Page 1 of 23 TO BE PUBLISHED IN THE GAZETTE OF INDIA, EXTRAORDINARY, PART III, SECTION 4 TELECOM REGULATORY AUTHORITY OF INDIA NOTIFICATION New Delhi, 11/06/2021 THE TELECOMMUNICATION (BROADCASTING AND CABLE) SERVICES INTERCONNECTION (ADDRESSABLE SYSTEMS) (THIRD AMENDMENT) REGULATIONS, 2021 (1 of 2021) F. No. RG-1/2/(3…
Official record
Open source pagePage 1 of 23 TO BE PUBLISHED IN THE GAZETTE OF INDIA, EXTRAORDINARY, PART III, SECTION 4 TELECOM REGULATORY AUTHORITY OF INDIA NOTIFICATION New Delhi, 11/06/2021 THE TELECOMMUNICATION (BROADCASTING AND CABLE) SERVICES INTERCONNECTION (ADDRESSABLE SYSTEMS) (THIRD AMENDMENT) REGULATIONS, 2021 (1 of 2021) F. No. RG-1/2/(3)/2021-B AND CS(2) ---- In exercise of the powers conferred by section 36, read with sub- clauses (ii), (iii), and (iv) of clause (b) of sub-section (1) of section 11, of the Telecom Regulatory Authority of India Act, 1997 (24 of 1997) (hereinafter referred to as “The Act”), read with notification of the Central Government, in the Ministry of Communication and Information Technology (Department of Telecommunications), No. 39, — (a) issued, in exercise of the powers conferred upon the Central Government under clause (d) of sub- section (1) of section 11 and proviso to clause (k) of sub-section (1) of section 2 of the said Act, and (b) published under notification No. S.O.44 (E) and 45 (E) dated 9th January 2004, in the Gazette of India, Extraordinary, Part II, Section 3, — the Telecom Regulatory Authority of India hereby makes the following regulations to further amend the Telecommunication (Broadcasting and Cable) Services Interconnection (Addressable Systems) Regulations, 2017 (1 of 2017), namely: 1. Short title, extent, and commencement: (i) These regulations may be called the Telecommunication (Broadcasting and Cable) Services Interconnection (Addressable Systems) (Third Amendment) Regulations, 2021 (1 of 2021). (ii) These Regulations shall apply throughout the territory of India. (iii) These Regulations shall come into force from the date of their publication in the Official Gazette. 2. After regulation 4 of the Telecommunication (Broadcasting and Cable) Services Interconnection (Addressable Systems) Regulations, 2017 (hereinafter referred to as the principal regulations), the following regulation shall be inserted, namely: “4A. Compliance to requirements of Addressable System by distributors of television channels.— (1) Every distributor of television channel shall, from such date and after such testing and certification, as may be specified by the Authority by order, deploy such conditional access system and subscriber management system which conform to the requirements as specified in the Schedule IX: Provided that for the conditional access systems and subscriber management systems already deployed before the date of issue of the order referred to in this sub-regulation, the Authority shall specify a separate timeline within which such systems shall get tested and certified to meet the requirements as specified in the Schedule IX. Page 2 of 23 (2) If a distributor fails to obtain the certification of the conditional access system and/or subscriber management system deployed in its network within the stipulated timelines, as specified by the Authority under sub-regulation (1), it shall, without prejudice to the terms and conditions of its license or permission or registration, or the Act or rules or regulations or orders made, or directions issued, there-under, be liable to pay, by way of financial disincentive, an amount of rupees one thousand per day for default up to thirty days beyond the due date and an additional amount of rupees two thousand per day in case the default continues beyond thirty days from the due date, as the Authority may, by order, direct: Provided that the financial disincentive levied by the Authority under this sub-regulation shall in no case exceed rupees two lakhs: Provided further that no order for payment of any amount by way of financial disincentive shall be made by the Authority unless the distributor has been given a reasonable opportunity of representation against the contravention of the regulations, observed by the Authority: Provided also that the Authority may direct the broadcasters to disconnect the signals of its television channel after giving written notice of three weeks to the distributor in case the default continues beyond sixty days from the due date.” 3. After Schedule VIII to the principal regulations, the following schedule shall be inserted, namely: “Schedule IX (Refer regulation 4A) Conditional Access System (CAS) and Subscriber Management System (SMS) A. CAS Mandatory Requirements 1. Time Stamping: All logs shall be stamped with date and time. The system shall not allow altering or modification of any logs. There shall be no facility for the distributor/users to purge logs. 2. Activation and Deactivation: No access/login IDs/user interface/application shall be provided to the distributor of television channels to execute any commands, including but not limited to, activation/de-activation, bouquet creation/modification/deletion, etc., directly from CAS by bypassing SMS: Provided that, if any activity has been carried directly from CAS for trouble shooting; such an exception shall be identified through the synchronization mismatch report. Further, for any activity outside the normal channel/route of SMS-based commands, a secure log shall be maintained and made available on request to the audit or testing agency for scrutiny. Page 3 of 23 3. SMS and CAS Integration: Each instance of the activity carried out at SMS pertaining to CAS shall be recorded in the logs/reports of CAS, along with date and time stamp. 4. Set Top Box (STB) Operation: Upon deactivation of any subscriber from the SMS, all program/services, including all free- to-air (FTA) and pay channels and platform services, shall be denied to that subscriber: Provided that there shall be a facility for the distribution platform operator (DPO) to continue to provide B-mail/scroll messages that enable a consumer to get the information in relation to the recharge/payment of the pending dues. 5. Channel Addition: CAS shall be capable to add/modify channels/bouquets as may be required from time to time. 6. Logical Channel Number (LCN): CAS shall not support carriage of channel with same name or nomenclature in the distributor’s network served by each headend under more than one LCN, and another channel descriptor. Further, each channel available in CAS shall be uniquely mapped with channels available in SMS. 7. Hybrid STB: In case a distributor of television channels has deployed hybrid STBs, CAS shall ensure that the over-the-top (OTT) App does not get access to the linear Television channels, and the CAS does not get access to channels delivered through OTT platform: Provided that, all the mandatory requirements for CAS shall be complied by the hybrid STBs. 8. CAS Reports: (a) CAS database shall have the reports of white list of card/STBs along with details such as active/inactive status, with the date and time stamp. (b) CAS system shall be capable of generating reports pertaining to the channel/bouquet subscriptions and active/deactivated subscribers, or any combination thereof; of sharing the same with SMS as a scheduled activity, and also upon request, including, but not limited to, the following details: (i) STB Number (ii) Viewing Card (VC) Number [or, in case of card-less CAS, chip identification (ID) or virtual card number of the STB] (iii) Product Code pertaining to channels/ bouquets available on the platform (iv) Start date of entitlement (v) End date of entitlement (vi) Status of card (Active/Inactive) (c) It shall be possible to generate following reports from the logs of CAS: (i) STB-VC pairing/de-pairing (ii) STB activation/deactivation Page 4 of 23 (iii) Channel assignment to STB (iv) Report of the activation/deactivations of a particular channel for a given period 9. CAS Database and tables: a) There shall not be any active unique subscriber outside the database tables. Further, there shall not be an option to split CAS database for creation of more than one instance by a DPO or a vendor. b) CAS must support the following options with reference to uploading of unique access (UA)/ viewing card (VC) details in CAS database: i. a secure un-editable file of card details, as purchased by the distributor, to be uploaded by the CAS vendor on the CAS Server directly, or, ii. if it is uploaded in any other form, UA/VC in CAS database shall be captured in logs. iii. Further, CAS shall support an automated, application programming interface (API)-based mechanism to populate such UA/VC details in the SMS, without any manual intervention. 