Who'll be responsible for breach? Telcos worried over security note on gears

New Delhi: India’s top telecom companies have raised concerns around legal ramifications of the National Security Directive, including who will be held responsible in case of a security breach on trusted equipment used in a telecom network, officials and industry executives familiar with the matter said.
In their meetings with security officials as part of the process to identify trusted sources for telecom equipment, telcos urged the government to ensure an adequate number of vendors to keep costs in check, while also seeking clarifications around maintenance, upgrade and repair of already installed equipment.

“What if there is a security breach in trusted gear, then who is going to take responsibility? So, we have asked authorities to take the decision technically and with the help of mandatory testing,” a senior executive at one of the three private telcos, who attended the meeting, told ET.

A second telco executive added that the government was asked to ensure that operators had enough vendors to choose from and there weren’t exclusive tie-ups between an operator and a vendor. “For affordable services, vendor diversity is needed since India is a cost-sensitive market,” he said.

Reliance Jio Infocomm, Bharti Airtel, Vodafone Idea (Vi) and BSNL were called in over the last couple of weeks for separate meetings with National Security Council Secretariat officials and National Cyber Security Coordinator Lt Gen Rajesh Pant.

As per a December 16 Cabinet decision, Pant is tasked with preparing a list of ‘trusted sources’ for acquiring equipment for telecom networks. He will make a list based on the approval of a committee.