भारतीय दूरसंचार विनियामक प्राधिकरण

TELECOM REGULATORY AUTHORITY OF INDIA

भारत सरकार / Government of India

August 20, 2024

DIRECTION

Subject: Direction under section 13, read with sub clauses (i) and (v) of clause (b) of sub-section (1) of section 11, of the Telecom Regulatory Authority of India Act, 1997 (24 of 1997) regarding measures to curb misuse of Headers and Content Templates under Telecom Commercial Communications Customer Preference Regulations, 2018 (6 of 2018)

F.No. D-27/1/(2)/2024-QoS (E-13563) - Whereas the Telecom Regulatory Authority of India (hereinafter referred as the “Authority”), established under sub-section (1) of section 3 of the Telecom Regulatory Authority of India Act, 1997 (24 of 1997) (hereinafter referred to as “TRAI Act”), has been entrusted with discharge of certain functions, inter alia, to regulate the telecommunication services; ensure technical compatibility and effective inter-connection between different service providers; lay-down the standards of quality of service to be provided by the service providers and ensure the quality of service and conduct the periodical survey of such services provided by the service providers so as to protect the interest of the consumers of telecommunication service;

2. And whereas the Authority, in exercise of the powers conferred upon it under section 36, read with sub-clause (v) of clause (b) and clause (c) of sub-section (1) of section 11, of the TRAI Act, made the Telecom Commercial Communications Customer Preference Regulations, 2018 (6 of 2018) dated the 19th July, 2018 (hereinafter referred to as the “regulations”), to regulate unsolicited commercial communications;

3. And whereas regulation 17 of the regulations provides that the Authority may direct Access Providers to make changes, at any time, in the Code of Practice (hereinafter referred to as “CoPs”) and Access Providers shall incorporate such changes and submit revised CoPs within fifteen days from the date of direction issued in this regard;

4. And whereas the Authority, vide Direction No. RG-25/(6)/2022-QoS dated 16th February, 2023, directed the Access Providers to, inter alia, ensure re-verification of all Headers registered on DLT platform within thirty days from the date of issue of the direction and blocking of unverified headers; ensure re-verification of all Content Templates within sixty days of issue of the direction and blocking of unverified templates; and comply with the direction and forward updated status on actions taken, including updating of CoPs, within thirty days from date of issue of the said direction;

5. And whereas the Authority, vide Direction No. RG-25/(6)/2022-QoS dated 12th May, 2023, in continuation of the direction dated 16th February 2023, referred to in para 4 above, directed all the Access Providers to, inter alia, ensure the use of only whitelisted URLs/ Apks/ OTT links/ call back numbers in the content template; ensure that, in case of an URL containing both fixed and variable parts, the fixed part of URL is whitelisted; to monitor the use of Content Templates and stop their misuse; and update the Code of Practice accordingly within fifteen days and furnish compliance report of the direction within forty five days from date of issue of the said direction;

6. And whereas the Authority, vide another Direction No. RG-25/(6)/2022-QoS dated 16th February, 2023, directed all the Access Providers to, inter alia, ensure traceability of messages from Principal Entity (PE) to the recipient at all times in all modes of transmission by obtaining from the PE the complete chain of the telemarketers engaged by such PE, including the registered telemarketers used in the chain between PE and OAP, for transmission for each message; reject all messages where the chain of TMs is not defined or does not match; and bar all telemarketers, who are not registered on Distributed Ledger Technologies (hereinafter referred to as "DLT") platform from handling the content template, scrubbing and delivery of messages to Access Provider;

7. And whereas the Authority, vide Direction No. M-5/11/(1)/2022-QoS dated 4th May 2024 directed all the Access Providers to, inter alia, implement Distributed Ledger Technology (DLT) based Voice Solution for 140 level numbering series as per the regulations, including migration of telemarketers from existing platform and updating Codes of Practice, within 60 days from the date of issue of the said direction;

8. And whereas, to facilitate discussion and to ensure expeditious implementation/ compliance of the directions issued by the Authority –

(a) meetings were held between the Authority and the Access Providers on 15th June 2023, 03rd July 2023, 21st July 2023, 26th September 2023, 29th November 2023, 05th January 2024, 03rd April 2024, 04th May 2024, and 08th August 2024; (b) the Authority, vide letter dated 22nd March 2024, directed the Access Providers to resolve/ set right all cases of resembling/ look-alike Headers latest by 30th June 2024; (c) six working groups were formed on 10th April 2024, comprising of technical team members from each Access Providers, and meetings were convened by the Authority on 18th April 2024, 19th April 2024, 26th April 2024, 02nd May 2024, 04th May 2024, 16th May 2024, 17th May 2024, 29th May 2024, 08th June 2024, 22nd June 2024, 27th June 2024, and 12th July 2024;