10. CAS Logs: CAS logs such as the user command, configuration, channel/bouquet creation, modification, etc., shall be kept in a secured and un-editable way. 11. CAS Backup Server: In the event of provisioning of a backup server, logs of all activities carried out in main server shall be concurrently copied into the backup server: Provided that a log of all such instances shall be maintained along with date and time stamp, where the backup server has been used as the main server: Provided further that the main and backup server shall always be in sync with regard to the key data such as subscription data, STB UA/VC details, entitlement level information, etc. 12. CAS-STB addressability: (a) CAS shall be capable of providing STB/viewing card information with the current date, time, and name/logo of the distributor of television channels. Page 5 of 23 (b) CAS shall be capable of individually addressing subscribers, for the purpose of generating the reports, on channel by channel and STB by STB basis. (c) CAS shall be capable of tagging and blacklisting VC numbers and STB numbers that are involved in piracy, to ensure that such STB/ VC cannot be redeployed. (d) CAS shall be capable of upgrading STBs over-the-air (OTA), so that the connected STBs can be upgraded. 13. Access to Database: CAS and SMS shall ensure that the access to database is available to authorized users only, and in “read only” mode only. Further, the database audit trail shall be permanently enabled. Explanation 1: Database here refers to the database where data and log of all activities related to STB activation, deactivation, subscription data, STB UA/VC details, entitlement level information, etc., is being stored. 14. Provision of à-la-carte channels or bouquet: (a) CAS (and SMS) shall be able to handle all the channels, made available on a platform, in à la carte mode. (b) CAS (and SMS) shall have the capability to handle such number of broadcaster/DPO bouquets, as required by the DPO. 15. CAS and SMS Server Separation: CAS and SMS applications, along with their respective databases, shall be stored in such a way that they can be separately identified. 16. Finger printing measures: (a) CAS shall support both covert and visible types of finger printing functionality. (b) The fingerprinting shall be on the topmost layer of the video. (c) The fingerprinting shall appear on the screen in all scenarios, such as menu, electronic programme guide (EPG), settings, blank screen, games, etc. (d) The fingerprinting shall not get invalidated by use of any device or software. (e) CAS shall have the capability to run fingerprinting at regular intervals (e.g., minimum of 2 fingerprints per hour on a 24x7x365 basis) and provide broadcasters with the fingerprint schedule on request. (f) The fingerprinting shall be available on global as well as on individual STB basis. 17. CAS Database (DB) Export: CAS shall have a provision to export the database/report for reconciliation with the SMS database. Further, there shall be a provision of reconciliation through secure APIs/secure scripts. 18. Firewall Access: CAS shall be accessible through a Firewall only. Page 6 of 23 19. CAS Server Hardware: CAS shall be deployed on hardened secure server hardware. CAS shall protect against any backdoors, malicious software deployments, and cyber security threats. 20. De-entitlement of STB: CAS should have the following features: (a) The entitlement end date in CAS shall be equal to the entitlement end date in SMS, or, (b) The entitlement end date in CAS shall be open and SMS shall manage entitlements based on the billing cycles and payments. B. SMS Mandatory Requirements 1. Synchronization of the data of both CAS and SMS: (a) CAS and SMS data shall be synchronized with each other. There shall be a facility to trace data mismatch between CAS and SMS on periodic basis, to be made available during audits. (b) SMS shall have a provision to generate synchronization report, with date and time, with the minimum fields as listed below: (i) STB No. (ii) VC No. (Or in case of card-less CAS, chip ID or virtual card number of the STB) (iii) Product Code pertaining to à-la-carte channels and bouquets available on the platform (iv) Start Date of entitlement (v) End Date of entitlement (vi) Status of card (Active/Inactive) (c) The file output of CAS shall be processed by SMS system to compare and generate a 100% match or mismatch error report. 2. Channel/Bouquet management: SMS shall support the following essential requirements: (a) Create and manage all channels and bouquets along with the relevant details such as name, tariff, broadcaster, or DPO bouquet, etc. (b) Manage changes in the channel/bouquet, as may be required, from time to time. (c) Link the products’IDs for à-la-carte channels and bouquets (Single and Bulk) created in CAS with the product information being managed in SMS, for smooth working of SMS and CAS integration. (d) Management of historical Data of Product name, i.e., Broadcasters (name), maximum retail price (MRP), distributor retail price (DRP). 3. Network Capacity Fee (NCF) Policy Creation: SMS shall support all Network Capacity Fee related requirements mandated by the applicable tariff order. 4. Bill/Invoice Generation: SMS shall be capable of generating proper subscriber bill/invoice with explicit details of NCF charges, Pay Channels charges (with clear itemized details of à-la-carte channel cost and bouquet costs), rental charges for STB (if any), other applicable charges, including Goods and Services Tax (GST). 5. Password Policy Creation for Users: SMS shall have a defined password policy, with minimum length criteria and composition (upper and lower-case characters, numeric, alphabets or special characters), forced password changes or any other appropriate mechanisms or combinations thereof. Page 7 of 23 6. Management of Logs: (a) SMS shall have the facility to provide user detail logs with the ID of users on each login event. (b) SMS shall have the provision of generating the user activity log report to enable tracking users’ work history. It shall not be allowed to delete the records from the log. (c) All logs shall be stamped with date and time and the system shall not allow altering or modifying any logs. (d) The logs shall be maintained for a period as specified in Schedule III or at least two audit cycles, whichever is later. 7. Channel subscription report: SMS shall be able to provide the total counts of monthly subscribers of channels including both à la carte and bouquet subscriptions. 8. SMS Database and tables: (a) There shall not be any active unique subscriber outside the database tables. (b) SMS shall not provide an option to split SMS database or for creation of more than one instance. (c) SMS shall have the provision to enable or disable channel (à-la-carte channel or bouquet of channels) selection by subscribers either through website or an application through interface provided by the distributor platform operator. (d) SMS shall be capable of capturing the following information required for audit or otherwise: (i) Bouquet à la carte status change history (ii) Bouquet composition change history (iii) Change in status of connection (primary to secondary and vice versa) 9. Firewall Access: SMS shall be accessed through a Firewall. 