defined MDEI as unique identification numbers for mobile wireless communication devices, however, the Rules expand this definition as unique numbers for any type of telecommunication equipment. 

Digital Implementation and Enforcement: The Central Government may specify digital means for implementing these Rules (upon taking effect), including for collection, sharing, and analysis of traffic data; issuance of notices and submission of responses; maintaining a repository of individuals and telecommunication identifiers against which actions have been taken; preventing the misuse of telecommunication identifiers or services, etc.