China-made SIMs may make telecom and banking sectors vulnerable: National Security Council

NEW DELHI: The National Security Council (NSC) has said that SIM cards manufactured by Chinese companies could make the country’s telecom and banking networks vulnerable to security threats, and called for 100% domestic procurement of such cards.

NSC — the apex agency looking into the country's political, economic, energy and strategic security concerns — has written to the department of telecom (DoT), seeking immediate steps to ensure all SIM cards used in the country are domestically manufactured and that the companies making them must secure a security clearance from the ministry of home affairs.

This is important to restrain transmission of sensitive data outside territorial limits of India, said the NSC communication, which was reviewed by ET.

Despite enough production capacity in the country, 40% SIM cards sold in the country are imported, mostly from China.


Consequently, all the secret keys used through the SIM card become available to personalised centres located outside judicial boundaries of Indian security agencies, it said. “Besides SIM card cloning, other security issues that can arise from compromise of keys can be location tracing, call and SMS diversion, copying of data transmitted, remote extraction of network and banking keys,” NCS said in its communication.

“With increasing use of mobile phones for various value-added services including mobile banking and payments, the risk of compromise of secret keys is extending to banking and payment infrastructure as well,” it added. Explaining the security threat, NCS said that unlike the telecom equipment that is centrally located, SIM cards are in the hands of a million users and can be attacked over the air from external locations.

It has further said that some SIM card manufacturers, owned and controlled by Chinese nationals with unclear ownership and antecedents, have established SIM card personalisation activity, or making them ready to use, in India. This, according to NSC, was done to bypass the upcoming policy that would mandate domestic production of SIM cards.

The council has also named Eastcompeace as one of Chinese SIM manufacturers that are partly owned by the sovereign. It said the government needs to clearly establish and monitor the context of ownership before it gives clearance to such facilities. To avert such threat, NSC has proposed that an appropriate technical agency such as the Telecom Engineering Centre (TEC) should inspect and certify security measures instituted by each SIM manufacturing units to ensure that personalisation keys are only located in India and are available to be inspected by the home ministry.

It has proposed a policy similar to that of China where all SIM cards are to be supplied only by units established in the country and each manufacturer and supplier needs to obtain a specific licence for supply of SIM cards. The licence is periodically renewed and monitored by a designated agency.