9. And whereas, the Authority has observed that –

(a) the directions referred to in para 4, 5, and 6 above have not been implemented, in entirety, till date; (b) many instances of misuse of headers and templates have been reported, however, Access Providers have not taken effective steps to prevent such misuse and trace the origination of the traffic when such incidences are reported; (c) Indian Cyber Crime Coordination Centre (hereinafter referred to as “I4C”) through its various reports, has brought to the notice of the Authority many cases of misuse of Entity ID, Header ID, and Content Template ID, and indicated the need to trace the Telemarketer who had sent messages using the compromised Headers, and further, I4C has also suggested to ensure traceability of messages by implementing the Telemarketers and Principal Entities chain binding; (d) in some cases, there is no correlation among the Entity Name, Headers and Content Templates, in many instances words like ‘disconnection’, ‘lottery’, ‘OTP’, etc. are used in the Content Templates which are not related to the business of the Senders and malicious APKs and URLs have also been found in some messages; (e) one Content Template has been linked to multiple headers and many similar or identical Content Templates are registered by the Access Providers; (f) registration of promotional Content Templates has been carried out in the service/ transactional category; (g) some Senders have registered a large number of Headers and Content Templates and many Content Templates contain a large number of variables; (h) in some cases, the Sender registers Headers with other Access Provider if any or all of its Headers are backlisted by an Access Provider; (i) Access Providers had temporarily blocked Headers which remained unused for a period of thirty (30) days in the month of October-2023 and November-2023, and citing technical challenges with DLT platform, sought relaxation for a period of three months; however, this activity has not been re-started till date; and (j) Access Providers have not fully implemented Distributed Ledger Technology (DLT) based voice solution for 140-level numbering series as per the regulations;

10. Now, therefore, the Authority, in exercise of the powers conferred upon it under section 13, read with sub-clauses (i) and (v) of clause (b) of sub-section (1) of section 11, of the Telecom Regulatory Authority of India Act, 1997 (24 of 1997) and the provisions of the Telecom Commercial Communications Customer Preference Regulations, 2018 (6 of 2018), hereby directs all the Access Providers to ensure that –

(a) end-to-end implementation of 140xxx numbering series on DLT platform, including migration of existing telemarketers and scrubbing of calls as per regulations, is completed latest by 30th September 2024; (b) traffic containing URLs/ APKs/ OTT links/ Call back numbers, which are not whitelisted, is not permitted with effect from 01st September, 2024; (c) the messages from Principal Entities to the recipients are traceable and, with effect from 01st November 2024, all messages, where the chain of Telemarketers is not defined or does not match, are rejected; (d) whenever misuse of Headers and/ or Content Templates is noticed or reported - i. traffic from concerned Sender is suspended by all the Access Providers immediately, till such time the Sender files a complaint/ FIR with the Law Enforcement Agency for such misuse of its Headers and Content Templates under the law of land, and the Sender reviews all its Headers and Content Templates and takes corrective measures as per the regulations to prevent misuse of its Headers and other credentials; ii. Delivery-Telemarketer identifies the entity that has pushed traffic from such Headers or Content Templates into the network and files a complaint/ FIR for misusing Headers and Content Templates of other entity with the Law Enforcement Agency (LEA), under the law of the land, against such entity within two business days, failing which the Originating Access Provider (OAP) files a complaint/ FIR against the concerned Delivery-Telemarketer and traffic from concerned Delivery-Telemarketer is suspended by all the Access Providers immediately, till such time a complaint/ FIR is made by the Delivery-Telemarketer; and the entity that pushed the traffic is blacklisted by Originating Access Provider as well as all other Access Providers for a period of one year; (e) when a complaint is registered due to registration of Content Template in wrong category, the Content Template is blacklisted by the OAP; and if five Content Templates of such Sender are blacklisted for registration under wrong category, the OAP suspends the services of the Sender, for one month or till such time all the Content Templates of the Sender are reverified, whichever is later; (f) one Content Template is not linked with more than one Header; (g) all the Headers and Content Templates registered on DLT comply with the regulations and directions issued thereunder latest within 30 days of the issue of this direction;

11. All the Access Providers are directed to comply with the above directions and furnish to the Authority an updated status on action taken, including updating of CoPs, within fifteen days from the date of issue of this direction.

(Jaipal Singh Tomar) Advisor (QoS-II)

To All Access Providers