DoT tightens satellite security rules as Starlink, Kuiper seek entry into India

As part of these updated guidelines, the government has mandated that satellite internet providers must achieve at least 20% indigenisation of their ground infrastructure within five years of launching commercial operations. This requirement is intended to reduce dependence on foreign technology and promote domestic manufacturing in the satellite communications sector.

“The licensee, in the format prescribed, will submit to the licensor a year-wise phased manufacturing programme aiming at indigenisation,” DoT said in the guidelines.

Under the updated framework, companies, which acquire the GMPCS licence, must now secure explicit security clearances for each proposed gateway hub location within Indian territory.

The guidelines mandate robust monitoring and lawful interception capabilities, which must be demonstrably functional at gateways, Points of Presence (PoPs), Network Control and Monitoring Centres (NCMCs), or any equivalent infrastructure before commercial operations can begin.

The DoT has stipulated that core network infrastructure must be housed entirely within India, including monitoring systems, traffic control points, and user data routing mechanisms. Operators are also required to demonstrate the ability to restrict or deny services to specific users or geographical areas during emergencies or on instructions from designated law enforcement or security agencies.

Additional compliance measures include precise geo-fencing technology to prevent signal overspill into neighboring territories, especially in sensitive and border regions. Service providers must tailor their coverage footprints to avoid cross-border interference and ensure accurate implementation of service limitations in such areas.

In high-sensitivity zones, such as areas within 50 kilometers of international land borders or along coastal regions extending up to 200 nautical miles, companies will need to facilitate special monitoring capabilities for designated security agencies.

The new rules also require licensees to block access to websites already banned in India and to enable metadata collection for the Telecom Security Operation Centre (TSOC).

User terminal registration and real-time authentication are now mandatory for all devices operating within Indian territory. Any unregistered or foreign devices must go through a verification process before they are permitted to access the network, even within geo-fenced zones. Moreover, operators will be expected to provide real-time location tracking of both fixed and mobile terminals, including precise latitude and longitude details, to relevant authorities upon request.

To further enhance domestic control, licensees are encouraged to integrate support for India’s NaviC satellite navigation system in their user terminals by 2029. The guidelines also restrict remote operational access to Indian infrastructure from outside the country, allowing it only under strict compliance with remote access protocols issued by the DoT.

In terms of data sovereignty, the guidelines clearly prohibit the copying or decryption of Indian telecom data outside the country. All user traffic must be routed through Indian gateways, and any form of direct communication between user terminals via satellite—bypassing Indian infrastructure—is expressly forbidden.

Additionally, data centers and DNS (Domain Name System) resolution services used for satellite operations must be located within India. Mobile terminals used for land-based mobility must report their location every 2.6 kilometers or every minute, whichever comes first. The ability to suspend service when a user terminal moves into a barred area is also a key requirement.

Lastly, the DoT has made compliance with its latest technical standards for non-geostationary satellite networks (NGSO), including Earth Stations in Motion (ESIM) and Transportable Earth Stations (TES), a prerequisite. Companies must demonstrate full technical adherence before launching services in India.

This sweeping regulatory overhaul underscores the Indian government’s focus on securing its communications infrastructure as it prepares to open up the satellite broadband sector to global players.

The revised conditions will apply not only to current GMPCS (Global Mobile Personal Communications by Satellite Services) license holders such as Eutelsat OneWeb and the Jio-SES alliance, but also to new entrants like Elon Musk’s Starlink and Amazon’s Project Kuiper, which are in the process of seeking licenses to operate in India.

The new guidelines remove uncertainty around security requirements for foreign operators and offer a clear framework for compliance. Multinational satellite communication firms can now align with these directives to obtain a GMPCS license and legally operate in India.

Speaking to Moneycontrol on March 18, Union Minister for Communications and Development of the North Eastern Region, Jyotiraditya Scindia, said that while Starlink must meet all regulatory conditions to secure a license, the government remains neutral and supportive of healthy competition in the satellite broadband sector.