India will not change upcoming cybersecurity rules that force social media, technology companies and cloud service providers to report data breaches swiftly, despite growing industry concerns, the government said on Wednesday.
The Indian Computer Emergency Response Team issued a directive in April asking tech companies to report data breaches within six hours of “noticing such incidents” and to maintain IT and communications logs for six months.
They also mandated cloud service providers such as Amazon and virtual private network (VPN) companies to retain names of their customers and IP addresses for at least five years, even after they stop using the company’s services.
India’s junior IT minister Rajeev Chandrasekhar said there will be no changes despite the worries, saying tech companies have an obligation to know who is using their services.
India has tightened regulation of Big Tech firms in recent years, prompting pushback from the industry and in some cases even straining tradNew Delhi has said the new rules were needed as cybersecurity incidents were reported regularly but the requisite information needed to investigate them was not always readily available from the service providers.
But the rules have caused widespread discontent. In a closed-door meeting this week, many social media and tech company executives discussed strategies to urge New Delhi to put the rules on hold, according to a source with direct knowledge.
The source said European authorities require data breaches to be reported within about 72 hours, adding that it was difficult to report incidents in six hours.
Chandrasekhar, however, said India was being generous, as some countries mandate immediate reporting.
The rules are set to be enforced from end of June. After they were announced, NordVPN, one of the world’s largest VPN providers, said it may remove its servers from India.
Privacy activists have said the rules contradict the idea of VPN, which is to safeguard identity of individuals such as whistleblowers from surveillance.
“If you don’t want to go by these rules, and if you want to pull out, then frankly … you have to pull out,” Chandrasekhar told reporters. ties between New Delhi and Washington.
On April 28, the Indian Computer Emergency Response Team (CERT-In) issued “directions” under Section 70-B(6) of the Information Technology Act 2000 (IT Act) relating to information security practices, procedure, prevention, response and reporting of cyber incidents. These directions have brought about a wide-ranging expansion in the scope of obligations of the above requirements compared to the Information Technology (The Indian Computer Emergency Response Team and Manner of performing functions and duties) Rules, 2013 (Rules). Among the activities in which compliance is sought by service providers, intermediaries, data centres and body corporates are the synchronisation of computer clocks to the network time protocol set at the National Physical Laboratory and National Informatics Centre (NIC), mandatory reporting of all cyber incidents within six hours of noticing or being brought to their notice in the prescribed format, designating point of contact and notifying CERT-In and undertaking to perform such actions for cyber security mitigation when notified by CERT-IN, maintaining all logs of all ICT systems up to 180 days within Indian jurisdiction and for data centres, virtual private network service providers, cloud service providers and virtual private server providers to maintain all records of their users and usage for a minimum of five years.
You must be logged in to post a comment.