Research and Articles

BACKGROUND

 

THE TELECOM SECTOR HAS ALWAYS BEEN A SENSITIVE AND HIGHLY REGULATED SECTOR IN INDIA. WHILE ECONOMIC LIBERALIZATION HAS LED TO THE OPENING UP OF THIS SECTOR TO FOREIGN INVESTMENT, THERE HAVE BEEN GROWING CONCERNS ON THE PART OF THE GOVERNMENT WITH RESPECT TO SECURITY OF THE TELECOM NETWORKS IN INDIA AND THEIR VULNERABILITY TO THREATS. OVER THE PAST FEW MONTHS, THE GOVERNMENT HAS INTRODUCED VARIOUS MEASURES IN VIEW OF THESE CONCERNS SUCH AS INTER ALIA¹,

 

1. THE REQUIREMENT FOR TELECOM OPERATORS TO OBTAIN SECURITY CLEARANCE FROM THE DEPARTMENT OF TELECOMMUNICATIONS (“DOT”) FOR CORE EQUIPMENT SUPPLIED TO THEM BY FOREIGN VENDORS; AND
2. THE REQUIREMENT THAT TELECOM OPERATORS ARE REQUIRED TO INCLUDE A CLAUSE IN THEIR PURCHASE ORDERS TO SUCH FOREIGN MANUFACTURERS TO THE EFFECT THAT THE FOREIGN MANUFACTURERS SHALL EFFECTUATE A TRANSFER OF TECHNOLOGY OF ALL CRITICAL EQUIPMENT AND SOFTWARE TO INDIAN MANUFACTURERS WITHIN A PERIOD OF THREE YEARS FROM THE DATE OF THE PURCHASE ORDER. CRIMINAL LIABILITY HAS BEEN LINKED TO NON-COMPLIANCE.

 

THOUGH THESE MEASURES ATTEMPT TO ADDRESS NATIONAL SECURITY CONCERNS, THEY HAVE BECOME THE SOURCE OF A LOT OF CONTROVERSY AND OPPOSITION DUE TO THEIR HARSH AND ONE-SIDED NATURE.

THE DOT HAS NOW ISSUED NOTIFICATION DATED JULY 28, 2010 WHICH AMENDS THE TERMS OF THE TELECOM LICENSES UNDER WHICH THE TELECOM OPERATORS PROVIDE SERVICES AND IMPOSES CERTAIN SPECIFIC OBLIGATIONS ON THE TELECOM OPERATORS (“NOTIFICATION”)². MORE IMPORTANTLY, THIS NOTIFICATION PROVIDES CLARIFICATION ON THE SCOPE AND NATURE OF TECHNOLOGY TRANSFER; IT IS NOW CLEAR THAT THE SCOPE OF TECHNOLOGY TRANSFER BEING CONSIDERED BY THE GOVERNMENT IS MUCH WIDER THAN WAS EARLIER PERCEIVED UPON ISSUE OF THE MARCH 18, 2010 NOTIFICATION

 

ANALYSIS OF THE SALIENT FEATURES OF THE NOTIFICATION

 

SOME OF THE SALIENT FEATURES OF THE NOTIFICATION ARE:

 

• SECURITY POLICY. WITHIN THIRTY (30) DAYS OF THE DATE OF THE NOTIFICATION, THE TELECOM OPERATORS ARE TO SUBMIT TO THE DOT THEIR ORGANIZATIONAL POLICY ON SECURITY AND SECURITY MANAGEMENT.

  THE TELECOM LICENSES CURRENTLY CONTAIN DETAILED SECURITY PROVISIONS WHICH THE TELECOM OPERATORS HAVE TO NECESSARILY COMPLY WITH INCLUDING TERMS AND CONDITIONS FOR THE INSPECTION OF NETWORK EQUIPMENT, MONITORING OF TRAFFIC, PROVISION OF CALL DATA RECORDS AND ENCRYPTION NORMS. SINCE THE DOT HAS NOT MANDATED ANY MINIMUM STANDARDS OR MODELS TO BE FOLLOWED BY THE TELECOM OPERATORS IN FRAMING SUCH ORGANIZATIONAL POLICIES AND IT IS NOT YET CLEAR WHETHER SUCH POLICIES WILL BE MADE PUBLIC, THE BENEFITS OF THIS REQUIREMENT REMAIN TO BE SEEN.

