Implementation of UCC Detect System Security Measures · F. No. RG-25/(22)/2023-QoS

TELECOM REGULATORY AUTHORITY OF INDIA Government of India

Dated: 19th July, 2023

DIRECTION

Subject: Direction under section 13, read with sub-clauses (i) and (v) of clause (b) of sub-section (1) of section 11, of the Telecom Regulatory Authority of India Act, 1997 (24 of 1997) regarding implementation of UCC Detect System under Telecom Commercial Communications Customer Preference Regulations, 2018 (6 of 2018).

F. No. RG-25/(22)/2023-QoS - Whereas the Telecom Regulatory Authority of India (hereinafter referred to as the "Authority"), established under sub-section (1) of section 3 of the Telecom Regulatory Authority of India Act, 1997 (24 of 1997) (hereinafter referred to as "TRAI Act"), has been entrusted with discharge of certain functions, inter alia, to regulate the telecommunication services; ensure technical compatibility and effective inter-connection between different service providers; lay-down the standards of quality of service to be provided by the service providers and ensure the quality of service and conduct the periodical survey of such services provided by the service providers so as to protect the interest of the consumers of telecommunication service;

2. And whereas the Authority, in exercise of the powers conferred upon it under section 36, read with sub-clause (v) of clause (b) and clause (c) of sub-section (1) of section 11, of the TRAI Act, made the Telecom Commercial Communications Customer Preference Regulations, 2018 (6 of 2018) dated the 19th July, 2018 (hereinafter referred to as the "regulations"), to regulate unsolicited commercial communications (UCC);

3. And whereas the Authority, on 13th June 2023, in exercise of the powers conferred upon it under section 13, read with sub-clauses (i) and (v) of clause (b) of sub-section (1) of section 11, of the Telecom Regulatory Authority of India Act, 1997 (24 of 1997), and the provisions of the regulations, inter alia, directed all the Access Providers to deploy Artificial Intelligence and Machine Learning based UCC_Detect system which is capable of evolving constantly to deal with new signatures, new patterns and new techniques used by the Unregistered Telemarketers (UTMs);

4. And whereas the Authority is of the view that there is a need to put in place adequate and effective checks to ensure that unauthorized use of AI/ML based UCC_Detect systems does not take place and utmost care and precaution is taken in the use of systems to ensure the safety and security of the customer data;

5. Therefore, the Authority, in the exercise of the powers conferred upon it under section 13, read with sub-clauses (i) and (v) of clause (b) of sub-section (1) of section 11, of the Telecom Regulatory Authority of India Act, 1997 (24 of 1997), and the provisions of the regulations, hereby directs the Access Providers to: -

i. ensure that the data generated through these systems and platforms shall only be used for the purposes specified by the Authority in its Direction dated 13th June 2023 regarding implementation of UCC Detect System under Telecom Commercial Communications Customer Preference Regulations, 2018, and further ensure that the data shall not be used for any other purpose, and it shall not be possible to download or share the data generated through these systems and platforms or process it through any other platforms/devices;

ii. ensure that strict access control shall be adhered wherein only authorized person/agencies, after obtaining prior approval from the Government, or TRAI, or any entity empowered by the Government or TRAI in this behalf, shall be permitted to access the system, and Logs in respect of access shall be maintained;

iii. ensure that the activity logs and system trails shall be maintained online for a minimum period of two years or as prescribed by the Government or TRAI from time to time;

iv. create a trusted execution environment for development of their platforms and systems with necessary requisite security features as may be notified by the Government, or TRAI, or entity empowered by the Government or TRAI in that behalf, from time to time;

v. ensure compliance with necessary certification process as provided by the Government, or TRAI, through a security auditor empanelled or appointed by the Government, or TRAI, or its designated agencies such as CERT-IN/ Ministry of Electronics & Information Technology;

vi. facilitate regular system audit by the Government or TRAI, or any entity empowered by the Government or TRAI, including agencies authorized by the Government or TRAI or the entities empowered by the Government in this behalf;

vii. put in place adequate and effective internal checks to ensure that unauthorized use of AI/ML systems does not take place and utmost care and precaution is taken in the use of systems to ensure the safety and security of the subscriber data as per the Indian Telegraph Act, 1885.

6. All Access Providers are directed to comply with the above directions and forward a compliance report within thirty days from date of issue of this direction.

(Jaipal Singh Tomar) Advisor (QoS-II)

To, All Access Providers (including BSNL and MTNL)