Satellite Internet Security Requirements in India

Satellite internet providers in India must meet security requirements set by the Department of Telecommunications (DoT) and the Indian National Space Promotion and Authorization Centre (IN-SPACe), including mandatory licensing, data localization, encryption standards, and government access for lawful interception. These rules apply to both foreign and Indian companies offering satellite broadband, and they are enforced through the Indian Telegraph Act, the IT Act, and IN-SPACe’s authorization framework.

Background: Why Satellite Internet Faces Extra Scrutiny

India has traditionally treated satellite communications as a strategic sector. Unlike terrestrial fiber or mobile networks, satellite signals cross national borders and are harder to physically secure. The government’s 2020 satellite communication policy and the 2022 IN-SPACe guidelines aim to balance open market access with national security. Providers like OneWeb, Starlink, and Jio SpaceFiber must all comply with the same baseline, though the specifics of their licenses may vary.

Licensing and Authorization

Before offering services, a satellite internet provider must obtain two key approvals:

• IN-SPACe authorization – for establishing and operating the satellite system, including gateways and user terminals.
• DoT license – under the Indian Telegraph Act, typically a Unified License with an Internet Service Provider (ISP) category, or a specific satellite service license.

The DoT also requires a security clearance for foreign ownership and for the company’s directors and key officers. The license agreement includes clauses that allow the government to suspend services in the interest of national security.

Data Localization and Storage

India’s data protection framework, reinforced by the Digital Personal Data Protection Act 2023, requires that certain categories of user data be stored on servers located in India. For satellite internet, this means:

• Customer identity and usage metadata must be stored domestically.
• Encryption keys for user communications must be made available to Indian authorities when legally demanded.
• Gateways (the ground stations that connect satellites to the internet) must be located within Indian territory.

This is a major reason why some global providers have had to build local data centers or partner with Indian firms.

Encryption and Lawful Interception

Providers must implement encryption that is strong enough to protect user privacy but weak enough to allow lawful interception. In practice, this means:

• Using encryption standards approved by the DoT (e.g., AES-256 for data in transit).
• Maintaining a lawful interception gateway that can decrypt traffic when a court order or government directive is issued.
• Providing real-time access to communications to intelligence agencies, as mandated by the IT Act’s Section 69.

This is a delicate balance. For instance, end-to-end encryption that prevents the provider from decrypting content may not be allowed unless a backdoor is provided to authorities.

Network Security and Cyber Resilience

Given that satellite networks are critical infrastructure, the DoT requires providers to:

• Conduct regular security audits by CERT-In (Indian Computer Emergency Response Team) empanelled auditors.
• Report any cyber incidents within 6 hours of detection.
• Maintain redundancy and failover mechanisms to prevent single points of failure.
• Ensure that user terminals (satellite dishes/modems) cannot be tampered with to cause interference.

These requirements are similar to those for telecom operators but are often stricter because satellite signals can be intercepted from outside India.

Compliance and Enforcement

Non-compliance can lead to heavy fines, suspension of the license, or even criminal charges under the Indian Penal Code and the IT Act. The DoT conducts periodic inspections, and IN-SPACe can revoke authorization if a provider fails to meet security benchmarks. In 2023, the government also mandated that all satellite ISPs must register their user base with the DoT, a move aimed at preventing misuse for illegal activities.

Frequently Asked Questions

Do foreign satellite internet companies need a local partner in India?

Yes, for most operations. The DoT and IN-SPACe require a foreign entity to have a local registered company (e.g., a subsidiary) and to route all communications through a licensed Indian entity. This ensures that Indian laws apply directly to the service provider.

Can satellite internet be used for VPNs or encrypted messaging in India?

Yes, but the provider must be able to decrypt traffic when legally required. Using a VPN is not illegal in India, but the satellite provider must comply with lawful interception orders, which may include decrypting VPN traffic if the VPN is not end-to-end encrypted.

What happens if a provider does not store data in India?

The provider’s license can be revoked. In practice, the DoT has refused or delayed licenses for companies that do not commit to local data storage. The Digital Personal Data Protection Act also imposes fines of up to ₹250 crore for non-compliance with data localization rules.

Are there different security rules for consumer vs. enterprise satellite internet?

No, the baseline security requirements are the same. However, enterprise contracts may have additional security clauses (e.g., dedicated encryption keys, separate gateways) that go beyond the minimum legal requirements.

Does the government monitor satellite internet traffic in real time?

Yes, the lawful interception framework allows real-time monitoring, but only with proper authorization. The DoT’s interception rules require a warrant or a government order, and the interception is typically done through the provider’s gateway, not by directly tapping satellites.

Related

• FDM vs Resin 3D Printing for Small Decor
• Pentagon Plan to Disrupt Islamic State’s Internet
• Flexible Work: Where Future Leaders Miss Out