While the Telecommunications Act, 2023 (“Telecom Act”) has been notified on 24^th December 2024, it will come into force in a phased manner. The Ministry of Communications, vide gazette notifications dated 26^th June 2024 and 4^th July 2024, has brought into effect certain sections of the Telecom Act. Many provisions of the Telecom Act will be operationalized through rules. On 29^th August 2024, the Department of Telecommunication (“DoT”) under the Ministry of Communication published drafts of the following four rules for public consultation till 27^th September 2024 under the Telecom Act:

• Draft Temporary Suspension of Telecommunication Services Rules, 2024: These draft rules intend to replace the extant Temporary Suspension of Telecom Services (Public Emergency or Public Safety) Rules, 2017 (as amended) issued under the Indian Telegraph Act, 1885. The draft rules, to a large extent, retain the requirements outlined in the extant rules such as empowering the competent central/state authority to issue directions to suspend any telecommunication services for a period not exceeding 15 days, specifying the geographical extent of application, duration and reason for suspension of telecom services, review of orders passed by a committee led by the Cabinet Secretary/Chief Secretary, etc. However, some of the changes proposed may need further consideration. E.g. prescribing a period of a maximum of 15 calendar days for a suspension order is excessive (given that such orders are issued under exceptional and serious circumstances due to the wide ramifications and generally do not exceed 1- 3 days).
• Draft Telecommunications (Procedures and Safeguards for Lawful Interception of Message) Rules, 2024: The Draft Rules, have mostly retained the requirements outlined in the extant rules for lawful interception under Rules 419 and 419A of the Indian Telegraph Rules, 1951 such as the designated competent authority, grounds for authorizing interception, the period for maintenance and destruction of interception orders, the procedure for implementing an interception order, etc. However, the draft rules also seek to introduce the following key changes:
  • Requiring entities establishing/operating/maintaining telecom networks (such as terrestrial or satellite networks, etc.), in addition to telecom service providers, to comply with interception orders.
  • DoT and Telecom service providers must undertake measures to prevent unauthorized interception,
  • The provision to fine or suspend/revoke the license of telecom service providers for not maintaining secrecy and confidentiality of interception orders/for unauthorized interception has been removed.
  • There is a clear exclusion for demonstration and testing of lawful interception systems and monitoring facilities that telecom entities might be required to put in place by the Government. However. the term “lawful interception systems and monitoring facilities” has not been defined.

  The draft rules suffer from the same shortcomings that the extant regime on interception is subject to, in so far as, the lack of appropriate safeguards for protecting the privacy of individuals (despite the right to privacy being recognized as a fundamental right) and the lack of meaningful and independent judicial or parliamentary oversight. Also given the wide definitions of terms in the Telecom Act describing and defining relevant and applicable stakeholders, at this stage it is unclear whether OTT communication services will be covered within the purview of the interception orders or not.

• Draft Telecommunications (Telecom Cyber Security) Rules, 2024: These Draft Rules seek to replace the Mobile Device Equipment Identification Number Rules of 2017 (as amended). Further, the Draft Rules empower the central government/ its authorized agency to ‘seek traffic data’ and any other data from a telecommunication entity for cyber security. Additionally, these rules require telecom entities to:
  • adopt a telecom cyber security policy,
  • comply with prescribed standards,
  • conduct a periodic audit,
  • appoint a Chief Telecommunication Security Officer,
  • establish facilities such as a Security Operations Centre to monitor cyber security threats, details of threat actors, maintenance of logs, etc.
  • report any security incident within 6 hours to the Central Government,
  • prohibit or limit access to telecommunication services to designated persons for 3 years.

  The Draft Rules also require all mobile devices to have their identification numbers (IMEI) registered with the Government, and in case of any tampering with the IMEI or device, the devices will be blocked by the Government from accessing networks.

• Draft Telecommunications (Critical Telecommunication Infrastructure) Rules, 2024: The Telecom Act introduces the concept of ‘Critical Telecommunication Infrastructure’ (“CTIs”) which would be a telecommunication network, or its part notified by the central government, which if disrupted would have a ‘debilitating impact on national security, economy, public health or safety’. These Draft Rules require telecom entities, upon request of the Central Government, to disclose details of their networks, services, and equipment to the Government to enable identification and notification of CTIs.
• The CTIs have to inter alia:
  • allow the Central Government to inspect the software and hardware of CTIs of telecom entities,
  • implement security measures and maintain records,
  • provide details to the government of their Cyber Crisis Management Plan,
  • inform the Central Government within two hours of a security incident, etc.

  The Chief Telecom Security Officer has been made responsible for the implementation of these draft rules.