10. STB-VC pairing: STB and VC shall be paired from the SMS to ensure security of channel. 11. SMS-STB addressability: The SMS shall be capable of individually addressing subscribers, for the purpose of generating the reports, on channel by channel and STB by STB basis. C. CAS Desirable Requirements: 1. Message Queue: (a) In the event of unsuccessful transmission of messages due to network failure (for instance, due to power failure), the head-end should have an option to queue up the messages. Further, there should be a provision to retry them at specified intervals using additive back off retrial timings. (b) In the event of unsuccessful deliveries of the messages, the life of the messages should be specifiable. 2. Geographical Blackout: CAS shall have the feature of geographical blackout. Explanation 1: Geographical blackout is the ability of CAS to blackout a particular region based on the postal index number (PIN) Codes [Geographic Area Code], if required by government agencies or for other reasons. 3. After-Sales Service Support: The required software and hardware support should be available to the distributor of the television channels’ installations from the CAS vendor’s support teams located Page 8 of 23 in India. The support should be such as to ensure the CAS system with 99.99% uptime and availability. The systems should have sufficient provisions for backup systems to ensure quality of service and uptime. Explanation 1: (i) The requirement for hardware support should be applicable, only if the hardware is directly or indirectly provided by the CAS vendor. (ii) The actual service-level arrangement for the system support shall be governed by the mutual agreement / service-level agreement (SLA) between the service provider, i.e., CAS vendor and the customer (DPO). (iii) The signatories to the said agreement may mutually choose lenient/stringent service-level guarantee. D.SMS Desirable Requirements 1. Data Verification: (a) SMS should have the facility to carry out auto-reconciliation of channels/à la carte and all bouquets with their respective ID created in SMS with CAS configuration, and the variance report should be available in the system with logs. 2. SMS Reports: SMS should have a provision of generating the following reports pertaining to STB/VC: (a) White list of STB/VC along with active/inactive status (b) Faulty STB/VC – repairable and beyond repairable (c) Warehouse fresh stock (d) In stock at local cable operator (LCO) end (e) Blacklist (f) Deployed with activation status (g) Testing/demonstration STB/VC with location 3. Audit-related requirements: SMS should have the capability to capture below-mentioned information that may be required for audit and otherwise: a. Subscriber related: (i) Subscriber contact details change history (ii) Connection count history (iii) Transition of connection between Disconnected/Active/Temporary Disconnected (iv) Subscription change history b. LCO related: (i) LCO Contact details change history (ii) LCO and DPO sharing change history c. Product (Bouquet/à-la-carte channel) related: (i) Broadcaster à-la-carte relation (ii) Bouquet name change history (iii) À la carte name change history Page 9 of 23 (iv) Bouquet à-la-carte channel rate change history d. STB/Smartcard related: (i) Change in location history (ii) Change in status (Active/Damaged/Repaired) 4. User Authentication: SMS should have the capability to authenticate its subscribers through registered mobile number (RMN) through one-time password (OTP) system. 5. Miscellaneous: SMS should have the provision to support the following miscellaneous requirements: (a) List of à-la-carte channels and bouquets, digital headend (DHE) and Zone-wise: Provision to support/manage Zone/ Sub-Headend-wise list of à-la-carte channels and bouquets, in sync with the list available in CAS. (b) Revenue Sharing Between DPO and LCO: Provision to define and calculate DPO and LCO revenue share separately for distribution fee as well as for NCF, as per the agreement executed between them, with the option to maintain historical information can be very useful and is desirable. (c) LCO invoicing with GST: Provision to generate invoicing under multiple GST registration numbers of LCO’s and to comply with GST invoicing norms as applicable. (d) Product(à-la-carte channels and bouquets)-wise Renewal and Reversal setting for the Subscriber Account: Provision to allow renewal of a product to a subscriber after the expiry date of a product, and provision to auto-calculate and refund the amount to a subscriber if he discontinues a product midterm. These requirements may be configurable on selective products, as required by the DPOs as per their business plans. (e) Product (à-la-carte channels and bouquets)-wise Reversal setting for LCO Account: Provision to calculate and refund the amount due to LCO, if he or the subscriber discontinues a product midterm. (f) Product (à-la-carte channels and bouquets) Tenure-wise LCO and Subscriber Discount Scheme/Free Days Scheme: Provision to create Discount Scheme and Free-day scheme for LCO and Subscriber, based on the duration (Tenure) of the product subscription. (g) Calendar/Activity Scheduling: Provision to auto-schedule activities like STB activation/deactivation, à-la-carte channels and bouquets addition/removal, channel/bouquet composition modification, etc. (h) Bulk Channel/Bouquet Management: Provision to perform bulk activity of à-la-carte channels and bouquets addition and removal on all or a designated group of STBs. (i) Token-number-based reports: Provision to download multiple generated reports with the help of token number, such as audit reports with different intervals. (j) Third-Party Integration: Provision to support integration with relevant third-party systems, such as, payment gateway integrations, interactive voice response (IVR) Integrations, SMS Gateway Integrations, etc. Page 10 of 23 (k) Bill payment and reconciliation feature: Provision for bill payment and reconciliation (in case a DPO is running service in post-paid mode). (l) Generation of Reports: Provision to generate the following reports for operational purpose: (i) All, selective and single boxes’ current status with their first-time activation date. (ii) Total number of à-la-carte channels and bouquets and STB expiring detail till given future date on the dashboard, according to the permission. (iii) Today’s fresh activation count, de-activation count, re-activation count, à-la-carte channels and bouquets addition/ removal count on dashboard, according to the permission. (iv) Total active and inactive subscriber’s details with multiple criteria (network-wise, à- la-carte channels and bouquets-wise, state-city wise and broadcaster-wise). 