Centre Mandates IMEI Registration For Mobile Manufacturers, Importers Under New Cyber Security Rules

The government has mandated that all mobile phone manufacturers in India register the IMEI numbers of every device they produce with the Union government.

Similarly, mobile phone importers must comply with this requirement under the new Telecommunications (Telecom Cyber Security) Rules, 2024, recently notified by the government, reported News18.

"A manufacturer of equipment that has International Mobile Equipment Identity (IMEI) number, shall register such IMEI number of such equipment manufactured in India with the Union government, prior to the first sale of such equipment, in the form as may be specified for such purpose on the portal by that Government. An importer of equipment that has an International Mobile Equipment Identity (IMEI) number, shall register such IMEI number of such equipment imported into India for sale or testing or research or for any other purpose, with the Central Government, prior to the import of such equipment into India, in the form as may be specified for such purpose on the portal," the new rules state.

The rules also empower the Central Government to instruct telecommunication entities to block any telecommunication equipment with tampered IMEI numbers from being used in networks or services. In the past, tampered IMEI numbers have been linked to criminal activities.

Mandatory Reporting of Breaches Within 6 Hours

The new regulations obligate telecommunication entities to notify the government within six hours of becoming aware of a security incident impacting their network or services.

Furthermore, within 24 hours of detection, entities must provide details such as the number of affected users, the duration of the incident, the geographical area impacted, the extent of the disruption to network or services, and the remedial measures taken or proposed.

"The Central Government may, where it determines that disclosure of the security incident is in the public interest, inform the public of such security incident, or require the affected telecommunication entity to do so," the rules stipulate.

The regulations also specify that the Union government or authorised agencies can request traffic data and other non-content data from telecommunication entities to ensure cyber security. This data may be shared with any government agency involved in law enforcement or security-related activities, according to the new rules.