• NETWORK AUDIT. TELECOM OPERATORS HAVE TO ENGAGE THE SERVICES OF INTERNATIONALLY ACCREDITED AGENCIES TO CONDUCT AUDIT AND CERTIFICATION OF CORE EQUIPMENT SUCH AS ROUTERS, SWITCHES, FIREWALL, INTRUSION DETECTION AND PREVENTION SYSTEMS, VOIP AND ALL SOFTWARE ASSOCIATED WITH ALL THE TELECOM OPERATIONS AND SERVICES. IN ORDER TO ELIMINATE ANY RISK OF CONFLICT, THE TELECOM OPERATORS HAVE TO ENSURE THAT SUCH AUDIT AGENCIES SHOULD NOT BE FROM THE SAME COUNTRY AS THAT OF THE VENDORS OF THE TELECOM OPERATORS.

• MINIMAL DEPENDENCE ON FOREIGN ENGINEERS. THE TELECOM OPERATORS ARE TO ENSURE THAT DEPENDENCE OF FOREIGN ENGINEERS SHALL BE MADE MINIMAL AND/OR ALMOST NIL WITHIN A PERIOD OF TWO (2) YEARS FROM THE DATE OF THE NOTIFICATION.

  THE TELECOM LICENSES ALREADY CONTAIN PROVISIONS WHICH MAKE IT MANDATORY FOR THE TELECOM OPERATORS TO OBTAIN SECURITY CLEARANCE IN RESPECT OF FOREIGN NATIONALS TO BE DEPLOYED FOR INSTALLATION, OPERATION AND MAINTENANCE OF THE TELECOM NETWORK. THE GOVERNMENT HAS NOW GONE A STEP FURTHER AND HAS MADE PROVISIONS TO ENSURE THAT THE THERE IS NO DEPENDENCE ON FOREIGN EXPERTISE IN NETWORK MANAGEMENT.

• LOCATION DETAILS. THE TELECOM OPERATORS HAVE TO ENSURE THAT WITHIN ONE (1) YEAR FROM THE DATE OF THEIR EXISTING EQUIPMENT ARE UPGRADED SO AS TO ENSURE THAT THE TELECOM OPERATORS ARE ABLE TO PROVIDE LOCATION DETAILS OF MOBILE CUSTOMERS WITHIN A PRECISION OF UPTO FIFTY (50) METERS.

  THE TELECOM LICENSES AUTHORIZE THE DOT TO ISSUE DIRECTIONS TO THE TELECOM OPERATORS ON THE PRECISION OF THE DATA REGARDING SUBSCRIBER LOCATIONS WHICH SHOULD BE PROVIDED BY THE DOT. THE DOT HAS EXERCISED THIS RIGHT AND HAS PROVIDED VERY SPECIFIC LOCATION DETAILS WHICH SHOULD BE PROVIDED BY THE TELECOM OPERATORS.

• SECURITY AND BUSINESS CONTINUITY AGREEMENT TEMPLATE. THE DOT HAS APPROVED THE TEMPLATE OF A SECURITY AND BUSINESS CONTINUITY AGREEMENT (“SECURITY AGREEMENT”) WHICH HAS TO BE EXECUTED BY THE TELECOM OPERATORS AND THEIR VENDORS. THIS SECURITY AGREEMENT WILL BE EXECUTED IN ADDITION TO THE MAIN SUPPLY/ PROCUREMENT/ LICENSE AGREEMENT WHICH MAY BE SIGNED BETWEEN THE TELECOM OPERATOR AND THE VENDORS; IT IS TO BE NOTED THAT IN CASE OF ANY CONFLICT, THE TERMS OF THE SECURITY AGREEMENT WOULD PREVAIL.

  WHILE THE SECURITY AGREEMENT HAS BEEN EAGERLY AWAITED BY THE INDUSTRY, IT IS PERHAPS THE MOST STRINGENT AND DISTURBING OF ALL THE NEW POLICIES. IT IS DISHEARTENING TO NOTE THE SOMEWHAT HAPHAZARD MANNER IN WHICH IT HAS BEEN DRAFTED AND MANDATORILY ENFORCED ON OPERATORS AND VENDORS. IT CONTAINS NUMEROUS PROVISIONS ON SECURITY RELATED TESTS, ACCESS TO NETWORK SYSTEMS AND TRANSFER OF INTELLECTUAL PROPERTY. WE DISCUSS SOME OF THE IMPORTANT ONES BELOW;

  1. TRANSFER OF TECHNOLOGY WHILE THE MARCH 18, 2010 NOTIFICATION DID STATE THAT THE VENDORS WOULD HAVE TO SIGN UP TO A TRANSFER OF TECHNOLOGY CLAUSE, THERE WAS HOPE THAT THE GOVERNMENT WOULD COME OUT WITH REASONABLE GUIDELINES ON THE SCOPE OF SUCH TRANSFER. HOWEVER THE ONLY PROVISION OF THE SECURITY AGREEMENT WHICH RELATES TO TECHNOLOGY TRANSFER READS AS FOLLOWS:

