Trusted Sources and Blocked Apps: How 2020 Turned India's Telecom Security Toward the Supply Chain of Digital Infrastructure

B.A.P-I Retrospective, 2020 to 2024. This paper looks back at 2020 and the lesson it holds for the protection of India's critical infrastructure.

1. Introduction

The year 2020 is remembered in India for the pandemic, but in the field of digital infrastructure it was the year in which India set out a clear and confident doctrine of its own. Until then, the security of telecom networks and of the software that ran on Indian phones had been treated largely as a matter of standards, testing and licence compliance. By the end of the year, the question had become one of origin: who built the equipment, who owned the application, and under whose jurisdiction the data might ultimately fall. Two measures marked the change. The first was a series of orders under Section 69A of the Information Technology Act, 2000, blocking mobile applications, beginning with 59 on 29 June 2020 (AZB & Partners, 2020, Jun. 30). The second was the National Security Directive on the Telecommunication Sector (NSDTS), announced on 16 December 2020 (Business Today, 2020, Dec. 16).

Six years later, both measures can be seen for what they were: the first steps toward treating the supply chain of digital infrastructure as a national security asset in its own right. This commentary assesses that turn, credits what it has achieved, and sets out the reform agenda that would carry it forward.

2. The App Blocking Orders of 2020: Section 69A as a Security Instrument

The June order blocked 59 applications on the ground that they were engaged in activities "prejudicial to sovereignty, integrity or defence of India, security of State and public order", and cited apprehensions of threat to the security of Indian citizens' data (AZB & Partners, 2020, Jun. 30). It was followed by the blocking of 118 more applications on 2 September 2020 and a further 43 on 24 November 2020, the last order resting on comprehensive reports from the Indian Cyber Crime Coordination Centre of the Ministry of Home Affairs (The Tribune, 2020, Nov. 24). The orders came in the wake of the standoff along the Line of Actual Control in eastern Ladakh, and the applications affected were largely linked to Chinese companies (Deccan Herald, 2021, May 5). The Government's message was that it "is committed to protect the interests of citizens and sovereignty and integrity of India on all fronts" (The Tribune, 2020, Nov. 24).

The legal instrument chosen matters. Section 69A had been upheld by the Supreme Court in Shreya Singhal precisely because it was narrow and hedged with procedural safeguards, including reasons recorded in writing and a hearing before a committee (LiveLaw, 2020, Jul. 6). Given the urgency, the 2020 orders used the emergency provision of the Blocking Rules, which permits an interim direction followed by review by a committee (LiveLaw, 2020, Jul. 6). One finds, therefore, a constitutionally tested power being applied with resolve to a new class of threat: the flow of Indian citizens' data to applications whose control lay outside India. It worked as a security measure, and it signalled that India would set the terms on which applications serve its citizens. The natural next step is to complement such orders with published guidance on data security expectations, so that every company, Indian or foreign, can comply in advance.

3. The National Security Directive: From Testing to Trust

The NSDTS addressed the network itself. Under it, the Government would declare trusted sources and trusted products, and telecom service providers would connect only new equipment designated as trusted products (Business Today, 2020, Dec. 16). The National Cyber Security Coordinator was made the designated authority, acting on the approval of a National Security Committee on Telecom headed by the Deputy National Security Adviser and including members from ministries, two industry members and an independent expert (Business Today, 2020, Dec. 16). A list of designated sources from which no procurement could be made was also contemplated. Importantly, the directive did not require replacement of equipment already in networks and did not affect ongoing annual maintenance contracts (Business Today, 2020, Dec. 16).

The directive was operationalised through the licence. From 15 June 2021, licensees were required to connect only trusted products, and to seek the designated authority's permission for upgrading or expanding existing networks with equipment not so designated (DoT, 2022, Jul. 13). A Trusted Telecom Portal, developed by C-DOT, was launched on the same date for operators and vendors to submit product, component and source details for assessment (tele.net, 2021, Jun. 16). In practice the policy shaped India's 5G choices even before the licence condition took effect. When the Department of Telecommunications approved 5G trials on 4 May 2021, operators were paired with Ericsson, Nokia, Samsung and C-DOT, and neither Huawei nor ZTE was approved, although the official note named no country (TechCrunch, 2021, May 4). India thus began its 5G journey with trusted partners and with its own C-DOT in the trials.

The intellectual shift here is considerable. Conformity testing asks whether a product meets a specification. The trusted source principle asks whether the supplier can be trusted at all, which is a judgement about ownership, jurisdiction and conduct that no laboratory can make. It recognises that a network can be compromised through an update, a maintenance channel or a component deep inside a box, long after it has passed every test.

4. A Wider Pattern: Procurement, Statute and Other Sectors

The telecom directive did not stand alone. On 23 July 2020 the Ministry of Finance amended the General Financial Rules so that bidders from countries sharing a land border with India could participate in public procurement only after registration with a committee constituted by the Department for Promotion of Industry and Internal Trade, citing reasons of national security and defence (PIB, 2020, Jul. 23). In the power sector, the guidelines issued by the Central Electricity Authority in 2021 also adopted the language of identified trusted sources for information and communication technology (Power Line, 2021, Oct. 8), a sign that the idea was travelling across infrastructure sectors.

Parliament later gave the principle a statutory basis. Section 21 of the Telecommunications Act, 2023 empowers the Central Government, in the interest of national security, to issue directions for the "procurement of telecommunication equipment and telecommunication services only from trusted sources", and to suspend or prohibit specified equipment from notified countries or persons (Telecommunications Act, 2023). In February 2024 the National Cyber Security Coordinator was reported as saying that the Government was exploring ways to extend trusted source rules beyond telecom to other critical sectors, devices and the Internet of Things (MediaNama, 2024, Feb. 21). What began as a directive for one sector, keeping this into consideration, is becoming a general principle of Indian infrastructure governance.

5. Strengthening the Framework: Criteria, Review and Coordination

The turn of 2020 was timely and right, and India acted decisively when the strategic environment demanded it. The regime it created rests appropriately on executive authority, since judgements of trust involve sensitive security assessments. As the principle extends from telecom to power, ports and connected devices, its strength will grow if the general criteria for trusted sources are published in enough detail for vendors, investors and Indian manufacturers to plan with confidence, while individual threat assessments remain confidential. Such clarity would also reward Indian manufacturers who invest in meeting the standard.

Coordination is the second area for reform. Telecom trust decisions sit with the National Cyber Security Coordinator, app blocking with MeitY, procurement screening with the Ministry of Finance and DPIIT, and power sector sourcing with the CEA. Each institution is doing its part well. The author's earlier work has argued for an integrated architecture that binds such sectoral decisions in critical infrastructure protection and internal security into one national posture (Dash, 2021, Jan. 22), and trusted sourcing is a natural place to begin.

6. Codifying Trust: A Recommendation for a Cross-Sector Supply-Chain Regime

India should now consolidate what 2020 began. A cross-sector supply-chain security regime, placed within a Critical Infrastructure Protection Act, should define the categories of equipment and software that are critical in each lifeline sector, publish the factors used to assess trusted sources, provide a reasoned decision and a review mechanism for vendors, and require periodic reassessment rather than permanent designation. The National Security Committee on Telecom model could be extended into a standing inter-sectoral committee so that a judgement of trust made for telecom applies consistently in substations and port terminals. Transparency of criteria need not mean disclosure of intelligence; it means that the rules of trust are knowable even when individual findings are not. The decisions of 2020 told the world that India would treat the origin of its digital infrastructure as a matter of national security. The task now is to build on that foundation with law that is predictable, reviewable and applied across every sector that keeps the country running.