6. After-Sales Service Support: The required software and hardware support should be available to the distributor of the television channels’ installations from the SMS vendor’s support teams located in India. The support should be such as to ensure the SMS system with 99.99% uptime and availability. The systems should have sufficient provisions for backup systems to ensure quality of service and uptime: Explanation 1: (i) The requirement for hardware support should be applicable, only if the hardware is directly or indirectly provided by the SMS vendor. (ii) The actual service-level arrangement for the system support shall be governed by the mutual agreement/SLA between the service provider, i.e., SMS vendor and the customer (DPO). (iii) The signatories to the said agreement may mutually choose lenient/stringent service-level guarantee.” (Rajiv Sinha) Secretary In-charge, TRAI Note.1: The principal regulations were published in the Gazette of India, extraordinary, Part III, Section 4, vide notification No. 21-4/2016-B&CS dated 3rd March 2017 (1 of 2017). Note. 2: The principal regulations were amended vide notification No. 21-6/2019-B&CS dated 30thOctober 2019 (7 of 2019). Note. 3: The principal regulations were further amended vide notification No. 21-5/2019-B&CS dated 1st January 2020 (1 of 2020). Note. 4: The Explanatory Memorandum explains the objects and reasons of the Telecommunication (Broadcasting and Cable) Services Interconnection (Addressable Systems) (Third Amendment) Regulations, 2021 (1 of 2021). Page 11 of 23 Explanatory Memorandum Introduction and Background 1. Pursuant to TRAI’s recommendations dated 5th August 2010 on Digital Addressable Systems (DAS), the Government issued notification dated 11th November 2011 for implementation of DAS in the country. This laid down the roadmap for implementation of the digitalization in the cable television sector. The digitalization in the cable television sector comprised of four phases. The entire process across India was completed by 31st March 2017. 2. DAS has enabled addressability, transparency, high channel carrying capacity, and has also provided technical feasibility to offer choice to the consumers. Conditional Access System (CAS) and Subscriber Management System (SMS) form the core of the Digital Addressable Broadcast ecosystem. They are responsible for delivering content in a secured and encrypted form to the authorized subscribers. 3. The Telecommunication (Broadcasting and Cable) Services Interconnection (Addressable Systems) Regulations, 2017 (hereinafter referred to as the Interconnection Regulations, 2017), notified by TRAI on 3rd March 2017, and subsequently amended on 30th October 2019, cover technical and commercial arrangements between the Broadcaster and the Distributor for providing television services to the consumers. As per the current scheme, the digital addressable systems deployed by the Distributor Platform Operators (DPOs) for distribution of television channels through cable and satellite must conform to Schedule III of the Interconnection Regulations, 2017. Schedule III, inter alia, contains the features of CAS and SMS for compliance. 4. To enable the stakeholders, the Authority has released ‘The Telecommunication (Broadcasting and Cable) Services Digital Addressable Systems Audit Manual’1 dated 8th November 2019. The manual provides process and audit procedure and includes procedural compliance requirements to be ascertained during the Audit as prescribed under the extant regulations. The audit, inter alia, includes self-certification by CAS and SMS vendors to confirm compliance to certain provisions in Schedule III. 5. The extant Regulatory Framework establishes a trust-based transparent regime, whereby distributors themselves offer the network for regular Audit and undertake full compliance. The Cable Television Networks (Regulation) Act, 1995, stipulates for transmission of content in an encrypted manner. However, the Authority regularly receives complaints about the unauthorised distribution of signals/piracy from various broadcasters and DPOs. Complaints have also been received on issues related to support from CAS/SMS providers, under-reporting of subscription, etc. 1The Audit Manual is only a guidance document for stakeholders and auditors. The manual does not supersede any provision(s) of the extant regulations. Page 12 of 23 6. As per the Cable Television Networks (Regulation) Act, 1995, issues related to content piracy and transmission of unencrypted signals are under the purview of the Authorised Officers2. However, it is quite difficult for the Authorised Officers to identify issues arising out of the deployment of sub-standard CAS. The extant provisions have no such prescribed minimum benchmark/criteria for appropriate security and compliance mechanism. Sub-standard CAS and SMS render the distribution network vulnerable to hacking and content piracy. 7. The Authority observed that in some cases, the distributors were unable to comply with the new regulatory framework within the prescribed time owing to the constraints of their CAS and SMS systems. Some distributors have raised support-related issues from the vendors of such systems. 8. Therefore, the Authority issued a consultation paper on "Framework for Technical Compliance of Conditional Access System (CAS) and Subscriber Management Systems (SMS) for Broadcasting & Cable services" on 22nd April 2020. The objective of this consultation process was to invite comments and suggestions from all stakeholders on the pertinent issues. The comments and counter-comments received from stakeholders are placed on TRAI’s website. An open-house discussion was held on 25th June 2020. 9. CAS and SMS are specialised systems that are responsible for core functions of DAS. The comments, in- general, reflect the issues and challenges faced by the stakeholders due to CAS and SMS. The stakeholders have suggested that the Authority should introduce some regulatory provisions for compliance by CAS and SMS. The Authority is also aware that the requisite regulatory interventions must remain light touch. Therefore, it is incumbent to ensure that requirements specified (if any) remain minimalistic. Taking this in cognizance, the Authority constituted a committee (‘The Committee’) comprising of industry stakeholders and domain experts. The Committee included nominees from the Indian Broadcasting Foundation (IBF), All India Digital Cable Federation (AIDCF), and a nominee representing the direct-to-home (DTH) operators. From among the technology providers, representative of the SMS providers and Indian as well as global CAS companies also contributed as committee members. The Authority also nominated representatives from expert bodies/eminent institutes like Telecommunications Engineering Centre (TEC), Standardisation Testing and Quality Certification (STQC), Centre for Development of Advance Computing (C-DAC), Broadcast Engineering Consultants India Limited (BECIL), and Indian Institute of Technology (IIT) Kanpur, in the Committee. After several rounds of detailed deliberations on the suggested features, received as comments to the consultation paper, the Committee recommended to introduce a testing and certification regime. The testing and certification regime will ensure that the systems deployed in the television channel distribution networks comply with the extant standards and ensure content security. The report of the 2Section 2 (a) of the Cable Television Networks (Regulation) Act, 1995 defines an ‘authorised officer’ to mean“ within his local limits of jurisdiction: - (i) a District Magistrate, or (ii) a Sub-Divisional Magistrate, or (iii) a Commissioner of Police and includes any other officer notified in the Official Gazette, by the Central Government or the State Government, to be an authorized officer for such local limits of jurisdiction as may be determined by that Government”. Page 13 of 23 Committee forms the mainstay of the amendments and Schedule IX of the Interconnection Regulations, 2017. Analysis of Issues A. Important features of CAS and SMS for ensuring content protection and factual reporting: 10. As explained in the consultation paper, CAS and SMS are the key elements that govern content security and proper accounting. As per the extant provisions, DAS for distribution of television channels must comply with the requirements as specified in Schedule III of the Interconnection Regulations, 2017. Oversight of the compliance to Schedule III provisions is through an audit process. The audit, inter alia, includes self-certification by CAS and SMS vendors. 