     4.6.2 AT THE TIME OF TERMINATION OF CONTRACT OR AS AND WHEN REQUIRED BY THE TSP, THE VENDOR SHALL ENSURE MAKING OVER ALL TOOLS, PROCEDURES, DOCUMENTS, SKILLS, SOFTWARES ETC. USING WHICH TSP SYSTEM WERE MAINTAINED OPERATED, ANALYSED, ATTENDED ETC, BY THE VENDOR.”³

     THIS PROVISION IS PARTICULARLY CONTROVERSIAL SINCE THE INTELLECTUAL PROPERTY THAT VESTS IN TECHNOLOGY PROVIDED BY VENDORS IS PERHAPS THE MOST IMPORTANT AND VALUABLE ASSET FOR THE VENDOR. THIS PROVISION READ IN LINE WITH THE REQUIREMENTS OF THE MARCH 18, 2010 NOTIFICATION IS IN EFFECT ASKING FOR AN OUTRIGHT TRANSFER OF THE VENDORS INTELLECTUAL PROPERTY TO A THIRD PARTY. SUCH A PROVISION IS HIGHLY OBJECTIONABLE AND AGAINST THE BASIC PRINCIPLES OF COMMERCE BETWEEN PRIVATE PARTIES.

  2. ESCROW THE TELECOM OPERATOR AND THE VENDOR HAVE TO ENTER INTO AN AGREEMENT WITH AN ESCROW AGENT AUTHORIZED BY CONTROLLER OF CERTIFYING AGENCIES (“CCA”) OR THE NATIONAL INFORMATICS CENTRE, DEPARTMENT OF INFORMATION TECHNOLOGY, GOVERNMENT OF INDIA. THIS ARRANGEMENT COVERS ALL INFORMATION AND DOCUMENTATION RELATING TO THE SUPPLY AND SERVICE OBLIGATIONS OF THE VENDOR (INCLUDING ALL SOFTWARE SOURCE CODES) (“ESCROW MATERIALS”). THE CCA SHALL CREATE AN ENCRYPTION KEY FOR THE ESCROW MATERIALS; THE ENCRYPTED ESCROW MATERIALS SHALL BE DEPOSITED IN ESCROW AND THE DECRYPTION KEY SHALL REMAIN WITH THE ESCROW AGENT. THE ESCROW MATERIALS MAY BE RELEASED ON THE OCCURRENCE OF ANY OF THE RELEASE EVENTS SUCH AS (A) FAILURE OF THE VENDOR TO PROVIDE SUPPORT, (B) CORPORATE REORGANIZATION (C) INSPECTION OF SOURCE CODES EXPERTS DESIGNATED BY THE DOT, (D) IN ANY EVENT WHERE THE DOT IS SATISFIED ABOUT THE NEED AND REQUIREMENT OF SUCH RELEASE.

     SOME OF THE RELEASE EVENTS INCLUDED IN THE ESCROW PROVISION ARE DRACONIAN IN THE SENSE THAT DOT HAS BEEN GIVEN THE RIGHT TO UNILATERALLY OBTAIN THE SOURCE CODES AT ITS DISCRETION. COUPLED WITH THE TRANSFER OF TECHNOLOGY PROVISION (WHICH CAN BE TRIGGERED NOT ONLY BY THE DOT BUT ALSO BY THE TELECOM OPERATOR), IT SEEMS THAT THE VENDOR IS EFFECTIVELY BEING ASKED TO SIGN AWAY ALL THEIR RIGHTS IN THEIR INTELLECTUAL PROPERTY.

  3. PERSONAL DATA THE SECURITY AGREEMENT IMPOSES CERTAIN OBLIGATIONS ON VENDORS WHERE THEY PROCESS ANY SENSITIVE OR PERSONAL DATA IN INDIA INTER ALIA THAT THE VENDOR SHOULD BE A REGISTERED SAFE HARBOR IN INDIA. THE NOTIFICATION ALSO STATES THAT THE VENDORS NEED TO COMPLY WITH THE “DATA PROTECTION LEGISLATION” WHICH IS DEFINED AS; “COLLECTIVELY THE DIRECTIVE APPLICABLE LOCAL LEGISLATION, WHICH INCLUDES IN RESPECT OF PERSONAL DATA ORIGINATING IN THE INDIA, THE IT ACT, 2000 AND OTHER RELEVANT LAWS”.⁴

