Tech firms say India cyber rules risk creating 'environment of fear'

The Internet and Mobile Association of India (IAMAI), which represents firms including Facebook, Google and Reliance, wrote this week to India's IT ministry criticising a directive on cybersecurity set out in April.

June 03, 2022 09:37 pm | Updated 09:37 pm IST

Broken Ethernet cable is seen in front of binary code and words “cyber security” in this illustration taken

Broken Ethernet cable is seen in front of binary code and words “cyber security” in this illustration taken | Photo Credit: DADO RUVIC

Indian cybersecurity rules due to come into force later this month will create an "environment of fear rather than trust", a body representing top tech companies has warned the government, calling for a one-year delay before the rules take effect.

(Sign up to our Technology newsletter, Today’s Cache, for insights on emerging themes at the intersection of technology, business and policy. Click here to subscribe for free.)

The Internet and Mobile Association of India (IAMAI), which represents firms including Facebook, Google and Reliance, wrote this week to India's IT ministry criticising a directive on cybersecurity set out in April.

Among other changes the directive from the Indian Computer Emergency Response Team (CERT) requires tech companies to report data breaches within six hours of noticing such incidents and to maintain IT and communications logs for six months.

In the letter seen by Reuters, IAMAI proposed to extend the six-hour window, noting the global standard for reporting cyber-security incidents is generally 72 hours.

CERT, which comes under the IT ministry, has also asked cloud service providers such as Amazon and virtual private network (VPN) companies to retain names of their customers and IP addresses for at least five years, even after they stop using the company's services.

The cost of complying with such directives could be "massive", and proposed penalties for violation including prison would lead to "entities ceasing operations in India for fear of running afoul," the IAMAI letter said.

On Thursday, VPN service provider ExpressVPN removed its servers from India, saying it "refuses to participate in the Indian government's attempts to limit internet freedom".

IAMAI's letter follows one from 11 significant tech-aligned industry associations earlier this week, which said the new requirements made it difficult to do business in India.

India has tightened regulation of big tech firms in recent years, prompting pushback from the industry and in some cases even straining trade ties between New Delhi and Washington.

New Delhi has said the new rules were needed as cybersecurity incidents were reported regularly but the requisite information needed to investigate them was not always readily available from service providers.

Top News Today

Sign in to unlock member-only benefits!
  • Access 10 free stories every month
  • Save stories to read later
  • Access to comment on every story
  • Sign-up/manage your newsletter subscriptions with a single click
  • Get notified by email for early access to discounts & offers on our products
Sign in

Comments

Comments have to be in English, and in full sentences. They cannot be abusive or personal. Please abide by our community guidelines for posting your comments.

We have migrated to a new commenting platform. If you are already a registered user of The Hindu and logged in, you may continue to engage with our articles. If you do not have an account please register and login to post comments. Users can access their older comments by logging into their accounts on Vuukle.