The Alarming Provisions of India’s New Telecommunications Act

At the time the Indian Telegraph Act of 1885 was conceived, India was still under the rule of the British Raj. The telegraph had become an important tool for British dominion over India by quelling rebellions and consolidating information. It was, therefore, important for the British to have control of telegraphy and infrastructure across the subcontinent.

Over the past few years, the administration has handed itself new powers that tighten controls over online content, allowing authorities to legally intercept messages, break encryption, and shut down telecom networks during moments of political turmoil. According to Statista data, between January 2012 and June 2022, there were 639 government-imposed internet shutdowns across India, resulting in the highest number of internet blocks in the world so far.

India: the Modi Question, examining the 2002 sectarian riots, came at a sensitive time for the Union government. The government invoked emergency laws to ban links and clips of the documentary from being shared online, which YouTube and Twitter complied with.

On December 24, 2023, the Telecommunications Act, 2023 was published in the official gazette, after the Bill was passed by both Houses of the Parliament and received the Presidential assent. The Act promises a tectonic shift in the legal framework relating to telecommunications in India, by demolishing the more than a century old Indian Telegraph Act, 1885 and other laws that have so far formed the basis of governing the telecom space in India.

Also read: Telecom Bill 2023 Is a Repackaged Version of the Archaic Colonial Law

The Act comes at a juncture of time when India is leapfrogging in the 5G era and consumption of telecom services is skyrocketing. There is an imminent need for a governance and regulatory framework that is in sync with the needs of the telecom industry as well as to foster development of new technologies. The licence regime under the prevailing laws is sought to be converted to an ‘authorisation’ framework. Pertinently, the trigger points for obtaining authorisations have been enhanced. As far as existing licences, registrations and permissions are concerned, they will have to be eventually migrated to the new regime.

By defining telecommunication services as “any service for telecommunication”, the government may have just opened up Pandora’s box. Any telecommunication service, which could arguably include OTT (over the top) and M2M (machine to machine) services as well, can potentially fall within this ambit and trigger a requirement to obtain an authorisation. Hence, it may not be safe to assume for the time being that OTT services are beyond the clutches of the law.

Use of verifiable biometric-based identification is yet another data tinderbox awaiting rampage by cyber criminals. All authorised entities are required to employ verifiable biometric-based identification mechanisms (as may be prescribed) for identifying persons to whom telecom services are provided. This is not only likely to limit the way in which subscriber verification formalities can be carried out, but also raise concerns relating to privacy and cybersecurity as storage of biometric data and records bring along its set of challenges.

The Union government can notify standards and conformity assessments for matters relating to cybersecurity for telecommunication services and networks, encryption, and data processing in telecommunication, etc. This might lead to an overlap with provisions under the information technology framework, which applies horizontally to all sectors.

In the recent past, the government has released specific laws and regulations dealing with these very aspects, such as the directions issued by the Indian Computer Emergency Response Team, the Digital Personal Data Protection (DPDP) Act, 2023, etc. This may culminate in multiplicity of compliances for entities, which will ultimately impact the ease of doing business.

Chapter IV, Article 20 of the new Telecommunications Act, 2023 has some alarming provisions. The Bill says, “On the occurrence of any public emergency, including disaster management, or in the interest of public safety, the Central Government or a State Government or any officer specially authorised in this behalf by the Central Government or a State Government, if satisfied that it is necessary or expedient so to do, by notification – (a) take temporary possession of any telecommunication service or telecommunication network from an authorised entity; or (b) provide for appropriate mechanism to ensure that messages of a user or group of users authorised for response and recovery during public emergency are routed on priority.”

Also read: With Cleverly Drafted Telecom Bill, Government Tightens Grip on Digital India

Any message or class of messages, to or from any person or class of persons, to or from any (or class of) telecommunication equipment, for example, mobile phone, laptop, server, communication infrastructure, etc. can be brought under the custody-authority for suitable actions.

Press messages, intended to be published in India, and of correspondents accredited to the central government or state government have been exempted from interception, although they can be intercepted for national security reasons.

In Article 22, the Central government may by rules provide for the measures to protect and ensure cyber security of telecommunication networks and telecommunication services. The measures may include collection, analysis, and dissemination of traffic data that is generated, transmitted, received, or stored in telecommunication networks.

Put simply, for the purposes of this sub-section, the term “traffic data” refers to any data generated, transmitted, received, or stored in telecommunication networks. This includes information pertaining to the type, routing, duration, or time of a telecommunication.

The challenge arises in how respective officers interpret the provisions of the new Act, which empowers them to oversee the stakeholders of India’s telecommunication network. This encompasses ordinary individuals, such as you and me, as well as the entities involved.

Paul Koshy is a consultant in infrastructure development and engineering.