     THE DOT HAD EARLIER ISSUED A DIRECTION DATED FEBRUARY 26, 2010 TO ENSURE COMPLIANCE BY THE SERVICE PROVIDERS REGARDING CONFIDENTIALITY OF INFORMATION OF SUBSCRIBERS AND PRIVACY OF COMMUNICATIONS. THE TELECOM LICENSES ALSO CONTAIN PROVISIONS FOR ENSURING THE PRIVACY AND CONFIDENTIALITY OF INFORMATION OF SUBSCRIBERS. THE INFORMATION TECHNOLOGY (AMENDMENT) ACT, 2008 HAS BEEN BROUGHT INTO FORCE FROM OCTOBER 27, 2009, ALSO INCLUDES A TELECOM SERVICE PROVIDER IN THE CATEGORY OF AN INTERMEDIARY AND IS LIABLE FOR ANY OFFENCE UNDER THE SAID ACT.

     IT SHOULD ALSO BE NOTED THAT INDIA DOES NOT HAVE ANY REGULATIONS FOR SAFE HARBOR REGISTRATION; AS SUCH THE INTENTION OF GOVERNMENT IN INCLUDING REQUIREMENTS FOR SAFE HARBOR REGISTRATION IS NOT CLEAR AT THIS POINT. MOREOVER, IT CAN BE ARGUED THAT PROVISIONS FOR PROCESSING OF PERSONAL DATA CANNOT BE MADE APPLICABLE TO A VENDOR WHO IS SIMPLY A SUPPLIER OF HARDWARE AND SOFTWARE UNLESS SUCH VENDOR ACTUALLY MANAGES AND CONTROL THE TELECOM NETWORK. IT REMAINS TO BE SEEN IF THE GOVERNMENT COMES UP WITH NEW REQUIREMENTS FOR SAFE HARBOR REGISTRATION.

• PENALTY.

  IN THE EVENT OF ANY SECURITY BREACH, THE AFFECTED EQUIPMENT SHALL BE TAKEN OUT OF SERVICE AD A PENALTY SHALL BE LEVIED ON THE TELECOM OPERATOR AMOUNTING TO INR 50,00,00,000 FOR EACH AFFECTED PURCHASE ORDER AND A PENALTY OF 100% OF THE CONTRACT VALUE.

 

CONCLUSION

IT SHOULD BE NOTED THAT WHILE ALL THE REQUIREMENTS UNDER THE NOTIFICATION (EXCEPT THE REQUIREMENT FOR TELECOM OPERATORS AND VENDORS TO EXECUTE THE SECURITY AGREEMENT)ARE IN THE NATURE OF OBLIGATIONS CAST ON THE TELECOM OPERATOR, IN ALL LIKELIHOOD, THE TELECOM OPERATORS WILL EXECUTE BACK-TO-BACK AGREEMENTS WITH THE VENDORS VIDE WHICH THE VENDORS WOULD HAVE TO COMPLY WITH THESE REQUIREMENTS. ACCORDINGLY, VIDE THE NOTIFICATION AND OTHER SIMILAR REQUIREMENTS PROMULGATED BY THE DOT, THE VENDORS ARE INDIRECTLY COMPELLED TO ABIDE BY THE DOT REGULATIONS. NOTWITHSTANDING THE FOREGOING, THE REQUIREMENT TO EXECUTE THE SECURITY AGREEMENT IS AN OBLIGATION THAT HAS BEEN IMPOSED BY THE DOT DIRECTLY ON THE VENDORS.

THE AIM OF THE GOVERNMENT IN IMPLEMENTING SUCH REGULATIONS AS STATED IN THE MARCH 18, 2010 NOTIFICATION IS THAT THERE IS A “NEED TO REDUCE VULNERABILITY IN THE LONG RUN”. IT IS TRUE THAT WHILE THE TELECOM SECTOR IN INDIA IS VERY LUCRATIVE, INDIA DOES NOT HAVE A VERY STRONG INDIGENOUS TELECOM MANUFACTURING INDUSTRY. SINCE TELECOM IS A SECURITY SENSITIVE SECTOR, THE GOVERNMENT’S CONCERNS IN THIS AREA ARE UNDERSTANDABLE. HOWEVER, WHILE SOME MEASURES WHICH HAVE BEEN ADOPTED BY THE GOVERNMENT SUCH AS SECURITY VETTING OF VENDORS MAY BE WELCOME AND DESIRABLE, THE UNILATERAL RIGHTS TO TAKE OVER THE INTELLECTUAL PROPERTY RIGHTS OF VENDORS WITHOUT PROVIDING JUSTIFICATION HAS MET WITH WIDESPREAD DISAPPROVAL NOT ONLY FROM THE VENDORS BUT FROM TELECOM OPERATORS AS WELL. IF SUCH MEASURES ARE NOT CHANGED IT WILL CAUSE GREAT PREJUDICE TO INDIAN TELECOM SINCE FOREIGN VENDORS ARE LIKELY TO SHY AWAY FROM A REGULATORY SET UP WHICH UNFAIRLY EMPOWERS THE GOVERNMENT TO LITERALLY TAKE OVER THEIR ASSETS. FURTHER, SUCH COMPLEX AND STRICT REGULATORY CONDITIONS MAY ALSO BE AKIN TO THE IMPOSITION OF NON- TARIFF BARRIERS ON FREE TRADE AND MAY BE VIEWED AS POTENTIAL WTO NON-COMPLIANCE.

