DoT reminds ISPs to scrupulously comply with security conditions in ISP licenses

The Department of Telecommunications (DoT) last month reminded Internet Service Licensees granted under 2002/2007 extant regulations and under UL(ISP)/UL(VNO)-ISP authorization to scrupulously comply with the security conditions mentioned in Unified License (UL) ISP license or corresponding security conditions mentioned thereof in respective ISP licenses.

ISP licensees are normally mandated to maintain all commerical records/Call Detail Record (CDR)/Exchange Detail Record (EDR)/IP Detail Record (IPDR) with regards to the communications exchanged on the network.

The records are to be archived for atleast one year for scrutiny by the Licensor for security reasons and may be destroyed thereafter unless directed otherwise by the Licensor. DoT being the Licensor has the right to issue directions from time to time with respect to CDR/IPDR/EDR.

Further, for security reasons the domestic traffic of such entities may be specified by the Licensor shall not be routed to any place outside India.

ISP licensees are also barred from transferring accounting information relating to the subscriber (except for international roaming), user information (except foreign subscribers using Indian Operators network while roaming and IPLC subscribers) to any person outside India.

The Department had separately issued instructions to ISP licensees in 2009 regarding provision of Wi-Fi internet service under delicensed frequency band and parameter of IPDR and SYS LOG of Network Address Translation (NAT).

“In light of the above, all Internet Services Providers are again instructed to scrupulously comply the above said license conditions/Instructions.

In addition, as per para (3) of instruction “Parameter of IPDR and SYS LOG of Network Address Translation(NAT)” dated 01.10.2013, TSPs/ISPs shall ensure that all subscribers other than individual subscribers shall record and maintain NAT SYS Log parameters in India as per specified format.

In no case, the subscriber data/IPDR data/NAT SYS Log data shall be taken outside country,” said DoT in its letter.