11. Schedule III requirements are generic in nature and do not prescribe testing and certification of CAS or SMS. Some vendors undertake elaborate measures and use advanced embedded security to ensure adequate mechanism towards content security. However, a few others do not take such measures and the systems they deploy do not conform to sufficient level of security and encryption. Such systems remain vulnerable to hacking, putting the content security at risk. Any piracy or content hacking causes market disruption and huge financial loss to the service providers. In addition, it causes loss of tax revenues for the government. 12. In order to find a suitable solution to the afore-stated problems, the comments were sought as to whether all CAS and SMS are in compliance with Schedule III. If not, what additional checks or compliance measures are required to improve the compliance of CAS/SMS. Stakeholders were also prompted to provide a list of all the important features of CAS and SMS to adequately cover the requirements for DAS with a focus on the content protection and the factual reporting of subscriptions. 13. In response, majority of the stakeholders were in favour of additional regulatory measures in addition to Schedule III to address the issues raised in the consultation paper. A few stakeholders suggested that the current mechanism under Schedule III is sufficient and favoured status quo. 14. The Authority observes that despite divergent views in terms of finer details, almost all stakeholders were of the opinion that the provisions under Schedule III were not adequate to address the issues raised in the consultation paper. Stakeholders have provided detailed and reasoned arguments that the self- certification mechanism is not sufficient. Most of the stakeholders have considered it necessary to strengthen the framework for enhancing the content security and better Quality of Service. Page 14 of 23 15. The Committee, after due deliberations, recommended that there is a need for additional mechanism for testing and certification of CAS and SMS. Such mechanism will ensure better conformity to the standards for DAS and improve the consumer experience. B. Additional compliance measures for CAS/SMS: 16. The distribution of television services should ideally be a smooth and problem-free operation in consonance with the extant regulatory framework and supported by the relevant technology. The underlying technologies have advanced over the years to enable secure transmission of content with adequate protection to the authorized subscribers. Even though CAS and SMS are critical for providing better services, the prescribed benchmarks are missing. 17. Therefore, the stakeholders were requested to provide their comments as to whether the certificate issued by CAS and SMS vendor suffices to confirm the compliance to Schedule III. If not, what additional checks/measures are required to improve the compliance to CAS/SMS. Stakeholders’ views were also sought regarding the need for defining a framework for CAS and SMS, and to prepare a benchmark for the minimum requirements of the system before these can be deployed in the network. 18. In response, most of the stakeholders opined that current compliance mechanism is not adequate, and there is a need to ensure effective compliance through additional measures. There were diverse suggestions regarding additional measures to be adopted. Few stakeholders have opined that all CAS and SMS vendors/OEMs should seek certification of their systems from international third-party content security expert body(ies). 19. Further, few stakeholders opined that an effective compliance of statutory provisions is ensured through the comprehensive Audit Manual published by the Authority. However, some other stakeholders have underlined the limitations of the audit-based mechanism citing lack of adequate technical expertise of the empaneled auditors. 20. Another stakeholder has suggested that Department of Telecommunications (DoT)/BECIL should test the systems and issue validation certificates as per TRAI’s regulatory framework, and that all CAS and SMS should be type approved by a neutral government agency. It was also suggested to make Schedule III more effective by shifting industry standards to higher-bit encryption for secure layer protection and mandate the generation/storage of encryption logs [Entitlement Control Message (ECM) / Entitlement Management Message (EMM) storage tables] during audit. Page 15 of 23 21. Few technology vendors suggested that there should be an additional certificate for CAS and SMS, and any new deployment needs to show compliance with secure Trusted Execution Environments (TEE) or hardware root of trust certificate issued by the System-on-Chip (SoC) vendor. 22. Few stakeholders requested TRAI to prescribe registration process for all CAS/SMS providers under a regulatory body by laying down appropriate guidelines, including the establishment of a Trusted Authority/Industry Licensing Authority. Such authority/body should mandatorily check and approve CAS and SMS and other related headend equipment. 23. Further, almost all stakeholders opined in favour of defining a framework for CAS and SMS. This, in their opinion, will also help DPOs in selection of the right solution for their network. Few stakeholders suggested that a comprehensive framework for CAS/SMS system is essential for end-to-end content protection. Better content security will enable better high-end content to be available for Indian viewers. Such a framework will improve the robustness of implementation and make the economics of content distribution more favourable to all the parties in content distribution chain. 24. One stakeholder stated that with the changing and fast improving technology, it becomes essential to review the standards and requirements of a CAS/SMS system and update them on a regular basis with appropriate testing and evaluation through an autonomous body. Moreover, such standards should be at par with global standards, in consonance with which the deployed CAS/SMS should be upgraded, within a defined period from its date of implementation. 25. One of the stakeholders stated that SMS and CAS vendors demand exorbitant amount for upgrading CAS/SMS, and any such statutory upgradation in the system should not be burdened on the service providers. 26. A scrutiny of the reported issues that led to the consultation on the subject reveals that the origin of the issues could be due to the deployment of sub-standard systems (CAS /SMS). Such issues could, sometimes, also be due to fraudulent operation of the systems. The effective way to curb the fraudulent operation of the system is to have an inspection/oversight mechanism with the relevant technical support. However, creating a framework that prevents deployment of sub-standard systems in the network entails pre-deployment evaluation by a trusted agency/organisation. 27. The Committee while analysing the comments also unanimously accepted that there is a need to prescribe some mechanism. However, everyone agreed that the prescribed regulation should be minimalistic, and only such parameters be enforced that are absolutely necessary. There were some concerns for specific features that are either futuristic or introduce much higher level of network robustness. Such features/parameters have been included as desirable features. Page 16 of 23 28. The Authority also observes that there is an overwhelming opinion in favour of additional measures, in addition to the requirement specified under Schedule III of the Interconnection Regulations, 2017. The Authority notes that the extant audit mechanism is based on Schedule III requirements. However, the concerns raised in the consultation paper and comments thereof reflect a need to benchmark the capabilities of the system that differs from the current audit mechanism. Thus, the additional requirements/framework suggested by majority of the stakeholders differ in context and scope. Any new regulation entails compliance cost, and the Authority is conscious of the same. Therefore, the Authority intends to specify the framework with minimum essential requirements to take care of the most important issues. 