New Delhi: The department of telecommunications (DoT) has approved new security norms governing telecom equipment that could cost operators at least Rs 5,000 crore each to implement.
“As per our initial estimates, the one-time expenditure to implement this policy within the next three months is $1.2-1.3 billion (Rs 5,400-5,850 crore),” said an executive with one of the companies.
Two other veterans of the Indian telecom sector concurred with this assessment. All of them requested anonymity.
The norms hold the telecom operators responsible for the security of their networks that includes risk assessment, prevention and ways to investigate breaches. They now need to have an organizational policy to address these aspects.
“They should submit the policy to the DoT within 30 days,” said an internal DoT note reviewed by Mint.
The norms make it mandatory for the operators to get their equipment audited from a security point of view by a certified agency. DoT will draw up a list of suggested agencies, but the operators will be free to use the services of others as well.
“The network must remain open for inspection by DoT at any point of time,” a DoT official said on condition of being remaining unnamed.
Records have to be kept for two years for all software details including changes made, upgrades, operations and maintenance logs as well as the actual commands given. The telcos have to also record the user ID of the system administrator linked to the system.
“It’s not the storage that is the expensive part but the constant maintenance of the records in an off-line mode that may prove a bit expensive,” an executive with one of the older telcos said on condition of anonymity due to the sensitivity of the issue.
The government has decided to retain the Rs 50 crore penalty that had been suggested at the time of consultations on the policy despite opposition from the companies.
“A penalty of Rs 50 crore will be levied by the licensor for any inadvertent breach in the networks,” the internal note said. The government will also look into criminal proceedings and cancellation of the licence in case it is found that the breach is deliberate.
The penalty for a deliberate breach will be for every instance while those that are inadvertent breaches will be penalized by a five-member committee on a collective basis.
The government had earlier proposed to penalize telcos 100% of the contract value of equipment, which could go into thousands of crores of rupees.
The policy also contains a location details clause, which mandates that operators put in place a system that tracks all mobile phone users in a service area. Details have to be part of call data records in the form of longitude and latitude. According to the internal note, in urban areas, the user must be tracked in a radius of 50m with an accuracy of 30%, while for semi-urban and rural areas, this is 100-300m with a 60-80% accuracy.
“This could cost as much as $5 per subscriber,” said a telecom executive with one of the dual-technology licence holders.
Earlier this month, the Prime Minister’s Office (PMO) wrote to DoT asking that the policy be in place by May-end and that there should be no further extensions. The original deadline of 30 October 2010 had been extended indefinitely due to disagreements between DoT and the home ministry.
Chinese telecom equipment vendors such as Huawei Technologies Co. Ltd and ZTE Corp. currently have a policy governing equipment imported by them that differs from that for European telecom equipment vendors such as Nokia Oyj, Siemens AG and Telefonaktiebolaget LM Ericsson.
The Chinese vendors have to follow a July 2010 policy while the others have been given the option of following the policy issued in late 2009, after they refused to operate in India under the former. The government was asked to review the policies as they were labelled too stringent by the stakeholders.
The main point of contention at the time was that the equipment vendors were expected to put intellectual property-related details of their equipment and source codes for their software in an escrow account. This clause has been removed, the DoT official said.
The new policy also dilutes an earlier proposal making it mandatory that only Indian engineers be employed—only the senior technical personnel have to be citizens of the country.
Both the primary telecom industry associations—the Cellular Operators Association of India and the Association of Unified Telecom Service Providers of India—have asked that the government share the burden of the extra cost as in some cases it could go up to $13,000 per cell tower.