IF THE TELECOM OPERATORS FOLLOW THE DOT GUIDELINES AND OBTAIN SECURITY CLEARANCE FOREIGN VENDORS AND THE EQUIPMENT, THERE IS VERY LITTLE JUSTIFICATION ON THE REASONING ADOPTED BY THE GOVERNMENT THAT SUCH FOREIGN VENDORS WOULD CONTINUE TO POSE A SECURITY THREAT TO THE COUNTRY. IF THE GOVERNMENT BELIEVES THAT IT HAS JUSTIFIED REASONS FOR BELIEVING THAT THE OPERATIONS OF ANY SUCH SECURITY VETTED VENDORS POSES A THREAT TO NATIONAL SECURITY, THE GOVERNMENT CAN CANCEL THE SECURITY CLEARANCE; SUCH CANCELLATION SHOULD OFF COURSE ONLY BE RESORTED TO UPON OBSERVANCE OF THE PRINCIPLES OF NATURAL JUSTICE. FURTHER A WELL FORMULATED ESCROW MECHANISM CAN BE CONSIDERED WHICH HAS WELL DEFINED RELEASE EVENTS WHICH DO NOT OPERATE AT THE MERE DISCRETION OF THE GOVERNMENT. SUCH RELEASE EVENTS COULD BE IN THE FORM OF IMMINENT AND GRAVE NATIONAL SECURITY THREATS. WHILE THE GOVERNMENT’S EFFORTS TO BOLSTER THE INDIAN TELECOM MANUFACTURING INDUSTRY IS UNDERSTANDABLE, THIS AIM CANNOT BE EFFECTIVELY ACHIEVED BY IMPOSING REGULATIONS WHICH COMPEL FOREIGN VENDORS TO GIVE THEIR ASSETS TO INDIGENOUS ENTITIES.

IT IS HOPED THAT THE GOVERNMENT WILL SOON COME OUT WITH POSITIVE AND ENCOURAGING CLARIFICATIONS AND AMENDMENTS TO THE NOTIFICATION AND TEMPLATE AGREEMENT.

– RAKHI JINDAL, VIVEK KATHPALIA & VAIBHAV PARIKH 
YOU CAN DIRECT YOUR QUERIES OR COMMENTS TO THE AUTHORS

 

---

¹ DOT NOTIFICATION DATED MARCH 18, 2010 ISSUED BY THE DOT; HTTP://WWW.DOT.GOV.IN/AS/2010/AS_22.03.2010.PDF

² (I) NOTIFICATION NO. 10-15/2009-AS.III/VOL.II/(PT.)/(25) AMENDS THE UNIFIED ACCESS SERVICE LICENSE AGREEMENT; (II) NOTIFICATION NO. 10-15/2009-AS.III/VOL.II/(PT.)/(26) AMENDS THE BASIC SERVICE LICENSE AGREEMENT; (III) NOTIFICATION NO. 10-15/2009-AS.III/VOL.II/(PT.)/(27) AND NOTIFICATION NO. 10-15/2009-AS.III/VOL.II/(PT.)/(28) AND NOTIFICATION NO. 10-15/2009-AS.III/VOL.II/(PT.)/(29) AMENDS THE CELLULAR MOBILE TELEPHONE SERVICE LICENSE AGREEMENT.

³ THE SECURITY AGREEMENT DEFINES TSP AS FOLLOWS: “TSP MEANS TELECOM SERVICE PROVIDER LICENSED UNDER SECTION 4 OF INDIAN TELEGRAPH ACT 1885 BY THE LICENSOR, GOVERNMENT OF INDIA”

⁴ THE SECURITY AGREEMENT DEFINES DIRECTIVE AS FOLLOWS: “DIRECTIVE OF THE LICENSOR WITH REGARD TO THE PROCESSING OF PERSONAL DATA AND ON THE FREE MOVEMENT OF SUCH DATA, OR ANY SUBSEQUENT LEGISLATION IN RELATION THERETO”