29. The purpose of the new framework will be to assess and certify the capabilities of CAS and SMS. Some stakeholders have voiced that such a framework needs to be dynamic and evolve with the advancement of technology. Keeping this in view, the Authority proposes to establish a standing committee of stakeholders (including members from academia and expert bodies) for regular review/updating of the framework. The Authority will review and change the composition of this stakeholders’ committee from time-to-time. 30. The industry faces loss of revenue due to mis-reporting or under-reporting of the subscribers. Absence of tight and non-intrudable integration between CAS and SMS is a leading cause behind such under- reporting or similar malfeasance. Many of the service-provisioning issues are also caused by non-existence of specifications for CAS and SMS integration. The integrated network performs in such a way that while the SMS is the interface of man-machine command, actual action on such command happens through configuration settings in CAS. Sometimes, the absence of proper command and execution mechanism between SMS and CAS causes service and reporting related issues. The issues are further aggravated as many networks deploy locally developed SMS solutions. Such solutions provide minimum essential features, and do not cater to stringent requirements requisite for fail-safe performance. 31. Furthermore, there are instances of complaints raised by DPOs regarding the lack of adequate support from their CAS/SMS vendors in carrying out necessary modifications in the systems, as per the license or regulatory requirements. Hence, the stakeholders were asked to express their views on the safeguard/measures that are necessary so that the consumers/DPOs do not suffer due to want of regular upgradation /configuration by the CAS/SMS vendors. 32. In response, many stakeholders have expressed the need of an industry-led body, with government participation, for laying down a complete framework, registration and certification of CAS and SMS. Many other stakeholders expressed that all partners involved in the value chain, including CAS provider and SMS provider should have an office in India with 24×7 support. Moreover, CAS and SMS database of all vendors must be stored at physical or cloud servers in India only. The need for registration of CAS/SMS vendors under the Companies Act, 2013, was emphasized by majority of the distributors. There was a suggestion that all the CAS and SMS companies should be mandated to get themselves registered with Ministry of Page 17 of 23 Information and Broadcasting (MIB). And further, that the list of latest software version that can be deployed in the field should be approved by an agency like Standardisation Testing and Quality Certification (STQC) Directorate and should be published online. 33. Some of the stakeholders proposed that there should be an active Service-Level Agreement (SLA) between the DPO and the CAS/SMS vendor. CAS/SMS vendors, who are unable to provide local technical support and/or are unable to enter into or abide by SLA, should be deregistered and disqualified to operate in India and should not be allowed to install any of their systems in India. 34. Few of the stakeholders have suggested that all CAS/SMS systems falling short of any of the features mentioned in Schedule III should have a roadmap delineating specific timelines and actions. There should be a provision for actions against the CAS/SMS vendors for non-compliance, so that the customers do not suffer. One of the vendors expressed that Secure OTA upgrade may be made a mandatory qualifying requirement for all CAS. 35. Upon analyzing the diverse inputs about the issues, the Authority observes that it is necessary to specify parameters with regards to integrated operations of CAS and SMS. To get the desired performance and to generate factual reports, the smooth, synchronized functioning of SMS along with CAS is crucial. 36. As regards the issues related to support, it is desirable that CAS and SMS vendors have an establishment in India for after-sales support. In addition, the vendor of CAS and SMS should be able to meet the stringent uptime requirements, as are requisite for distribution services of television channels. Given that the distribution networks need to function on 24(hours a day) × 365 (days a year) basis, the vendor should be capable to provide service support to maintain the desired uptime. CAS and SMS vendor must build their support infrastructure, to assure their buyers of service whenever needed. It is important to note that while the Authority is prescribing capability standards for the vendors, the individual networks are free to form arrangements (service agreements) as per their own requirements and business analysis. Of course, every network must ensure that it meets the Quality-of-Service standards, as per the extant regulations. C. Testing and Certification Agency: 37. The regulatory framework provides for non-discrimination and mandatory sharing of signals. These provisions have helped many new small multi-system operators (MSOs)3 to install networks and start their services. As per the extant regulations, if the addressable system does not meet the requirements as specified in Schedule III, the broadcaster is permitted to disconnect signals of television channels, as per proviso to sub-Regulation (2) of regulation 15, after due notice. Sometimes, small MSOs suffer such eventuality due 3For more details, please refer to TRAI’s White Paper on “Benefits of 'New Framework' for Small MSOs”https://www.trai.gov.in/sites/default/files/WhitePaper_23042019.pdf Page 18 of 23 to deployment of sub-standard CAS and SMS. This arises from the fact that there are no prescribed, tested, and certified solutions. Small MSOs have limited awareness of necessary technical parameters. Many a times, cost remains the primary deciding factor for buying certain products/solutions. 38. Hence, not only there is a need for drafting and deployment of adequate standards for content security for CAS, but an effective compliance of statutory framework is also essential to build the trust and confidence among all the stakeholders. This entails entrustment of testing and certification work to a reputed and trusted agency. With this view, the stakeholders were asked to suggest the structure of the agency that will be entrusted with the task of testing and certification. 39. In response, stakeholders have expressed mixed opinions regarding the nodal agency to carry out the testing and certificationto ensure compliance to such framework. Many stakeholders have expressed that there should be an independent industry-led body consisting of representatives from TRAI, C-DAC, BECIL, Digital Video Broadcasting (DVB), Technical Experts, CAS/SMS vendors, MSOs, and DTH operators — for registration, certification, testing, auditing, and taking punitive action. This industry body should be entrusted with the task of defining the framework for CAS and SMS through a consultation process, and with the involvement and support of relevant stakeholders. 40. Few stakeholders opined that there should be a TRAI-led agency for defining the framework for CAS and SMS along with the execution support from Bureau of Indian Standards (BIS). The final input on the framework may be provided by industry members. 41. On the other hand, one of the stakeholders stated that in addition to the BIS certification, the vendors of CAS/SMS should be required to get an ISO certification. An independent stakeholder has stated that requirements under Schedule III and Audit Manual could be a starting point for defining the framework; the industry stakeholders and government can jointly add and modify the same. 42. There were few suggestions in favour of STQC Directorate, Quality Council of India (QCI) or a nominated Trusted Authority (TA)/Certification Authority (CA) of international repute to define the framework for CAS and SMS. 43. Some of the stakeholders were of the view that the testing and certification can be done by an industry body based on international standards, through a consultative process. It should lay down a process for certification of any new version of CAS and SMS from the vendors before it is released in India. It was further suggested that if deployed CAS and SMS are not certified within the suggested timeframe, intimation must be given to the DPOs using such CAS. Page 19 of 23 44. On the other hand, there were several suggestions in favour of statutory/government bodies being entrusted to carry out the testing and certification. Arguing for the framework to be fair, reasonable, and non- discriminatory, suggestions were made for bodies like Standardisation Testing and Quality Certification (STQC) Directorate, Telecommunications Engineering Centre (TEC), Quality Council of India (QCI), Bureau of Indian Standards (BIS) and government accredited labs to carry out the certification. One of the stakeholders commented that BIS is a reputed agency with a proven track record and could be the designated agency to carry out the testing and certification of CAS. There were also comments that TEC is appropriately placed to carry such testing and certification, as they have been doing the same for telecom equipment and have processes and procedures in place for the same. 45. One individual stakeholder had suggested that the process of implementation, adherence, monitoring, and upgradation of the requirements should be kept simple to bring in transparency. More layers and agencies will make the involved process more complex, and all the DPOs will not have the means to meet these requirements. 46. The Authority observes that the development and operationalization of a framework would require several factors to be taken into consideration. While such a framework should address important concerns, aspects related to its implementation and operationalization also need due consideration. Trust and confidence among all stakeholders should be the cornerstone of any statutory framework for its effective compliance. Therefore, the testing and certification agency must not only be fair, reasonable, and non- discriminatory; it must also generate such confidence and trust among all the stakeholders. There are statutory bodies that are already carrying out testing and certification in their respective domain with some degree of correlation with the requirements of testing and certification of CAS and SMS. 47. The Authority shall designate Testing and Certification Agency(ies) that shall oversee the testing and certification of different CAS and SMS. The Authority, in consultation with the designated testing and certification agency(ies) shall issue a ‘Test Schedule’ with a detailed testing procedure for each requirement, as may be required. Looking to the importance of synchronized functioning of SMS along with CAS as emphasized in preceding sections, such ‘Test Schedule’ shall also check that the CAS under testing supports to integrate with any other SMS and vice versa. The designated agency(ies) may carry out the testing on its own or get the testing done through accredited test labs, as per the prescribed test schedule. For this purpose, the agency(ies) shall empanel accredited testing laboratories (domestic and international accredited test labs, as may be necessary). 48. The Authority envisages that there will be some time-gap before the ecosystem becomes fully compliant to the testing and certification framework. Accordingly, the Authority will prescribe the timeline within which such systems shall get tested and certified to meet the requirements as specified in the Schedule IX. It is obvious that once the regime is in place, the current provisions of self-certification by CAS and Page 20 of 23 SMS, as per Schedule III and Audit Manual, will need revision. Accordingly, the Authority shall notify relevant amendments, if any, in Schedule III and the Audit Manual, as may be required along with the dates of effect of the testing and certification regime. The said amendments shall take into account the inputs received from stakeholders in response to this consultation. D. Oversight Mechanism to ensure compliance for CAS and SMS: 49. Diverse suggestions were received from the stakeholders regarding the oversight mechanism required to ensure compliance. Many stakeholders have suggested that the new framework should be introduced gradually, with a phased migration period, and that all CAS and SMS vendors should get their already deployed systems duly certified by the industry body within three to six months of the framework coming into effect. Existing DPOs should be given an opportunity to rectify the deficiencies, and non- compliant systems should be deregistered and disqualified to operate in India. It was suggested that the existing systems can migrate within a period ranging from one to three years. It was commented by some stakeholders that upon release of a new version of CAS/SMS, fresh certification should be mandated. There was also a suggestion to grant certifications for limited periods, for example three years. Further, upon evidence of system getting compromised, there should be provisions for rectification and for penal action too. Few stakeholders had raised the issue that the Authority should incorporate appropriate provisions for dealing with such DPOs who do not comply with regulatory provisions, especially when it comes to adherence to timelines. 50. There were few comments in favour of regular review of the framework in view of continuous technological advancements. Some stakeholders have suggested that certification by international security agencies, such as Farncombe Security Audit, with suitable changes to suit the Indian market, may be considered. One stakeholder suggested that due consideration should be given to the entire process, i.e., designating an agency to carry out the testing and certification, and to ensure adequate technical understanding and tools to test and certify the compliance. 51. The Authority is of the view that the deployed as well as upcoming systems must get a fair opportunity to ensure compliance to the notified framework. Accordingly, they should be allowed appropriate time to check their systems and get the necessary testing and certification done by their respective CAS and SMS vendor. This would avoid any undue disruption of services. It is to be kept in consideration that upon designation of the Testing and Certification Agency(ies), they will require time to suggest a test schedule to the Authority. The agency may also release the list of accredited labs to do the testing. As such, the timeline to be allowed to the deployed systems can only be referred from the publication of the test schedule and accredited labs, whichever is later. However, notification of the framework will provide additional lead time to the industry to review and ramp-up their system as per the notified framework. The solution providers will then be able to identify the challenges, if any, and initiate the remedial measures to ensure compliance. Page 21 of 23 Keeping this in view, the Authority may specify different timelines for the distributors of already deployed networks or those deploying new networks, to ensure that the CAS and SMS in their networks are certified. 52. For better compliance to the prescribed timelines, some dissuasion is necessary for those who do not comply. The Authority, therefore, considers it prudent to prescribe financial disincentive to deal with non-compliant service providers. In case a distributor of television channels deploys addressable systems, which are not compliant to the Schedule IX after the due date, a financial disincentive may be imposed. The financial disincentive is proposed on a graded scale. That is, if the CAS and/or SMS system deployed by the distributor continue to remain untested/uncertified after the date (as prescribed), the distributor of television channels shall be liable to pay a financial disincentive of @Rs. 1000/- (Rupees One Thousand) per day for the delay of the first thirty days. In case of delay beyond thirty days, the financial disincentive shall increase to @Rs. 2000/- (Rupees Two Thousand) per additional day. The Authority is aware that there are some very large as well as small distributors in the sector. Therefore, a capping of disincentive is necessary to ensure that the maximum disincentive remains reasonable for even the small distributors. Accordingly, the Authority considers that the maximum financial disincentive should be restricted to an upper capping. Therefore, the Authority has prescribed a maximum limit of Rs 2,00,000/- (Rupees Two Lakhs) only, per instance of violation/delay. The Authority will follow the principal of natural justice and provide the distributor with an opportunity to make submissions before levying financial disincentive. In addition, if the default continues beyond sixty days, the Authority may direct the broadcasters to disconnect the signals of television channels, after giving a written notice of three weeks to such defaulting distributor. The Authority also retains the right to take further suitable action against a defaulting distributor of television channels as per the provisions of the TRAI Act, 1997. 53. In an ever-developing technological field such as television distribution, no framework can be final. Such framework will require continuous oversight and updation. Therefore, the Authority proposes to establish a committee of stakeholders (including members from academia and expert bodies) for regular review/updation of the framework. The committee would be empowered to review the testing and certification process at regular intervals and provide its recommendations to the Authority. The committee would include nominees of leading associations of the sector and will be re-configured from time-to-time to retire existing members and bring-in new representatives. E. Impact of standardization and certification of CAS and SMS on economic efficiency, quality of service and end-consumer experience: 54. Most of the stakeholders have expressed that the standardization and certification of CAS and SMS will help the distributors of television channels in offering better services. The framework would reduce piracy and benefit the entire ecosystem. Some of the stakeholders opined that standardisation would result in nil or less service outage. Standardized SMS will not have any bottleneck in processing multiple Page 22 of 23 transactions. Few other stakeholders commented that the advantages of standardization are not just limited to economic efficiency, improving quality of service, and enhancing end-consumer experience, but also extends to ease of doing business, easing adaptation of new technology and technology upgrades. The SMS vendors would be able to reject the demands of providing alternate revenue recognition mechanism in violation of extant regulations by their customers. They can rather focus on providing enhanced features to ease the workflow. On the other hand, there were few comments that such a framework will lead to additional cost burden, which could be passed on the subscribers, thus leading to a higher subscription pay-out. Some stakeholders have also commented on the dearth of genuine testing labs that can test complex products such as CAS and SMS. 55. Upon analyzing the inputs, the Authority observes that there is a consensus among stakeholders that the framework will bring long-term benefits, both economic and otherwise. A robustly designed and tightly coupled CAS and SMS are expected to put a check on piracy and result in factual reporting of subscriptions, which in turn, will lead to improved revenue realization by all concerned stakeholders. Furthermore, the framework promises many non-pecuniary benefits, such as being conducive to ease of doing business, aiding in adoption of better technology, which in turn, can result in better quality of service and end-user experience. A more secure network can also attract availability of more high-quality content, thereby providing consumers with more choice. 56. Regarding cost concerns raised by some stakeholders, the Authority is of the view that a minimalistic framework, addressing the important issues, may keep costs associated with testing and certification to a minimum. Such an approach is aimed to address the referred issues with least disruption in the sector. It is with this view that the Authority has pruned some of the recommendations made by the Committee. The report of the Committee has been further scaled down to include bare minimum essential parameters in Schedule IX. More stringent provisions with higher quality considerations, as suggested during the consultation process by few stakeholders, may be appropriately reviewed at a later stage. The Authority will constitute a multi-stakeholder committee for the periodical review of the framework. 57. The Authority acknowledges that initially there may be a capacity constraint as regards the testing facilities for complex systems. However, the Authority considers leaving this issue to the Testing and Certification Agency(ies). The agency(ies) can either itself develop testing facilities or identify such accredited labs that may be domestic or international as accredited testing laboratories. The international testing and certification ecosystem is well-established with various national accreditation boards/agencies working under the aegis of international institutions like International Laboratory Accreditation Cooperation (ILAC). A test certificate issued by any accredited test lab from within India or from outside India will be sufficient to recognise a product as tested and for being included in the certified product list. The Authority observes that once a testing and certification regime is enforced in the country, the testing ecosystem will Page 23 of 23 also start developing. Such ecosystem will help domestic solutions to develop further. The Authority considers that such ecosystem will also boost product localisation as envisioned under ‘Atmanirbhar Bharat’. F. Any other issue relevant to the present consultation: 58. Apart from the comments on the major issues raised in the consultation paper, there were some suggestions, which were not directly focused on the topic of consultation. For example, one stakeholder has suggested that apart from CAS and SMS, the role of other components of distribution chain, e.g., encoder, multiplexer (MUX), middleware, SoC, etc., may also be examined. A stakeholder suggested that the guidelines on internet protocol television service (IPTV) should clearly define the medium to be multicast or unicast. Such suggestions have been kept on record for appropriate consideration in future. **************
Research the source law
This record is not yet linked to a specific provision. Browse the law library, choose the affected provision and ask against the exact statutory text.
Browse source laws